--- /dev/null
+From b69651fe6eb9a2fc50a7d9ab8fc075a724c3e016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 14:59:45 +0200
+Subject: ALSA: control: Use deferred fasync helper
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4a971e84a7ae10a38d875cd2d4e487c8d1682ca3 ]
+
+For avoiding the potential deadlock via kill_fasync() call, use the
+new fasync helpers to defer the invocation from the control API. Note
+that it's merely a workaround.
+
+Another note: although we haven't received reports about the deadlock
+with the control API, the deadlock is still potentially possible, and
+it's better to align the behavior with other core APIs (PCM and
+timer); so let's move altogether.
+
+Link: https://lore.kernel.org/r/20220728125945.29533-5-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/control.h | 2 +-
+ sound/core/control.c | 7 ++++---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/include/sound/control.h b/include/sound/control.h
+index 77d9fa10812d..41bd72ffd232 100644
+--- a/include/sound/control.h
++++ b/include/sound/control.h
+@@ -103,7 +103,7 @@ struct snd_ctl_file {
+ int preferred_subdevice[SND_CTL_SUBDEV_ITEMS];
+ wait_queue_head_t change_sleep;
+ spinlock_t read_lock;
+- struct fasync_struct *fasync;
++ struct snd_fasync *fasync;
+ int subscribed; /* read interface is activated */
+ struct list_head events; /* waiting events for read */
+ };
+diff --git a/sound/core/control.c b/sound/core/control.c
+index 3b44378b9dec..732eb515d2f5 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -121,6 +121,7 @@ static int snd_ctl_release(struct inode *inode, struct file *file)
+ if (control->vd[idx].owner == ctl)
+ control->vd[idx].owner = NULL;
+ up_write(&card->controls_rwsem);
++ snd_fasync_free(ctl->fasync);
+ snd_ctl_empty_read_queue(ctl);
+ put_pid(ctl->pid);
+ kfree(ctl);
+@@ -175,7 +176,7 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask,
+ _found:
+ wake_up(&ctl->change_sleep);
+ spin_unlock(&ctl->read_lock);
+- kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
+ }
+ read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+ }
+@@ -1941,7 +1942,7 @@ static int snd_ctl_fasync(int fd, struct file * file, int on)
+ struct snd_ctl_file *ctl;
+
+ ctl = file->private_data;
+- return fasync_helper(fd, file, on, &ctl->fasync);
++ return snd_fasync_helper(fd, file, on, &ctl->fasync);
+ }
+
+ /* return the preferred subdevice number if already assigned;
+@@ -2015,7 +2016,7 @@ static int snd_ctl_dev_disconnect(struct snd_device *device)
+ read_lock_irqsave(&card->ctl_files_rwlock, flags);
+ list_for_each_entry(ctl, &card->ctl_files, list) {
+ wake_up(&ctl->change_sleep);
+- kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
+ }
+ read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+
+--
+2.35.1
+
--- /dev/null
+From 8f33e57bfdc2a97655ca9dd201855736c775ddab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 14:59:42 +0200
+Subject: ALSA: core: Add async signal helpers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 ]
+
+Currently the call of kill_fasync() from an interrupt handler might
+lead to potential spin deadlocks, as spotted by syzkaller.
+Unfortunately, it's not so trivial to fix this lock chain as it's
+involved with the tasklist_lock that is touched in allover places.
+
+As a temporary workaround, this patch provides the way to defer the
+async signal notification in a work. The new helper functions,
+snd_fasync_helper() and snd_kill_faync() are replacements for
+fasync_helper() and kill_fasync(), respectively. In addition,
+snd_fasync_free() needs to be called at the destructor of the relevant
+file object.
+
+Link: https://lore.kernel.org/r/20220728125945.29533-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/core.h | 8 ++++
+ sound/core/misc.c | 94 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 102 insertions(+)
+
+diff --git a/include/sound/core.h b/include/sound/core.h
+index 0462c577d7a3..85610ede9ea0 100644
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -446,4 +446,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device,
+ }
+ #endif
+
++/* async signal helpers */
++struct snd_fasync;
++
++int snd_fasync_helper(int fd, struct file *file, int on,
++ struct snd_fasync **fasyncp);
++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll);
++void snd_fasync_free(struct snd_fasync *fasync);
++
+ #endif /* __SOUND_CORE_H */
+diff --git a/sound/core/misc.c b/sound/core/misc.c
+index 3579dd7a161f..c3f3d94b5197 100644
+--- a/sound/core/misc.c
++++ b/sound/core/misc.c
+@@ -10,6 +10,7 @@
+ #include <linux/time.h>
+ #include <linux/slab.h>
+ #include <linux/ioport.h>
++#include <linux/fs.h>
+ #include <sound/core.h>
+
+ #ifdef CONFIG_SND_DEBUG
+@@ -145,3 +146,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list)
+ }
+ EXPORT_SYMBOL(snd_pci_quirk_lookup);
+ #endif
++
++/*
++ * Deferred async signal helpers
++ *
++ * Below are a few helper functions to wrap the async signal handling
++ * in the deferred work. The main purpose is to avoid the messy deadlock
++ * around tasklist_lock and co at the kill_fasync() invocation.
++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper()
++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has
++ * to be called at releasing the relevant file object.
++ */
++struct snd_fasync {
++ struct fasync_struct *fasync;
++ int signal;
++ int poll;
++ int on;
++ struct list_head list;
++};
++
++static DEFINE_SPINLOCK(snd_fasync_lock);
++static LIST_HEAD(snd_fasync_list);
++
++static void snd_fasync_work_fn(struct work_struct *work)
++{
++ struct snd_fasync *fasync;
++
++ spin_lock_irq(&snd_fasync_lock);
++ while (!list_empty(&snd_fasync_list)) {
++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list);
++ list_del_init(&fasync->list);
++ spin_unlock_irq(&snd_fasync_lock);
++ if (fasync->on)
++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll);
++ spin_lock_irq(&snd_fasync_lock);
++ }
++ spin_unlock_irq(&snd_fasync_lock);
++}
++
++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn);
++
++int snd_fasync_helper(int fd, struct file *file, int on,
++ struct snd_fasync **fasyncp)
++{
++ struct snd_fasync *fasync = NULL;
++
++ if (on) {
++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL);
++ if (!fasync)
++ return -ENOMEM;
++ INIT_LIST_HEAD(&fasync->list);
++ }
++
++ spin_lock_irq(&snd_fasync_lock);
++ if (*fasyncp) {
++ kfree(fasync);
++ fasync = *fasyncp;
++ } else {
++ if (!fasync) {
++ spin_unlock_irq(&snd_fasync_lock);
++ return 0;
++ }
++ *fasyncp = fasync;
++ }
++ fasync->on = on;
++ spin_unlock_irq(&snd_fasync_lock);
++ return fasync_helper(fd, file, on, &fasync->fasync);
++}
++EXPORT_SYMBOL_GPL(snd_fasync_helper);
++
++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll)
++{
++ unsigned long flags;
++
++ if (!fasync || !fasync->on)
++ return;
++ spin_lock_irqsave(&snd_fasync_lock, flags);
++ fasync->signal = signal;
++ fasync->poll = poll;
++ list_move(&fasync->list, &snd_fasync_list);
++ schedule_work(&snd_fasync_work);
++ spin_unlock_irqrestore(&snd_fasync_lock, flags);
++}
++EXPORT_SYMBOL_GPL(snd_kill_fasync);
++
++void snd_fasync_free(struct snd_fasync *fasync)
++{
++ if (!fasync)
++ return;
++ fasync->on = 0;
++ flush_work(&snd_fasync_work);
++ kfree(fasync);
++}
++EXPORT_SYMBOL_GPL(snd_fasync_free);
+--
+2.35.1
+
--- /dev/null
+From a2dff819cc4ac69dabd85ee11a199773e1d00699 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 14:59:43 +0200
+Subject: ALSA: timer: Use deferred fasync helper
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c ]
+
+For avoiding the potential deadlock via kill_fasync() call, use the
+new fasync helpers to defer the invocation from PCI API. Note that
+it's merely a workaround.
+
+Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com
+Reported-by: syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com
+Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20220728125945.29533-3-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/timer.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 04cd8953605a..764d2b19344e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -83,7 +83,7 @@ struct snd_timer_user {
+ unsigned int filter;
+ struct timespec64 tstamp; /* trigger tstamp */
+ wait_queue_head_t qchange_sleep;
+- struct fasync_struct *fasync;
++ struct snd_fasync *fasync;
+ struct mutex ioctl_lock;
+ };
+
+@@ -1345,7 +1345,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri,
+ }
+ __wake:
+ spin_unlock(&tu->qlock);
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1383,7 +1383,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
+ spin_lock_irqsave(&tu->qlock, flags);
+ snd_timer_user_append_to_tqueue(tu, &r1);
+ spin_unlock_irqrestore(&tu->qlock, flags);
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1453,7 +1453,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri,
+ spin_unlock(&tu->qlock);
+ if (append == 0)
+ return;
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1521,6 +1521,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file)
+ snd_timer_instance_free(tu->timeri);
+ }
+ mutex_unlock(&tu->ioctl_lock);
++ snd_fasync_free(tu->fasync);
+ kfree(tu->queue);
+ kfree(tu->tqueue);
+ kfree(tu);
+@@ -2135,7 +2136,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on)
+ struct snd_timer_user *tu;
+
+ tu = file->private_data;
+- return fasync_helper(fd, file, on, &tu->fasync);
++ return snd_fasync_helper(fd, file, on, &tu->fasync);
+ }
+
+ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+--
+2.35.1
+
--- /dev/null
+From f708c895d08d6d2c75f0894dfc4c8fda223b6dd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 19:54:49 +0800
+Subject: ASoC: SOF: intel: move sof_intel_dsp_desc() forward
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 2f1315ae94b46bf0d5b4be29be15cc3641364404 ]
+
+sof_intel_dsp_desc() will be used by hda_dsp_check_sdw_irq() in the
+following commit.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20210723115451.7245-5-yung-chuan.liao@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
+index b0faf050132d..b4cc72483137 100644
+--- a/sound/soc/sof/intel/hda.c
++++ b/sound/soc/sof/intel/hda.c
+@@ -39,6 +39,17 @@
+ #define EXCEPT_MAX_HDR_SIZE 0x400
+ #define HDA_EXT_ROM_STATUS_SIZE 8
+
++static const struct sof_intel_dsp_desc
++ *get_chip_info(struct snd_sof_pdata *pdata)
++{
++ const struct sof_dev_desc *desc = pdata->desc;
++ const struct sof_intel_dsp_desc *chip_info;
++
++ chip_info = desc->chip_info;
++
++ return chip_info;
++}
++
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_INTEL_SOUNDWIRE)
+
+ /*
+@@ -674,17 +685,6 @@ static int hda_init_caps(struct snd_sof_dev *sdev)
+ return 0;
+ }
+
+-static const struct sof_intel_dsp_desc
+- *get_chip_info(struct snd_sof_pdata *pdata)
+-{
+- const struct sof_dev_desc *desc = pdata->desc;
+- const struct sof_intel_dsp_desc *chip_info;
+-
+- chip_info = desc->chip_info;
+-
+- return chip_info;
+-}
+-
+ static irqreturn_t hda_dsp_interrupt_handler(int irq, void *context)
+ {
+ struct snd_sof_dev *sdev = context;
+--
+2.35.1
+
--- /dev/null
+From 714bb40fddbc97450d2d0f45ab5184422c1453cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Mar 2021 13:38:59 -0400
+Subject: audit: log nftables configuration change events once per table
+
+From: Richard Guy Briggs <rgb@redhat.com>
+
+[ Upstream commit c520292f29b8047285bcfbc2322fa2a9bf02521a ]
+
+Reduce logging of nftables events to a level similar to iptables.
+Restore the table field to list the table, adding the generation.
+
+Indicate the op as the most significant operation in the event.
+
+A couple of sample events:
+
+type=PROCTITLE msg=audit(2021-03-18 09:30:49.801:143) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid
+type=SYSCALL msg=audit(2021-03-18 09:30:49.801:143) : arch=x86_64 syscall=sendmsg success=yes exit=172 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=roo
+t sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null)
+type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv6 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
+type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=ipv4 entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
+type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.801:143) : table=firewalld:2 family=inet entries=1 op=nft_register_table pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
+
+type=PROCTITLE msg=audit(2021-03-18 09:30:49.839:144) : proctitle=/usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid
+type=SYSCALL msg=audit(2021-03-18 09:30:49.839:144) : arch=x86_64 syscall=sendmsg success=yes exit=22792 a0=0x6 a1=0x7ffdcfcbe650 a2=0x0 a3=0x7ffdcfcbd52c items=0 ppid=1 pid=367 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=r
+oot sgid=root fsgid=root tty=(none) ses=unset comm=firewalld exe=/usr/bin/python3.9 subj=system_u:system_r:firewalld_t:s0 key=(null)
+type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv6 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
+type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=ipv4 entries=30 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
+type=NETFILTER_CFG msg=audit(2021-03-18 09:30:49.839:144) : table=firewalld:3 family=inet entries=165 op=nft_register_chain pid=367 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
+
+The issue was originally documented in
+https://github.com/linux-audit/audit-kernel/issues/124
+
+Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
+Acked-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 186 +++++++++++++++++++---------------
+ 1 file changed, 103 insertions(+), 83 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 990a0274e555..507d3d24a347 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -66,6 +66,41 @@ static const struct rhashtable_params nft_objname_ht_params = {
+ .automatic_shrinking = true,
+ };
+
++struct nft_audit_data {
++ struct nft_table *table;
++ int entries;
++ int op;
++ struct list_head list;
++};
++
++static const u8 nft2audit_op[NFT_MSG_MAX] = { // enum nf_tables_msg_types
++ [NFT_MSG_NEWTABLE] = AUDIT_NFT_OP_TABLE_REGISTER,
++ [NFT_MSG_GETTABLE] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_DELTABLE] = AUDIT_NFT_OP_TABLE_UNREGISTER,
++ [NFT_MSG_NEWCHAIN] = AUDIT_NFT_OP_CHAIN_REGISTER,
++ [NFT_MSG_GETCHAIN] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_DELCHAIN] = AUDIT_NFT_OP_CHAIN_UNREGISTER,
++ [NFT_MSG_NEWRULE] = AUDIT_NFT_OP_RULE_REGISTER,
++ [NFT_MSG_GETRULE] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_DELRULE] = AUDIT_NFT_OP_RULE_UNREGISTER,
++ [NFT_MSG_NEWSET] = AUDIT_NFT_OP_SET_REGISTER,
++ [NFT_MSG_GETSET] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_DELSET] = AUDIT_NFT_OP_SET_UNREGISTER,
++ [NFT_MSG_NEWSETELEM] = AUDIT_NFT_OP_SETELEM_REGISTER,
++ [NFT_MSG_GETSETELEM] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_DELSETELEM] = AUDIT_NFT_OP_SETELEM_UNREGISTER,
++ [NFT_MSG_NEWGEN] = AUDIT_NFT_OP_GEN_REGISTER,
++ [NFT_MSG_GETGEN] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_TRACE] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_NEWOBJ] = AUDIT_NFT_OP_OBJ_REGISTER,
++ [NFT_MSG_GETOBJ] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_DELOBJ] = AUDIT_NFT_OP_OBJ_UNREGISTER,
++ [NFT_MSG_GETOBJ_RESET] = AUDIT_NFT_OP_OBJ_RESET,
++ [NFT_MSG_NEWFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_REGISTER,
++ [NFT_MSG_GETFLOWTABLE] = AUDIT_NFT_OP_INVALID,
++ [NFT_MSG_DELFLOWTABLE] = AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
++};
++
+ static void nft_validate_state_update(struct net *net, u8 new_validate_state)
+ {
+ switch (net->nft.validate_state) {
+@@ -710,17 +745,6 @@ static void nf_tables_table_notify(const struct nft_ctx *ctx, int event)
+ {
+ struct sk_buff *skb;
+ int err;
+- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;?:0",
+- ctx->table->name, ctx->table->handle);
+-
+- audit_log_nfcfg(buf,
+- ctx->family,
+- ctx->table->use,
+- event == NFT_MSG_NEWTABLE ?
+- AUDIT_NFT_OP_TABLE_REGISTER :
+- AUDIT_NFT_OP_TABLE_UNREGISTER,
+- GFP_KERNEL);
+- kfree(buf);
+
+ if (!ctx->report &&
+ !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
+@@ -1477,18 +1501,6 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event)
+ {
+ struct sk_buff *skb;
+ int err;
+- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
+- ctx->table->name, ctx->table->handle,
+- ctx->chain->name, ctx->chain->handle);
+-
+- audit_log_nfcfg(buf,
+- ctx->family,
+- ctx->chain->use,
+- event == NFT_MSG_NEWCHAIN ?
+- AUDIT_NFT_OP_CHAIN_REGISTER :
+- AUDIT_NFT_OP_CHAIN_UNREGISTER,
+- GFP_KERNEL);
+- kfree(buf);
+
+ if (!ctx->report &&
+ !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
+@@ -2844,18 +2856,6 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx,
+ {
+ struct sk_buff *skb;
+ int err;
+- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
+- ctx->table->name, ctx->table->handle,
+- ctx->chain->name, ctx->chain->handle);
+-
+- audit_log_nfcfg(buf,
+- ctx->family,
+- rule->handle,
+- event == NFT_MSG_NEWRULE ?
+- AUDIT_NFT_OP_RULE_REGISTER :
+- AUDIT_NFT_OP_RULE_UNREGISTER,
+- GFP_KERNEL);
+- kfree(buf);
+
+ if (!ctx->report &&
+ !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
+@@ -3882,18 +3882,6 @@ static void nf_tables_set_notify(const struct nft_ctx *ctx,
+ struct sk_buff *skb;
+ u32 portid = ctx->portid;
+ int err;
+- char *buf = kasprintf(gfp_flags, "%s:%llu;%s:%llu",
+- ctx->table->name, ctx->table->handle,
+- set->name, set->handle);
+-
+- audit_log_nfcfg(buf,
+- ctx->family,
+- set->field_count,
+- event == NFT_MSG_NEWSET ?
+- AUDIT_NFT_OP_SET_REGISTER :
+- AUDIT_NFT_OP_SET_UNREGISTER,
+- gfp_flags);
+- kfree(buf);
+
+ if (!ctx->report &&
+ !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
+@@ -5035,18 +5023,6 @@ static void nf_tables_setelem_notify(const struct nft_ctx *ctx,
+ u32 portid = ctx->portid;
+ struct sk_buff *skb;
+ int err;
+- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
+- ctx->table->name, ctx->table->handle,
+- set->name, set->handle);
+-
+- audit_log_nfcfg(buf,
+- ctx->family,
+- set->handle,
+- event == NFT_MSG_NEWSETELEM ?
+- AUDIT_NFT_OP_SETELEM_REGISTER :
+- AUDIT_NFT_OP_SETELEM_UNREGISTER,
+- GFP_KERNEL);
+- kfree(buf);
+
+ if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
+ return;
+@@ -6180,12 +6156,11 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
+ filter->type != NFT_OBJECT_UNSPEC &&
+ obj->ops->type->type != filter->type)
+ goto cont;
+-
+ if (reset) {
+ char *buf = kasprintf(GFP_ATOMIC,
+- "%s:%llu;?:0",
++ "%s:%u",
+ table->name,
+- table->handle);
++ net->nft.base_seq);
+
+ audit_log_nfcfg(buf,
+ family,
+@@ -6306,8 +6281,8 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk,
+ reset = true;
+
+ if (reset) {
+- char *buf = kasprintf(GFP_ATOMIC, "%s:%llu;?:0",
+- table->name, table->handle);
++ char *buf = kasprintf(GFP_ATOMIC, "%s:%u",
++ table->name, net->nft.base_seq);
+
+ audit_log_nfcfg(buf,
+ family,
+@@ -6394,15 +6369,15 @@ void nft_obj_notify(struct net *net, const struct nft_table *table,
+ {
+ struct sk_buff *skb;
+ int err;
+- char *buf = kasprintf(gfp, "%s:%llu;?:0",
+- table->name, table->handle);
++ char *buf = kasprintf(gfp, "%s:%u",
++ table->name, net->nft.base_seq);
+
+ audit_log_nfcfg(buf,
+ family,
+ obj->handle,
+ event == NFT_MSG_NEWOBJ ?
+- AUDIT_NFT_OP_OBJ_REGISTER :
+- AUDIT_NFT_OP_OBJ_UNREGISTER,
++ AUDIT_NFT_OP_OBJ_REGISTER :
++ AUDIT_NFT_OP_OBJ_UNREGISTER,
+ gfp);
+ kfree(buf);
+
+@@ -7220,18 +7195,6 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx,
+ {
+ struct sk_buff *skb;
+ int err;
+- char *buf = kasprintf(GFP_KERNEL, "%s:%llu;%s:%llu",
+- flowtable->table->name, flowtable->table->handle,
+- flowtable->name, flowtable->handle);
+-
+- audit_log_nfcfg(buf,
+- ctx->family,
+- flowtable->hooknum,
+- event == NFT_MSG_NEWFLOWTABLE ?
