--- /dev/null
+From ad49ca733d988232e4aa1f6f4a167d3569980175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 May 2025 15:30:10 +0000
+Subject: drm/xe: Use xe_mmio_read32() to read mtcfg register
+
+From: Shuicheng Lin <shuicheng.lin@intel.com>
+
+[ Upstream commit 84b6f8503b29a6cc5a82848253a97c09a95fdf49 ]
+
+The mtcfg register is a 32-bit register and should therefore be
+accessed using xe_mmio_read32().
+
+Other 3 changes per codestyle suggestion:
+"
+xe_mmio.c:83: CHECK: Alignment should match open parenthesis
+xe_mmio.c:131: CHECK: Comparison to NULL could be written "!xe->mmio.regs"
+xe_mmio.c:315: CHECK: line length of 103 exceeds 100 columns
+"
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Reviewed-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Link: https://lore.kernel.org/r/20250513153010.3464767-1-shuicheng.lin@intel.com
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+(cherry picked from commit d2662cf8f44a68deb6c76ad9f1d9f29dbf7ba601)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_mmio.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_mmio.c b/drivers/gpu/drm/xe/xe_mmio.c
+index a48f239cad1c5..9c2f60ce0c948 100644
+--- a/drivers/gpu/drm/xe/xe_mmio.c
++++ b/drivers/gpu/drm/xe/xe_mmio.c
+@@ -76,12 +76,12 @@ static void mmio_multi_tile_setup(struct xe_device *xe, size_t tile_mmio_size)
+ * is fine as it's going to the root tile's mmio, that's
+ * guaranteed to be initialized earlier in xe_mmio_init()
+ */
+- mtcfg = xe_mmio_read64_2x32(mmio, XEHP_MTCFG_ADDR);
++ mtcfg = xe_mmio_read32(mmio, XEHP_MTCFG_ADDR);
+ tile_count = REG_FIELD_GET(TILE_COUNT, mtcfg) + 1;
+
+ if (tile_count < xe->info.tile_count) {
+ drm_info(&xe->drm, "tile_count: %d, reduced_tile_count %d\n",
+- xe->info.tile_count, tile_count);
++ xe->info.tile_count, tile_count);
+ xe->info.tile_count = tile_count;
+
+ /*
+@@ -173,7 +173,7 @@ int xe_mmio_init(struct xe_device *xe)
+ */
+ xe->mmio.size = pci_resource_len(pdev, GTTMMADR_BAR);
+ xe->mmio.regs = pci_iomap(pdev, GTTMMADR_BAR, 0);
+- if (xe->mmio.regs == NULL) {
++ if (!xe->mmio.regs) {
+ drm_err(&xe->drm, "failed to map registers\n");
+ return -EIO;
+ }
+@@ -338,8 +338,8 @@ u64 xe_mmio_read64_2x32(struct xe_mmio *mmio, struct xe_reg reg)
+ return (u64)udw << 32 | ldw;
+ }
+
+-static int __xe_mmio_wait32(struct xe_mmio *mmio, struct xe_reg reg, u32 mask, u32 val, u32 timeout_us,
+- u32 *out_val, bool atomic, bool expect_match)
++static int __xe_mmio_wait32(struct xe_mmio *mmio, struct xe_reg reg, u32 mask, u32 val,
++ u32 timeout_us, u32 *out_val, bool atomic, bool expect_match)
+ {
+ ktime_t cur = ktime_get_raw();
+ const ktime_t end = ktime_add_us(cur, timeout_us);
+--
+2.39.5
+
--- /dev/null
+From d7375381f5360264ca68aaf436e90831d3f37083 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 May 2025 16:46:11 +0900
+Subject: ksmbd: fix stream write failure
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+[ Upstream commit 1f4bbedd4e5a69b01cde2cc21d01151ab2d0884f ]
+
+If there is no stream data in file, v_len is zero.
+So, If position(*pos) is zero, stream write will fail
+due to stream write position validation check.
+This patch reorganize stream write position validation.
