From 5cbef849f9899a8070be5bfa409509842c406b63 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 22 Mar 2024 12:53:56 -0400
Subject: [PATCH] Fixes for 5.15

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...dle-fix-memory-leak-in-acpi_processo.patch |   61 +
 ...d-infinity-laptops-to-irq1_edge_low_.patch |   51 +
 ...d-maibenben-x577-to-irq1_edge_low_fo.patch |   49 +
 ...-irq-override-on-lunnen-ground-lapto.patch |   51 +
 ...x-device-check-notification-handling.patch |   57 +
 ...-data-race-of-gc_in_progress-in-wait.patch |   39 +
 ...ide-silly-rename-files-from-userspac.patch |   55 +
 ...-fix-alc285-issues-on-hp-envy-x360-l.patch |  147 ++
 .../alsa-seq-fix-function-cast-warnings.patch |   95 ++
 ...top-parsing-channels-bits-when-all-c.patch |   43 +
 ...ntial-use-after-free-problem-in-aoec.patch |   88 +
 ...emove-linux-fb.h-from-backlight-code.patch |   98 ++
 ...view-fix-development-chip-rom-compat.patch |   43 +
 ...app4-fix-typo-in-the-qca-switch-regi.patch |   42 +
 ...app4-move-phy-reset-into-switch-node.patch |   47 +
 ...app4-move-the-internal-switch-phys-u.patch |   98 ++
 ...r8a73a4-fix-external-clocks-and-cloc.patch |   82 +
 ...-kontron-add-support-for-ultra-high-.patch |   91 +
 ...-kontron-disable-pull-resistors-for-.patch |   80 +
 ...-kontron-disable-pullups-for-i2c-sig.patch |   56 +
 ...-kontron-disable-pullups-for-onboard.patch |   58 +
 ...-kontron-use-the-vselect-signal-to-s.patch |   82 +
 ...mx8mm-venice-gw71xx-fix-usb-otg-vbus.patch |   85 +
 ...l-reorder-crypto-interrupts-on-armad.patch |   88 +
 ...ek-mt7622-add-missing-device_type-to.patch |   57 +
 ...m64-dts-mt8183-kukui-add-type-c-node.patch |   54 +
 ...-kukui-split-out-keyboard-node-and-d.patch |  107 ++
 ...-move-crosec-base-detection-node-to-.patch |  106 ++
 ...sm8996-define-ufs-unipro-clock-limit.patch |   42 +
 ...-dts-qcom-msm8996-fix-ufs-phy-clocks.patch |   42 +
 ...sm8996-move-clock-cells-to-qmp-phy-c.patch |  150 ++
 ...sm8998-declare-vls-clamp-register-fo.patch |   53 +
 ...com-msm8998-drop-usb-phy-clock-index.patch |   38 +
 ...-dts-qcom-msm8998-fix-ufs-phy-clocks.patch |   51 +
 ...sm8998-switch-usb-qmp-phy-to-new-sty.patch |   85 +
 ...4-dts-qcom-sdm845-fix-ufs-phy-clocks.patch |   51 +
 ...dm845-switch-ufs-qmp-phy-to-new-styl.patch |   70 +
 ...4-dts-qcom-sm8150-fix-ufs-phy-clocks.patch |   51 +
 ...m8150-switch-ufs-qmp-phy-to-new-styl.patch |   71 +
 ...4-dts-qcom-sm8250-fix-ufs-phy-clocks.patch |   51 +
 ...m8250-switch-ufs-qmp-phy-to-new-styl.patch |   71 +
 ...as-r8a779a0-correct-avb-01-reg-sizes.patch |   48 +
 ...s-r8a779a0-update-to-r-car-gen4-comp.patch |  143 ++
 ...u-fix-function-pointer-type-mismatch.patch |   85 +
 ...dm-interface-add-frame-rate-constrai.patch |   86 +
 ...dm-interface-fix-mclk-setup-without-.patch |   49 +
 ...5-fix-function-pointer-type-mismatch.patch |   83 +
 .../asoc-meson-use-dev_err_probe-helper.patch |  420 +++++
 ...-fully-initialize-backlight_properti.patch |   37 +
 ...a-don-t-set-bl-props.brightness-in-g.patch |   77 +
 ...a-initialize-backlight_properties-on.patch |   37 +
 ...-fully-initialize-backlight_properti.patch |   37 +
 ...-fully-initialize-backlight_properti.patch |   37 +
 ...ci_core-fix-possible-buffer-overflow.patch |   36 +
 ...a-add-support-for-qti-bluetooth-chip.patch |  275 +++
 ...a-don-t-use-is_err_or_null-with-gpio.patch |   59 +
 ...-superfluous-call-to-hci_conn_check_.patch |   62 +
 ...hash-overflow-check-on-32-bit-arches.patch |   66 +
 ...htab-overflow-check-on-32-bit-arches.patch |   65 +
 ...kmap-overflow-check-on-32-bit-arches.patch |   61 +
 ...n_-lock-unlock-helpers-with-notrace-.patch |  133 ++
 ...o_ip_getsockopt-to-take-the-sockptr_.patch |  382 +++++
 ...k_getsockopt-to-take-the-sockptr_t-a.patch |  236 +++
 ...l-silence-build-warning-about-calloc.patch |   54 +
 ...nect-update-dependency-to-arch_tegra.patch |   47 +
 ...lk-fix-clk_core_get-null-dereference.patch |   56 +
 ...3519-release-the-correct-number-of-g.patch |   39 +
 ...-hi3559a-fix-an-erroneous-devm_kfree.patch |   42 +
 ...dd-missing-clocks-to-axg_clk_regmaps.patch |   83 +
 ...sdm845-adjust-internal-gdsc-wait-tim.patch |   38 +
 ...-sc8180x-add-missing-ufs-qref-clocks.patch |   84 +
 ...et-commonize-the-de-assert-functions.patch |   69 +
 ...nsure-write-completion-on-reset-de-a.patch |   45 +
 ...-null-pointer-dereference-caused-by-.patch |   74 +
 ...avs-cpufreq-add-check-for-cpufreq_cp.patch |   39 +
 ...plicitly-include-correct-dt-includes.patch |  157 ++
 ...-hw-don-t-error-out-if-supply-is-not.patch |   48 +
 ...-hw-wait-for-cpu-supplies-before-pro.patch |   72 +
 ...o-arm-sha-fix-function-cast-warnings.patch |  115 ++
 ...ilinx-call-finalize-with-bh-disabled.patch |   72 +
 ...he-resume-method-on-internal-suspend.patch |  123 ++
 ...e-positive-for-requeue-needed-during.patch |   46 +
 ...10-adma-update-dependency-to-arch_te.patch |   60 +
 ...andle-use-kzalloc-to-fix-kernel-info.patch |   72 +
 ...fix-a-potential-buffer-overflow-in-d.patch |   46 +
 ...fix-potential-null-pointer-dereferen.patch |   57 +
 ...issing-break-in-atom_arg_imm-case-of.patch |   48 +
 ...-t-treat-0-as-1-in-drm_fixp2int_ceil.patch |   41 +
 ...ima-fix-a-memleak-in-lima_heap_alloc.patch |   72 +
 ...-fix-dsi-rgb666-formats-and-definiti.patch |   78 +
 ...-a-null-pointer-crash-in-mtk_drm_crt.patch |   81 +
 ...division-of-drm_display_mode-s-hskew.patch |   49 +
 ...x-wrong-firmware-size-logging-in-ni_.patch |   39 +
 ...-rockchip-inno_hdmi-fix-video-timing.patch |   51 +
 ...hip-lvds-do-not-overwrite-error-code.patch |   38 +
 ...s-do-not-print-scary-message-when-pr.patch |   41 +
 ...-allow-changing-plld-rate-on-tegra30.patch |  244 +++
 ...fix-pm-disable-depth-imbalance-in-te.patch |   77 +
 .../drm-tegra-dpaux-populate-aux-bus.patch    |   62 +
 ...d-missing-check-for-of_find_device_b.patch |   41 +
 ...x-missing-pm_runtime_disable-in-the-.patch |   37 +
 ...x-some-error-handling-paths-in-tegra.patch |  116 ++
 ...ke-use-of-the-helper-function-dev_er.patch |   71 +