+- AUDIT_NFT_OP_FLOWTABLE_REGISTER :
+- AUDIT_NFT_OP_FLOWTABLE_UNREGISTER,
+- GFP_KERNEL);
+- kfree(buf);
+
+ if (!ctx->report &&
+ !nfnetlink_has_listeners(ctx->net, NFNLGRP_NFTABLES))
+@@ -7352,9 +7315,6 @@ static void nf_tables_gen_notify(struct net *net, struct sk_buff *skb,
+ struct sk_buff *skb2;
+ int err;
+
+- audit_log_nfcfg("?:0;?:0", 0, net->nft.base_seq,
+- AUDIT_NFT_OP_GEN_REGISTER, GFP_KERNEL);
+-
+ if (!nlmsg_report(nlh) &&
+ !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES))
+ return;
+@@ -7885,12 +7845,64 @@ static void nft_commit_notify(struct net *net, u32 portid)
+ WARN_ON_ONCE(!list_empty(&net->nft.notify_list));
+ }
+
++static int nf_tables_commit_audit_alloc(struct list_head *adl,
++ struct nft_table *table)
++{
++ struct nft_audit_data *adp;
++
++ list_for_each_entry(adp, adl, list) {
++ if (adp->table == table)
++ return 0;
++ }
++ adp = kzalloc(sizeof(*adp), GFP_KERNEL);
++ if (!adp)
++ return -ENOMEM;
++ adp->table = table;
++ list_add(&adp->list, adl);
++ return 0;
++}
++
++static void nf_tables_commit_audit_collect(struct list_head *adl,
++ struct nft_table *table, u32 op)
++{
++ struct nft_audit_data *adp;
++
++ list_for_each_entry(adp, adl, list) {
++ if (adp->table == table)
++ goto found;
++ }
++ WARN_ONCE("table=%s not expected in commit list", table->name);
++ return;
++found:
++ adp->entries++;
++ if (!adp->op || adp->op > op)
++ adp->op = op;
++}
++
++#define AUNFTABLENAMELEN (NFT_TABLE_MAXNAMELEN + 22)
++
++static void nf_tables_commit_audit_log(struct list_head *adl, u32 generation)
++{
++ struct nft_audit_data *adp, *adn;
++ char aubuf[AUNFTABLENAMELEN];
++
++ list_for_each_entry_safe(adp, adn, adl, list) {
++ snprintf(aubuf, AUNFTABLENAMELEN, "%s:%u", adp->table->name,
++ generation);
++ audit_log_nfcfg(aubuf, adp->table->family, adp->entries,
++ nft2audit_op[adp->op], GFP_KERNEL);
++ list_del(&adp->list);
++ kfree(adp);
++ }
++}
++
+ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ {
+ struct nft_trans *trans, *next;
+ struct nft_trans_elem *te;
+ struct nft_chain *chain;
+ struct nft_table *table;
++ LIST_HEAD(adl);
+ int err;
+
+ if (list_empty(&net->nft.commit_list)) {
+@@ -7910,6 +7922,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
+ int ret;
+
++ ret = nf_tables_commit_audit_alloc(&adl, trans->ctx.table);
++ if (ret) {
++ nf_tables_commit_chain_prepare_cancel(net);
++ return ret;
++ }
+ if (trans->msg_type == NFT_MSG_NEWRULE ||
+ trans->msg_type == NFT_MSG_DELRULE) {
+ chain = trans->ctx.chain;
+@@ -7938,6 +7955,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+ net->nft.gencursor = nft_gencursor_next(net);
+
+ list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
++ nf_tables_commit_audit_collect(&adl, trans->ctx.table,
++ trans->msg_type);
+ switch (trans->msg_type) {
+ case NFT_MSG_NEWTABLE:
+ if (nft_trans_table_update(trans)) {
+@@ -8092,6 +8111,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
+
+ nft_commit_notify(net, NETLINK_CB(skb).portid);
+ nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
++ nf_tables_commit_audit_log(&adl, net->nft.base_seq);
+ nf_tables_commit_release(net);
+
+ return 0;
+--
+2.35.1
+
--- /dev/null
+From 8c0262a34241c80017756fa82b35bc5d8274f534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 09:27:11 +0300
+Subject: clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit 94bed9bb05c7850ff5d80b87cc29004901f37956 ]
+
+After merging lucid and trion pll functions in commit 0b01489475c6
+("clk: qcom: clk-alpha-pll: same regs and ops for trion and lucid")
+the function clk_trion_pll_configure() is left with an old description
+header, which results in a W=2 compile time warning, fix it.
+
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220701062711.2757855-1-vladimir.zapolskiy@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c
+index 1a571c04a76c..cf265ab035ea 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -1379,7 +1379,7 @@ const struct clk_ops clk_alpha_pll_postdiv_fabia_ops = {
+ EXPORT_SYMBOL_GPL(clk_alpha_pll_postdiv_fabia_ops);
+
+ /**
+- * clk_lucid_pll_configure - configure the lucid pll
++ * clk_trion_pll_configure - configure the trion pll
+ *
+ * @pll: clk alpha pll
+ * @regmap: register map
+--
+2.35.1
+
--- /dev/null
+From 0ebddd64d7936fe9dc8ad23dcdadace8c44b2c54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 May 2022 23:00:47 +0200
+Subject: clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 1bf7305e79aab095196131bdc87a97796e0e3fac ]
+
+Once the usb sleep clocks are disabled, clock framework is trying to
+disable the sleep clock source also.
+
+However, it seems that it cannot be disabled and trying to do so produces:
+[ 245.436390] ------------[ cut here ]------------
+[ 245.441233] gcc_sleep_clk_src status stuck at 'on'
+[ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140
+[ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio
+[ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215
+[ 245.463889] Hardware name: Xiaomi AX9000 (DT)
+[ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 245.474307] pc : clk_branch_wait+0x130/0x140
+[ 245.481073] lr : clk_branch_wait+0x130/0x140
+[ 245.485588] sp : ffffffc009f2bad0
+[ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000
+[ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20
+[ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0
+[ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7
+[ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777
+[ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129
+[ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001
+[ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001
+[ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027
+[ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026
+[ 245.557122] Call trace:
+[ 245.564229] clk_branch_wait+0x130/0x140
+[ 245.566490] clk_branch2_disable+0x2c/0x40
+[ 245.570656] clk_core_disable+0x60/0xb0
+[ 245.574561] clk_core_disable+0x68/0xb0
+[ 245.578293] clk_disable+0x30/0x50
+[ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom]
+[ 245.585588] platform_remove+0x28/0x60
+[ 245.590361] device_remove+0x4c/0x80
+[ 245.594179] device_release_driver_internal+0x1dc/0x230
+[ 245.597914] device_driver_detach+0x18/0x30
+[ 245.602861] unbind_store+0xec/0x110
+[ 245.607027] drv_attr_store+0x24/0x40
+[ 245.610847] sysfs_kf_write+0x44/0x60
+[ 245.614405] kernfs_fop_write_iter+0x128/0x1c0
+[ 245.618052] new_sync_write+0xc0/0x130
+[ 245.622391] vfs_write+0x1d4/0x2a0
+[ 245.626123] ksys_write+0x58/0xe0
+[ 245.629508] __arm64_sys_write+0x1c/0x30
+[ 245.632895] invoke_syscall.constprop.0+0x5c/0x110
+[ 245.636890] do_el0_svc+0xa0/0x150
+[ 245.641488] el0_svc+0x18/0x60
+[ 245.644872] el0t_64_sync_handler+0xa4/0x130
+[ 245.647914] el0t_64_sync+0x174/0x178
+[ 245.652340] ---[ end trace 0000000000000000 ]---
+
+So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try
+to disable the sleep clock.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220515210048.483898-10-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
+index 2c2ecfc5e61f..d6d5defb82c9 100644
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -662,6 +662,7 @@ static struct clk_branch gcc_sleep_clk_src = {
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
++ .flags = CLK_IS_CRITICAL,
+ },
+ },
+ };
+--
+2.35.1
+
--- /dev/null
+From 0a1d34e15f8548496bf3ac106fccebee561672ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jun 2022 09:43:06 +0300
+Subject: clk: ti: Stop using legacy clkctrl names for omap4 and 5
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 255584b138343d4a28c6d25bd82d04b09460d672 ]
+
+With the addition of clock-output-names, we can now unify the internal
+clock naming for omap4 and 5 to follow the other TI SoCs.
+
+We are still using legacy clkctrl names for omap4 and 5 based on the clock
+manager name which is wrong. Instead, we want to use the clkctrl clock
+based naming.
+
+We must now also drop the legacy TI_CLK_CLKCTRL_COMPAT quirk for the
+clkctrl clock.
+
+This change will allow further devicetree warning cleanup as already
+done for am3/4 and dra7.
+
+Cc: linux-clk@vger.kernel.org
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Tero Kristo <kristo@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20220615064306.22254-1-tony@atomide.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-44xx.c | 210 +++++++++++++++++++-------------------
+ drivers/clk/ti/clk-54xx.c | 160 ++++++++++++++---------------
+ drivers/clk/ti/clkctrl.c | 4 -
+ 3 files changed, 185 insertions(+), 189 deletions(-)
+
+diff --git a/drivers/clk/ti/clk-44xx.c b/drivers/clk/ti/clk-44xx.c
+index a38c92153979..cbf9922d93d4 100644
+--- a/drivers/clk/ti/clk-44xx.c
++++ b/drivers/clk/ti/clk-44xx.c
+@@ -56,7 +56,7 @@ static const struct omap_clkctrl_bit_data omap4_aess_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_func_dmic_abe_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0018:26",
++ "abe-clkctrl:0018:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -76,7 +76,7 @@ static const struct omap_clkctrl_bit_data omap4_dmic_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_func_mcasp_abe_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0020:26",
++ "abe-clkctrl:0020:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -89,7 +89,7 @@ static const struct omap_clkctrl_bit_data omap4_mcasp_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_func_mcbsp1_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0028:26",
++ "abe-clkctrl:0028:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -102,7 +102,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp1_bit_data[] __initconst =
+ };
+
+ static const char * const omap4_func_mcbsp2_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0030:26",
++ "abe-clkctrl:0030:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -115,7 +115,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp2_bit_data[] __initconst =
+ };
+
+ static const char * const omap4_func_mcbsp3_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0038:26",
++ "abe-clkctrl:0038:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -183,18 +183,18 @@ static const struct omap_clkctrl_bit_data omap4_timer8_bit_data[] __initconst =
+
+ static const struct omap_clkctrl_reg_data omap4_abe_clkctrl_regs[] __initconst = {
+ { OMAP4_L4_ABE_CLKCTRL, NULL, 0, "ocp_abe_iclk" },
+- { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" },
++ { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" },
+ { OMAP4_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" },
+- { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" },
+- { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe_cm:clk:0020:24" },
+- { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" },
+- { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" },
+- { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" },
+- { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0040:8" },
+- { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" },
+- { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" },
+- { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" },
+- { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" },
++ { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" },
++ { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe-clkctrl:0020:24" },
++ { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" },
++ { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" },
++ { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" },
++ { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0040:8" },
++ { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" },
++ { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" },
++ { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" },
++ { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" },
+ { OMAP4_WD_TIMER3_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { 0 },
+ };
+@@ -287,7 +287,7 @@ static const struct omap_clkctrl_bit_data omap4_fdif_bit_data[] __initconst = {
+
+ static const struct omap_clkctrl_reg_data omap4_iss_clkctrl_regs[] __initconst = {
+ { OMAP4_ISS_CLKCTRL, omap4_iss_bit_data, CLKF_SW_SUP, "ducati_clk_mux_ck" },
+- { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss_cm:clk:0008:24" },
++ { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss-clkctrl:0008:24" },
+ { 0 },
+ };
+
+@@ -320,7 +320,7 @@ static const struct omap_clkctrl_bit_data omap4_dss_core_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l3_dss_clkctrl_regs[] __initconst = {
+- { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3_dss_cm:clk:0000:8" },
++ { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3-dss-clkctrl:0000:8" },
+ { 0 },
+ };
+
+@@ -336,7 +336,7 @@ static const struct omap_clkctrl_bit_data omap4_gpu_bit_data[] __initconst = {
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l3_gfx_clkctrl_regs[] __initconst = {
+- { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3_gfx_cm:clk:0000:24" },
++ { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3-gfx-clkctrl:0000:24" },
+ { 0 },
+ };
+
+@@ -372,12 +372,12 @@ static const struct omap_clkctrl_bit_data omap4_hsi_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_usb_host_hs_utmi_p1_clk_parents[] __initconst = {
+- "l3_init_cm:clk:0038:24",
++ "l3-init-clkctrl:0038:24",
+ NULL,
+ };
+
+ static const char * const omap4_usb_host_hs_utmi_p2_clk_parents[] __initconst = {
+- "l3_init_cm:clk:0038:25",
++ "l3-init-clkctrl:0038:25",
+ NULL,
+ };
+
+@@ -418,7 +418,7 @@ static const struct omap_clkctrl_bit_data omap4_usb_host_hs_bit_data[] __initcon
+ };
+
+ static const char * const omap4_usb_otg_hs_xclk_parents[] __initconst = {
+- "l3_init_cm:clk:0040:24",
++ "l3-init-clkctrl:0040:24",
+ NULL,
+ };
+
+@@ -452,14 +452,14 @@ static const struct omap_clkctrl_bit_data omap4_ocp2scp_usb_phy_bit_data[] __ini
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l3_init_clkctrl_regs[] __initconst = {
+- { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0008:24" },
+- { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0010:24" },
+- { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:0018:24" },
++ { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0008:24" },
++ { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0010:24" },
++ { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:0018:24" },
+ { OMAP4_USB_HOST_HS_CLKCTRL, omap4_usb_host_hs_bit_data, CLKF_SW_SUP, "init_60m_fclk" },
+ { OMAP4_USB_OTG_HS_CLKCTRL, omap4_usb_otg_hs_bit_data, CLKF_HW_SUP, "l3_div_ck" },
+ { OMAP4_USB_TLL_HS_CLKCTRL, omap4_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_div_ck" },
+ { OMAP4_USB_HOST_FS_CLKCTRL, NULL, CLKF_SW_SUP, "func_48mc_fclk" },
+- { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:00c0:8" },
++ { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:00c0:8" },
+ { 0 },
+ };
+
+@@ -530,7 +530,7 @@ static const struct omap_clkctrl_bit_data omap4_gpio6_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_per_mcbsp4_gfclk_parents[] __initconst = {
+- "l4_per_cm:clk:00c0:26",
++ "l4-per-clkctrl:00c0:26",
+ "pad_clks_ck",
+ NULL,
+ };
+@@ -570,12 +570,12 @@ static const struct omap_clkctrl_bit_data omap4_slimbus2_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initconst = {
+- { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0008:24" },
+- { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0010:24" },
+- { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0018:24" },
+- { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0020:24" },
+- { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0028:24" },
+- { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0030:24" },
++ { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0008:24" },
++ { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0010:24" },
++ { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0018:24" },
++ { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0020:24" },
++ { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0028:24" },
++ { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0030:24" },
+ { OMAP4_ELM_CLKCTRL, NULL, 0, "l4_div_ck" },
+ { OMAP4_GPIO2_CLKCTRL, omap4_gpio2_bit_data, CLKF_HW_SUP, "l4_div_ck" },
+ { OMAP4_GPIO3_CLKCTRL, omap4_gpio3_bit_data, CLKF_HW_SUP, "l4_div_ck" },
+@@ -588,14 +588,14 @@ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initcons
+ { OMAP4_I2C3_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" },
+ { OMAP4_I2C4_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" },
+ { OMAP4_L4_PER_CLKCTRL, NULL, 0, "l4_div_ck" },
+- { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:00c0:24" },
++ { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:00c0:24" },
+ { OMAP4_MCSPI1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MCSPI2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MCSPI3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MCSPI4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MMC3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MMC4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+- { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0118:8" },
++ { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0118:8" },
+ { OMAP4_UART1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_UART2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_UART3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+@@ -630,7 +630,7 @@ static const struct omap_clkctrl_reg_data omap4_l4_wkup_clkctrl_regs[] __initcon
+ { OMAP4_L4_WKUP_CLKCTRL, NULL, 0, "l4_wkup_clk_mux_ck" },
+ { OMAP4_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { OMAP4_GPIO1_CLKCTRL, omap4_gpio1_bit_data, CLKF_HW_SUP, "l4_wkup_clk_mux_ck" },
+- { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4_wkup_cm:clk:0020:24" },
++ { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4-wkup-clkctrl:0020:24" },
+ { OMAP4_COUNTER_32K_CLKCTRL, NULL, 0, "sys_32k_ck" },
+ { OMAP4_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { 0 },
+@@ -644,7 +644,7 @@ static const char * const omap4_pmd_stm_clock_mux_ck_parents[] __initconst = {
+ };
+
+ static const char * const omap4_trace_clk_div_div_ck_parents[] __initconst = {
+- "emu_sys_cm:clk:0000:22",
++ "emu-sys-clkctrl:0000:22",
+ NULL,
+ };
+
+@@ -662,7 +662,7 @@ static const struct omap_clkctrl_div_data omap4_trace_clk_div_div_ck_data __init
+ };
+
+ static const char * const omap4_stm_clk_div_ck_parents[] __initconst = {
+- "emu_sys_cm:clk:0000:20",
++ "emu-sys-clkctrl:0000:20",
+ NULL,
+ };
+
+@@ -716,73 +716,73 @@ static struct ti_dt_clk omap44xx_clks[] = {
+ * hwmod support. Once hwmod is removed, these can be removed
+ * also.