+
+Fixes: 0ca6df4f40cf ("ksmbd: prevent out-of-bounds stream writes by validating *pos")
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/vfs.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/fs/smb/server/vfs.c b/fs/smb/server/vfs.c
+index 648efed5ff7de..474dc6e122c84 100644
+--- a/fs/smb/server/vfs.c
++++ b/fs/smb/server/vfs.c
+@@ -426,10 +426,15 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
+ ksmbd_debug(VFS, "write stream data pos : %llu, count : %zd\n",
+ *pos, count);
+
++ if (*pos >= XATTR_SIZE_MAX) {
++ pr_err("stream write position %lld is out of bounds\n", *pos);
++ return -EINVAL;
++ }
++
+ size = *pos + count;
+ if (size > XATTR_SIZE_MAX) {
+ size = XATTR_SIZE_MAX;
+- count = (*pos + count) - XATTR_SIZE_MAX;
++ count = XATTR_SIZE_MAX - *pos;
+ }
+
+ v_len = ksmbd_vfs_getcasexattr(idmap,
+@@ -443,13 +448,6 @@ static int ksmbd_vfs_stream_write(struct ksmbd_file *fp, char *buf, loff_t *pos,
+ goto out;
+ }
+
+- if (v_len <= *pos) {
+- pr_err("stream write position %lld is out of bounds (stream length: %zd)\n",
+- *pos, v_len);
+- err = -EINVAL;
+- goto out;
+- }
+-
+ if (v_len < size) {
+ wbuf = kvzalloc(size, KSMBD_DEFAULT_GFP);
+ if (!wbuf) {
+--
+2.39.5
+
--- /dev/null
+From 0b968a7dc62d7c23fd86ca6f4015f2310cee9053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 May 2025 20:50:18 -0400
+Subject: platform/x86: think-lmi: Fix attribute name usage for non-compliant
+ items
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mark Pearson <mpearson-lenovo@squebb.ca>
+
+[ Upstream commit 8508427a6e21c1ef01ae4c9f4e2675fc99deb949 ]
+
+A few, quite rare, WMI attributes have names that are not compatible with
+filenames, e.g. "Intel VT for Directed I/O (VT-d)".
+For these cases the '/' gets replaced with '\' for display, but doesn't
+get switched again when doing the WMI access.
+
+Fix this by keeping the original attribute name and using that for sending
+commands to the BIOS
+
+Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
+Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca>
+Link: https://lore.kernel.org/r/20250520005027.3840705-1-mpearson-lenovo@squebb.ca
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/think-lmi.c | 26 ++++++++++++++------------
+ drivers/platform/x86/think-lmi.h | 1 +
+ 2 files changed, 15 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
+index 323316ac6783a..e4b3b20d03f32 100644
+--- a/drivers/platform/x86/think-lmi.c
++++ b/drivers/platform/x86/think-lmi.c
+@@ -1065,8 +1065,8 @@ static ssize_t current_value_store(struct kobject *kobj,
+ ret = -EINVAL;
+ goto out;
+ }
+- set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,
+- new_setting, tlmi_priv.pwd_admin->signature);
++ set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->name,
++ new_setting, tlmi_priv.pwd_admin->signature);
+ if (!set_str) {
+ ret = -ENOMEM;
+ goto out;
+@@ -1096,7 +1096,7 @@ static ssize_t current_value_store(struct kobject *kobj,
+ goto out;
+ }
+
+- set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,
++ set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->name,
+ new_setting);
+ if (!set_str) {
+ ret = -ENOMEM;
+@@ -1124,11 +1124,11 @@ static ssize_t current_value_store(struct kobject *kobj,
+ }
+
+ if (auth_str)
+- set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->display_name,
+- new_setting, auth_str);
++ set_str = kasprintf(GFP_KERNEL, "%s,%s,%s", setting->name,
++ new_setting, auth_str);
+ else
+- set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->display_name,
+- new_setting);