 ...-fix-missing-i2c_put_adapter-in-the-.patch |   75 +
 ...m_gem_object-ref-on-error-in-tegra_f.patch |   40 +
 ...x-missing-clk_put-in-the-error-handl.patch |   50 +
 ...x-some-error-handling-paths-in-tegra.patch |   81 +
 ...-tidss-fix-initial-plane-zpos-values.patch |   56 +
 .../drm-ttm-add-ttm_resource_fini-v2.patch    |  300 ++++
 ...-a-memleak-in-vmw_gmrid_man_get_node.patch |   41 +
 ...ock-qcom-add-missing-ufs-qref-clocks.patch |   38 +
 ...x-reserve_cblocks-counting-error-whe.patch |  132 ++
 ...x-to-check-unreleased-compressed-clu.patch |   56 +
 ...x-to-cover-normal-cluster-write-with.patch |  125 ++
 ...lidate-meta_mapping-before-dio-write.patch |   89 +
 .../f2fs-implement-iomap-operations.patch     |  123 ++
 ...meta-pages-only-for-post_read-requir.patch |  108 ++
 ...te-meta_mapping-before-ipu-dio-write.patch |   80 +
 .../f2fs-multidevice-support-direct-io.patch  |  390 +++++
 ...k-memory-cost-by-using-bitfield-in-s.patch |  231 +++
 ...gestion_wait-calls-with-io_schedule_.patch |  150 ++
 ...work-stack-allocation-hack-for-clang.patch |   67 +
 ...update-hpd-sensor-structure-elements.patch |   44 +
 ...iddleclick_workaround-sysfs-knob-for.patch |  134 ++
 .../igb-fix-missing-time-sync-events.patch    |   94 +
 ...and-extts-isr-logic-to-separate-func.patch |  141 ++
 ...te-data-races-around-inet_diag_table.patch |   58 +
 .../iommu-amd-mark-interrupt-as-managed.patch |   69 +
 ...-issue-ats-invalidation-request-when.patch |  203 +++
 ...ct-parameter-validation-in-the-ip_mr.patch |   45 +
 ...flush-route-cache-when-rule-is-chang.patch |   55 +
 ...e-one-synchronize_net-barrier-in-ipv.patch |   43 +
 ...ct-parameter-validation-in-the-pppol.patch |   47 +
 ...13-unlock-mutex-before-destroying-it.patch |   37 +
 ...-missing-timer-cleanup-and-flash-gpi.patch |   41 +
 ...an-invalid-format-specifier-in-an-as.patch |   43 +
 ..._set_def_max_entries-for-inner_maps-.patch |   54 +
 ...d_closing-when-the-raid-is-about-to-.patch |   73 +
 ...nds-avoid-stack-overflow-warnings-wi.patch |   95 ++
 ...dia-edia-dvbdev-fix-a-use-after-free.patch |   84 +
 ...otate-unchecked-call-to-media_device.patch |   42 +
 ...-check-of-return-value-of-go7007_rea.patch |   40 +
 ...fix-a-memleak-in-go7007_load_encoder.patch |   57 +
 ...aler-fix-v4l2_ctrl_handler-memory-le.patch |   35 +
 ...codec-avoid-wcast-function-type-stri.patch |   93 +
 ...rusb2-fix-pvr2_stream_callback-casts.patch |  115 ++
 ...2-fix-uaf-in-pvr2_context_set_notify.patch |   75 +
 ...-pvrusb2-remove-redundant-null-check.patch |   41 +
 ...i-di-fix-chroma-difference-threshold.patch |   36 +
 ...edia-sun8i-di-fix-coefficient-writes.patch |  102 ++
 ...-sun8i-di-fix-power-on-off-sequences.patch |   88 +
 ...egister-v4l2-async-device-only-after.patch |   51 +
 ...fix-two-memleaks-in-budget_av_attach.patch |   52 +
 ...em-fix-a-memleak-in-v4l2_m2m_registe.patch |   48 +
 ...2-tpg-fix-some-memleaks-in-tpg_alloc.patch |  112 ++
 ...r-call-of_node_put-only-when-of_pars.patch |   42 +
 ...of_node_put-only-when-of_parse_phand.patch |   42 +
 ...move-an-incorrect-release_mem_region.patch |   50 +
 ...rt-for-default-value-for-module-asyn.patch |  100 ++
 .../modules-wait-do_free_init-correctly.patch |  125 ++
 ...-core-fix-flash-size-larger-than-32-.patch |   39 +
 ...pc32xx_mlc-fix-irq-handler-prototype.patch |   52 +
 .../nbd-null-check-for-nla_nest_start.patch   |   43 +
 ...v-fix-build-warning-for-ethh-set-but.patch |   49 +
 ...getsockopt-to-take-the-sk-ptr-instea.patch |   80 +
 .../net-ena-remove-ena_select_queue.patch     |   66 +
 ...nel-crash-when-1588-is-received-on-h.patch |   84 +
 ...t-duplex-configure-error-in-imp-rese.patch |   44 +
 ...ke-sure-to-pull-inner-header-in-ip_t.patch |  125 ++
 ...rrect-parameter-validation-in-the-kc.patch |   45 +
 ...enable-rgmii-mode-if-phy_interface_i.patch |   59 +
 ...822-fix-rgmii-tx-delay-configuration.patch |   91 +
 ...get_internal_delay-accessing-an-empt.patch |   48 +
 ...-an-off-by-one-in-rpc_sockaddr2uaddr.patch |   42 +
 ...rrect-parameter-validation-in-the-x2.patch |   47 +
 ...ndle-acti_netdevs-allocation-failure.patch |   45 +
 ...fs-fix-an-off-by-one-in-root_nfs_cat.patch |   42 +
 ...ix-listxattr-maximum-xdr-buffer-size.patch |   60 +
 ..._listxattr-kernel-bug-at-mm-usercopy.patch |   99 ++
 ...ssible-memory-leak-in-pci_vntb_probe.patch |   40 +
 ...ble-name-leak-in-ntb_register_device.patch |   85 +
 ...ugfs-fix-warning-around-icc_get_name.patch |   50 +
 ...rootport-attribute-paths-in-abi-docs.patch |   52 +
 ...-all-tlp-prefixes-not-just-the-first.patch |   45 +
 ...pport-ntb-transfer-between-rc-and-ep.patch | 1515 +++++++++++++++++
 ..._is_disconnected-helper-public-for-o.patch |   67 +
 ...650se-root-port-extended-tags-as-bro.patch |   56 +
 ...-sleeping-issue-in-a-rcu-read-sectio.patch |   38 +
 ...x-an-error-handling-path-in-switchte.patch |   51 +
 ...uplicate-initialization-of-data-id-i.patch |   38 +
 ...possible-incorrect-free-in-record__s.patch |   40 +
 .../perf-stat-avoid-metric-only-segv.patch    |   43 +
 ...free-strlist-on-normal-path-in-threa.patch |   45 +
 ...-drop-bogus-slew-rate-register-range.patch |   40 +
 ...6xx-fix-no-previous-prototype-for-av.patch |   53 +
 ...lining-of-arch_vmap_p-u-m-d_supporte.patch |   65 +
 ...fix-the-h_get_perf_counter_info-hcal.patch |  118 ++
 .../printk-add-panic_in_progress-helper.patch |   46 +
 ...assing-console-lock-owner-completely.patch |  116 ++
 ...convert-to-platform-remove-callback-.patch |   65 +
 ...fix-clock-imbalance-related-to-suspe.patch |   41 +
 ...hlcdc-use-consistent-variable-naming.patch |  210 +++
 ...ure-for-st-pwm-num-chan-st-capture-n.patch |   62 +
 .../pwm-sti-implement-.apply-callback.patch   |   71 +
 ...x-potential-null-pointer-dereference.patch |  278 +++
 ...-annotations-of-inode-dquot-pointers.patch |  253 +++
 .../quota-simplify-drop_dquot_ref.patch       |  132 ++
 ...a-race-between-mad_client-and-cm_cli.patch |  133 ++
 ...eck-strnlen-return-len-in-sysfs-mpat.patch |   41 +