+ */
+- DT_CLK(NULL, "aess_fclk", "abe_cm:0008:24"),
+- DT_CLK(NULL, "cm2_dm10_mux", "l4_per_cm:0008:24"),
+- DT_CLK(NULL, "cm2_dm11_mux", "l4_per_cm:0010:24"),
+- DT_CLK(NULL, "cm2_dm2_mux", "l4_per_cm:0018:24"),
+- DT_CLK(NULL, "cm2_dm3_mux", "l4_per_cm:0020:24"),
+- DT_CLK(NULL, "cm2_dm4_mux", "l4_per_cm:0028:24"),
+- DT_CLK(NULL, "cm2_dm9_mux", "l4_per_cm:0030:24"),
+- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"),
+- DT_CLK(NULL, "dmt1_clk_mux", "l4_wkup_cm:0020:24"),
+- DT_CLK(NULL, "dss_48mhz_clk", "l3_dss_cm:0000:9"),
+- DT_CLK(NULL, "dss_dss_clk", "l3_dss_cm:0000:8"),
+- DT_CLK(NULL, "dss_sys_clk", "l3_dss_cm:0000:10"),
+- DT_CLK(NULL, "dss_tv_clk", "l3_dss_cm:0000:11"),
+- DT_CLK(NULL, "fdif_fck", "iss_cm:0008:24"),
+- DT_CLK(NULL, "func_dmic_abe_gfclk", "abe_cm:0018:24"),
+- DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe_cm:0020:24"),
+- DT_CLK(NULL, "func_mcbsp1_gfclk", "abe_cm:0028:24"),
+- DT_CLK(NULL, "func_mcbsp2_gfclk", "abe_cm:0030:24"),
+- DT_CLK(NULL, "func_mcbsp3_gfclk", "abe_cm:0038:24"),
+- DT_CLK(NULL, "gpio1_dbclk", "l4_wkup_cm:0018:8"),
+- DT_CLK(NULL, "gpio2_dbclk", "l4_per_cm:0040:8"),
+- DT_CLK(NULL, "gpio3_dbclk", "l4_per_cm:0048:8"),
+- DT_CLK(NULL, "gpio4_dbclk", "l4_per_cm:0050:8"),
+- DT_CLK(NULL, "gpio5_dbclk", "l4_per_cm:0058:8"),
+- DT_CLK(NULL, "gpio6_dbclk", "l4_per_cm:0060:8"),
+- DT_CLK(NULL, "hsi_fck", "l3_init_cm:0018:24"),
+- DT_CLK(NULL, "hsmmc1_fclk", "l3_init_cm:0008:24"),
+- DT_CLK(NULL, "hsmmc2_fclk", "l3_init_cm:0010:24"),
+- DT_CLK(NULL, "iss_ctrlclk", "iss_cm:0000:8"),
+- DT_CLK(NULL, "mcasp_sync_mux_ck", "abe_cm:0020:26"),
+- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"),
+- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"),
+- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"),
+- DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4_per_cm:00c0:26"),
+- DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3_init_cm:00c0:8"),
+- DT_CLK(NULL, "otg_60m_gfclk", "l3_init_cm:0040:24"),
+- DT_CLK(NULL, "per_mcbsp4_gfclk", "l4_per_cm:00c0:24"),
+- DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu_sys_cm:0000:20"),
+- DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu_sys_cm:0000:22"),
+- DT_CLK(NULL, "sgx_clk_mux", "l3_gfx_cm:0000:24"),
+- DT_CLK(NULL, "slimbus1_fclk_0", "abe_cm:0040:8"),
+- DT_CLK(NULL, "slimbus1_fclk_1", "abe_cm:0040:9"),
+- DT_CLK(NULL, "slimbus1_fclk_2", "abe_cm:0040:10"),
+- DT_CLK(NULL, "slimbus1_slimbus_clk", "abe_cm:0040:11"),
+- DT_CLK(NULL, "slimbus2_fclk_0", "l4_per_cm:0118:8"),
+- DT_CLK(NULL, "slimbus2_fclk_1", "l4_per_cm:0118:9"),
+- DT_CLK(NULL, "slimbus2_slimbus_clk", "l4_per_cm:0118:10"),
+- DT_CLK(NULL, "stm_clk_div_ck", "emu_sys_cm:0000:27"),
+- DT_CLK(NULL, "timer5_sync_mux", "abe_cm:0048:24"),
+- DT_CLK(NULL, "timer6_sync_mux", "abe_cm:0050:24"),
+- DT_CLK(NULL, "timer7_sync_mux", "abe_cm:0058:24"),
+- DT_CLK(NULL, "timer8_sync_mux", "abe_cm:0060:24"),
+- DT_CLK(NULL, "trace_clk_div_div_ck", "emu_sys_cm:0000:24"),
+- DT_CLK(NULL, "usb_host_hs_func48mclk", "l3_init_cm:0038:15"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3_init_cm:0038:13"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3_init_cm:0038:14"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3_init_cm:0038:11"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3_init_cm:0038:12"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3_init_cm:0038:8"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3_init_cm:0038:9"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init_cm:0038:10"),
+- DT_CLK(NULL, "usb_otg_hs_xclk", "l3_init_cm:0040:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3_init_cm:0048:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3_init_cm:0048:9"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3_init_cm:0048:10"),
+- DT_CLK(NULL, "utmi_p1_gfclk", "l3_init_cm:0038:24"),
+- DT_CLK(NULL, "utmi_p2_gfclk", "l3_init_cm:0038:25"),
++ DT_CLK(NULL, "aess_fclk", "abe-clkctrl:0008:24"),
++ DT_CLK(NULL, "cm2_dm10_mux", "l4-per-clkctrl:0008:24"),
++ DT_CLK(NULL, "cm2_dm11_mux", "l4-per-clkctrl:0010:24"),
++ DT_CLK(NULL, "cm2_dm2_mux", "l4-per-clkctrl:0018:24"),
++ DT_CLK(NULL, "cm2_dm3_mux", "l4-per-clkctrl:0020:24"),
++ DT_CLK(NULL, "cm2_dm4_mux", "l4-per-clkctrl:0028:24"),
++ DT_CLK(NULL, "cm2_dm9_mux", "l4-per-clkctrl:0030:24"),
++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"),
++ DT_CLK(NULL, "dmt1_clk_mux", "l4-wkup-clkctrl:0020:24"),
++ DT_CLK(NULL, "dss_48mhz_clk", "l3-dss-clkctrl:0000:9"),
++ DT_CLK(NULL, "dss_dss_clk", "l3-dss-clkctrl:0000:8"),
++ DT_CLK(NULL, "dss_sys_clk", "l3-dss-clkctrl:0000:10"),
++ DT_CLK(NULL, "dss_tv_clk", "l3-dss-clkctrl:0000:11"),
++ DT_CLK(NULL, "fdif_fck", "iss-clkctrl:0008:24"),
++ DT_CLK(NULL, "func_dmic_abe_gfclk", "abe-clkctrl:0018:24"),
++ DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe-clkctrl:0020:24"),
++ DT_CLK(NULL, "func_mcbsp1_gfclk", "abe-clkctrl:0028:24"),
++ DT_CLK(NULL, "func_mcbsp2_gfclk", "abe-clkctrl:0030:24"),
++ DT_CLK(NULL, "func_mcbsp3_gfclk", "abe-clkctrl:0038:24"),
++ DT_CLK(NULL, "gpio1_dbclk", "l4-wkup-clkctrl:0018:8"),
++ DT_CLK(NULL, "gpio2_dbclk", "l4-per-clkctrl:0040:8"),
++ DT_CLK(NULL, "gpio3_dbclk", "l4-per-clkctrl:0048:8"),
++ DT_CLK(NULL, "gpio4_dbclk", "l4-per-clkctrl:0050:8"),
++ DT_CLK(NULL, "gpio5_dbclk", "l4-per-clkctrl:0058:8"),
++ DT_CLK(NULL, "gpio6_dbclk", "l4-per-clkctrl:0060:8"),
++ DT_CLK(NULL, "hsi_fck", "l3-init-clkctrl:0018:24"),
++ DT_CLK(NULL, "hsmmc1_fclk", "l3-init-clkctrl:0008:24"),
++ DT_CLK(NULL, "hsmmc2_fclk", "l3-init-clkctrl:0010:24"),
++ DT_CLK(NULL, "iss_ctrlclk", "iss-clkctrl:0000:8"),
++ DT_CLK(NULL, "mcasp_sync_mux_ck", "abe-clkctrl:0020:26"),
++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"),
++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"),
++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"),
++ DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4-per-clkctrl:00c0:26"),
++ DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3-init-clkctrl:00c0:8"),
++ DT_CLK(NULL, "otg_60m_gfclk", "l3-init-clkctrl:0040:24"),
++ DT_CLK(NULL, "per_mcbsp4_gfclk", "l4-per-clkctrl:00c0:24"),
++ DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu-sys-clkctrl:0000:20"),
++ DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu-sys-clkctrl:0000:22"),
++ DT_CLK(NULL, "sgx_clk_mux", "l3-gfx-clkctrl:0000:24"),
++ DT_CLK(NULL, "slimbus1_fclk_0", "abe-clkctrl:0040:8"),
++ DT_CLK(NULL, "slimbus1_fclk_1", "abe-clkctrl:0040:9"),
++ DT_CLK(NULL, "slimbus1_fclk_2", "abe-clkctrl:0040:10"),
++ DT_CLK(NULL, "slimbus1_slimbus_clk", "abe-clkctrl:0040:11"),
++ DT_CLK(NULL, "slimbus2_fclk_0", "l4-per-clkctrl:0118:8"),
++ DT_CLK(NULL, "slimbus2_fclk_1", "l4-per-clkctrl:0118:9"),
++ DT_CLK(NULL, "slimbus2_slimbus_clk", "l4-per-clkctrl:0118:10"),
++ DT_CLK(NULL, "stm_clk_div_ck", "emu-sys-clkctrl:0000:27"),
++ DT_CLK(NULL, "timer5_sync_mux", "abe-clkctrl:0048:24"),
++ DT_CLK(NULL, "timer6_sync_mux", "abe-clkctrl:0050:24"),
++ DT_CLK(NULL, "timer7_sync_mux", "abe-clkctrl:0058:24"),
++ DT_CLK(NULL, "timer8_sync_mux", "abe-clkctrl:0060:24"),
++ DT_CLK(NULL, "trace_clk_div_div_ck", "emu-sys-clkctrl:0000:24"),
++ DT_CLK(NULL, "usb_host_hs_func48mclk", "l3-init-clkctrl:0038:15"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3-init-clkctrl:0038:13"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3-init-clkctrl:0038:14"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3-init-clkctrl:0038:11"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3-init-clkctrl:0038:12"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3-init-clkctrl:0038:8"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3-init-clkctrl:0038:9"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init-clkctrl:0038:10"),
++ DT_CLK(NULL, "usb_otg_hs_xclk", "l3-init-clkctrl:0040:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3-init-clkctrl:0048:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3-init-clkctrl:0048:9"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3-init-clkctrl:0048:10"),
++ DT_CLK(NULL, "utmi_p1_gfclk", "l3-init-clkctrl:0038:24"),
++ DT_CLK(NULL, "utmi_p2_gfclk", "l3-init-clkctrl:0038:25"),
+ { .node_name = NULL },
+ };
+
+diff --git a/drivers/clk/ti/clk-54xx.c b/drivers/clk/ti/clk-54xx.c
+index 8694bc9f5fc7..04a5408085ac 100644
+--- a/drivers/clk/ti/clk-54xx.c
++++ b/drivers/clk/ti/clk-54xx.c
+@@ -50,7 +50,7 @@ static const struct omap_clkctrl_bit_data omap5_aess_bit_data[] __initconst = {
+ };
+
+ static const char * const omap5_dmic_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0018:26",
++ "abe-clkctrl:0018:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -70,7 +70,7 @@ static const struct omap_clkctrl_bit_data omap5_dmic_bit_data[] __initconst = {
+ };
+
+ static const char * const omap5_mcbsp1_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0028:26",
++ "abe-clkctrl:0028:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -83,7 +83,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp1_bit_data[] __initconst =
+ };
+
+ static const char * const omap5_mcbsp2_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0030:26",
++ "abe-clkctrl:0030:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -96,7 +96,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp2_bit_data[] __initconst =
+ };
+
+ static const char * const omap5_mcbsp3_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0038:26",
++ "abe-clkctrl:0038:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -136,16 +136,16 @@ static const struct omap_clkctrl_bit_data omap5_timer8_bit_data[] __initconst =
+
+ static const struct omap_clkctrl_reg_data omap5_abe_clkctrl_regs[] __initconst = {
+ { OMAP5_L4_ABE_CLKCTRL, NULL, 0, "abe_iclk" },
+- { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" },
++ { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" },
+ { OMAP5_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" },
+- { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" },
+- { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" },
+- { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" },
+- { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" },
+- { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" },
+- { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" },
+- { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" },
+- { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" },
++ { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" },
++ { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" },
++ { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" },
++ { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" },
++ { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" },
++ { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" },
++ { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" },
++ { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" },
+ { 0 },
+ };
+
+@@ -266,12 +266,12 @@ static const struct omap_clkctrl_bit_data omap5_gpio8_bit_data[] __initconst = {
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_l4per_clkctrl_regs[] __initconst = {
+- { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0008:24" },
+- { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0010:24" },
+- { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0018:24" },
+- { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0020:24" },
+- { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0028:24" },
+- { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0030:24" },
++ { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0008:24" },
++ { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0010:24" },
++ { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0018:24" },
++ { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0020:24" },
++ { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0028:24" },
++ { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0030:24" },
+ { OMAP5_GPIO2_CLKCTRL, omap5_gpio2_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+ { OMAP5_GPIO3_CLKCTRL, omap5_gpio3_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+ { OMAP5_GPIO4_CLKCTRL, omap5_gpio4_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+@@ -343,7 +343,7 @@ static const struct omap_clkctrl_bit_data omap5_dss_core_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_dss_clkctrl_regs[] __initconst = {
+- { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss_cm:clk:0000:8" },
++ { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss-clkctrl:0000:8" },
+ { 0 },
+ };
+
+@@ -376,7 +376,7 @@ static const struct omap_clkctrl_bit_data omap5_gpu_core_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_gpu_clkctrl_regs[] __initconst = {
+- { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu_cm:clk:0000:24" },
++ { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu-clkctrl:0000:24" },
+ { 0 },
+ };
+
+@@ -387,7 +387,7 @@ static const char * const omap5_mmc1_fclk_mux_parents[] __initconst = {
+ };
+
+ static const char * const omap5_mmc1_fclk_parents[] __initconst = {
+- "l3init_cm:clk:0008:24",
++ "l3init-clkctrl:0008:24",
+ NULL,
+ };
+
+@@ -403,7 +403,7 @@ static const struct omap_clkctrl_bit_data omap5_mmc1_bit_data[] __initconst = {
+ };
+
+ static const char * const omap5_mmc2_fclk_parents[] __initconst = {
+- "l3init_cm:clk:0010:24",
++ "l3init-clkctrl:0010:24",
+ NULL,
+ };
+
+@@ -428,12 +428,12 @@ static const char * const omap5_usb_host_hs_hsic480m_p3_clk_parents[] __initcons
+ };
+
+ static const char * const omap5_usb_host_hs_utmi_p1_clk_parents[] __initconst = {
+- "l3init_cm:clk:0038:24",
++ "l3init-clkctrl:0038:24",
+ NULL,
+ };
+
+ static const char * const omap5_usb_host_hs_utmi_p2_clk_parents[] __initconst = {
+- "l3init_cm:clk:0038:25",
++ "l3init-clkctrl:0038:25",
+ NULL,
+ };
+
+@@ -492,8 +492,8 @@ static const struct omap_clkctrl_bit_data omap5_usb_otg_ss_bit_data[] __initcons
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_l3init_clkctrl_regs[] __initconst = {
+- { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0008:25" },
+- { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0010:25" },
++ { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0008:25" },
++ { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0010:25" },
+ { OMAP5_USB_HOST_HS_CLKCTRL, omap5_usb_host_hs_bit_data, CLKF_SW_SUP, "l3init_60m_fclk" },
+ { OMAP5_USB_TLL_HS_CLKCTRL, omap5_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+ { OMAP5_SATA_CLKCTRL, omap5_sata_bit_data, CLKF_SW_SUP, "func_48m_fclk" },
+@@ -517,7 +517,7 @@ static const struct omap_clkctrl_reg_data omap5_wkupaon_clkctrl_regs[] __initcon
+ { OMAP5_L4_WKUP_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" },
+ { OMAP5_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { OMAP5_GPIO1_CLKCTRL, omap5_gpio1_bit_data, CLKF_HW_SUP, "wkupaon_iclk_mux" },
+- { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon_cm:clk:0020:24" },
++ { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon-clkctrl:0020:24" },
+ { OMAP5_COUNTER_32K_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" },
+ { OMAP5_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { 0 },
+@@ -547,58 +547,58 @@ const struct omap_clkctrl_data omap5_clkctrl_data[] __initconst = {
+ static struct ti_dt_clk omap54xx_clks[] = {
+ DT_CLK(NULL, "timer_32k_ck", "sys_32k_ck"),
+ DT_CLK(NULL, "sys_clkin_ck", "sys_clkin"),
+- DT_CLK(NULL, "dmic_gfclk", "abe_cm:0018:24"),
+- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"),
+- DT_CLK(NULL, "dss_32khz_clk", "dss_cm:0000:11"),
+- DT_CLK(NULL, "dss_48mhz_clk", "dss_cm:0000:9"),
+- DT_CLK(NULL, "dss_dss_clk", "dss_cm:0000:8"),
+- DT_CLK(NULL, "dss_sys_clk", "dss_cm:0000:10"),
+- DT_CLK(NULL, "gpio1_dbclk", "wkupaon_cm:0018:8"),
+- DT_CLK(NULL, "gpio2_dbclk", "l4per_cm:0040:8"),
+- DT_CLK(NULL, "gpio3_dbclk", "l4per_cm:0048:8"),
+- DT_CLK(NULL, "gpio4_dbclk", "l4per_cm:0050:8"),
+- DT_CLK(NULL, "gpio5_dbclk", "l4per_cm:0058:8"),
+- DT_CLK(NULL, "gpio6_dbclk", "l4per_cm:0060:8"),
+- DT_CLK(NULL, "gpio7_dbclk", "l4per_cm:00f0:8"),
+- DT_CLK(NULL, "gpio8_dbclk", "l4per_cm:00f8:8"),
+- DT_CLK(NULL, "mcbsp1_gfclk", "abe_cm:0028:24"),
+- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"),
+- DT_CLK(NULL, "mcbsp2_gfclk", "abe_cm:0030:24"),
+- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"),
+- DT_CLK(NULL, "mcbsp3_gfclk", "abe_cm:0038:24"),
+- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"),
+- DT_CLK(NULL, "mmc1_32khz_clk", "l3init_cm:0008:8"),
+- DT_CLK(NULL, "mmc1_fclk", "l3init_cm:0008:25"),
+- DT_CLK(NULL, "mmc1_fclk_mux", "l3init_cm:0008:24"),
+- DT_CLK(NULL, "mmc2_fclk", "l3init_cm:0010:25"),
+- DT_CLK(NULL, "mmc2_fclk_mux", "l3init_cm:0010:24"),
+- DT_CLK(NULL, "sata_ref_clk", "l3init_cm:0068:8"),
+- DT_CLK(NULL, "timer10_gfclk_mux", "l4per_cm:0008:24"),
+- DT_CLK(NULL, "timer11_gfclk_mux", "l4per_cm:0010:24"),
+- DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon_cm:0020:24"),
+- DT_CLK(NULL, "timer2_gfclk_mux", "l4per_cm:0018:24"),
+- DT_CLK(NULL, "timer3_gfclk_mux", "l4per_cm:0020:24"),
+- DT_CLK(NULL, "timer4_gfclk_mux", "l4per_cm:0028:24"),
+- DT_CLK(NULL, "timer5_gfclk_mux", "abe_cm:0048:24"),
+- DT_CLK(NULL, "timer6_gfclk_mux", "abe_cm:0050:24"),
+- DT_CLK(NULL, "timer7_gfclk_mux", "abe_cm:0058:24"),
+- DT_CLK(NULL, "timer8_gfclk_mux", "abe_cm:0060:24"),
+- DT_CLK(NULL, "timer9_gfclk_mux", "l4per_cm:0030:24"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init_cm:0038:13"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init_cm:0038:14"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init_cm:0038:7"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init_cm:0038:11"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init_cm:0038:12"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init_cm:0038:6"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init_cm:0038:8"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init_cm:0038:9"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init_cm:0038:10"),
+- DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init_cm:00d0:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init_cm:0048:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init_cm:0048:9"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init_cm:0048:10"),
+- DT_CLK(NULL, "utmi_p1_gfclk", "l3init_cm:0038:24"),
+- DT_CLK(NULL, "utmi_p2_gfclk", "l3init_cm:0038:25"),
++ DT_CLK(NULL, "dmic_gfclk", "abe-clkctrl:0018:24"),
++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"),
++ DT_CLK(NULL, "dss_32khz_clk", "dss-clkctrl:0000:11"),
++ DT_CLK(NULL, "dss_48mhz_clk", "dss-clkctrl:0000:9"),
++ DT_CLK(NULL, "dss_dss_clk", "dss-clkctrl:0000:8"),
++ DT_CLK(NULL, "dss_sys_clk", "dss-clkctrl:0000:10"),
++ DT_CLK(NULL, "gpio1_dbclk", "wkupaon-clkctrl:0018:8"),
++ DT_CLK(NULL, "gpio2_dbclk", "l4per-clkctrl:0040:8"),
++ DT_CLK(NULL, "gpio3_dbclk", "l4per-clkctrl:0048:8"),
++ DT_CLK(NULL, "gpio4_dbclk", "l4per-clkctrl:0050:8"),
++ DT_CLK(NULL, "gpio5_dbclk", "l4per-clkctrl:0058:8"),
++ DT_CLK(NULL, "gpio6_dbclk", "l4per-clkctrl:0060:8"),
++ DT_CLK(NULL, "gpio7_dbclk", "l4per-clkctrl:00f0:8"),
++ DT_CLK(NULL, "gpio8_dbclk", "l4per-clkctrl:00f8:8"),
++ DT_CLK(NULL, "mcbsp1_gfclk", "abe-clkctrl:0028:24"),
++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"),
++ DT_CLK(NULL, "mcbsp2_gfclk", "abe-clkctrl:0030:24"),
++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"),
++ DT_CLK(NULL, "mcbsp3_gfclk", "abe-clkctrl:0038:24"),
++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"),
++ DT_CLK(NULL, "mmc1_32khz_clk", "l3init-clkctrl:0008:8"),
++ DT_CLK(NULL, "mmc1_fclk", "l3init-clkctrl:0008:25"),
++ DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"),
++ DT_CLK(NULL, "mmc2_fclk", "l3init-clkctrl:0010:25"),
++ DT_CLK(NULL, "mmc2_fclk_mux", "l3init-clkctrl:0010:24"),
++ DT_CLK(NULL, "sata_ref_clk", "l3init-clkctrl:0068:8"),
++ DT_CLK(NULL, "timer10_gfclk_mux", "l4per-clkctrl:0008:24"),
++ DT_CLK(NULL, "timer11_gfclk_mux", "l4per-clkctrl:0010:24"),
++ DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon-clkctrl:0020:24"),
++ DT_CLK(NULL, "timer2_gfclk_mux", "l4per-clkctrl:0018:24"),
++ DT_CLK(NULL, "timer3_gfclk_mux", "l4per-clkctrl:0020:24"),
++ DT_CLK(NULL, "timer4_gfclk_mux", "l4per-clkctrl:0028:24"),
++ DT_CLK(NULL, "timer5_gfclk_mux", "abe-clkctrl:0048:24"),
++ DT_CLK(NULL, "timer6_gfclk_mux", "abe-clkctrl:0050:24"),
++ DT_CLK(NULL, "timer7_gfclk_mux", "abe-clkctrl:0058:24"),
++ DT_CLK(NULL, "timer8_gfclk_mux", "abe-clkctrl:0060:24"),
++ DT_CLK(NULL, "timer9_gfclk_mux", "l4per-clkctrl:0030:24"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init-clkctrl:0038:13"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init-clkctrl:0038:14"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init-clkctrl:0038:7"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init-clkctrl:0038:11"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init-clkctrl:0038:12"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init-clkctrl:0038:6"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init-clkctrl:0038:8"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init-clkctrl:0038:9"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init-clkctrl:0038:10"),
++ DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init-clkctrl:00d0:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init-clkctrl:0048:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init-clkctrl:0048:9"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init-clkctrl:0048:10"),
++ DT_CLK(NULL, "utmi_p1_gfclk", "l3init-clkctrl:0038:24"),
++ DT_CLK(NULL, "utmi_p2_gfclk", "l3init-clkctrl:0038:25"),
+ { .node_name = NULL },
+ };
+
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index 864c484bde1b..08a85c559f79 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -511,10 +511,6 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
+ char *c;
+ u16 soc_mask = 0;
+
+- if (!(ti_clk_get_features()->flags & TI_CLK_CLKCTRL_COMPAT) &&
+- of_node_name_eq(node, "clk"))
+- ti_clk_features.flags |= TI_CLK_CLKCTRL_COMPAT;
+-
+ addrp = of_get_address(node, 0, NULL, NULL);
+ addr = (u32)of_translate_address(node, addrp);
+
+--
+2.35.1
+
--- /dev/null
+From a0be869cb824f314176cc17cd287584a0b3a7838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 May 2022 16:02:41 +0800
+Subject: csky/kprobe: reclaim insn_slot on kprobe unregistration
+
+From: Liao Chang <liaochang1@huawei.com>
+
+[ Upstream commit a2310c74d418deca0f1d749c45f1f43162510f51 ]
+
+On kprobe registration kernel allocate one insn_slot for new kprobe,
+but it forget to reclaim the insn_slot on unregistration, leading to a
+potential leakage.
+
+Reported-by: Chen Guokai <chenguokai17@mails.ucas.ac.cn>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Liao Chang <liaochang1@huawei.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/kernel/probes/kprobes.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/csky/kernel/probes/kprobes.c b/arch/csky/kernel/probes/kprobes.c
+index 556b9ba61ec0..79272dde72db 100644
+--- a/arch/csky/kernel/probes/kprobes.c
++++ b/arch/csky/kernel/probes/kprobes.c
+@@ -124,6 +124,10 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)
+
+ void __kprobes arch_remove_kprobe(struct kprobe *p)
+ {
++ if (p->ainsn.api.insn) {
++ free_insn_slot(p->ainsn.api.insn, 0);
++ p->ainsn.api.insn = NULL;
++ }
+ }
+
+ static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
+--
+2.35.1
+
--- /dev/null
+From 0701f4035ce9aa6b293ee449e065b9eb6ed764bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jul 2022 21:14:48 +0200
+Subject: cxl: Fix a memory leak in an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3a15b45b5454da862376b5d69a4967f5c6fa1368 ]
+
+A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the
+error handling path of afu_allocate_irqs().