++ set_str = kasprintf(GFP_KERNEL, "%s,%s;", setting->name,
++ new_setting);
+ if (!set_str) {
+ ret = -ENOMEM;
+ goto out;
+@@ -1633,9 +1633,6 @@ static int tlmi_analyze(void)
+ continue;
+ }
+
+- /* It is not allowed to have '/' for file name. Convert it into '\'. */
+- strreplace(item, '/', '\\');
+-
+ /* Remove the value part */
+ strreplace(item, ',', '\0');
+
+@@ -1647,11 +1644,16 @@ static int tlmi_analyze(void)
+ goto fail_clear_attr;
+ }
+ setting->index = i;
++
++ strscpy(setting->name, item);
++ /* It is not allowed to have '/' for file name. Convert it into '\'. */
++ strreplace(item, '/', '\\');
+ strscpy(setting->display_name, item);
++
+ /* If BIOS selections supported, load those */
+ if (tlmi_priv.can_get_bios_selections) {
+- ret = tlmi_get_bios_selections(setting->display_name,
+- &setting->possible_values);
++ ret = tlmi_get_bios_selections(setting->name,
++ &setting->possible_values);
+ if (ret || !setting->possible_values)
+ pr_info("Error retrieving possible values for %d : %s\n",
+ i, setting->display_name);
+diff --git a/drivers/platform/x86/think-lmi.h b/drivers/platform/x86/think-lmi.h
+index f267d8b46957e..95a3d935edaaf 100644
+--- a/drivers/platform/x86/think-lmi.h
++++ b/drivers/platform/x86/think-lmi.h
+@@ -88,6 +88,7 @@ struct tlmi_pwd_setting {
+ struct tlmi_attr_setting {
+ struct kobject kobj;
+ int index;
++ char name[TLMI_SETTINGS_MAXLEN];
+ char display_name[TLMI_SETTINGS_MAXLEN];
+ char *possible_values;
+ };
+--
+2.39.5
+
--- /dev/null
+From d048559560d8a756e309155e58e9359c577bfd23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 13 Apr 2025 15:58:48 +0200
+Subject: Revert "arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC
+ connection"
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 573f99c7585f597630f14596550c79e73ffaeef4 ]
+
+This reverts commit 531fdbeedeb89bd32018a35c6e137765c9cc9e97.
+
+Hardware that uses I2C wasn't designed with high speeds in mind, so
+communication with PMIC via RSB can intermittently fail. Go back to I2C
+as higher speed and efficiency isn't worth the trouble.
+
+Fixes: 531fdbeedeb8 ("arm64: dts: allwinner: h6: Use RSB for AXP805 PMIC connection")
+Link: https://github.com/LibreELEC/LibreELEC.tv/issues/7731
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20250413135848.67283-1-jernej.skrabec@gmail.com
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/allwinner/sun50i-h6-beelink-gs1.dts | 38 +++++++++----------
+ .../dts/allwinner/sun50i-h6-orangepi-3.dts | 14 +++----
+ .../dts/allwinner/sun50i-h6-orangepi.dtsi | 22 +++++------
+ 3 files changed, 37 insertions(+), 37 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+index 13a0e63afeaf3..2c64d834a2c4f 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+@@ -152,28 +152,12 @@
+ vcc-pg-supply = <®_aldo1>;
+ };
+
+-&r_ir {
+- linux,rc-map-name = "rc-beelink-gs1";
+- status = "okay";
+-};
+-
+-&r_pio {
+- /*
+- * FIXME: We can't add that supply for now since it would
+- * create a circular dependency between pinctrl, the regulator
+- * and the RSB Bus.
+- *
+- * vcc-pl-supply = <®_aldo1>;
+- */
+- vcc-pm-supply = <®_aldo1>;
+-};
+-
+-&r_rsb {
++&r_i2c {
+ status = "okay";
+
+- axp805: pmic@745 {
++ axp805: pmic@36 {
+ compatible = "x-powers,axp805", "x-powers,axp806";
+- reg = <0x745>;
++ reg = <0x36>;
+ interrupt-parent = <&r_intc>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+@@ -291,6 +275,22 @@
+ };
+ };
+
++&r_ir {
++ linux,rc-map-name = "rc-beelink-gs1";
++ status = "okay";
++};
++
++&r_pio {
++ /*