 ...-register-event-handler-until-srpt-d.patch |   61 +
 ...tc-test-fix-invalid-format-specifier.patch |   41 +
 .../s390-dasd-add-autoquiesce-feature.patch   |  216 +++
 .../s390-dasd-add-copy-pair-setup.patch       |  858 ++++++++++
 .../s390-dasd-add-query-pprc-function.patch   |  181 ++
 ...fix-double-module-refcount-decrement.patch |   58 +
 ...lock-allocation-in-separate-function.patch |   88 +
 ...asd-use-dev_-for-device-log-messages.patch |  172 ++
 .../s390-vdso-drop-fpic-from-ldflags.patch    |   66 +
 ...the-scheduling-domain-into-account-i.patch |   55 +
 ...ction-pointer-type-mismatch-for-hcb_.patch |  152 ++
 ...siostor-avoid-function-pointer-casts.patch |  135 ++
 ...-map_in_maps-with-bpf_map_type_perf_.patch |   98 ++
 queue-5.15/series                             |  254 +++
 ...te-data-races-around-sock_diag_handl.patch |   74 +
 ...x-section-mismatch-in-leon_pci_grpci.patch |   62 +
 ...0-add-check-for-usbnet_get_endpoints.patch |   40 +
 ...me-memleaks-in-gssx_dec_option_array.patch |   86 +
 ...t-parameter-validation-in-the-do_tcp.patch |   47 +
 ...-test-fix-incorrect-format-specifier.patch |   40 +
 ...cross-timestamp-interpolation-corner.patch |  114 ++
 ...cross-timestamp-interpolation-for-no.patch |   58 +
 ...cross-timestamp-interpolation-on-cou.patch |   43 +
 ...t-parameter-validation-in-the-udp_li.patch |   47 +
 ...tm32_iwdg-initialize-default-timeout.patch |   59 +
 ...null-pointer-dereference-in-ath10k_w.patch |   42 +
 ...-all-of-ath9k_wmi_event_tasklet-unti.patch |  124 ++
 .../wifi-b43-disable-qos-for-bcm4331.patch    |   68 +
 ...rrect-queue-in-dma-worker-when-qos-i.patch |   66 +
 ...ke-correct-queue-in-dma-tx-path-when.patch |  167 ++
 ...ke-correct-queue-in-pio-tx-path-when.patch |   59 +
 ...rcmsmac-avoid-function-pointer-casts.patch |   81 +
 ...lwifi-dbg-tlv-ensure-nul-termination.patch |   43 +
 ...wlwifi-fix-ewrd-table-validity-check.patch |   44 +
 ...vm-don-t-set-replay-counters-to-0xff.patch |   52 +
 ...vm-report-beacon-protection-failures.patch |  105 ++
 ...x-some-memleaks-in-lbs_allocate_cmd_.patch |   57 +
 ...ugfs-drop-unnecessary-error-check-fo.patch |   46 +
 ...add-cancel_work_sync-for-c2hcmd_work.patch |   37 +
 ...fi-rtw88-8821c-fix-false-alarm-count.patch |   40 +
 ...i-wilc1000-fix-declarations-ordering.patch |   49 +
 ...x-multi-vif-management-when-deleting.patch |   54 +
 ...lc1000-fix-rcu-usage-in-connect-path.patch |  176 ++
 ...event-use-after-free-on-vif-when-cle.patch |  172 ++
 ...move-redundant-flush_workqueue-calls.patch |  243 +++
 ...ignore-relocations-in-.notes-section.patch |   54 +
 255 files changed, 22945 insertions(+)
 create mode 100644 queue-5.15/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
 create mode 100644 queue-5.15/acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch
 create mode 100644 queue-5.15/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
 create mode 100644 queue-5.15/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
 create mode 100644 queue-5.15/acpi-scan-fix-device-check-notification-handling.patch
 create mode 100644 queue-5.15/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
 create mode 100644 queue-5.15/afs-revert-afs-hide-silly-rename-files-from-userspac.patch
 create mode 100644 queue-5.15/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
 create mode 100644 queue-5.15/alsa-seq-fix-function-cast-warnings.patch
 create mode 100644 queue-5.15/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
 create mode 100644 queue-5.15/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
 create mode 100644 queue-5.15/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
 create mode 100644 queue-5.15/arm-dts-arm-realview-fix-development-chip-rom-compat.patch
 create mode 100644 queue-5.15/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
 create mode 100644 queue-5.15/arm-dts-imx6dl-yapp4-move-phy-reset-into-switch-node.patch
 create mode 100644 queue-5.15/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
 create mode 100644 queue-5.15/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
 create mode 100644 queue-5.15/arm64-dts-imx8mm-kontron-add-support-for-ultra-high-.patch
 create mode 100644 queue-5.15/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
 create mode 100644 queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
 create mode 100644 queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
 create mode 100644 queue-5.15/arm64-dts-imx8mm-kontron-use-the-vselect-signal-to-s.patch
 create mode 100644 queue-5.15/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
 create mode 100644 queue-5.15/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
 create mode 100644 queue-5.15/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
 create mode 100644 queue-5.15/arm64-dts-mt8183-kukui-add-type-c-node.patch
 create mode 100644 queue-5.15/arm64-dts-mt8183-kukui-split-out-keyboard-node-and-d.patch
 create mode 100644 queue-5.15/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-msm8996-move-clock-cells-to-qmp-phy-c.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-msm8998-drop-usb-phy-clock-index.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
 create mode 100644 queue-5.15/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch
 create mode 100644 queue-5.15/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
 create mode 100644 queue-5.15/arm64-dts-renesas-r8a779a0-update-to-r-car-gen4-comp.patch
 create mode 100644 queue-5.15/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
 create mode 100644 queue-5.15/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
 create mode 100644 queue-5.15/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
 create mode 100644 queue-5.15/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
 create mode 100644 queue-5.15/asoc-meson-use-dev_err_probe-helper.patch
 create mode 100644 queue-5.15/backlight-da9052-fully-initialize-backlight_properti.patch