+
+Acked-by: Andrew Donnellan <ajd@linux.ibm.com>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/ce5869418f5838187946eb6b11a52715a93ece3d.1657566849.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/cxl/irq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
+index 4cb829d5d873..2e4dcfebf19a 100644
+--- a/drivers/misc/cxl/irq.c
++++ b/drivers/misc/cxl/irq.c
+@@ -349,6 +349,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count)
+
+ out:
+ cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter);
++ bitmap_free(ctx->irq_bitmap);
+ afu_irq_name_free(ctx);
+ return -ENOMEM;
+ }
+--
+2.35.1
+
--- /dev/null
+From 566f57ae00edcd9d9002d6013e4601191b1ce47a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jul 2022 22:40:54 +0200
+Subject: dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync()
+ failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 1e42f82cbec7b2cc4873751e7791e6611901c5fc ]
+
+It's not allowed to quit remove early without cleaning up completely.
+Otherwise this results in resource leaks that probably yield graver
+problems later. Here for example some tasklets might survive the lifetime
+of the sprd-dma device and access sdev which is freed after .remove()
+returns.
+
+As none of the device freeing requires an active device, just ignore the
+return value of pm_runtime_get_sync().
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Baolin Wang <baolin.wang7@gmail.com>
+Link: https://lore.kernel.org/r/20220721204054.323602-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sprd-dma.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 4357d2395e6b..60115d8d4083 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -1236,11 +1236,8 @@ static int sprd_dma_remove(struct platform_device *pdev)
+ {
+ struct sprd_dma_dev *sdev = platform_get_drvdata(pdev);
+ struct sprd_dma_chn *c, *cn;
+- int ret;
+
+- ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ pm_runtime_get_sync(&pdev->dev);
+
+ /* explicitly free the irq */
+ if (sdev->irq > 0)
+--
+2.35.1
+
--- /dev/null
+From e006c5eed7642642760642042f44c2752034eb8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 19:39:19 +0800
+Subject: drivers:md:fix a potential use-after-free bug
+
+From: Wentao_Liang <Wentao_Liang_g@163.com>
+
+[ Upstream commit 104212471b1c1817b311771d817fb692af983173 ]
+
+In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
+may cause sh to be released. However, sh is subsequently used in lines
+2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
+use-after-free bug.
+
+It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
+the function.
+
+Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c8cafdb094aa..01c7edf32936 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2864,10 +2864,10 @@ static void raid5_end_write_request(struct bio *bi)
+ if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags))
+ clear_bit(R5_LOCKED, &sh->dev[i].flags);
+ set_bit(STRIPE_HANDLE, &sh->state);
+- raid5_release_stripe(sh);
+
+ if (sh->batch_head && sh != sh->batch_head)
+ raid5_release_stripe(sh->batch_head);
++ raid5_release_stripe(sh);
+ }
+
+ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
+--
+2.35.1
+
--- /dev/null
+From 1c8fde9d3c3fb935d52ec9bb2ecdb3af5ac0fdbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 May 2022 22:14:13 +0530
+Subject: drm/meson: Fix overflow implicit truncation warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+
+[ Upstream commit 98692f52c588225034cbff458622c2c06dfcb544 ]
+
+Fix -Woverflow warnings for drm/meson driver which is a result
+of moving arm64 custom MMIO accessor macros to asm-generic function
+implementations giving a bonus type-checking now and uncovering these
+overflow warnings.
+
+drivers/gpu/drm/meson/meson_viu.c: In function ‘meson_viu_init’:
+drivers/gpu/drm/meson/meson_registers.h:1826:48: error: large integer implicitly truncated to unsigned type [-Werror=overflow]
+ #define VIU_OSD_BLEND_REORDER(dest, src) ((src) << (dest * 4))
+ ^
+drivers/gpu/drm/meson/meson_viu.c:472:18: note: in expansion of macro ‘VIU_OSD_BLEND_REORDER’
+ writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) |
+ ^~~~~~~~~~~~~~~~~~~~~
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_viu.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
+index 259f3e6bec90..bb7e109534de 100644
+--- a/drivers/gpu/drm/meson/meson_viu.c
++++ b/drivers/gpu/drm/meson/meson_viu.c
+@@ -469,17 +469,17 @@ void meson_viu_init(struct meson_drm *priv)
+ priv->io_base + _REG(VD2_IF0_LUMA_FIFO_SIZE));
+
+ if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) {
+- writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) |
+- VIU_OSD_BLEND_REORDER(1, 0) |
+- VIU_OSD_BLEND_REORDER(2, 0) |
+- VIU_OSD_BLEND_REORDER(3, 0) |
+- VIU_OSD_BLEND_DIN_EN(1) |
+- VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 |
+- VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 |
+- VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 |
+- VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) |
+- VIU_OSD_BLEND_HOLD_LINES(4),
+- priv->io_base + _REG(VIU_OSD_BLEND_CTRL));
++ u32 val = (u32)VIU_OSD_BLEND_REORDER(0, 1) |
++ (u32)VIU_OSD_BLEND_REORDER(1, 0) |
++ (u32)VIU_OSD_BLEND_REORDER(2, 0) |
++ (u32)VIU_OSD_BLEND_REORDER(3, 0) |
++ (u32)VIU_OSD_BLEND_DIN_EN(1) |
++ (u32)VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 |
++ (u32)VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 |
++ (u32)VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 |
++ (u32)VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) |
++ (u32)VIU_OSD_BLEND_HOLD_LINES(4);
++ writel_relaxed(val, priv->io_base + _REG(VIU_OSD_BLEND_CTRL));
+
+ writel_relaxed(OSD_BLEND_PATH_SEL_ENABLE,
+ priv->io_base + _REG(OSD1_BLEND_SRC_CTRL));
+--
+2.35.1
+
--- /dev/null
+From e6258bf26f3f1abdb4451e3f598c5bba19d1e930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jul 2022 09:07:22 +0800
+Subject: drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 91b3c8dbe898df158fd2a84675f3a284ff6666f7 ]
+
+In this function, there are two refcount leak bugs:
+(1) when breaking out of for_each_endpoint_of_node(), we need call
+the of_node_put() for the 'ep';
+(2) we should call of_node_put() for the reference returned by
+of_graph_get_remote_port() when it is not used anymore.
+
+Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")
+Signed-off-by: Liang He <windhl@126.com>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220726010722.1319416-1-windhl@126.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 728fea509412..2d022f3fb437 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -116,8 +116,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev)
+ for_each_endpoint_of_node(dev->of_node, ep) {
+ /* If the endpoint node exists, consider it enabled */
+ remote = of_graph_get_remote_port(ep);
+- if (remote)
++ if (remote) {
++ of_node_put(remote);
++ of_node_put(ep);
+ return true;
++ }
+ }
+
+ return false;
+--
+2.35.1
+
--- /dev/null
+From 3c12efb4f88a5c8ab2d0aaa33f60ccd8e7c8f5b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Aug 2022 22:16:23 -0500
+Subject: drm/sun4i: dsi: Prevent underflow when computing packet sizes
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 82a1356a933d8443139f8886f11b63c974a09a67 ]
+
+Currently, the packet overhead is subtracted using unsigned arithmetic.
+With a short sync pulse, this could underflow and wrap around to near
+the maximal u16 value. Fix this by using signed subtraction. The call to
+max() will correctly handle any negative numbers that are produced.
+
+Apply the same fix to the other timings, even though those subtractions
+are less likely to underflow.
+
+Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support")
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20220812031623.34057-1-samuel@sholland.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index 4f5efcace68e..51edb4244af7 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -531,7 +531,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ struct drm_display_mode *mode)
+ {
+ struct mipi_dsi_device *device = dsi->device;
+- unsigned int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8;
++ int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8;
+ u16 hbp = 0, hfp = 0, hsa = 0, hblk = 0, vblk = 0;
+ u32 basic_ctl = 0;
+ size_t bytes;
+@@ -555,7 +555,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * (4 bytes). Its minimal size is therefore 10 bytes
+ */
+ #define HSA_PACKET_OVERHEAD 10
+- hsa = max((unsigned int)HSA_PACKET_OVERHEAD,
++ hsa = max(HSA_PACKET_OVERHEAD,
+ (mode->hsync_end - mode->hsync_start) * Bpp - HSA_PACKET_OVERHEAD);
+
+ /*
+@@ -564,7 +564,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * therefore 6 bytes
+ */
+ #define HBP_PACKET_OVERHEAD 6
+- hbp = max((unsigned int)HBP_PACKET_OVERHEAD,
++ hbp = max(HBP_PACKET_OVERHEAD,
+ (mode->htotal - mode->hsync_end) * Bpp - HBP_PACKET_OVERHEAD);
+
+ /*
+@@ -574,7 +574,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * 16 bytes
+ */
+ #define HFP_PACKET_OVERHEAD 16
+- hfp = max((unsigned int)HFP_PACKET_OVERHEAD,
++ hfp = max(HFP_PACKET_OVERHEAD,
+ (mode->hsync_start - mode->hdisplay) * Bpp - HFP_PACKET_OVERHEAD);
+
+ /*
+@@ -583,7 +583,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * bytes). Its minimal size is therefore 10 bytes.
+ */
+ #define HBLK_PACKET_OVERHEAD 10
+- hblk = max((unsigned int)HBLK_PACKET_OVERHEAD,
++ hblk = max(HBLK_PACKET_OVERHEAD,
+ (mode->htotal - (mode->hsync_end - mode->hsync_start)) * Bpp -
+ HBLK_PACKET_OVERHEAD);
+
+--
+2.35.1
+
--- /dev/null
+From 87f22331a85e64cc3e8e95834949cc075624c0cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jun 2022 17:02:23 +0800
+Subject: ext4: avoid remove directory when directory is corrupted
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a ]
+
+Now if check directoy entry is corrupted, ext4_empty_dir may return true
+then directory will be removed when file system mounted with "errors=continue".
+In order not to make things worse just return false when directory is corrupted.
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220622090223.682234-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/namei.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index afc20d32c9fd..58b0f1b12095 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -2961,11 +2961,8 @@ bool ext4_empty_dir(struct inode *inode)
+ de = (struct ext4_dir_entry_2 *) (bh->b_data +
+ (offset & (sb->s_blocksize - 1)));
+ if (ext4_check_dir_entry(inode, NULL, de, bh,
+- bh->b_data, bh->b_size, offset)) {
+- offset = (offset | (sb->s_blocksize - 1)) + 1;
+- continue;
+- }
+- if (le32_to_cpu(de->inode)) {
++ bh->b_data, bh->b_size, offset) ||
++ le32_to_cpu(de->inode)) {
+ brelse(bh);
+ return false;
+ }
+--
+2.35.1
+
--- /dev/null
+From 095ed774b21d7440ab34c799489849888ac92223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jul 2022 04:27:48 +0000
+Subject: ext4: avoid resizing to a partial cluster size
+
+From: Kiselev, Oleg <okiselev@amazon.com>
+
+[ Upstream commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd ]
+
+This patch avoids an attempt to resize the filesystem to an
+unaligned cluster boundary. An online resize to a size that is not
+integral to cluster size results in the last iteration attempting to
+grow the fs by a negative amount, which trips a BUG_ON and leaves the fs
+with a corrupted in-memory superblock.
+
+Signed-off-by: Oleg Kiselev <okiselev@amazon.com>
+Link: https://lore.kernel.org/r/0E92A0AB-4F16-4F1A-94B7-702CC6504FDE@amazon.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/resize.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 5cfea77f3322..f6409ddfd117 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1957,6 +1957,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ }
+ brelse(bh);
+
++ /*
++ * For bigalloc, trim the requested size to the nearest cluster
++ * boundary to avoid creating an unusable filesystem. We do this
++ * silently, instead of returning an error, to avoid breaking
++ * callers that blindly resize the filesystem to the full size of
++ * the underlying block device.
++ */
++ if (ext4_has_feature_bigalloc(sb))
++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1);
++
+ retry:
+ o_blocks_count = ext4_blocks_count(es);
+
+--
+2.35.1
+
--- /dev/null
+From f2a52ae3ee69cb96fb2e0d87bb3ac6b9106154d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jul 2022 00:03:23 +0800
+Subject: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
+
+From: Chao Yu <chao.yu@oppo.com>
+
+[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ]
+
+As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller
+found a f2fs bug as below:
+
+RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295
+Call Trace:
+ write_all_xattrs fs/f2fs/xattr.c:487 [inline]
+ __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743
+ f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790
+ f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
+ __vfs_setxattr+0x115/0x180 fs/xattr.c:182
+ __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
+ __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277
+ vfs_setxattr+0x13f/0x330 fs/xattr.c:303
+ setxattr+0x146/0x160 fs/xattr.c:611
+ path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
+ __do_sys_lsetxattr fs/xattr.c:653 [inline]
+ __se_sys_lsetxattr fs/xattr.c:649 [inline]
+ __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+NAT entry and nat bitmap can be inconsistent, e.g. one nid is free
+in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it
+may trigger BUG_ON() in f2fs_new_node_page(), fix it.
+
+Reported-by: Dipanjan Das <mail.dipanjan.das@gmail.com>
+Signed-off-by: Chao Yu <chao.yu@oppo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 5fa10d0b0068..c63274d4b74b 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1238,7 +1238,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)
+ dec_valid_node_count(sbi, dn->inode, !ofs);
+ goto fail;
+ }
+- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR);
++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) {
++ err = -EFSCORRUPTED;
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ goto fail;
++ }
+ #endif
+ new_ni.nid = dn->nid;
+ new_ni.ino = dn->inode->i_ino;
+--
+2.35.1
+
--- /dev/null
+From e1f722b4811137c27e90d1fda233bddf25d0e623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jul 2022 22:51:05 +0800
+Subject: f2fs: fix to do sanity check on segment type in build_sit_entries()
+
+From: Chao Yu <chao.yu@oppo.com>
+
+[ Upstream commit 09beadf289d6e300553e60d6e76f13c0427ecab3 ]
+
+As Wenqing Liu <wenqingliu0120@gmail.com> reported in bugzilla:
+
+https://bugzilla.kernel.org/show_bug.cgi?id=216285
+
+RIP: 0010:memcpy_erms+0x6/0x10
+ f2fs_update_meta_page+0x84/0x570 [f2fs]
+ change_curseg.constprop.0+0x159/0xbd0 [f2fs]
+ f2fs_do_replace_block+0x5c7/0x18a0 [f2fs]
+ f2fs_replace_block+0xeb/0x180 [f2fs]
+ recover_data+0x1abd/0x6f50 [f2fs]
+ f2fs_recover_fsync_data+0x12ce/0x3250 [f2fs]
+ f2fs_fill_super+0x4459/0x6190 [f2fs]
+ mount_bdev+0x2cf/0x3b0
+ legacy_get_tree+0xed/0x1d0
+ vfs_get_tree+0x81/0x2b0
+ path_mount+0x47e/0x19d0
+ do_mount+0xce/0xf0
+ __x64_sys_mount+0x12c/0x1a0
+ do_syscall_64+0x38/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+The root cause is segment type is invalid, so in f2fs_do_replace_block(),
+f2fs accesses f2fs_sm_info::curseg_array with out-of-range segment type,
+result in accessing invalid curseg->sum_blk during memcpy in
+f2fs_update_meta_page(). Fix this by adding sanity check on segment type
+in build_sit_entries().
+
+Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
+Signed-off-by: Chao Yu <chao.yu@oppo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 20091f4cf84d..19224e7d2ad0 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -4449,6 +4449,12 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ return err;
+ seg_info_from_raw_sit(se, &sit);
+
++ if (se->type >= NR_PERSISTENT_LOG) {
++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u",
++ se->type, start);
++ return -EFSCORRUPTED;
++ }
++
+ sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks;
+
+ /* build discard map only one time */
+@@ -4495,6 +4501,13 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ break;
+ seg_info_from_raw_sit(se, &sit);
+
++ if (se->type >= NR_PERSISTENT_LOG) {
++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u",
++ se->type, start);
++ err = -EFSCORRUPTED;
++ break;
++ }
++
+ sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks;
+
+ if (is_set_ckpt_flags(sbi, CP_TRIMMED_FLAG)) {
+--
+2.35.1
+
--- /dev/null
+From 6365e39f65c8a3ab994250fd1fdb46e0bc0a621c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 09:06:44 +0200
+Subject: gadgetfs: ep_io - wait until IRQ finishes
+
+From: Jozef Martiniak <jomajm@gmail.com>
+
+[ Upstream commit 04cb742d4d8f30dc2e83b46ac317eec09191c68e ]
+
+after usb_ep_queue() if wait_for_completion_interruptible() is
+interrupted we need to wait until IRQ gets finished.
+
+Otherwise complete() from epio_complete() can corrupt stack.
+
+Signed-off-by: Jozef Martiniak <jomajm@gmail.com>
+Link: https://lore.kernel.org/r/20220708070645.6130-1-jomajm@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/legacy/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 454860d52ce7..cd097474b6c3 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -362,6 +362,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
+ spin_unlock_irq (&epdata->dev->lock);
+
+ DBG (epdata->dev, "endpoint gone\n");
++ wait_for_completion(&done);
+ epdata->status = -ENODEV;
+ }
+ }
+--
+2.35.1
+
--- /dev/null
+From aee61adf68e079dd882aec1e8029ef1a568e5a36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 May 2022 22:14:12 +0530
+Subject: irqchip/tegra: Fix overflow implicit truncation warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+
+[ Upstream commit 443685992bda9bb4f8b17fc02c9f6c60e62b1461 ]
+
+Fix -Woverflow warnings for tegra irqchip driver which is a result
+of moving arm64 custom MMIO accessor macros to asm-generic function
+implementations giving a bonus type-checking now and uncovering these
+overflow warnings.
+
+drivers/irqchip/irq-tegra.c: In function ‘tegra_ictlr_suspend’:
+drivers/irqchip/irq-tegra.c:151:18: warning: large integer implicitly truncated to unsigned type [-Woverflow]
+ writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
+ ^
+
+Suggested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-tegra.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c
+index e1f771c72fc4..ad3e2c1b3c87 100644
+--- a/drivers/irqchip/irq-tegra.c
++++ b/drivers/irqchip/irq-tegra.c
+@@ -148,10 +148,10 @@ static int tegra_ictlr_suspend(void)
+ lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS);
+
+ /* Disable COP interrupts */
+- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR);
+
+ /* Disable CPU interrupts */
+- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR);
+
+ /* Enable the wakeup sources of ictlr */
+ writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET);
+@@ -172,12 +172,12 @@ static void tegra_ictlr_resume(void)
+
+ writel_relaxed(lic->cpu_iep[i],
+ ictlr + ICTLR_CPU_IEP_CLASS);
+- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR);
+ writel_relaxed(lic->cpu_ier[i],
+ ictlr + ICTLR_CPU_IER_SET);
+ writel_relaxed(lic->cop_iep[i],
+ ictlr + ICTLR_COP_IEP_CLASS);
+- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR);
+ writel_relaxed(lic->cop_ier[i],
+ ictlr + ICTLR_COP_IER_SET);
+ }
+@@ -312,7 +312,7 @@ static int __init tegra_ictlr_init(struct device_node *node,
+ lic->base[i] = base;
+
+ /* Disable all interrupts */
+- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR);
+ /* All interrupts target IRQ */
+ writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS);
+
+--
+2.35.1
+
--- /dev/null
+From da3c993e750981fef050ccf411bdd794aab6dd63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 May 2022 15:29:51 -0700
+Subject: lib/list_debug.c: Detect uninitialized lists
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 0cc011c576aaa4de505046f7a6c90933d7c749a9 ]
+
+In some circumstances, attempts are made to add entries to or to remove
+entries from an uninitialized list. A prime example is
+amdgpu_bo_vm_destroy(): It is indirectly called from
+ttm_bo_init_reserved() if that function fails, and tries to remove an
+entry from a list. However, that list is only initialized in
+amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned
+success. This results in crashes such as
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5
+ Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020
+ RIP: 0010:__list_del_entry_valid+0x26/0x7d
+ ...
+ Call Trace:
+ amdgpu_bo_vm_destroy+0x48/0x8b
+ ttm_bo_init_reserved+0x1d7/0x1e0
+ amdgpu_bo_create+0x212/0x476
+ ? amdgpu_bo_user_destroy+0x23/0x23
+ ? kmem_cache_alloc+0x60/0x271
+ amdgpu_bo_create_vm+0x40/0x7d
+ amdgpu_vm_pt_create+0xe8/0x24b
+ ...
+
+Check if the list's prev and next pointers are NULL to catch such problems.
+
+Link: https://lkml.kernel.org/r/20220531222951.92073-1-linux@roeck-us.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/list_debug.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/lib/list_debug.c b/lib/list_debug.c
+index 5d5424b51b74..413daa72a3d8 100644
+--- a/lib/list_debug.c
++++ b/lib/list_debug.c
+@@ -20,7 +20,11 @@
+ bool __list_add_valid(struct list_head *new, struct list_head *prev,
+ struct list_head *next)
+ {
+- if (CHECK_DATA_CORRUPTION(next->prev != prev,
++ if (CHECK_DATA_CORRUPTION(prev == NULL,
++ "list_add corruption. prev is NULL.\n") ||
++ CHECK_DATA_CORRUPTION(next == NULL,
++ "list_add corruption. next is NULL.\n") ||
++ CHECK_DATA_CORRUPTION(next->prev != prev,
+ "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n",
+ prev, next->prev, next) ||
+ CHECK_DATA_CORRUPTION(prev->next != next,
+@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry)
+ prev = entry->prev;
+ next = entry->next;
+
+- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1,
++ if (CHECK_DATA_CORRUPTION(next == NULL,
++ "list_del corruption, %px->next is NULL\n", entry) ||
++ CHECK_DATA_CORRUPTION(prev == NULL,
++ "list_del corruption, %px->prev is NULL\n", entry) ||
++ CHECK_DATA_CORRUPTION(next == LIST_POISON1,
+ "list_del corruption, %px->next is LIST_POISON1 (%px)\n",
+ entry, LIST_POISON1) ||
+ CHECK_DATA_CORRUPTION(prev == LIST_POISON2,
+--
+2.35.1
+
--- /dev/null
+From aef996f2e811fa2e8c123f09d181a9e3c9170ba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jun 2022 10:27:56 -0600
+Subject: md: Notify sysfs sync_completed in md_reap_sync_thread()
+
+From: Logan Gunthorpe <logang@deltatee.com>
+
+[ Upstream commit 9973f0fa7d20269fe6fefe6333997fb5914449c1 ]
+
+The mdadm test 07layouts randomly produces a kernel hung task deadlock.