++ * PL0 and PL1 are used for PMIC I2C
++ * don't enable the pl-supply else
++ * it will fail at boot
++ *
++ * vcc-pl-supply = <®_aldo1>;
++ */
++ vcc-pm-supply = <®_aldo1>;
++};
++
+ &spdif {
+ pinctrl-names = "default";
+ pinctrl-0 = <&spdif_tx_pin>;
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts
+index ab87c3447cd78..f005072c68a16 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-3.dts
+@@ -176,16 +176,12 @@
+ vcc-pg-supply = <®_vcc_wifi_io>;
+ };
+
+-&r_ir {
+- status = "okay";
+-};
+-
+-&r_rsb {
++&r_i2c {
+ status = "okay";
+
+- axp805: pmic@745 {
++ axp805: pmic@36 {
+ compatible = "x-powers,axp805", "x-powers,axp806";
+- reg = <0x745>;
++ reg = <0x36>;
+ interrupt-parent = <&r_intc>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+@@ -296,6 +292,10 @@
+ };
+ };
+
++&r_ir {
++ status = "okay";
++};
++
+ &rtc {
+ clocks = <&ext_osc32k>;
+ };
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi
+index d05dc5d6e6b9f..e34dbb9920216 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi.dtsi
+@@ -113,20 +113,12 @@
+ vcc-pg-supply = <®_aldo1>;
+ };
+
+-&r_ir {
+- status = "okay";
+-};
+-
+-&r_pio {
+- vcc-pm-supply = <®_bldo3>;
+-};
+-
+-&r_rsb {
++&r_i2c {
+ status = "okay";
+
+- axp805: pmic@745 {
++ axp805: pmic@36 {
+ compatible = "x-powers,axp805", "x-powers,axp806";
+- reg = <0x745>;
++ reg = <0x36>;
+ interrupt-parent = <&r_intc>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_LOW>;
+ interrupt-controller;
+@@ -241,6 +233,14 @@
+ };
+ };
+
++&r_ir {
++ status = "okay";
++};
++
++&r_pio {
++ vcc-pm-supply = <®_bldo3>;
++};
++
+ &rtc {
+ clocks = <&ext_osc32k>;
+ };
+--
+2.39.5
+
nilfs2-fix-deadlock-warnings-caused-by-lock-dependency-in-init_nilfs.patch
bluetooth-btmtksdio-check-function-enabled-before-doing-close.patch
bluetooth-btmtksdio-do-close-if-sdio-card-removed-without-close.patch
+revert-arm64-dts-allwinner-h6-use-rsb-for-axp805-pmi.patch
+ksmbd-fix-stream-write-failure.patch
+platform-x86-think-lmi-fix-attribute-name-usage-for-.patch
+spi-use-container_of_cont-for-to_spi_device.patch
+spi-spi-fsl-dspi-restrict-register-range-for-regmap-.patch
+spi-spi-fsl-dspi-halt-the-module-after-a-new-message.patch
+spi-spi-fsl-dspi-reset-sr-flags-before-sending-a-new.patch
+drm-xe-use-xe_mmio_read32-to-read-mtcfg-register.patch
--- /dev/null
+From 05d455842cd62361b082f4fe13a1bcbd44d52c11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:31 +0100
+Subject: spi: spi-fsl-dspi: Halt the module after a new message transfer
+
+From: Bogdan-Gabriel Roman <bogdan-gabriel.roman@nxp.com>
+
+[ Upstream commit 8a30a6d35a11ff5ccdede7d6740765685385a917 ]
+
+The XSPI mode implementation in this driver still uses the EOQ flag to
+signal the last word in a transmission and deassert the PCS signal.
+However, at speeds lower than ~200kHZ, the PCS signal seems to remain
+asserted even when SR[EOQF] = 1 indicates the end of a transmission.
+This is a problem for target devices which require the deassertation of
+the PCS signal between transfers.
+
+Hence, this commit 'forces' the deassertation of the PCS by stopping the
+module through MCR[HALT] after completing a new transfer. According to
+the reference manual, the module stops or transitions from the Running
+state to the Stopped state after the current frame, when any one of the
+following conditions exist:
+- The value of SR[EOQF] = 1.
+- The chip is in Debug mode and the value of MCR[FRZ] = 1.
+- The value of MCR[HALT] = 1.
+
+This shouldn't be done if the last transfer in the message has cs_change
+set.