 create mode 100644 queue-5.15/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
 create mode 100644 queue-5.15/backlight-lm3630a-initialize-backlight_properties-on.patch
 create mode 100644 queue-5.15/backlight-lm3639-fully-initialize-backlight_properti.patch
 create mode 100644 queue-5.15/backlight-lp8788-fully-initialize-backlight_properti.patch
 create mode 100644 queue-5.15/bluetooth-hci_core-fix-possible-buffer-overflow.patch
 create mode 100644 queue-5.15/bluetooth-hci_qca-add-support-for-qti-bluetooth-chip.patch
 create mode 100644 queue-5.15/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
 create mode 100644 queue-5.15/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
 create mode 100644 queue-5.15/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
 create mode 100644 queue-5.15/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
 create mode 100644 queue-5.15/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
 create mode 100644 queue-5.15/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
 create mode 100644 queue-5.15/bpf-net-change-do_ip_getsockopt-to-take-the-sockptr_.patch
 create mode 100644 queue-5.15/bpf-net-change-sk_getsockopt-to-take-the-sockptr_t-a.patch
 create mode 100644 queue-5.15/bpftool-silence-build-warning-about-calloc.patch
 create mode 100644 queue-5.15/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
 create mode 100644 queue-5.15/clk-fix-clk_core_get-null-dereference.patch
 create mode 100644 queue-5.15/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
 create mode 100644 queue-5.15/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
 create mode 100644 queue-5.15/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
 create mode 100644 queue-5.15/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
 create mode 100644 queue-5.15/clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch
 create mode 100644 queue-5.15/clk-qcom-reset-commonize-the-de-assert-functions.patch
 create mode 100644 queue-5.15/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
 create mode 100644 queue-5.15/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
 create mode 100644 queue-5.15/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
 create mode 100644 queue-5.15/cpufreq-explicitly-include-correct-dt-includes.patch
 create mode 100644 queue-5.15/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
 create mode 100644 queue-5.15/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
 create mode 100644 queue-5.15/crypto-arm-sha-fix-function-cast-warnings.patch
 create mode 100644 queue-5.15/crypto-xilinx-call-finalize-with-bh-disabled.patch
 create mode 100644 queue-5.15/dm-call-the-resume-method-on-internal-suspend.patch
 create mode 100644 queue-5.15/dm-raid-fix-false-positive-for-requeue-needed-during.patch
 create mode 100644 queue-5.15/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
 create mode 100644 queue-5.15/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
 create mode 100644 queue-5.15/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
 create mode 100644 queue-5.15/drm-amd-display-fix-potential-null-pointer-dereferen.patch
 create mode 100644 queue-5.15/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
 create mode 100644 queue-5.15/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
 create mode 100644 queue-5.15/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
 create mode 100644 queue-5.15/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
 create mode 100644 queue-5.15/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
 create mode 100644 queue-5.15/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
 create mode 100644 queue-5.15/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
 create mode 100644 queue-5.15/drm-rockchip-inno_hdmi-fix-video-timing.patch
 create mode 100644 queue-5.15/drm-rockchip-lvds-do-not-overwrite-error-code.patch
 create mode 100644 queue-5.15/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
 create mode 100644 queue-5.15/drm-tegra-dc-rgb-allow-changing-plld-rate-on-tegra30.patch
 create mode 100644 queue-5.15/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
 create mode 100644 queue-5.15/drm-tegra-dpaux-populate-aux-bus.patch
 create mode 100644 queue-5.15/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
 create mode 100644 queue-5.15/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
 create mode 100644 queue-5.15/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
 create mode 100644 queue-5.15/drm-tegra-dsi-make-use-of-the-helper-function-dev_er.patch
 create mode 100644 queue-5.15/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
 create mode 100644 queue-5.15/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
 create mode 100644 queue-5.15/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
 create mode 100644 queue-5.15/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
 create mode 100644 queue-5.15/drm-tidss-fix-initial-plane-zpos-values.patch
 create mode 100644 queue-5.15/drm-ttm-add-ttm_resource_fini-v2.patch
 create mode 100644 queue-5.15/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
 create mode 100644 queue-5.15/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch
 create mode 100644 queue-5.15/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
 create mode 100644 queue-5.15/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
 create mode 100644 queue-5.15/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
 create mode 100644 queue-5.15/f2fs-fix-to-invalidate-meta_mapping-before-dio-write.patch
 create mode 100644 queue-5.15/f2fs-implement-iomap-operations.patch
 create mode 100644 queue-5.15/f2fs-invalidate-meta-pages-only-for-post_read-requir.patch
 create mode 100644 queue-5.15/f2fs-invalidate-meta_mapping-before-ipu-dio-write.patch
 create mode 100644 queue-5.15/f2fs-multidevice-support-direct-io.patch
 create mode 100644 queue-5.15/f2fs-reduce-stack-memory-cost-by-using-bitfield-in-s.patch