+The deadlock is caused by the suspend_lo/suspend_hi files being set by
+the mdadm background process during reshape and not being cleared
+because the process hangs. (Leaving aside the issue of the fragility of
+freezing kernel tasks by buggy userspace processes...)
+
+When the background mdadm process hangs it, is waiting (without a
+timeout) on a change to the sync_completed file signalling that the
+reshape has completed. The process is woken up a couple times when
+the reshape finishes but it is woken up before MD_RECOVERY_RUNNING
+is cleared so sync_completed_show() reports 0 instead of "none".
+
+To fix this, notify the sysfs file in md_reap_sync_thread() after
+MD_RECOVERY_RUNNING has been cleared. This wakes up mdadm and causes
+it to continue and write to suspend_lo/suspend_hi to allow IO to
+continue.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 4463ef3e3729..884317ee1759 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9424,6 +9424,7 @@ void md_reap_sync_thread(struct mddev *mddev)
+ wake_up(&resync_wait);
+ /* flag recovery needed just to double check */
+ set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
++ sysfs_notify_dirent_safe(mddev->sysfs_completed);
+ sysfs_notify_dirent_safe(mddev->sysfs_action);
+ md_new_event(mddev);
+ if (mddev->event_work.func)
+--
+2.35.1
+
--- /dev/null
+From 5627e989dcd1b571cc4edc0177e5e8313a5e01ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 20:41:12 +0800
+Subject: mips: cavium-octeon: Fix missing of_node_put() in
+ octeon2_usb_clocks_start
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 7a9f743ceead60ed454c46fbc3085ee9a79cbebb ]
+
+We should call of_node_put() for the reference 'uctl_node' returned by
+of_get_parent() which will increase the refcount. Otherwise, there will
+be a refcount leak bug.
+
+Signed-off-by: Liang He <windhl@126.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/octeon-platform.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index a994022e32c9..ce05c0dd3acd 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev)
+ "refclk-frequency", &clock_rate);
+ if (i) {
+ dev_err(dev, "No UCTL \"refclk-frequency\"\n");
++ of_node_put(uctl_node);
+ goto exit;
+ }
+ i = of_property_read_string(uctl_node,
+ "refclk-type", &clock_type);
+-
++ of_node_put(uctl_node);
+ if (!i && strcmp("crystal", clock_type) == 0)
+ is_crystal_clock = true;
+ }
+--
+2.35.1
+
--- /dev/null
+From bce536be5cf49cd84af26f17c40a30754f618f2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Aug 2022 10:59:36 -0700
+Subject: MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 ]
+
+When CONFIG_XPA is enabled, Clang warns:
+
+ arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context]
+ if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
+ ^
+ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC'
+ # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT)
+ ^
+ arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context]
+ if (!cpu_has_rixi || !_PAGE_NO_EXEC) {
+ ^
+ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC'
+ # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT)
+ ^
+ 2 errors generated.
+
+_PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the
+build and runtime configuration, which is what the negation operators
+are trying to convey. To silence the warning, explicitly compare against
+0 so the result of the '<<' operator is not implicitly converted to a
+boolean.
+
+According to its documentation, GCC enables -Wint-in-bool-context with
+-Wall but this warning is not visible when building the same
+configuration with GCC. It appears GCC only warns when compiling C++,
+not C, although the documentation makes no note of this:
+https://godbolt.org/z/x39q3brxf
+
+Reported-by: Sudip Mukherjee (Codethink) <sudipm.mukherjee@gmail.com>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/tlbex.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index a7521b8f7658..e8e3635dda09 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -633,7 +633,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
+ return;
+ }
+
+- if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) {
+ if (fill_includes_sw_bits) {
+ UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL));
+ } else {
+@@ -2572,7 +2572,7 @@ static void check_pabits(void)
+ unsigned long entry;
+ unsigned pabits, fillbits;
+
+- if (!cpu_has_rixi || !_PAGE_NO_EXEC) {
++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) {
+ /*
+ * We'll only be making use of the fact that we can rotate bits
+ * into the fill if the CPU supports RIXI, so don't bother
+--
+2.35.1
+
--- /dev/null
+From 1051a2550572375dccaea8d11af7ca1b22b112ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 11:44:54 +0200
+Subject: modules: Ensure natural alignment for .altinstructions and
+ __bug_table sections
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 87c482bdfa79f378297d92af49cdf265be199df5 ]
+
+In the kernel image vmlinux.lds.S linker scripts the .altinstructions
+and __bug_table sections are 4- or 8-byte aligned because they hold 32-
+and/or 64-bit values.
+
+Most architectures use altinstructions and BUG() or WARN() in modules as
+well, but in the module linker script (module.lds.S) those sections are
+currently missing. As consequence the linker will store their content
+byte-aligned by default, which then can lead to unnecessary unaligned
+memory accesses by the CPU when those tables are processed at runtime.
+
+Usually unaligned memory accesses are unnoticed, because either the
+hardware (as on x86 CPUs) or in-kernel exception handlers (e.g. on
+parisc or sparc) emulate and fix them up at runtime. Nevertheless, such
+unaligned accesses introduce a performance penalty and can even crash
+the kernel if there is a bug in the unalignment exception handlers
+(which happened once to me on the parisc architecture and which is why I
+noticed that issue at all).
+
+This patch fixes a non-critical issue and might be backported at any time.
+It's trivial and shouldn't introduce any regression because it simply
+tells the linker to use a different (8-byte alignment) for those
+sections by default.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Link: https://lore.kernel.org/all/Yr8%2Fgr8e8I7tVX4d@p100/
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/module.lds.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/module.lds.S b/scripts/module.lds.S
+index c5f12195817b..2c510db6c2ed 100644
+--- a/scripts/module.lds.S
++++ b/scripts/module.lds.S
+@@ -22,6 +22,8 @@ SECTIONS {
+
+ .init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) }
+
++ .altinstructions 0 : ALIGN(8) { KEEP(*(.altinstructions)) }
++ __bug_table 0 : ALIGN(8) { KEEP(*(__bug_table)) }
+ __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) }
+
+ __patchable_function_entries : { *(__patchable_function_entries) }
+--
+2.35.1
+
--- /dev/null
+From 2ebfe16ff9dd9685892eb367918d9f26699b4c80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Mar 2021 16:58:37 +0200
+Subject: netfilter: add helper function to set up the nfnetlink header and use
+ it
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 19c28b1374fb1073a9ec873a6c10bf5f16b10b9d ]
+
+This patch adds a helper function to set up the netlink and nfnetlink headers.
+Update existing codebase to use it.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nfnetlink.h | 27 +++++++
+ net/netfilter/ipset/ip_set_core.c | 17 +----
+ net/netfilter/nf_conntrack_netlink.c | 77 ++++++--------------
+ net/netfilter/nf_tables_api.c | 102 +++++++--------------------
+ net/netfilter/nf_tables_trace.c | 9 +--
+ net/netfilter/nfnetlink_acct.c | 11 +--
+ net/netfilter/nfnetlink_cthelper.c | 11 +--
+ net/netfilter/nfnetlink_cttimeout.c | 22 ++----
+ net/netfilter/nfnetlink_log.c | 11 +--
+ net/netfilter/nfnetlink_queue.c | 12 ++--
+ net/netfilter/nft_compat.c | 11 +--
+ 11 files changed, 102 insertions(+), 208 deletions(-)
+
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index f6267e2883f2..791d516e1e88 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -57,6 +57,33 @@ static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
+ return subsys << 8 | msg_type;
+ }
+
++static inline void nfnl_fill_hdr(struct nlmsghdr *nlh, u8 family, u8 version,
++ __be16 res_id)
++{
++ struct nfgenmsg *nfmsg;
++
++ nfmsg = nlmsg_data(nlh);
++ nfmsg->nfgen_family = family;
++ nfmsg->version = version;
++ nfmsg->res_id = res_id;
++}
++
++static inline struct nlmsghdr *nfnl_msg_put(struct sk_buff *skb, u32 portid,
++ u32 seq, int type, int flags,
++ u8 family, u8 version,
++ __be16 res_id)
++{
++ struct nlmsghdr *nlh;
++
++ nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
++ if (!nlh)
++ return NULL;
++
++ nfnl_fill_hdr(nlh, family, version, res_id);
++
++ return nlh;
++}
++
+ void nfnl_lock(__u8 subsys_id);
+ void nfnl_unlock(__u8 subsys_id);
+ #ifdef CONFIG_PROVE_LOCKING
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 2b19189a930f..c17a7dda0163 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -963,20 +963,9 @@ static struct nlmsghdr *
+ start_msg(struct sk_buff *skb, u32 portid, u32 seq, unsigned int flags,
+ enum ipset_cmd cmd)
+ {
+- struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+-
+- nlh = nlmsg_put(skb, portid, seq, nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd),
+- sizeof(*nfmsg), flags);
+- if (!nlh)
+- return NULL;
+-
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = NFPROTO_IPV4;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+- return nlh;
++ return nfnl_msg_put(skb, portid, seq,
++ nfnl_msg_type(NFNL_SUBSYS_IPSET, cmd), flags,
++ NFPROTO_IPV4, NFNETLINK_V0, 0);
+ }
+
+ /* Create a set */
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index eeeaa34b3e7b..9e6898164199 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -553,22 +553,17 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ {
+ const struct nf_conntrack_zone *zone;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct nlattr *nest_parms;
+ unsigned int event;
+
+ if (portid)
+ flags |= NLM_F_MULTI;
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_NEW);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, nf_ct_l3num(ct),
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = nf_ct_l3num(ct);
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ zone = nf_ct_zone(ct);
+
+ nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG);
+@@ -711,7 +706,6 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
+ const struct nf_conntrack_zone *zone;
+ struct net *net;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct nlattr *nest_parms;
+ struct nf_conn *ct = item->ct;
+ struct sk_buff *skb;
+@@ -741,15 +735,11 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
+ goto errout;
+
+ type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, type);
+- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags, nf_ct_l3num(ct),
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = nf_ct_l3num(ct);
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ zone = nf_ct_zone(ct);
+
+ nest_parms = nla_nest_start(skb, CTA_TUPLE_ORIG);
+@@ -2483,20 +2473,15 @@ ctnetlink_ct_stat_cpu_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
+ __u16 cpu, const struct ip_conntrack_stat *st)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0, event;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK,
+ IPCTNL_MSG_CT_GET_STATS_CPU);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, htons(cpu));
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(cpu);
+-
+ if (nla_put_be32(skb, CTA_STATS_FOUND, htonl(st->found)) ||
+ nla_put_be32(skb, CTA_STATS_INVALID, htonl(st->invalid)) ||
+ nla_put_be32(skb, CTA_STATS_INSERT, htonl(st->insert)) ||
+@@ -2568,20 +2553,15 @@ ctnetlink_stat_ct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ struct net *net)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0, event;
+ unsigned int nr_conntracks = atomic_read(&net->ct.count);
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK, IPCTNL_MSG_CT_GET_STATS);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_be32(skb, CTA_STATS_GLOBAL_ENTRIES, htonl(nr_conntracks)))
+ goto nla_put_failure;
+
+@@ -3085,19 +3065,14 @@ ctnetlink_exp_fill_info(struct sk_buff *skb, u32 portid, u32 seq,
+ int event, const struct nf_conntrack_expect *exp)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags,
++ exp->tuple.src.l3num, NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = exp->tuple.src.l3num;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (ctnetlink_exp_dump_expect(skb, exp) < 0)
+ goto nla_put_failure;
+
+@@ -3117,7 +3092,6 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
+ struct nf_conntrack_expect *exp = item->exp;
+ struct net *net = nf_ct_exp_net(exp);
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct sk_buff *skb;
+ unsigned int type, group;
+ int flags = 0;
+@@ -3140,15 +3114,11 @@ ctnetlink_expect_event(unsigned int events, struct nf_exp_event *item)
+ goto errout;
+
+ type = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_EXP, type);
+- nlh = nlmsg_put(skb, item->portid, 0, type, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, item->portid, 0, type, flags,
++ exp->tuple.src.l3num, NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = exp->tuple.src.l3num;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (ctnetlink_exp_dump_expect(skb, exp) < 0)
+ goto nla_put_failure;
+
+@@ -3716,20 +3686,15 @@ ctnetlink_exp_stat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, int cpu,
+ const struct ip_conntrack_stat *st)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0, event;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK,
+ IPCTNL_MSG_EXP_GET_STATS_CPU);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, htons(cpu));
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(cpu);
+-
+ if (nla_put_be32(skb, CTA_STATS_EXP_NEW, htonl(st->expect_new)) ||
+ nla_put_be32(skb, CTA_STATS_EXP_CREATE, htonl(st->expect_create)) ||
+ nla_put_be32(skb, CTA_STATS_EXP_DELETE, htonl(st->expect_delete)))
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 2ed8ccb9c8c1..e638e7380e79 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -702,18 +702,13 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
+ int family, const struct nft_table *table)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(net);
+-
+ if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
+ nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
+ nla_put_be32(skb, NFTA_TABLE_USE, htonl(table->use)) ||
+@@ -1443,18 +1438,13 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ const struct nft_chain *chain)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(net);
+-
+ if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
+ goto nla_put_failure;
+ if (nla_put_be64(skb, NFTA_CHAIN_HANDLE, cpu_to_be64(chain->handle),
+@@ -2803,20 +2793,15 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
+ const struct nft_rule *prule)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ const struct nft_expr *expr, *next;
+ struct nlattr *list;
+ u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+
+- nlh = nlmsg_put(skb, portid, seq, type, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0,
++ nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(net);
+-
+ if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_RULE_CHAIN, chain->name))
+@@ -3791,23 +3776,17 @@ static int nf_tables_fill_set_concat(struct sk_buff *skb,
+ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
+ const struct nft_set *set, u16 event, u16 flags)
+ {
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ u32 portid = ctx->portid;
+ struct nlattr *nest;
+ u32 seq = ctx->seq;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+- flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
++ NFNETLINK_V0, nft_base_seq(ctx->net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = ctx->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(ctx->net);
+-
+ if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_SET_NAME, set->name))
+@@ -4715,7 +4694,6 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
+ struct nft_set *set;
+ struct nft_set_dump_args args;
+ bool set_found = false;
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ struct nlattr *nest;
+ u32 portid, seq;
+@@ -4748,16 +4726,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
+ portid = NETLINK_CB(cb->skb).portid;
+ seq = cb->nlh->nlmsg_seq;
+
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+- NLM_F_MULTI);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI,
++ table->family, NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = table->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(net);
+-
+ if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
+@@ -4814,22 +4787,16 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb,
+ const struct nft_set *set,
+ const struct nft_set_elem *elem)
+ {
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ struct nlattr *nest;
+ int err;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
+- flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
++ NFNETLINK_V0, nft_base_seq(ctx->net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = ctx->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(ctx->net);
+-
+ if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+ goto nla_put_failure;
+ if (nla_put_string(skb, NFTA_SET_NAME, set->name))
+@@ -6086,19 +6053,14 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
+ int family, const struct nft_table *table,
+ struct nft_object *obj, bool reset)
+ {
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(net);
+-
+ if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
+ nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
+ nla_put_be32(skb, NFTA_OBJ_TYPE, htonl(obj->ops->type->type)) ||
+@@ -6997,20 +6959,15 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
+ struct list_head *hook_list)
+ {
+ struct nlattr *nest, *nest_devs;
+- struct nfgenmsg *nfmsg;
+ struct nft_hook *hook;
+ struct nlmsghdr *nlh;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(net);
+-
+ if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
+ nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
+ nla_put_be32(skb, NFTA_FLOWTABLE_USE, htonl(flowtable->use)) ||
+@@ -7243,19 +7200,14 @@ static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
+ u32 portid, u32 seq)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ char buf[TASK_COMM_LEN];
+ int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
+
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg), 0);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC,
++ NFNETLINK_V0, nft_base_seq(net));
++ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = nft_base_seq(net);
+-
+ if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
+ nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
+ nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
+diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c
+index 87b36da5cd98..0cf3278007ba 100644
+--- a/net/netfilter/nf_tables_trace.c
++++ b/net/netfilter/nf_tables_trace.c
+@@ -183,7 +183,6 @@ static bool nft_trace_have_verdict_chain(struct nft_traceinfo *info)
+ void nft_trace_notify(struct nft_traceinfo *info)
+ {
+ const struct nft_pktinfo *pkt = info->pkt;
+- struct nfgenmsg *nfmsg;
+ struct nlmsghdr *nlh;
+ struct sk_buff *skb;
+ unsigned int size;
+@@ -219,15 +218,11 @@ void nft_trace_notify(struct nft_traceinfo *info)
+ return;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_TRACE);
+- nlh = nlmsg_put(skb, 0, 0, event, sizeof(struct nfgenmsg), 0);
++ nlh = nfnl_msg_put(skb, 0, 0, event, 0, info->basechain->type->family,
++ NFNETLINK_V0, 0);
+ if (!nlh)
+ goto nla_put_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = info->basechain->type->family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_be32(skb, NFTA_TRACE_NFPROTO, htonl(nft_pf(pkt))))
+ goto nla_put_failure;
+
+diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
+index 5bfec829c12f..ec3e378da73d 100644
+--- a/net/netfilter/nfnetlink_acct.c
++++ b/net/netfilter/nfnetlink_acct.c
+@@ -132,21 +132,16 @@ nfnl_acct_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int event, struct nf_acct *acct)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+ u64 pkts, bytes;
+ u32 old_flags;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_ACCT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, NFACCT_NAME, acct->name))
+ goto nla_put_failure;
+
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index 91afbf8ac8cf..52d5f2411834 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -530,20 +530,15 @@ nfnl_cthelper_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int event, struct nf_conntrack_helper *helper)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+ int status;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTHELPER, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, NFCTH_NAME, helper->name))
+ goto nla_put_failure;
+
+diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
+index 89a381f7f945..de831a257512 100644
+--- a/net/netfilter/nfnetlink_cttimeout.c
++++ b/net/netfilter/nfnetlink_cttimeout.c
+@@ -160,22 +160,17 @@ ctnl_timeout_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int event, struct ctnl_timeout *timeout)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+ const struct nf_conntrack_l4proto *l4proto = timeout->timeout.l4proto;
+ struct nlattr *nest_parms;
+ int ret;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, CTA_TIMEOUT_NAME, timeout->name) ||
+ nla_put_be16(skb, CTA_TIMEOUT_L3PROTO,
+ htons(timeout->timeout.l3num)) ||
+@@ -382,21 +377,16 @@ cttimeout_default_fill_info(struct net *net, struct sk_buff *skb, u32 portid,
+ const unsigned int *timeouts)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+ struct nlattr *nest_parms;
+ int ret;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_CTNETLINK_TIMEOUT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, AF_UNSPEC,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = AF_UNSPEC;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_be16(skb, CTA_TIMEOUT_L3PROTO, htons(l3num)) ||
+ nla_put_u8(skb, CTA_TIMEOUT_L4PROTO, l4proto->l4proto))
+ goto nla_put_failure;
+diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
+index 33c13edbca4b..f087baa95b07 100644
+--- a/net/netfilter/nfnetlink_log.c
++++ b/net/netfilter/nfnetlink_log.c
+@@ -452,20 +452,15 @@ __build_packet_message(struct nfnl_log_net *log,
+ {
+ struct nfulnl_msg_packet_hdr pmsg;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ sk_buff_data_t old_tail = inst->skb->tail;
+ struct sock *sk;
+ const unsigned char *hwhdrp;
+
+- nlh = nlmsg_put(inst->skb, 0, 0,
+- nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET),
+- sizeof(struct nfgenmsg), 0);
++ nlh = nfnl_msg_put(inst->skb, 0, 0,
++ nfnl_msg_type(NFNL_SUBSYS_ULOG, NFULNL_MSG_PACKET),
++ 0, pf, NFNETLINK_V0, htons(inst->group_num));
+ if (!nlh)
+ return -1;
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = pf;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(inst->group_num);
+
+ memset(&pmsg, 0, sizeof(pmsg));
+ pmsg.hw_protocol = skb->protocol;
+diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
+index 72d30922ed29..9d87606c76ff 100644
+--- a/net/netfilter/nfnetlink_queue.c
++++ b/net/netfilter/nfnetlink_queue.c
+@@ -383,7 +383,6 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ struct nlattr *nla;
+ struct nfqnl_msg_packet_hdr *pmsg;
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ struct sk_buff *entskb = entry->skb;
+ struct net_device *indev;
+ struct net_device *outdev;
+@@ -469,18 +468,15 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ goto nlmsg_failure;
+ }
+
+- nlh = nlmsg_put(skb, 0, 0,
+- nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET),
+- sizeof(struct nfgenmsg), 0);
++ nlh = nfnl_msg_put(skb, 0, 0,
++ nfnl_msg_type(NFNL_SUBSYS_QUEUE, NFQNL_MSG_PACKET),
++ 0, entry->state.pf, NFNETLINK_V0,
++ htons(queue->queue_num));
+ if (!nlh) {
+ skb_tx_error(entskb);
+ kfree_skb(skb);
+ goto nlmsg_failure;
+ }
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = entry->state.pf;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(queue->queue_num);
+
+ nla = __nla_reserve(skb, NFQA_PACKET_HDR, sizeof(*pmsg));
+ pmsg = nla_data(nla);
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 8e56f353ff35..b8dbd20a6a4c 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -591,19 +591,14 @@ nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type,
+ int rev, int target)
+ {
+ struct nlmsghdr *nlh;
+- struct nfgenmsg *nfmsg;
+ unsigned int flags = portid ? NLM_F_MULTI : 0;
+
+ event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event);
+- nlh = nlmsg_put(skb, portid, seq, event, sizeof(*nfmsg), flags);
+- if (nlh == NULL)
++ nlh = nfnl_msg_put(skb, portid, seq, event, flags, family,
++ NFNETLINK_V0, 0);
++ if (!nlh)
+ goto nlmsg_failure;
+
+- nfmsg = nlmsg_data(nlh);
+- nfmsg->nfgen_family = family;
+- nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = 0;
+-
+ if (nla_put_string(skb, NFTA_COMPAT_NAME, name) ||
+ nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) ||
+ nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target)))
+--
+2.35.1
+
--- /dev/null
+From 22d971db9c92fdfcd2f184168fec54b820d9bdd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 00:18:02 +0200
+Subject: netfilter: nftables: add helper function to set the base sequence
+ number
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 802b805162a1b7d8391c40ac8a878e9e63287aff ]
+
+This patch adds a helper function to calculate the base sequence number
+field that is stored in the nfnetlink header. Use the helper function
+whenever possible.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 507d3d24a347..2ed8ccb9c8c1 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -683,6 +683,11 @@ nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
+ return ERR_PTR(-ENOENT);
+ }
+
++static __be16 nft_base_seq(const struct net *net)
++{
++ return htons(net->nft.base_seq & 0xffff);
++}
++
+ static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
+ [NFTA_TABLE_NAME] = { .type = NLA_STRING,
+ .len = NFT_TABLE_MAXNAMELEN - 1 },
+@@ -707,7 +712,7 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(net);
+
+ if (nla_put_string(skb, NFTA_TABLE_NAME, table->name) ||
+ nla_put_be32(skb, NFTA_TABLE_FLAGS, htonl(table->flags)) ||
+@@ -1448,7 +1453,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(net);
+
+ if (nla_put_string(skb, NFTA_CHAIN_TABLE, table->name))
+ goto nla_put_failure;
+@@ -2810,7 +2815,7 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(net);
+
+ if (nla_put_string(skb, NFTA_RULE_TABLE, table->name))
+ goto nla_put_failure;
+@@ -3801,7 +3806,7 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = ctx->family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(ctx->net);
+
+ if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+ goto nla_put_failure;
+@@ -4751,7 +4756,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = table->family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(net);
+
+ if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
+ goto nla_put_failure;
+@@ -4823,7 +4828,7 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = ctx->family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(ctx->net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(ctx->net);
+
+ if (nla_put_string(skb, NFTA_SET_TABLE, ctx->table->name))
+ goto nla_put_failure;
+@@ -6092,7 +6097,7 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(net);
+
+ if (nla_put_string(skb, NFTA_OBJ_TABLE, table->name) ||
+ nla_put_string(skb, NFTA_OBJ_NAME, obj->key.name) ||
+@@ -7004,7 +7009,7 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = family;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(net);
+
+ if (nla_put_string(skb, NFTA_FLOWTABLE_TABLE, flowtable->table->name) ||
+ nla_put_string(skb, NFTA_FLOWTABLE_NAME, flowtable->name) ||
+@@ -7249,7 +7254,7 @@ static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
+ nfmsg = nlmsg_data(nlh);
+ nfmsg->nfgen_family = AF_UNSPEC;
+ nfmsg->version = NFNETLINK_V0;
+- nfmsg->res_id = htons(net->nft.base_seq & 0xffff);
++ nfmsg->res_id = nft_base_seq(net);
+
+ if (nla_put_be32(skb, NFTA_GEN_ID, htonl(net->nft.base_seq)) ||
+ nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
+--
+2.35.1
+
--- /dev/null
+From 8b4c5db499550412eb1b0529d84c509da28b6e74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jul 2022 11:58:43 +0300
+Subject: nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue
+ teardown
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 533d2e8b4d5e4c89772a0adce913525fb86cbbee ]
+
+We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are
+sending/receiving for the socket from works on this workqueue.