+
+Fixes: ea93ed4c181b ("spi: spi-fsl-dspi: Use EOQ for last word in buffer even for XSPI mode")
+Signed-off-by: Bogdan-Gabriel Roman <bogdan-gabriel.roman@nxp.com>
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-2-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index effb460d436da..1fa96e8189cfa 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -62,6 +62,7 @@
+ #define SPI_SR_TFIWF BIT(18)
+ #define SPI_SR_RFDF BIT(17)
+ #define SPI_SR_CMDFFF BIT(16)
++#define SPI_SR_TXRXS BIT(30)
+ #define SPI_SR_CLEAR (SPI_SR_TCFQF | \
+ SPI_SR_TFUF | SPI_SR_TFFF | \
+ SPI_SR_CMDTCF | SPI_SR_SPEF | \
+@@ -921,9 +922,20 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ struct spi_transfer *transfer;
+ bool cs = false;
+ int status = 0;
++ u32 val = 0;
++ bool cs_change = false;
+
+ message->actual_length = 0;
+
++ /* Put DSPI in running mode if halted. */
++ regmap_read(dspi->regmap, SPI_MCR, &val);
++ if (val & SPI_MCR_HALT) {
++ regmap_update_bits(dspi->regmap, SPI_MCR, SPI_MCR_HALT, 0);
++ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 &&
++ !(val & SPI_SR_TXRXS))
++ ;
++ }
++
+ list_for_each_entry(transfer, &message->transfers, transfer_list) {
+ dspi->cur_transfer = transfer;
+ dspi->cur_msg = message;
+@@ -953,6 +965,7 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ dspi->tx_cmd |= SPI_PUSHR_CMD_CONT;
+ }
+
++ cs_change = transfer->cs_change;
+ dspi->tx = transfer->tx_buf;
+ dspi->rx = transfer->rx_buf;
+ dspi->len = transfer->len;
+@@ -988,6 +1001,15 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ dspi_deassert_cs(spi, &cs);
+ }
+
++ if (status || !cs_change) {
++ /* Put DSPI in stop mode */
++ regmap_update_bits(dspi->regmap, SPI_MCR,
++ SPI_MCR_HALT, SPI_MCR_HALT);
++ while (regmap_read(dspi->regmap, SPI_SR, &val) >= 0 &&
++ val & SPI_SR_TXRXS)
++ ;
++ }
++
+ message->status = status;
+ spi_finalize_current_message(ctlr);
+
+@@ -1245,6 +1267,8 @@ static int dspi_init(struct fsl_dspi *dspi)
+ if (!spi_controller_is_target(dspi->ctlr))
+ mcr |= SPI_MCR_HOST;
+
++ mcr |= SPI_MCR_HALT;
++
+ regmap_write(dspi->regmap, SPI_MCR, mcr);
+ regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR);
+
+--
+2.39.5
+
--- /dev/null
+From db5ac9e6c9bb961ef930e4274f939ad3a9ae0cb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:32 +0100
+Subject: spi: spi-fsl-dspi: Reset SR flags before sending a new message
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 7aba292eb15389073c7f3bd7847e3862dfdf604d ]
+
+If, in a previous transfer, the controller sends more data than expected
+by the DSPI target, SR.RFDF (RX FIFO is not empty) will remain asserted.
+When flushing the FIFOs at the beginning of a new transfer (writing 1
+into MCR.CLR_TXF and MCR.CLR_RXF), SR.RFDF should also be cleared.
+Otherwise, when running in target mode with DMA, if SR.RFDF remains
+asserted, the DMA callback will be fired before the controller sends any
+data.
+
+Take this opportunity to reset all Status Register fields.
+
+Fixes: 5ce3cc567471 ("spi: spi-fsl-dspi: Provide support for DSPI slave mode operation (Vybryd vf610)")
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-3-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 1fa96e8189cfa..863781ba6c160 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -975,6 +975,8 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,
+ SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF,
+ SPI_MCR_CLR_TXF | SPI_MCR_CLR_RXF);
+
++ regmap_write(dspi->regmap, SPI_SR, SPI_SR_CLEAR);
++
+ spi_take_timestamp_pre(dspi->ctlr, dspi->cur_transfer,
+ dspi->progress, !dspi->irq);
+
+--
+2.39.5
+
--- /dev/null
+From cd5079dffd6a90f7aa0c5d6204a84410c07f64ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 15:51:30 +0100
+Subject: spi: spi-fsl-dspi: restrict register range for regmap access
+
+From: Larisa Grigore <larisa.grigore@nxp.com>
+
+[ Upstream commit 283ae0c65e9c592f4a1ba4f31917f5e766da7f31 ]
+
+DSPI registers are NOT continuous, some registers are reserved and
+accessing them from userspace will trigger external abort, add regmap
+register access table to avoid below abort.
+
+ For example on S32G:
+
+ # cat /sys/kernel/debug/regmap/401d8000.spi/registers
+
+ Internal error: synchronous external abort: 96000210 1 PREEMPT SMP
+ ...