 create mode 100644 queue-5.15/f2fs-replace-congestion_wait-calls-with-io_schedule_.patch
 create mode 100644 queue-5.15/fs-select-rework-stack-allocation-hack-for-clang.patch
 create mode 100644 queue-5.15/hid-amd_sfh-update-hpd-sensor-structure-elements.patch
 create mode 100644 queue-5.15/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
 create mode 100644 queue-5.15/igb-fix-missing-time-sync-events.patch
 create mode 100644 queue-5.15/igb-move-perout-and-extts-isr-logic-to-separate-func.patch
 create mode 100644 queue-5.15/inet_diag-annotate-data-races-around-inet_diag_table.patch
 create mode 100644 queue-5.15/iommu-amd-mark-interrupt-as-managed.patch
 create mode 100644 queue-5.15/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
 create mode 100644 queue-5.15/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
 create mode 100644 queue-5.15/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
 create mode 100644 queue-5.15/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
 create mode 100644 queue-5.15/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
 create mode 100644 queue-5.15/leds-aw2013-unlock-mutex-before-destroying-it.patch
 create mode 100644 queue-5.15/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
 create mode 100644 queue-5.15/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
 create mode 100644 queue-5.15/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
 create mode 100644 queue-5.15/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
 create mode 100644 queue-5.15/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
 create mode 100644 queue-5.15/media-edia-dvbdev-fix-a-use-after-free.patch
 create mode 100644 queue-5.15/media-em28xx-annotate-unchecked-call-to-media_device.patch
 create mode 100644 queue-5.15/media-go7007-add-check-of-return-value-of-go7007_rea.patch
 create mode 100644 queue-5.15/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
 create mode 100644 queue-5.15/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
 create mode 100644 queue-5.15/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
 create mode 100644 queue-5.15/media-pvrusb2-fix-pvr2_stream_callback-casts.patch
 create mode 100644 queue-5.15/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
 create mode 100644 queue-5.15/media-pvrusb2-remove-redundant-null-check.patch
 create mode 100644 queue-5.15/media-sun8i-di-fix-chroma-difference-threshold.patch
 create mode 100644 queue-5.15/media-sun8i-di-fix-coefficient-writes.patch
 create mode 100644 queue-5.15/media-sun8i-di-fix-power-on-off-sequences.patch
 create mode 100644 queue-5.15/media-tc358743-register-v4l2-async-device-only-after.patch
 create mode 100644 queue-5.15/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
 create mode 100644 queue-5.15/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
 create mode 100644 queue-5.15/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
 create mode 100644 queue-5.15/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
 create mode 100644 queue-5.15/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
 create mode 100644 queue-5.15/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
 create mode 100644 queue-5.15/module-add-support-for-default-value-for-module-asyn.patch
 create mode 100644 queue-5.15/modules-wait-do_free_init-correctly.patch
 create mode 100644 queue-5.15/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
 create mode 100644 queue-5.15/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
 create mode 100644 queue-5.15/nbd-null-check-for-nla_nest_start.patch
 create mode 100644 queue-5.15/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
 create mode 100644 queue-5.15/net-change-sock_getsockopt-to-take-the-sk-ptr-instea.patch
 create mode 100644 queue-5.15/net-ena-remove-ena_select_queue.patch
 create mode 100644 queue-5.15/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
 create mode 100644 queue-5.15/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
 create mode 100644 queue-5.15/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
 create mode 100644 queue-5.15/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
 create mode 100644 queue-5.15/net-phy-dp83822-enable-rgmii-mode-if-phy_interface_i.patch
 create mode 100644 queue-5.15/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
 create mode 100644 queue-5.15/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
 create mode 100644 queue-5.15/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
 create mode 100644 queue-5.15/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
 create mode 100644 queue-5.15/nfp-flower-handle-acti_netdevs-allocation-failure.patch
 create mode 100644 queue-5.15/nfs-fix-an-off-by-one-in-root_nfs_cat.patch
 create mode 100644 queue-5.15/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
 create mode 100644 queue-5.15/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
 create mode 100644 queue-5.15/ntb-epf-fix-possible-memory-leak-in-pci_vntb_probe.patch
 create mode 100644 queue-5.15/ntb-fix-possible-name-leak-in-ntb_register_device.patch
 create mode 100644 queue-5.15/opp-debugfs-fix-warning-around-icc_get_name.patch
 create mode 100644 queue-5.15/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
 create mode 100644 queue-5.15/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
 create mode 100644 queue-5.15/pci-endpoint-support-ntb-transfer-between-rc-and-ep.patch
 create mode 100644 queue-5.15/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
 create mode 100644 queue-5.15/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
 create mode 100644 queue-5.15/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
 create mode 100644 queue-5.15/pci-switchtec-fix-an-error-handling-path-in-switchte.patch
 create mode 100644 queue-5.15/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
 create mode 100644 queue-5.15/perf-record-fix-possible-incorrect-free-in-record__s.patch
 create mode 100644 queue-5.15/perf-stat-avoid-metric-only-segv.patch