+Also this eliminates lockdep complaints:
+--
+[ 6174.010200] workqueue: WQ_MEM_RECLAIM
+nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing
+!WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp]
+[ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628
+check_flush_dependency+0x110/0x14c
+
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 96b67a70cbbb..d030d5e69dc5 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1802,7 +1802,8 @@ static int __init nvmet_tcp_init(void)
+ {
+ int ret;
+
+- nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", WQ_HIGHPRI, 0);
++ nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq",
++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+ if (!nvmet_tcp_wq)
+ return -ENOMEM;
+
+--
+2.35.1
+
--- /dev/null
+From 85bcef28c3bbbbf8b0f4e943e99fc67c84504728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jul 2022 20:42:10 +0800
+Subject: PCI/ACPI: Guard ARM64-specific mcfg_quirks
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 40a6cc141b4b9580de140bcb3e893445708acc5d ]
+
+Guard ARM64-specific quirks with CONFIG_ARM64 to avoid build errors,
+since mcfg_quirks will be shared by more than one architectures.
+
+Link: https://lore.kernel.org/r/20220714124216.1489304-2-chenhuacai@loongson.cn
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pci_mcfg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
+index 95f23acd5b80..2709ef2b0351 100644
+--- a/drivers/acpi/pci_mcfg.c
++++ b/drivers/acpi/pci_mcfg.c
+@@ -41,6 +41,8 @@ struct mcfg_fixup {
+ static struct mcfg_fixup mcfg_quirks[] = {
+ /* { OEM_ID, OEM_TABLE_ID, REV, SEGMENT, BUS_RANGE, ops, cfgres }, */
+
++#ifdef CONFIG_ARM64
++
+ #define AL_ECAM(table_id, rev, seg, ops) \
+ { "AMAZON", table_id, rev, seg, MCFG_BUS_ANY, ops }
+
+@@ -162,6 +164,7 @@ static struct mcfg_fixup mcfg_quirks[] = {
+ ALTRA_ECAM_QUIRK(1, 13),
+ ALTRA_ECAM_QUIRK(1, 14),
+ ALTRA_ECAM_QUIRK(1, 15),
++#endif /* ARM64 */
+ };
+
+ static char mcfg_oem_id[ACPI_OEM_ID_SIZE];
+--
+2.35.1
+
--- /dev/null
+From 44b084d2720458ec88bd6576d2ac4907a3002419 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jun 2022 13:41:47 -0400
+Subject: PCI: Add ACS quirk for Broadcom BCM5750x NICs
+
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+
+[ Upstream commit afd306a65cedb9589564bdb23a0c368abc4215fd ]
+
+The Broadcom BCM5750x NICs may be multi-function devices. They do not
+advertise ACS capability. Peer-to-peer transactions are not possible
+between the individual functions, so it is safe to treat them as fully
+isolated.
+
+Add an ACS quirk for these devices so the functions can be in independent
+IOMMU groups and attached individually to userspace applications using
+VFIO.
+
+Link: https://lore.kernel.org/r/1654796507-28610-1-git-send-email-michael.chan@broadcom.com
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 1be2894ada70..fb2e52fd01b3 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4897,6 +4897,9 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs },
+ /* Broadcom multi-function device */
+ { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs },
+ /* Amazon Annapurna Labs */
+ { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs },
+--
+2.35.1
+
--- /dev/null
+From ab98a65db01361e1b1a93e8686dea360689f7f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jun 2022 19:41:28 +0300
+Subject: pinctrl: intel: Check against matching data instead of ACPI companion
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c551bd81d198bf1dcd4398d5454acdc0309dbe77 ]
+
+In some cases we may get a platform device that has ACPI companion
+which is different to the pin control described in the ACPI tables.
+This is primarily happens when device is instantiated by board file.
+
+In order to allow this device being enumerated, refactor
+intel_pinctrl_get_soc_data() to check the matching data instead of
+ACPI companion.
+
+Reported-by: Henning Schild <henning.schild@siemens.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Tested-by: Henning Schild <henning.schild@siemens.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-intel.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 348c670a7b07..4de832ac47d3 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -1571,16 +1571,14 @@ EXPORT_SYMBOL_GPL(intel_pinctrl_probe_by_uid);
+
+ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_device *pdev)
+ {
++ const struct intel_pinctrl_soc_data * const *table;
+ const struct intel_pinctrl_soc_data *data = NULL;
+- const struct intel_pinctrl_soc_data **table;
+- struct acpi_device *adev;
+- unsigned int i;
+
+- adev = ACPI_COMPANION(&pdev->dev);
+- if (adev) {
+- const void *match = device_get_match_data(&pdev->dev);
++ table = device_get_match_data(&pdev->dev);
++ if (table) {
++ struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
++ unsigned int i;
+
+- table = (const struct intel_pinctrl_soc_data **)match;
+ for (i = 0; table[i]; i++) {
+ if (!strcmp(adev->pnp.unique_id, table[i]->uid)) {
+ data = table[i];
+@@ -1594,7 +1592,7 @@ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_
+ if (!id)
+ return ERR_PTR(-ENODEV);
+
+- table = (const struct intel_pinctrl_soc_data **)id->driver_data;
++ table = (const struct intel_pinctrl_soc_data * const *)id->driver_data;
+ data = table[pdev->id];
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 3afb6e831f261c74641a0b0156f7d7292fb93932 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jun 2022 08:49:49 +0000
+Subject: platform/chrome: cros_ec_proto: don't show MKBP version if
+ unsupported
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit b36f0643ff14a2fb281b105418e4e73c9d7c11d0 ]
+
+It wrongly showed the following message when it doesn't support MKBP:
+"MKBP support version 4294967295".
+
+Fix it.
+
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Link: https://lore.kernel.org/r/20220609084957.3684698-14-tzungbi@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_proto.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
+index e1fadf059e05..3a2a78ff3330 100644
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -507,13 +507,13 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev)
+ ret = cros_ec_get_host_command_version_mask(ec_dev,
+ EC_CMD_GET_NEXT_EVENT,
+ &ver_mask);
+- if (ret < 0 || ver_mask == 0)
++ if (ret < 0 || ver_mask == 0) {
+ ec_dev->mkbp_event_supported = 0;
+- else
++ } else {
+ ec_dev->mkbp_event_supported = fls(ver_mask);
+
+- dev_dbg(ec_dev->dev, "MKBP support version %u\n",
+- ec_dev->mkbp_event_supported - 1);
++ dev_dbg(ec_dev->dev, "MKBP support version %u\n", ec_dev->mkbp_event_supported - 1);
++ }
+
+ /* Probe if host sleep v1 is supported for S0ix failure detection. */
+ ret = cros_ec_get_host_command_version_mask(ec_dev,
+--
+2.35.1
+
--- /dev/null
+From 74ee6d33c5195dfeaea198a237a65f5942037a42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jul 2022 16:19:30 +0200
+Subject: powerpc/32: Don't always pass -mcpu=powerpc to the compiler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 446cda1b21d9a6b3697fe399c6a3a00ff4a285f5 ]
+
+Since commit 4bf4f42a2feb ("powerpc/kbuild: Set default generic
+machine type for 32-bit compile"), when building a 32 bits kernel
+with a bi-arch version of GCC, or when building a book3s/32 kernel,
+the option -mcpu=powerpc is passed to GCC at all time, relying on it
+being eventually overriden by a subsequent -mcpu=xxxx.
+
+But when building the same kernel with a 32 bits only version of GCC,
+that is not done, relying on gcc being built with the expected default
+CPU.
+
+This logic has two problems. First, it is a bit fragile to rely on
+whether the GCC version is bi-arch or not, because today we can have
+bi-arch versions of GCC configured with a 32 bits default. Second,
+there are some versions of GCC which don't support -mcpu=powerpc,
+for instance for e500 SPE-only versions.
+
+So, stop relying on this approximative logic and allow the user to
+decide whether he/she wants to use the toolchain's default CPU or if
+he/she wants to set one, and allow only possible CPUs based on the
+selected target.
+
+Reported-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Tested-by: Pali Rohár <pali@kernel.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/d4df724691351531bf46d685d654689e5dfa0d74.1657549153.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 26 +-------------------------
+ arch/powerpc/platforms/Kconfig.cputype | 21 ++++++++++++++++++---
+ 2 files changed, 19 insertions(+), 28 deletions(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 7a96cdefbd4e..59175651f0b9 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -17,23 +17,6 @@ HAS_BIARCH := $(call cc-option-yn, -m32)
+ # Set default 32 bits cross compilers for vdso and boot wrapper
+ CROSS32_COMPILE ?=
+
+-ifeq ($(HAS_BIARCH),y)
+-ifeq ($(CROSS32_COMPILE),)
+-ifdef CONFIG_PPC32
+-# These options will be overridden by any -mcpu option that the CPU
+-# or platform code sets later on the command line, but they are needed
+-# to set a sane 32-bit cpu target for the 64-bit cross compiler which
+-# may default to the wrong ISA.
+-KBUILD_CFLAGS += -mcpu=powerpc
+-KBUILD_AFLAGS += -mcpu=powerpc
+-endif
+-endif
+-endif
+-
+-ifdef CONFIG_PPC_BOOK3S_32
+-KBUILD_CFLAGS += -mcpu=powerpc
+-endif
+-
+ # If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use
+ # ppc64_defconfig because we have nothing better to go on.
+ uname := $(shell uname -m)
+@@ -190,6 +173,7 @@ endif
+ endif
+
+ CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU))
++AFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU))
+
+ # Altivec option not allowed with e500mc64 in GCC.
+ ifdef CONFIG_ALTIVEC
+@@ -200,14 +184,6 @@ endif
+ CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU)
+ CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU))
+
+-ifdef CONFIG_PPC32
+-ifdef CONFIG_PPC_E500MC
+-CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc)
+-else
+-CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc)
+-endif
+-endif
+-
+ asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1)
+
+ KBUILD_CPPFLAGS += -I $(srctree)/arch/$(ARCH) $(asinstr)
+diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
+index 75ebfbff4deb..84f9dd476bbb 100644
+--- a/arch/powerpc/platforms/Kconfig.cputype
++++ b/arch/powerpc/platforms/Kconfig.cputype
+@@ -119,9 +119,9 @@ config GENERIC_CPU
+ depends on PPC64 && CPU_LITTLE_ENDIAN
+ select ARCH_HAS_FAST_MULTIPLIER
+
+-config GENERIC_CPU
++config POWERPC_CPU
+ bool "Generic 32 bits powerpc"
+- depends on PPC32 && !PPC_8xx
++ depends on PPC32 && !PPC_8xx && !PPC_85xx
+
+ config CELL_CPU
+ bool "Cell Broadband Engine"
+@@ -175,11 +175,23 @@ config G4_CPU
+ depends on PPC_BOOK3S_32
+ select ALTIVEC
+
++config E500_CPU
++ bool "e500 (8540)"
++ depends on PPC_85xx && !PPC_E500MC
++
++config E500MC_CPU
++ bool "e500mc"
++ depends on PPC_85xx && PPC_E500MC
++
++config TOOLCHAIN_DEFAULT_CPU
++ bool "Rely on the toolchain's implicit default CPU"
++ depends on PPC32
++
+ endchoice
+
+ config TARGET_CPU_BOOL
+ bool
+- default !GENERIC_CPU
++ default !GENERIC_CPU && !TOOLCHAIN_DEFAULT_CPU
+
+ config TARGET_CPU
+ string
+@@ -194,6 +206,9 @@ config TARGET_CPU
+ default "e300c2" if E300C2_CPU
+ default "e300c3" if E300C3_CPU
+ default "G4" if G4_CPU
++ default "8540" if E500_CPU
++ default "e500mc" if E500MC_CPU
++ default "powerpc" if POWERPC_CPU
+
+ config PPC_BOOK3S
+ def_bool y
+--
+2.35.1
+
--- /dev/null
+From 17f026212d00ba4476f37031d44f24d880019685 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jul 2022 09:57:47 +0800
+Subject: powerpc/64: Init jump labels before parse_early_param()
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 ]
+
+On 64-bit, calling jump_label_init() in setup_feature_keys() is too
+late because static keys may be used in subroutines of
+parse_early_param() which is again subroutine of early_init_devtree().
+
+For example booting with "threadirqs":
+
+ static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init()
+ WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120
+ ...
+ NIP static_key_enable_cpuslocked+0xfc/0x120
+ LR static_key_enable_cpuslocked+0xf8/0x120
+ Call Trace:
+ static_key_enable_cpuslocked+0xf8/0x120 (unreliable)
+ static_key_enable+0x30/0x50
+ setup_forced_irqthreads+0x28/0x40
+ do_early_param+0xa0/0x108
+ parse_args+0x290/0x4e0
+ parse_early_options+0x48/0x5c
+ parse_early_param+0x58/0x84
+ early_init_devtree+0xd4/0x518
+ early_setup+0xb4/0x214
+
+So call jump_label_init() just before parse_early_param() in
+early_init_devtree().
+
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[mpe: Add call trace to change log and minor wording edits.]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220726015747.11754-1-zhouzhouyi@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index 7a14a094be8a..1dfb4c213fea 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -750,6 +750,13 @@ void __init early_init_devtree(void *params)
+ of_scan_flat_dt(early_init_dt_scan_root, NULL);
+ of_scan_flat_dt(early_init_dt_scan_memory_ppc, NULL);
+
++ /*
++ * As generic code authors expect to be able to use static keys
++ * in early_param() handlers, we initialize the static keys just
++ * before parsing early params (it's fine to call jump_label_init()
++ * more than once).
++ */
++ jump_label_init();
+ parse_early_param();
+
+ /* make sure we've parsed cmdline for mem= before this */
+--
+2.35.1
+
--- /dev/null
+From 6dc462c82f82d33dd88b717e505763529fb1ac97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jun 2022 14:04:25 -0500
+Subject: RDMA/rxe: Limit the number of calls to each tasklet
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit eff6d998ca297cb0b2e53b032a56cf8e04dd8b17 ]
+
+Limit the maximum number of calls to each tasklet from rxe_do_task()
+before yielding the cpu. When the limit is reached reschedule the tasklet
+and exit the calling loop. This patch prevents one tasklet from consuming
+100% of a cpu core and causing a deadlock or soft lockup.
+
+Link: https://lore.kernel.org/r/20220630190425.2251-9-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_param.h | 6 ++++++
+ drivers/infiniband/sw/rxe/rxe_task.c | 16 ++++++++++++----
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h
+index f9fb56ec6dfd..dca86422b0a2 100644
+--- a/drivers/infiniband/sw/rxe/rxe_param.h
++++ b/drivers/infiniband/sw/rxe/rxe_param.h
+@@ -98,6 +98,12 @@ enum rxe_device_param {
+ RXE_INFLIGHT_SKBS_PER_QP_HIGH = 64,
+ RXE_INFLIGHT_SKBS_PER_QP_LOW = 16,
+
++ /* Max number of interations of each tasklet
++ * before yielding the cpu to let other
++ * work make progress
++ */
++ RXE_MAX_ITERATIONS = 1024,
++
+ /* Delay before calling arbiter timer */
+ RXE_NSEC_ARB_TIMER_DELAY = 200,
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 6951fdcb31bf..568cf56c236b 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -8,7 +8,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/hardirq.h>
+
+-#include "rxe_task.h"
++#include "rxe.h"
+
+ int __rxe_do_task(struct rxe_task *task)
+
+@@ -34,6 +34,7 @@ void rxe_do_task(struct tasklet_struct *t)
+ int ret;
+ unsigned long flags;
+ struct rxe_task *task = from_tasklet(task, t, tasklet);
++ unsigned int iterations = RXE_MAX_ITERATIONS;
+
+ spin_lock_irqsave(&task->state_lock, flags);
+ switch (task->state) {
+@@ -62,13 +63,20 @@ void rxe_do_task(struct tasklet_struct *t)
+ spin_lock_irqsave(&task->state_lock, flags);
+ switch (task->state) {
+ case TASK_STATE_BUSY:
+- if (ret)
++ if (ret) {
+ task->state = TASK_STATE_START;
+- else
++ } else if (iterations--) {
+ cont = 1;
++ } else {
++ /* reschedule the tasklet and exit
++ * the loop to give up the cpu
++ */
++ tasklet_schedule(&task->tasklet);
++ task->state = TASK_STATE_START;
++ }
+ break;
+
+- /* soneone tried to run the task since the last time we called
++ /* someone tried to run the task since the last time we called
+ * func, so we will call one more time regardless of the
+ * return value
+ */
+--
+2.35.1
+
--- /dev/null
+From bd9b1c0a1b150eb2d452fedd2b7240930d077913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jun 2022 16:23:08 +0800
+Subject: RISC-V: Add fast call path of crash_kexec()
+
+From: Xianting Tian <xianting.tian@linux.alibaba.com>
+
+[ Upstream commit 3f1901110a89b0e2e13adb2ac8d1a7102879ea98 ]
+
+Currently, almost all archs (x86, arm64, mips...) support fast call
+of crash_kexec() when "regs && kexec_should_crash()" is true. But
+RISC-V not, it can only enter crash system via panic(). However panic()
+doesn't pass the regs of the real accident scene to crash_kexec(),
+it caused we can't get accurate backtrace via gdb,
+ $ riscv64-linux-gnu-gdb vmlinux vmcore
+ Reading symbols from vmlinux...
+ [New LWP 95]
+ #0 console_unlock () at kernel/printk/printk.c:2557
+ 2557 if (do_cond_resched)
+ (gdb) bt
+ #0 console_unlock () at kernel/printk/printk.c:2557
+ #1 0x0000000000000000 in ?? ()
+
+With the patch we can get the accurate backtrace,
+ $ riscv64-linux-gnu-gdb vmlinux vmcore
+ Reading symbols from vmlinux...