+ Call trace:
+ regmap_mmio_read32le+0x24/0x48
+ regmap_mmio_read+0x48/0x70
+ _regmap_bus_reg_read+0x38/0x48
+ _regmap_read+0x68/0x1b0
+ regmap_read+0x50/0x78
+ regmap_read_debugfs+0x120/0x338
+
+Fixes: 1acbdeb92c87 ("spi/fsl-dspi: Convert to use regmap and add big-endian support")
+Co-developed-by: Xulin Sun <xulin.sun@windriver.com>
+Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
+Signed-off-by: Larisa Grigore <larisa.grigore@nxp.com>
+Signed-off-by: James Clark <james.clark@linaro.org>
+Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-1-bea884630cfb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-dspi.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
+index 067c954cb6ea0..effb460d436da 100644
+--- a/drivers/spi/spi-fsl-dspi.c
++++ b/drivers/spi/spi-fsl-dspi.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0+
+ //
+ // Copyright 2013 Freescale Semiconductor, Inc.
+-// Copyright 2020 NXP
++// Copyright 2020-2025 NXP
+ //
+ // Freescale DSPI driver
+ // This file contains a driver for the Freescale DSPI
+@@ -1167,6 +1167,20 @@ static int dspi_resume(struct device *dev)
+
+ static SIMPLE_DEV_PM_OPS(dspi_pm, dspi_suspend, dspi_resume);
+
++static const struct regmap_range dspi_yes_ranges[] = {
++ regmap_reg_range(SPI_MCR, SPI_MCR),
++ regmap_reg_range(SPI_TCR, SPI_CTAR(3)),
++ regmap_reg_range(SPI_SR, SPI_TXFR3),
++ regmap_reg_range(SPI_RXFR0, SPI_RXFR3),
++ regmap_reg_range(SPI_CTARE(0), SPI_CTARE(3)),
++ regmap_reg_range(SPI_SREX, SPI_SREX),
++};
++
++static const struct regmap_access_table dspi_access_table = {
++ .yes_ranges = dspi_yes_ranges,
++ .n_yes_ranges = ARRAY_SIZE(dspi_yes_ranges),
++};
++
+ static const struct regmap_range dspi_volatile_ranges[] = {
+ regmap_reg_range(SPI_MCR, SPI_TCR),
+ regmap_reg_range(SPI_SR, SPI_SR),
+@@ -1184,6 +1198,8 @@ static const struct regmap_config dspi_regmap_config = {
+ .reg_stride = 4,
+ .max_register = 0x88,
+ .volatile_table = &dspi_volatile_table,
++ .rd_table = &dspi_access_table,
++ .wr_table = &dspi_access_table,
+ };
+
+ static const struct regmap_range dspi_xspi_volatile_ranges[] = {
+@@ -1205,6 +1221,8 @@ static const struct regmap_config dspi_xspi_regmap_config[] = {
+ .reg_stride = 4,
+ .max_register = 0x13c,
+ .volatile_table = &dspi_xspi_volatile_table,
++ .rd_table = &dspi_access_table,
++ .wr_table = &dspi_access_table,
+ },
+ {
+ .name = "pushr",
+--
+2.39.5
+
--- /dev/null
+From 35a0f10a708f5015539304d82ad42f52fa8ee622 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 May 2025 12:47:31 +0200
+Subject: spi: use container_of_cont() for to_spi_device()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 1007ae0d464ceb55a3740634790521d3543aaab9 ]
+
+Some places in the spi core pass in a const pointer to a device and the
+default container_of() casts that away, which is not a good idea.
+Preserve the proper const attribute by using container_of_const() for
+to_spi_device() instead, which is what it was designed for.
+
+Note, this removes the NULL check for a device pointer in the call, but
+no one was ever checking for that return value, and a device pointer
+should never be NULL overall anyway, so this should be a safe change.
+
+Cc: Mark Brown <broonie@kernel.org>
+Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Link: https://patch.msgid.link/2025052230-fidgeting-stooge-66f5@gregkh
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/spi/spi.h | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index 8497f4747e24d..660725dfd6fb6 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -247,10 +247,7 @@ struct spi_device {
+ static_assert((SPI_MODE_KERNEL_MASK & SPI_MODE_USER_MASK) == 0,
+ "SPI_MODE_USER_MASK & SPI_MODE_KERNEL_MASK must not overlap");
+
+-static inline struct spi_device *to_spi_device(const struct device *dev)
+-{
+- return dev ? container_of(dev, struct spi_device, dev) : NULL;
+-}
++#define to_spi_device(__dev) container_of_const(__dev, struct spi_device, dev)
+
+ /* Most drivers won't need to care about device refcounting */
+ static inline struct spi_device *spi_dev_get(struct spi_device *spi)
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