 create mode 100644 queue-5.15/perf-thread_map-free-strlist-on-normal-path-in-threa.patch
 create mode 100644 queue-5.15/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
 create mode 100644 queue-5.15/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
 create mode 100644 queue-5.15/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
 create mode 100644 queue-5.15/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
 create mode 100644 queue-5.15/printk-add-panic_in_progress-helper.patch
 create mode 100644 queue-5.15/printk-disable-passing-console-lock-owner-completely.patch
 create mode 100644 queue-5.15/pwm-atmel-hlcdc-convert-to-platform-remove-callback-.patch
 create mode 100644 queue-5.15/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
 create mode 100644 queue-5.15/pwm-atmel-hlcdc-use-consistent-variable-naming.patch
 create mode 100644 queue-5.15/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
 create mode 100644 queue-5.15/pwm-sti-implement-.apply-callback.patch
 create mode 100644 queue-5.15/quota-fix-potential-null-pointer-dereference.patch
 create mode 100644 queue-5.15/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
 create mode 100644 queue-5.15/quota-simplify-drop_dquot_ref.patch
 create mode 100644 queue-5.15/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
 create mode 100644 queue-5.15/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
 create mode 100644 queue-5.15/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
 create mode 100644 queue-5.15/rtc-test-fix-invalid-format-specifier.patch
 create mode 100644 queue-5.15/s390-dasd-add-autoquiesce-feature.patch
 create mode 100644 queue-5.15/s390-dasd-add-copy-pair-setup.patch
 create mode 100644 queue-5.15/s390-dasd-add-query-pprc-function.patch
 create mode 100644 queue-5.15/s390-dasd-fix-double-module-refcount-decrement.patch
 create mode 100644 queue-5.15/s390-dasd-put-block-allocation-in-separate-function.patch
 create mode 100644 queue-5.15/s390-dasd-use-dev_-for-device-log-messages.patch
 create mode 100644 queue-5.15/s390-vdso-drop-fpic-from-ldflags.patch
 create mode 100644 queue-5.15/sched-fair-take-the-scheduling-domain-into-account-i.patch
 create mode 100644 queue-5.15/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
 create mode 100644 queue-5.15/scsi-csiostor-avoid-function-pointer-casts.patch
 create mode 100644 queue-5.15/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
 create mode 100644 queue-5.15/sock_diag-annotate-data-races-around-sock_diag_handl.patch
 create mode 100644 queue-5.15/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
 create mode 100644 queue-5.15/sr9800-add-check-for-usbnet_get_endpoints.patch
 create mode 100644 queue-5.15/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
 create mode 100644 queue-5.15/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
 create mode 100644 queue-5.15/time-test-fix-incorrect-format-specifier.patch
 create mode 100644 queue-5.15/timekeeping-fix-cross-timestamp-interpolation-corner.patch
 create mode 100644 queue-5.15/timekeeping-fix-cross-timestamp-interpolation-for-no.patch
 create mode 100644 queue-5.15/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
 create mode 100644 queue-5.15/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
 create mode 100644 queue-5.15/watchdog-stm32_iwdg-initialize-default-timeout.patch
 create mode 100644 queue-5.15/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
 create mode 100644 queue-5.15/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
 create mode 100644 queue-5.15/wifi-b43-disable-qos-for-bcm4331.patch
 create mode 100644 queue-5.15/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
 create mode 100644 queue-5.15/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
 create mode 100644 queue-5.15/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
 create mode 100644 queue-5.15/wifi-brcmsmac-avoid-function-pointer-casts.patch
 create mode 100644 queue-5.15/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
 create mode 100644 queue-5.15/wifi-iwlwifi-fix-ewrd-table-validity-check.patch
 create mode 100644 queue-5.15/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
 create mode 100644 queue-5.15/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
 create mode 100644 queue-5.15/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
 create mode 100644 queue-5.15/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
 create mode 100644 queue-5.15/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
 create mode 100644 queue-5.15/wifi-rtw88-8821c-fix-false-alarm-count.patch
 create mode 100644 queue-5.15/wifi-wilc1000-fix-declarations-ordering.patch
 create mode 100644 queue-5.15/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
 create mode 100644 queue-5.15/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
 create mode 100644 queue-5.15/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
 create mode 100644 queue-5.15/wireless-remove-redundant-flush_workqueue-calls.patch
 create mode 100644 queue-5.15/x86-relocs-ignore-relocations-in-.notes-section.patch

diff --git a/queue-5.15/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch b/queue-5.15/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
new file mode 100644
index 00000000000..10eb5631ecf
--- /dev/null
+++ b/queue-5.15/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
@@ -0,0 +1,61 @@
+From a5c0898fe7fa65f744c3f95ac021f031335992c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 01:41:58 +0100
+Subject: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit e18afcb7b2a12b635ac10081f943fcf84ddacc51 ]
+
+After unregistering the CPU idle device, the memory associated with
+it is not freed, leading to a memory leak:
+
+unreferenced object 0xffff896282f6c000 (size 1024):
+  comm "swapper/0", pid 1, jiffies 4294893170
+  hex dump (first 32 bytes):
+    00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00  ................