+ [New LWP 95]
+ #0 0xffffffe00063a4e0 in test_thread (data=<optimized out>) at drivers/test_crash.c:81
+ 81 *(int *)p = 0xdead;
+ (gdb)
+ (gdb) bt
+ #0 0xffffffe00064d5c0 in test_thread (data=<optimized out>) at drivers/test_crash.c:81
+ #1 0x0000000000000000 in ?? ()
+
+Test code to produce NULL address dereference in test_crash.c,
+ void *p = NULL;
+ *(int *)p = 0xdead;
+
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Tested-by: Xianting Tian <xianting.tian@linux.alibaba.com>
+Signed-off-by: Xianting Tian <xianting.tian@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20220606082308.2883458-1-xianting.tian@linux.alibaba.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/traps.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index ad14f4466d92..c1a13011fb8e 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -15,6 +15,7 @@
+ #include <linux/mm.h>
+ #include <linux/module.h>
+ #include <linux/irq.h>
++#include <linux/kexec.h>
+
+ #include <asm/processor.h>
+ #include <asm/ptrace.h>
+@@ -43,6 +44,9 @@ void die(struct pt_regs *regs, const char *str)
+
+ ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV);
+
++ if (regs && kexec_should_crash(current))
++ crash_kexec(regs);
++
+ bust_spinlocks(0);
+ add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+ spin_unlock_irq(&die_lock);
+--
+2.35.1
+
--- /dev/null
+From 1c3fb44f2d4f43151b1cfe543f57bc0e63b0d42d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jul 2022 20:04:33 +0100
+Subject: riscv: dts: sifive: Add fu540 topology information
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+[ Upstream commit af8f260abc608c06e4466a282b53f1e2dc09f042 ]
+
+The fu540 has no cpu-map node, so tools like hwloc cannot correctly
+parse the topology. Add the node using the existing node labels.
+
+Reported-by: Brice Goglin <Brice.Goglin@inria.fr>
+Link: https://github.com/open-mpi/hwloc/issues/536
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20220705190435.1790466-3-mail@conchuod.ie
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 24 ++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+index 64c06c9b41dc..87d6e5a4253f 100644
+--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+@@ -133,6 +133,30 @@
+ interrupt-controller;
+ };
+ };
++
++ cpu-map {
++ cluster0 {
++ core0 {
++ cpu = <&cpu0>;
++ };
++
++ core1 {
++ cpu = <&cpu1>;
++ };
++
++ core2 {
++ cpu = <&cpu2>;
++ };
++
++ core3 {
++ cpu = <&cpu3>;
++ };
++
++ core4 {
++ cpu = <&cpu4>;
++ };
++ };
++ };
+ };
+ soc {
+ #address-cells = <2>;
+--
+2.35.1
+
--- /dev/null
+From 14db1099d443c7ab1e97584f7861895a6eea01b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 May 2022 15:56:52 +0800
+Subject: riscv: mmap with PROT_WRITE but no PROT_READ is invalid
+
+From: Celeste Liu <coelacanthus@outlook.com>
+
+[ Upstream commit 2139619bcad7ac44cc8f6f749089120594056613 ]
+
+As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3, write
+but not read is "Reserved for future use.". For now, they are not valid.
+In the current code, -wx is marked as invalid, but -w- is not marked
+as invalid.
+This patch refines that judgment.
+
+Reported-by: xctan <xc-tan@outlook.com>
+Co-developed-by: dram <dramforever@live.com>
+Signed-off-by: dram <dramforever@live.com>
+Co-developed-by: Ruizhe Pan <c141028@gmail.com>
+Signed-off-by: Ruizhe Pan <c141028@gmail.com>
+Signed-off-by: Celeste Liu <coelacanthus@outlook.com>
+Link: https://lore.kernel.org/r/PH7PR14MB559464DBDD310E755F5B21E8CEDC9@PH7PR14MB5594.namprd14.prod.outlook.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/sys_riscv.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
+index 12f8a7fce78b..8a7880b9c433 100644
+--- a/arch/riscv/kernel/sys_riscv.c
++++ b/arch/riscv/kernel/sys_riscv.c
+@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
+ if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
+ return -EINVAL;
+
+- if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
+- if (unlikely(!(prot & PROT_READ)))
+- return -EINVAL;
++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
++ return -EINVAL;
+
+ return ksys_mmap_pgoff(addr, len, prot, flags, fd,
+ offset >> (PAGE_SHIFT - page_shift_offset));
+--
+2.35.1
+
--- /dev/null
+From 9e952818fc49d55ee833c72361ea2025042180ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 14:14:15 -0700
+Subject: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed
+ user input
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit f8191d40aa612981ce897e66cda6a88db8df17bb ]
+
+Malformed user input to debugfs results in buffer overflow crashes. Adapt
+input string lengths to fit within internal buffers, leaving space for NULL
+terminators.
+
+Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index beaf3a8d206f..fbc76d69ea0b 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -2609,8 +2609,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf,
+ struct lpfc_sli4_hdw_queue *qp;
+ struct lpfc_multixri_pool *multixri_pool;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -2690,8 +2690,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
+ if (!phba->targetport)
+ return -ENXIO;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -2828,8 +2828,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf,
+ char mybuf[64];
+ char *pbuf;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -2956,8 +2956,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
+ char mybuf[64];
+ char *pbuf;
+
+- if (nbytes > 63)
+- nbytes = 63;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -3062,8 +3062,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf,
+ char *pbuf;
+ int i;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+--
+2.35.1
+
--- /dev/null
+From a61c405c946bca2edf094bacd9d47b558aea799e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 16:17:07 -0400
+Subject: selftests/kprobe: Do not test for GRP/ without event failures
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit f5eab65ff2b76449286d18efc7fee3e0b72f7d9b ]
+
+A new feature is added where kprobes (and other probes) do not need to
+explicitly state the event name when creating a probe. The event name will
+come from what is being attached.
+
+That is:
+
+ # echo 'p:foo/ vfs_read' > kprobe_events
+
+Will no longer error, but instead create an event:
+
+ # cat kprobe_events
+ p:foo/p_vfs_read_0 vfs_read
+
+This should not be tested as an error case anymore. Remove it from the
+selftest as now this feature "breaks" the selftest as it no longer fails
+as expected.
+
+Link: https://lore.kernel.org/all/1656296348-16111-1-git-send-email-quic_linyyuan@quicinc.com/
+Link: https://lkml.kernel.org/r/20220712161707.6dc08a14@gandalf.local.home
+
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
+index fa928b431555..7c02509c71d0 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
+@@ -21,7 +21,6 @@ check_error 'p:^/bar vfs_read' # NO_GROUP_NAME
+ check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG
+
+ check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME
+-check_error 'p:foo/^ vfs_read' # NO_EVENT_NAME
+ check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG
+ check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME
+
+--
+2.35.1
+
igb-add-lock-to-avoid-data-race.patch
kbuild-fix-the-modules-order-between-drivers-and-libs.patch
gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch
+asoc-sof-intel-move-sof_intel_dsp_desc-forward.patch
+drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch
+audit-log-nftables-configuration-change-events-once-.patch
+netfilter-nftables-add-helper-function-to-set-the-ba.patch
+netfilter-add-helper-function-to-set-up-the-nfnetlin.patch
+drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch
+pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch
+platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch
+usb-cdns3-fix-use-after-free-at-workaround-2.patch
+usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch
+irqchip-tegra-fix-overflow-implicit-truncation-warni.patch
+drm-meson-fix-overflow-implicit-truncation-warnings.patch
+clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch
+usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch
+usb-renesas-fix-refcount-leak-bug.patch
+usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch
+vboxguest-do-not-use-devm-for-irq.patch
+clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch
+uacce-handle-parent-device-removal-or-parent-driver-.patch
+zram-do-not-lookup-algorithm-in-backends-table.patch
+clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch
+scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch
+gadgetfs-ep_io-wait-until-irq-finishes.patch
+pinctrl-intel-check-against-matching-data-instead-of.patch
+cxl-fix-a-memory-leak-in-an-error-handling-path.patch
+pci-acpi-guard-arm64-specific-mcfg_quirks.patch
+um-add-noreboot-command-line-option-for-panic_timeou.patch
+rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch
+csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch
+selftests-kprobe-do-not-test-for-grp-without-event-f.patch
+dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch
+md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch
+nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch
+drivers-md-fix-a-potential-use-after-free-bug.patch
+ext4-avoid-remove-directory-when-directory-is-corrup.patch
+ext4-avoid-resizing-to-a-partial-cluster-size.patch
+lib-list_debug.c-detect-uninitialized-lists.patch
+tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch
+vfio-clear-the-caps-buf-to-null-after-free.patch
+mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch
+modules-ensure-natural-alignment-for-.altinstruction.patch
+riscv-dts-sifive-add-fu540-topology-information.patch
+riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch
+risc-v-add-fast-call-path-of-crash_kexec.patch
+watchdog-export-lockup_detector_reconfigure.patch
+powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch
+alsa-core-add-async-signal-helpers.patch
+alsa-timer-use-deferred-fasync-helper.patch
+alsa-control-use-deferred-fasync-helper.patch
+f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch
+f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch
+smb3-check-xattr-value-length-earlier.patch
+powerpc-64-init-jump-labels-before-parse_early_param.patch
+video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch
+mips-tlbex-explicitly-compare-_page_no_exec-against-.patch
--- /dev/null
+From c07519a7aa243a6495e1c72cd4053dc26c13e954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 11:43:44 -0500
+Subject: smb3: check xattr value length earlier
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 5fa2cffba0b82336a2244d941322eb1627ff787b ]
+
+Coverity complains about assigning a pointer based on
+value length before checking that value length goes
+beyond the end of the SMB. Although this is even more
+unlikely as value length is a single byte, and the
+pointer is not dereferenced until laterm, it is clearer
+to check the lengths first.
+
+Addresses-Coverity: 1467704 ("Speculative execution data leak")
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index b855abfaaf87..b6d72e3c5eba 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1000,9 +1000,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ size_t name_len, value_len, user_name_len;
+
+ while (src_size > 0) {
+- name = &src->ea_data[0];
+ name_len = (size_t)src->ea_name_length;
+- value = &src->ea_data[src->ea_name_length + 1];
+ value_len = (size_t)le16_to_cpu(src->ea_value_length);
+
+ if (name_len == 0)
+@@ -1014,6 +1012,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ goto out;
+ }
+
++ name = &src->ea_data[0];
++ value = &src->ea_data[src->ea_name_length + 1];
++
+ if (ea_name) {
+ if (ea_name_len == name_len &&
+ memcmp(ea_name, name, name_len) == 0) {
+--
+2.35.1
+
--- /dev/null
+From bc2ecd5bfc28d702e06b7a78ce399581228e2bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jun 2022 14:08:50 +0800
+Subject: tty: serial: Fix refcount leak bug in ucc_uart.c
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit d24d7bb2cd947676f9b71fb944d045e09b8b282f ]
+
+In soc_info(), of_find_node_by_type() will return a node pointer
+with refcount incremented. We should use of_node_put() when it is
+not used anymore.
+
+Acked-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20220618060850.4058525-1-windhl@126.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/ucc_uart.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
+index d6a8604157ab..d1fecc88330e 100644
+--- a/drivers/tty/serial/ucc_uart.c
++++ b/drivers/tty/serial/ucc_uart.c
+@@ -1137,6 +1137,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l)
+ /* No compatible property, so try the name. */
+ soc_string = np->name;
+
++ of_node_put(np);
++
+ /* Extract the SOC number from the "PowerPC," string */
+ if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc)
+ return 0;
+--
+2.35.1
+
--- /dev/null
+From 5c50e1742a26e703f99b95ff559a97756949bccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 11:48:43 +0800
+Subject: uacce: Handle parent device removal or parent driver module rmmod
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 80fc671bcc0173836e9032b0c698ea74c13b9d7c ]
+
+The uacce driver must deal with a possible removal of the parent device
+or parent driver module rmmod at any time.
+
+Although uacce_remove(), called on device removal and on driver unbind,
+prevents future use of the uacce fops by removing the cdev, fops that
+were called before that point may still be running.
+
+Serialize uacce_fops_open() and uacce_remove() with uacce->mutex.
+Serialize other fops against uacce_remove() with q->mutex.
+Since we need to protect uacce_fops_poll() which gets called on the fast
+path, replace uacce->queues_lock with q->mutex to improve scalability.
+The other fops are only used during setup.
+
+uacce_queue_is_valid(), checked under q->mutex or uacce->mutex, denotes
+whether uacce_remove() has disabled all queues. If that is the case,
+don't go any further since the parent device is being removed and
+uacce->ops should not be called anymore.
+
+Reported-by: Yang Shen <shenyang39@huawei.com>
+Signed-off-by: Zhangfei Gao <zhangfei.gao@linaro.org>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Link: https://lore.kernel.org/r/20220701034843.7502-1-zhangfei.gao@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/uacce/uacce.c | 133 ++++++++++++++++++++++++-------------
+ include/linux/uacce.h | 6 +-
+ 2 files changed, 91 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c
+index 56dd98ab5a81..95e56eb2cdd0 100644
+--- a/drivers/misc/uacce/uacce.c
++++ b/drivers/misc/uacce/uacce.c
+@@ -9,43 +9,38 @@
+
+ static struct class *uacce_class;
+ static dev_t uacce_devt;
+-static DEFINE_MUTEX(uacce_mutex);
+ static DEFINE_XARRAY_ALLOC(uacce_xa);
+
+-static int uacce_start_queue(struct uacce_queue *q)
++/*
++ * If the parent driver or the device disappears, the queue state is invalid and
++ * ops are not usable anymore.
++ */
++static bool uacce_queue_is_valid(struct uacce_queue *q)
+ {
+- int ret = 0;
++ return q->state == UACCE_Q_INIT || q->state == UACCE_Q_STARTED;
++}
+
+- mutex_lock(&uacce_mutex);
++static int uacce_start_queue(struct uacce_queue *q)
++{
++ int ret;
+
+- if (q->state != UACCE_Q_INIT) {
+- ret = -EINVAL;
+- goto out_with_lock;
+- }
++ if (q->state != UACCE_Q_INIT)
++ return -EINVAL;
+
+ if (q->uacce->ops->start_queue) {
+ ret = q->uacce->ops->start_queue(q);
+ if (ret < 0)
+- goto out_with_lock;
++ return ret;
+ }
+
+ q->state = UACCE_Q_STARTED;
+-
+-out_with_lock:
+- mutex_unlock(&uacce_mutex);
+-
+- return ret;
++ return 0;
+ }
+
+ static int uacce_put_queue(struct uacce_queue *q)
+ {
+ struct uacce_device *uacce = q->uacce;
+
+- mutex_lock(&uacce_mutex);
+-
+- if (q->state == UACCE_Q_ZOMBIE)
+- goto out;
+-
+ if ((q->state == UACCE_Q_STARTED) && uacce->ops->stop_queue)
+ uacce->ops->stop_queue(q);
+
+@@ -54,8 +49,6 @@ static int uacce_put_queue(struct uacce_queue *q)
+ uacce->ops->put_queue(q);
+
+ q->state = UACCE_Q_ZOMBIE;
+-out:
+- mutex_unlock(&uacce_mutex);
+
+ return 0;
+ }
+@@ -65,20 +58,36 @@ static long uacce_fops_unl_ioctl(struct file *filep,
+ {
+ struct uacce_queue *q = filep->private_data;
+ struct uacce_device *uacce = q->uacce;
++ long ret = -ENXIO;
++
++ /*
++ * uacce->ops->ioctl() may take the mmap_lock when copying arg to/from
++ * user. Avoid a circular lock dependency with uacce_fops_mmap(), which
++ * gets called with mmap_lock held, by taking uacce->mutex instead of
++ * q->mutex. Doing this in uacce_fops_mmap() is not possible because
++ * uacce_fops_open() calls iommu_sva_bind_device(), which takes
++ * mmap_lock, while holding uacce->mutex.
++ */
++ mutex_lock(&uacce->mutex);
++ if (!uacce_queue_is_valid(q))
++ goto out_unlock;
+
+ switch (cmd) {
+ case UACCE_CMD_START_Q:
+- return uacce_start_queue(q);
+-
++ ret = uacce_start_queue(q);
++ break;
+ case UACCE_CMD_PUT_Q:
+- return uacce_put_queue(q);
+-
++ ret = uacce_put_queue(q);
++ break;
+ default:
+- if (!uacce->ops->ioctl)
+- return -EINVAL;
+-
+- return uacce->ops->ioctl(q, cmd, arg);
++ if (uacce->ops->ioctl)
++ ret = uacce->ops->ioctl(q, cmd, arg);
++ else
++ ret = -EINVAL;
+ }
++out_unlock:
++ mutex_unlock(&uacce->mutex);
++ return ret;
+ }
+
+ #ifdef CONFIG_COMPAT
+@@ -136,6 +145,13 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)
+ if (!q)
+ return -ENOMEM;
+
++ mutex_lock(&uacce->mutex);
++
++ if (!uacce->parent) {
++ ret = -EINVAL;
++ goto out_with_mem;
++ }
++
+ ret = uacce_bind_queue(uacce, q);
+ if (ret)
+ goto out_with_mem;
+@@ -152,10 +168,9 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)
+ filep->private_data = q;
+ uacce->inode = inode;
+ q->state = UACCE_Q_INIT;
+-
+- mutex_lock(&uacce->queues_lock);
++ mutex_init(&q->mutex);
+ list_add(&q->list, &uacce->queues);
+- mutex_unlock(&uacce->queues_lock);
++ mutex_unlock(&uacce->mutex);
+
+ return 0;
+
+@@ -163,18 +178,20 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)
+ uacce_unbind_queue(q);
+ out_with_mem:
+ kfree(q);
++ mutex_unlock(&uacce->mutex);
+ return ret;
+ }
+
+ static int uacce_fops_release(struct inode *inode, struct file *filep)
+ {
+ struct uacce_queue *q = filep->private_data;
++ struct uacce_device *uacce = q->uacce;
+
+- mutex_lock(&q->uacce->queues_lock);
+- list_del(&q->list);
+- mutex_unlock(&q->uacce->queues_lock);
++ mutex_lock(&uacce->mutex);
+ uacce_put_queue(q);
+ uacce_unbind_queue(q);
++ list_del(&q->list);
++ mutex_unlock(&uacce->mutex);
+ kfree(q);
+
+ return 0;
+@@ -217,10 +234,9 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma)
+ vma->vm_private_data = q;
+ qfr->type = type;
+
+- mutex_lock(&uacce_mutex);
+-
+- if (q->state != UACCE_Q_INIT && q->state != UACCE_Q_STARTED) {
+- ret = -EINVAL;
++ mutex_lock(&q->mutex);
++ if (!uacce_queue_is_valid(q)) {
++ ret = -ENXIO;
+ goto out_with_lock;
+ }
+
+@@ -259,12 +275,12 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma)
+ }
+
+ q->qfrs[type] = qfr;
+- mutex_unlock(&uacce_mutex);
++ mutex_unlock(&q->mutex);
+
+ return ret;
+
+ out_with_lock:
+- mutex_unlock(&uacce_mutex);
++ mutex_unlock(&q->mutex);
+ kfree(qfr);
+ return ret;
+ }
+@@ -273,12 +289,20 @@ static __poll_t uacce_fops_poll(struct file *file, poll_table *wait)
+ {
+ struct uacce_queue *q = file->private_data;
+ struct uacce_device *uacce = q->uacce;
++ __poll_t ret = 0;
++
++ mutex_lock(&q->mutex);
++ if (!uacce_queue_is_valid(q))
++ goto out_unlock;
+
+ poll_wait(file, &q->wait, wait);
++
+ if (uacce->ops->is_q_updated && uacce->ops->is_q_updated(q))
+- return EPOLLIN | EPOLLRDNORM;
++ ret = EPOLLIN | EPOLLRDNORM;
+
+- return 0;
++out_unlock:
++ mutex_unlock(&q->mutex);
++ return ret;
+ }
+
+ static const struct file_operations uacce_fops = {
+@@ -431,7 +455,7 @@ struct uacce_device *uacce_alloc(struct device *parent,
+ goto err_with_uacce;
+
+ INIT_LIST_HEAD(&uacce->queues);
+- mutex_init(&uacce->queues_lock);
++ mutex_init(&uacce->mutex);
+ device_initialize(&uacce->dev);
+ uacce->dev.devt = MKDEV(MAJOR(uacce_devt), uacce->dev_id);
+ uacce->dev.class = uacce_class;
+@@ -489,13 +513,23 @@ void uacce_remove(struct uacce_device *uacce)
+ if (uacce->inode)
+ unmap_mapping_range(uacce->inode->i_mapping, 0, 0, 1);
+
++ /*
++ * uacce_fops_open() may be running concurrently, even after we remove
++ * the cdev. Holding uacce->mutex ensures that open() does not obtain a
++ * removed uacce device.
++ */
++ mutex_lock(&uacce->mutex);
+ /* ensure no open queue remains */
+- mutex_lock(&uacce->queues_lock);
+ list_for_each_entry_safe(q, next_q, &uacce->queues, list) {
++ /*
++ * Taking q->mutex ensures that fops do not use the defunct
++ * uacce->ops after the queue is disabled.
++ */
++ mutex_lock(&q->mutex);
+ uacce_put_queue(q);
++ mutex_unlock(&q->mutex);
+ uacce_unbind_queue(q);
+ }
+- mutex_unlock(&uacce->queues_lock);
+
+ /* disable sva now since no opened queues */
+ if (uacce->flags & UACCE_DEV_SVA)
+@@ -504,6 +538,13 @@ void uacce_remove(struct uacce_device *uacce)
+ if (uacce->cdev)
+ cdev_device_del(uacce->cdev, &uacce->dev);
+ xa_erase(&uacce_xa, uacce->dev_id);
++ /*
++ * uacce exists as long as there are open fds, but ops will be freed
++ * now. Ensure that bugs cause NULL deref rather than use-after-free.