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace (crc 8836a742):
+    [<ffffffff993495ed>] kmalloc_trace+0x29d/0x340
+    [<ffffffff9972f3b3>] acpi_processor_power_init+0xf3/0x1c0
+    [<ffffffff9972d263>] __acpi_processor_start+0xd3/0xf0
+    [<ffffffff9972d2bc>] acpi_processor_start+0x2c/0x50
+    [<ffffffff99805872>] really_probe+0xe2/0x480
+    [<ffffffff99805c98>] __driver_probe_device+0x78/0x160
+    [<ffffffff99805daf>] driver_probe_device+0x1f/0x90
+    [<ffffffff9980601e>] __driver_attach+0xce/0x1c0
+    [<ffffffff99803170>] bus_for_each_dev+0x70/0xc0
+    [<ffffffff99804822>] bus_add_driver+0x112/0x210
+    [<ffffffff99807245>] driver_register+0x55/0x100
+    [<ffffffff9aee4acb>] acpi_processor_driver_init+0x3b/0xc0
+    [<ffffffff990012d1>] do_one_initcall+0x41/0x300
+    [<ffffffff9ae7c4b0>] kernel_init_freeable+0x320/0x470
+    [<ffffffff99b231f6>] kernel_init+0x16/0x1b0
+    [<ffffffff99042e6d>] ret_from_fork+0x2d/0x50
+
+Fix this by freeing the CPU idle device after unregistering it.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index e9116db1e3527..4cb44d80bf520 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1424,6 +1424,8 @@ int acpi_processor_power_exit(struct acpi_processor *pr)
+ 		acpi_processor_registered--;
+ 		if (acpi_processor_registered == 0)
+ 			cpuidle_unregister_driver(&acpi_idle_driver);
++
++		kfree(dev);
+ 	}
+ 
+ 	pr->flags.power_setup_done = 0;
+-- 
+2.43.0
+
diff --git a/queue-5.15/acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch b/queue-5.15/acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch
new file mode 100644
index 00000000000..0eadc771519
--- /dev/null
+++ b/queue-5.15/acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch
@@ -0,0 +1,51 @@
+From 3ae624c17f2a79896d9662a19c94d7ac188f039a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 12:55:18 -0400
+Subject: ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override
+
+From: David McFarland <corngood@gmail.com>
+
+[ Upstream commit e2605d4039a42a03000856b3229932455717b48b ]
+
+A user reported a keyboard problem similar to ones reported with other
+Zen laptops, on an Infinity E15-5A165-BM.
+
+Add board name matches for this model and one (untested) close relative
+to irq1_edge_low_force_override.
+
+Link: https://lemmy.ml/post/9864736
+Link: https://www.infinitygaming.com.au/bios/
+Link: https://lore.kernel.org/linux-acpi/20231006123304.32686-1-hdegoede@redhat.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 021a67d09615 ("ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index a364cb07c5578..16a18654f6879 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -546,6 +546,18 @@ static const struct dmi_system_id lg_laptop[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "17U70P"),
+ 		},
+ 	},
++	{
++		/* Infinity E15-5A165-BM */
++		.matches = {
++			DMI_MATCH(DMI_BOARD_NAME, "GM5RG1E0009COM"),
++		},
++	},
++	{
++		/* Infinity E15-5A305-1M */
++		.matches = {
++			DMI_MATCH(DMI_BOARD_NAME, "GM5RGEE0016COM"),
++		},
++	},
+ 	{ }
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch b/queue-5.15/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
new file mode 100644
index 00000000000..c32d252c42c
--- /dev/null
+++ b/queue-5.15/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
@@ -0,0 +1,49 @@
+From a50f587c4f9ca72360e7fbf2614dca2071b5dbf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 19:24:08 +0300
+Subject: ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
+
+From: Maxim Kudinov <m.kudinovv@gmail.com>
+
+[ Upstream commit 021a67d096154893cd1d883c7be0097e2ee327fd ]
+
+A known issue on some Zen laptops, keyboard stopped working due to commit
+9946e39fe8d0 fael@kernel.org("ACPI: resource: skip IRQ override on AMD
+Zen platforms") on kernel 5.19.10.
+
+The ACPI IRQ override is required for this board due to buggy DSDT, thus
+adding the board vendor and name to irq1_edge_low_force_override fixes
+the issue.
+
+Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217394
+Link: https://lore.kernel.org/linux-acpi/20231006123304.32686-1-hdegoede@redhat.com/
+Tested-by: Maxim Trofimov <maxvereschagin@gmail.com>
+Signed-off-by: Maxim Kudinov <m.kudinovv@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index a46e0bf0e1dc4..0f533aff23a17 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -572,6 +572,13 @@ static const struct dmi_system_id lg_laptop[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "LL6FA"),
+ 		},
+ 	},
++	{
++		/* MAIBENBEN X577 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "MAIBENBEN"),
++			DMI_MATCH(DMI_BOARD_NAME, "X577"),
++		},
++	},
+ 	{ }
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch b/queue-5.15/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
new file mode 100644
index 00000000000..024dff75027
--- /dev/null
+++ b/queue-5.15/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
@@ -0,0 +1,51 @@
+From 1d29cb6d2bcf8a5cd790ca3324465f121268bdbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 12:30:09 +0000
+Subject: ACPI: resource: Do IRQ override on Lunnen Ground laptops
+
+From: Alexey I. Froloff <raorn@raorn.name>
+
+[ Upstream commit e23ad54fef186aa66007895be1382c88f1ee2bf7 ]
+
+The Lunnen Ground 15 and 16 needs IRQ overriding for the keyboard to
+work.
+
+Adding an entries for these laptops to the override_table makes the
+internal keyboard functional.