++ */
++ uacce->ops = NULL;
++ uacce->parent = NULL;
++ mutex_unlock(&uacce->mutex);
+ put_device(&uacce->dev);
+ }
+ EXPORT_SYMBOL_GPL(uacce_remove);
+diff --git a/include/linux/uacce.h b/include/linux/uacce.h
+index 48e319f40275..9ce88c28b0a8 100644
+--- a/include/linux/uacce.h
++++ b/include/linux/uacce.h
+@@ -70,6 +70,7 @@ enum uacce_q_state {
+ * @wait: wait queue head
+ * @list: index into uacce queues list
+ * @qfrs: pointer of qfr regions
++ * @mutex: protects queue state
+ * @state: queue state machine
+ * @pasid: pasid associated to the mm
+ * @handle: iommu_sva handle returned by iommu_sva_bind_device()
+@@ -80,6 +81,7 @@ struct uacce_queue {
+ wait_queue_head_t wait;
+ struct list_head list;
+ struct uacce_qfile_region *qfrs[UACCE_MAX_REGION];
++ struct mutex mutex;
+ enum uacce_q_state state;
+ u32 pasid;
+ struct iommu_sva *handle;
+@@ -97,9 +99,9 @@ struct uacce_queue {
+ * @dev_id: id of the uacce device
+ * @cdev: cdev of the uacce
+ * @dev: dev of the uacce
++ * @mutex: protects uacce operation
+ * @priv: private pointer of the uacce
+ * @queues: list of queues
+- * @queues_lock: lock for queues list
+ * @inode: core vfs
+ */
+ struct uacce_device {
+@@ -113,9 +115,9 @@ struct uacce_device {
+ u32 dev_id;
+ struct cdev *cdev;
+ struct device dev;
++ struct mutex mutex;
+ void *priv;
+ struct list_head queues;
+- struct mutex queues_lock;
+ struct inode *inode;
+ };
+
+--
+2.35.1
+
--- /dev/null
+From def17f562aa7453ed23270921ac4de244e5254d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jul 2022 13:56:17 +0200
+Subject: um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+[ Upstream commit dda520d07b95072a0b63f6c52a8eb566d08ea897 ]
+
+QEMU has a -no-reboot option, which halts instead of reboots when the
+guest asks to reboot. This is invaluable when used with
+CONFIG_PANIC_TIMEOUT=-1 (and panic_on_warn), because it allows panics
+and warnings to be caught immediately in CI. Implement this in UML too,
+by way of a basic setup param.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/skas/process.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
+index 94a7c4125ebc..eecde73b2e78 100644
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -5,6 +5,7 @@
+ */
+
+ #include <stdlib.h>
++#include <stdbool.h>
+ #include <unistd.h>
+ #include <sched.h>
+ #include <errno.h>
+@@ -644,10 +645,24 @@ void halt_skas(void)
+ UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT);
+ }
+
++static bool noreboot;
++
++static int __init noreboot_cmd_param(char *str, int *add)
++{
++ noreboot = true;
++ return 0;
++}
++
++__uml_setup("noreboot", noreboot_cmd_param,
++"noreboot\n"
++" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n"
++" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n"
++" crashes in CI\n");
++
+ void reboot_skas(void)
+ {
+ block_signals_trace();
+- UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT);
++ UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT);
+ }
+
+ void __switch_mm(struct mm_id *mm_idp)
+--
+2.35.1
+
--- /dev/null
+From 779c26a83145d4cdae2fed49b072472efe581b1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jun 2022 14:04:30 -0500
+Subject: usb: cdns3 fix use-after-free at workaround 2
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 7d602f30149a117eea260208b1661bc404c21dfd ]
+
+BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac
+
+cdns3_wa2_remove_old_request()
+{
+ ...
+ kfree(priv_req->request.buf);
+ cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
+ list_del_init(&priv_req->list);
+ ^^^ use after free
+ ...
+}
+
+cdns3_gadget_ep_free_request() free the space pointed by priv_req,
+but priv_req is used in the following list_del_init().
+
+This patch move list_del_init() before cdns3_gadget_ep_free_request().
+
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Faqiang Zhu <faqiang.zhu@nxp.com>
+Link: https://lore.kernel.org/r/20220608190430.2814358-1-Frank.Li@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
+index f120da442d43..a37ea946459c 100644
+--- a/drivers/usb/cdns3/gadget.c
++++ b/drivers/usb/cdns3/gadget.c
+@@ -655,9 +655,9 @@ static void cdns3_wa2_remove_old_request(struct cdns3_endpoint *priv_ep)
+ trace_cdns3_wa2(priv_ep, "removes eldest request");
+
+ kfree(priv_req->request.buf);
++ list_del_init(&priv_req->list);
+ cdns3_gadget_ep_free_request(&priv_ep->endpoint,
+ &priv_req->request);
+- list_del_init(&priv_req->list);
+ --priv_ep->wa2_counter;
+
+ if (!chain)
+--
+2.35.1
+
--- /dev/null
+From 24bb18535943eeb4a3ac75bc28aa4bbdb98e5d68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jun 2022 18:07:17 +0200
+Subject: usb: dwc2: gadget: remove D+ pull-up while no vbus with
+ usb-role-switch
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit db638c6500abaffb8f7770b2a69c40d003d54ae1 ]
+
+When using usb-role-switch, D+ pull-up is set as soon as DTCL_SFTDISCON is
+cleared, whatever the vbus valid signal state is. The pull-up should not
+be set when vbus isn't present (this is determined by the drd controller).
+
+This patch ensures that B-Session (so Peripheral role + vbus valid signal)
+is valid before clearing the DCTL_SFTDISCON bit when role switch is used.
+Keep original behavior when usb-role-switch isn't used.
+
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Link: https://lore.kernel.org/r/20220622160717.314580-1-fabrice.gasnier@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 64485f82dc5b..da0df69cc234 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3593,7 +3593,8 @@ void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg)
+ void dwc2_hsotg_core_connect(struct dwc2_hsotg *hsotg)
+ {
+ /* remove the soft-disconnect and let's go */
+- dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON);
++ if (!hsotg->role_sw || (dwc2_readl(hsotg, GOTGCTL) & GOTGCTL_BSESVLD))
++ dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON);
+ }
+
+ /**
+--
+2.35.1
+
--- /dev/null
+From b0efcbf07f232522da3068cd727d0c354492b478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 May 2022 00:38:48 +0200
+Subject: usb: gadget: uvc: call uvc uvcg_warn on completed status instead of
+ uvcg_info
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+[ Upstream commit a725d0f6dfc5d3739d6499f30ec865305ba3544d ]
+
+Likewise to the uvcvideo hostside driver, this patch is changing the
+usb_request message of an non zero completion handler call from dev_info
+to dev_warn.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Link: https://lore.kernel.org/r/20220529223848.105914-4-m.grzeschik@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index 633e23d58d86..5ce548c2359d 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -159,7 +159,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
+ break;
+
+ default:
+- uvcg_info(&video->uvc->func,
++ uvcg_warn(&video->uvc->func,
+ "VS request completed with status %d.\n",
+ req->status);
+ uvcg_queue_cancel(queue, 0);
+--
+2.35.1
+
--- /dev/null
+From 3850013bbcd5b36d9e0fb2ede8fed55297c6fdef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jun 2022 11:46:37 +0800
+Subject: usb: host: ohci-ppc-of: Fix refcount leak bug
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ]
+
+In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return
+a node pointer with refcount incremented. We should use of_node_put()
+when it is not used anymore.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20220617034637.4003115-1-windhl@126.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ohci-ppc-of.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c
+index 45f7cceb6df3..98e46725999e 100644
+--- a/drivers/usb/host/ohci-ppc-of.c
++++ b/drivers/usb/host/ohci-ppc-of.c
+@@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op)
+ release_mem_region(res.start, 0x4);
+ } else
+ pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__);
++ of_node_put(np);
+ }
+
+ irq_dispose_mapping(irq);
+--
+2.35.1
+
--- /dev/null
+From 8e81e1bf3415bf767b221c8247f4c0f65baa5b37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jun 2022 10:32:05 +0800
+Subject: usb: renesas: Fix refcount leak bug
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 9d6d5303c39b8bc182475b22f45504106a07f086 ]
+
+In usbhs_rza1_hardware_init(), of_find_node_by_name() will return
+a node pointer with refcount incremented. We should use of_node_put()
+when it is not used anymore.
+
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20220618023205.4056548-1-windhl@126.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/renesas_usbhs/rza.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c
+index 24de64edb674..2d77edefb4b3 100644
+--- a/drivers/usb/renesas_usbhs/rza.c
++++ b/drivers/usb/renesas_usbhs/rza.c
+@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev)
+ extal_clk = of_find_node_by_name(NULL, "extal");
+ of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb);
+ of_property_read_u32(extal_clk, "clock-frequency", &freq_extal);
++
++ of_node_put(usb_x1_clk);
++ of_node_put(extal_clk);
++
+ if (freq_usb == 0) {
+ if (freq_extal == 12000000) {
+ /* Select 12MHz XTAL */
+--
+2.35.1
+
--- /dev/null
+From 3208c375de15572832875f40c9271833ce08bc26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jun 2022 14:37:44 +0100
+Subject: vboxguest: Do not use devm for irq
+
+From: Pascal Terjan <pterjan@google.com>
+
+[ Upstream commit 6169525b76764acb81918aa387ac168fb9a55575 ]
+
+When relying on devm it doesn't get freed early enough which causes the
+following warning when unloading the module:
+
+[249348.837181] remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'vboxguest'
+[249348.837219] WARNING: CPU: 0 PID: 6708 at fs/proc/generic.c:715 remove_proc_entry+0x119/0x140
+
+[249348.837379] Call Trace:
+[249348.837385] unregister_irq_proc+0xbd/0xe0
+[249348.837392] free_desc+0x23/0x60
+[249348.837396] irq_free_descs+0x4a/0x70
+[249348.837401] irq_domain_free_irqs+0x160/0x1a0
+[249348.837452] mp_unmap_irq+0x5c/0x60
+[249348.837458] acpi_unregister_gsi_ioapic+0x29/0x40
+[249348.837463] acpi_unregister_gsi+0x17/0x30
+[249348.837467] acpi_pci_irq_disable+0xbf/0xe0
+[249348.837473] pcibios_disable_device+0x20/0x30
+[249348.837478] pci_disable_device+0xef/0x120
+[249348.837482] vbg_pci_remove+0x6c/0x70 [vboxguest]
+
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Pascal Terjan <pterjan@google.com>
+Link: https://lore.kernel.org/r/20220612133744.4030602-1-pterjan@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/vboxguest/vboxguest_linux.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
+index 73eb34849eab..4ccfd30c2a30 100644
+--- a/drivers/virt/vboxguest/vboxguest_linux.c
++++ b/drivers/virt/vboxguest/vboxguest_linux.c
+@@ -356,8 +356,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ goto err_vbg_core_exit;
+ }
+
+- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED,
+- DEVICE_NAME, gdev);
++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME,
++ gdev);
+ if (ret) {
+ vbg_err("vboxguest: Error requesting irq: %d\n", ret);
+ goto err_vbg_core_exit;
+@@ -367,7 +367,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ if (ret) {
+ vbg_err("vboxguest: Error misc_register %s failed: %d\n",
+ DEVICE_NAME, ret);
+- goto err_vbg_core_exit;
++ goto err_free_irq;
+ }
+
+ ret = misc_register(&gdev->misc_device_user);
+@@ -403,6 +403,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ misc_deregister(&gdev->misc_device_user);
+ err_unregister_misc_device:
+ misc_deregister(&gdev->misc_device);
++err_free_irq:
++ free_irq(pci->irq, gdev);
+ err_vbg_core_exit:
+ vbg_core_exit(gdev);
+ err_disable_pcidev:
+@@ -419,6 +421,7 @@ static void vbg_pci_remove(struct pci_dev *pci)
+ vbg_gdev = NULL;
+ mutex_unlock(&vbg_gdev_mutex);
+
++ free_irq(pci->irq, gdev);
+ device_remove_file(gdev->dev, &dev_attr_host_features);
+ device_remove_file(gdev->dev, &dev_attr_host_version);
+ misc_deregister(&gdev->misc_device_user);
+--
+2.35.1
+
--- /dev/null
+From a5f72f33828c9283f546c83caa84facc0b64e70b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jun 2022 10:29:48 +0800
+Subject: vfio: Clear the caps->buf to NULL after free
+
+From: Schspa Shi <schspa@gmail.com>
+
+[ Upstream commit 6641085e8d7b3f061911517f79a2a15a0a21b97b ]
+
+On buffer resize failure, vfio_info_cap_add() will free the buffer,
+report zero for the size, and return -ENOMEM. As additional
+hardening, also clear the buffer pointer to prevent any chance of a
+double free.
+
+Signed-off-by: Schspa Shi <schspa@gmail.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Link: https://lore.kernel.org/r/20220629022948.55608-1-schspa@gmail.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
+index f886f2db8153..90db9d66867c 100644
+--- a/drivers/vfio/vfio.c
++++ b/drivers/vfio/vfio.c
+@@ -1783,6 +1783,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps,
+ buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL);
+ if (!buf) {
+ kfree(caps->buf);
++ caps->buf = NULL;
+ caps->size = 0;
+ return ERR_PTR(-ENOMEM);
+ }
+--
+2.35.1
+
--- /dev/null
+From a3b263d01bcd7833830893f3b5f3aad77abef6be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Aug 2022 17:24:19 +0800
+Subject: video: fbdev: i740fb: Check the argument of i740_calc_vclk()
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 40bf722f8064f50200b8c4f8946cd625b441dda9 ]
+
+Since the user can control the arguments of the ioctl() from the user
+space, under special arguments that may result in a divide-by-zero bug.
+
+If the user provides an improper 'pixclock' value that makes the argumet
+of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a
+divide-by-zero bug in:
+ drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX)));
+
+The following log can reveal it:
+
+divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline]
+RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline]
+RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742
+Call Trace:
+ fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034
+ do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
+ fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
+
+Fix this by checking the argument of i740_calc_vclk() first.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/i740fb.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c
+index 52cce0db8bd3..ad5ced4ef972 100644
+--- a/drivers/video/fbdev/i740fb.c
++++ b/drivers/video/fbdev/i740fb.c
+@@ -400,7 +400,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
+ u32 xres, right, hslen, left, xtotal;
+ u32 yres, lower, vslen, upper, ytotal;
+ u32 vxres, xoffset, vyres, yoffset;
+- u32 bpp, base, dacspeed24, mem;
++ u32 bpp, base, dacspeed24, mem, freq;
+ u8 r7;
+ int i;
+
+@@ -643,7 +643,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
+ par->atc[VGA_ATC_OVERSCAN] = 0;
+
+ /* Calculate VCLK that most closely matches the requested dot clock */
+- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par);
++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3);
++ if (freq < I740_RFREQ_FIX) {
++ fb_dbg(info, "invalid pixclock\n");
++ freq = I740_RFREQ_FIX;
++ }
++ i740_calc_vclk(freq, par);
+
+ /* Since we program the clocks ourselves, always use VCLK2. */
+ par->misc |= 0x0C;
+--
+2.35.1
+
--- /dev/null
+From 560ebe59024a18a23a273f3ab85adee72a9acf16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jul 2022 17:47:27 +0200
+Subject: watchdog: export lockup_detector_reconfigure
+
+From: Laurent Dufour <ldufour@linux.ibm.com>
+
+[ Upstream commit 7c56a8733d0a2a4be2438a7512566e5ce552fccf ]
+
+In some circumstances it may be interesting to reconfigure the watchdog
+from inside the kernel.
+
+On PowerPC, this may helpful before and after a LPAR migration (LPM) is
+initiated, because it implies some latencies, watchdog, and especially NMI
+watchdog is expected to be triggered during this operation. Reconfiguring
+the watchdog with a factor, would prevent it to happen too frequently
+during LPM.
+
+Rename lockup_detector_reconfigure() as __lockup_detector_reconfigure() and
+create a new function lockup_detector_reconfigure() calling
+__lockup_detector_reconfigure() under the protection of watchdog_mutex.
+
+Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
+[mpe: Squash in build fix from Laurent, reported by Sachin]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220713154729.80789-3-ldufour@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/nmi.h | 2 ++
+ kernel/watchdog.c | 21 ++++++++++++++++-----
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/nmi.h b/include/linux/nmi.h
+index 750c7f395ca9..f700ff2df074 100644
+--- a/include/linux/nmi.h
++++ b/include/linux/nmi.h
+@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void);
+ int watchdog_nmi_enable(unsigned int cpu);
+ void watchdog_nmi_disable(unsigned int cpu);
+
++void lockup_detector_reconfigure(void);
++
+ /**
+ * touch_nmi_watchdog - restart NMI watchdog timeout.
+ *
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index 01bf977090dc..ec34d9f2eab2 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -518,7 +518,7 @@ int lockup_detector_offline_cpu(unsigned int cpu)
+ return 0;
+ }
+
+-static void lockup_detector_reconfigure(void)
++static void __lockup_detector_reconfigure(void)
+ {
+ cpus_read_lock();
+ watchdog_nmi_stop();
+@@ -538,6 +538,13 @@ static void lockup_detector_reconfigure(void)
+ __lockup_detector_cleanup();
+ }
+
++void lockup_detector_reconfigure(void)
++{
++ mutex_lock(&watchdog_mutex);
++ __lockup_detector_reconfigure();
++ mutex_unlock(&watchdog_mutex);
++}
++
+ /*
+ * Create the watchdog thread infrastructure and configure the detector(s).
+ *
+@@ -558,13 +565,13 @@ static __init void lockup_detector_setup(void)
+ return;
+
+ mutex_lock(&watchdog_mutex);
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ softlockup_initialized = true;
+ mutex_unlock(&watchdog_mutex);
+ }
+
+ #else /* CONFIG_SOFTLOCKUP_DETECTOR */
+-static void lockup_detector_reconfigure(void)
++static void __lockup_detector_reconfigure(void)
+ {
+ cpus_read_lock();
+ watchdog_nmi_stop();
+@@ -572,9 +579,13 @@ static void lockup_detector_reconfigure(void)
+ watchdog_nmi_start();
+ cpus_read_unlock();
+ }
++void lockup_detector_reconfigure(void)
++{
++ __lockup_detector_reconfigure();
++}
+ static inline void lockup_detector_setup(void)
+ {
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ }
+ #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */
+
+@@ -614,7 +625,7 @@ static void proc_watchdog_update(void)
+ {
+ /* Remove impossible cpus to keep sysctl output clean. */
+ cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask);
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ }
+
+ /*
+--
+2.35.1
+
--- /dev/null
+From d9e3d13806b61b0136243e4436ab610d0fa3bc37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jun 2022 11:35:01 +0900
+Subject: zram: do not lookup algorithm in backends table
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit dc89997264de565999a1cb55db3f295d3a8e457b ]
+
+Always use crypto_has_comp() so that crypto can lookup module, call
+usermodhelper to load the modules, wait for usermodhelper to finish and so
+on. Otherwise crypto will do all of these steps under CPU hot-plug lock
+and this looks like too much stuff to handle under the CPU hot-plug lock.
+Besides this can end up in a deadlock when usermodhelper triggers a code
+path that attempts to lock the CPU hot-plug lock, that zram already holds.
+
+An example of such deadlock:
+
+- path A. zram grabs CPU hot-plug lock, execs /sbin/modprobe from crypto
+ and waits for modprobe to finish
+
+disksize_store
+ zcomp_create
+ __cpuhp_state_add_instance
+ __cpuhp_state_add_instance_cpuslocked
+ zcomp_cpu_up_prepare
+ crypto_alloc_base
+ crypto_alg_mod_lookup
+ call_usermodehelper_exec
+ wait_for_completion_killable
+ do_wait_for_common
+ schedule
+
+- path B. async work kthread that brings in scsi device. It wants to
+ register CPUHP states at some point, and it needs the CPU hot-plug
+ lock for that, which is owned by zram.
+
+async_run_entry_fn
+ scsi_probe_and_add_lun
+ scsi_mq_alloc_queue
+ blk_mq_init_queue
+ blk_mq_init_allocated_queue
+ blk_mq_realloc_hw_ctxs
+ __cpuhp_state_add_instance
+ __cpuhp_state_add_instance_cpuslocked
+ mutex_lock
+ schedule
+
+- path C. modprobe sleeps, waiting for all aync works to finish.
+
+load_module
+ do_init_module
+ async_synchronize_full
+ async_synchronize_cookie_domain
+ schedule
+
+[senozhatsky@chromium.org: add comment]
+ Link: https://lkml.kernel.org/r/20220624060606.1014474-1-senozhatsky@chromium.org
+Link: https://lkml.kernel.org/r/20220622023501.517125-1-senozhatsky@chromium.org
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Nitin Gupta <ngupta@vflare.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zcomp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
+index 33e3b76c4fa9..b08650417bf0 100644
+--- a/drivers/block/zram/zcomp.c
++++ b/drivers/block/zram/zcomp.c
+@@ -61,12 +61,6 @@ static int zcomp_strm_init(struct zcomp_strm *zstrm, struct zcomp *comp)
+
+ bool zcomp_available_algorithm(const char *comp)
+ {
+- int i;
+-
+- i = sysfs_match_string(backends, comp);
+- if (i >= 0)
+- return true;
+-
+ /*
+ * Crypto does not ignore a trailing new line symbol,
+ * so make sure you don't supply a string containing
+@@ -215,6 +209,11 @@ struct zcomp *zcomp_create(const char *compress)
+ struct zcomp *comp;
+ int error;
+
++ /*
++ * Crypto API will execute /sbin/modprobe if the compression module
++ * is not loaded yet. We must do it here, otherwise we are about to
++ * call /sbin/modprobe under CPU hot-plug lock.
++ */
+ if (!zcomp_available_algorithm(compress))
+ return ERR_PTR(-EINVAL);
+
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