+
+Signed-off-by: Alexey I. Froloff <raorn@raorn.name>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 021a67d09615 ("ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 16a18654f6879..a46e0bf0e1dc4 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -558,6 +558,20 @@ static const struct dmi_system_id lg_laptop[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "GM5RGEE0016COM"),
+ 		},
+ 	},
++	{
++		/* Lunnen Ground 15 / AMD Ryzen 5 5500U */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"),
++			DMI_MATCH(DMI_BOARD_NAME, "LLL5DAW"),
++		},
++	},
++	{
++		/* Lunnen Ground 16 / AMD Ryzen 7 5800U */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"),
++			DMI_MATCH(DMI_BOARD_NAME, "LL6FA"),
++		},
++	},
+ 	{ }
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/acpi-scan-fix-device-check-notification-handling.patch b/queue-5.15/acpi-scan-fix-device-check-notification-handling.patch
new file mode 100644
index 00000000000..a85068a3b64
--- /dev/null
+++ b/queue-5.15/acpi-scan-fix-device-check-notification-handling.patch
@@ -0,0 +1,57 @@
+From c032b991dce57bfb2ba058cf2b1ff29d720a8988 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 17:35:27 +0100
+Subject: ACPI: scan: Fix device check notification handling
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 793551c965116d9dfaf0550dacae1396a20efa69 ]
+
+It is generally invalid to fail a Device Check notification if the scan
+handler has not been attached to the given device after a bus rescan,
+because there may be valid reasons for the scan handler to refuse
+attaching to the device (for example, the device is not ready).
+
+For this reason, modify acpi_scan_device_check() to return 0 in that
+case without printing a warning.
+
+While at it, reduce the log level of the "already enumerated" message
+in the same function, because it is only interesting when debugging
+notification handling
+
+Fixes: 443fc8202272 ("ACPI / hotplug: Rework generic code to handle suprise removals")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index ae74720888dbf..2393cd993b3cb 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -315,18 +315,14 @@ static int acpi_scan_device_check(struct acpi_device *adev)
+ 		 * again).
+ 		 */
+ 		if (adev->handler) {
+-			dev_warn(&adev->dev, "Already enumerated\n");
+-			return -EALREADY;
++			dev_dbg(&adev->dev, "Already enumerated\n");
++			return 0;
+ 		}
+ 		error = acpi_bus_scan(adev->handle);
+ 		if (error) {
+ 			dev_warn(&adev->dev, "Namespace scan failure\n");
+ 			return error;
+ 		}
+-		if (!adev->handler) {
+-			dev_warn(&adev->dev, "Enumeration failure\n");
+-			error = -ENODEV;
+-		}
+ 	} else {
+ 		error = acpi_scan_device_not_present(adev);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-5.15/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch b/queue-5.15/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
new file mode 100644
index 00000000000..2f6ba26f2f9
--- /dev/null
+++ b/queue-5.15/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
@@ -0,0 +1,39 @@
+From 6aec561647d5c0c965f1953fc96fca61452f2608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 09:08:52 -0800
+Subject: af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 31e03207119a535d0b0e3b3a7f91983aeb2cb14d ]
+
+gc_in_progress is changed under spin_lock(&unix_gc_lock),
+but wait_for_unix_gc() reads it locklessly.
+
+Let's use READ_ONCE().
+
+Fixes: 5f23b734963e ("net: Fix soft lockups/OOM issues w/ unix garbage collector")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://lore.kernel.org/r/20240123170856.41348-2-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/unix/garbage.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index ab2c83d58b62a..9bfffe2a7f020 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -198,7 +198,7 @@ void wait_for_unix_gc(void)
+ 	if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC &&
+ 	    !READ_ONCE(gc_in_progress))
+ 		unix_gc();
+-	wait_event(unix_gc_wait, gc_in_progress == false);
++	wait_event(unix_gc_wait, !READ_ONCE(gc_in_progress));
+ }
+ 
+ /* The external entry point: unix_gc() */
+-- 
+2.43.0
+
diff --git a/queue-5.15/afs-revert-afs-hide-silly-rename-files-from-userspac.patch b/queue-5.15/afs-revert-afs-hide-silly-rename-files-from-userspac.patch
new file mode 100644
index 00000000000..cb9aaad9af3
--- /dev/null
+++ b/queue-5.15/afs-revert-afs-hide-silly-rename-files-from-userspac.patch
@@ -0,0 +1,55 @@
+From 3efeeff4c21de6f503439e33d4a86cd3194ad82b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 11:08:41 +0000
+Subject: afs: Revert "afs: Hide silly-rename files from userspace"
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 0aec3847d044273733285dcff90afda89ad461d2 ]
+
+This reverts commit 57e9d49c54528c49b8bffe6d99d782ea051ea534.
+
+This undoes the hiding of .__afsXXXX silly-rename files.  The problem with
+hiding them is that rm can't then manually delete them.
+
+This also reverts commit 5f7a07646655fb4108da527565dcdc80124b14c4 ("afs: Fix
+endless loop in directory parsing") as that's a bugfix for the above.
+
+Fixes: 57e9d49c5452 ("afs: Hide silly-rename files from userspace")
+Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
+Link: https://lists.infradead.org/pipermail/linux-afs/2024-February/008102.html
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/3085695.1710328121@warthog.procyon.org.uk
+Reviewed-by: Jeffrey E Altman <jaltman@auristor.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index c4e22e9f7a666..cec18f9f8bd7a 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -492,16 +492,6 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
+ 			continue;
+ 		}
+ 
+-		/* Don't expose silly rename entries to userspace. */
+-		if (nlen > 6 &&
+-		    dire->u.name[0] == '.' &&
+-		    ctx->actor != afs_lookup_filldir &&
+-		    ctx->actor != afs_lookup_one_filldir &&
+-		    memcmp(dire->u.name, ".__afs", 6) == 0) {
+-			ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent);
+-			continue;
+-		}
+-
+ 		/* found the next entry */
+ 		if (!dir_emit(ctx, dire->u.name, nlen,
+ 			      ntohl(dire->u.vnode),
+-- 
+2.43.0
+
diff --git a/queue-5.15/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch b/queue-5.15/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
new file mode 100644
index 00000000000..af45b56a3c3
--- /dev/null
+++ b/queue-5.15/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
@@ -0,0 +1,147 @@
+From 19cd22d371839f5c8ee0226edafb4810392b7c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Mar 2024 20:58:44 +0700
+Subject: ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
+
+From: Athaariq Ardhiansyah <foss@athaariq.my.id>
+
+[ Upstream commit c062166995c9e57d5cd508b332898f79da319802 ]
+
+Realtek codec on HP Envy laptop series are heavily modified by vendor.
+Therefore, need intervention to make it work properly. The patch fixes:
+
+- B&O soundbar speakers (between lid and keyboard) activation
+- Enable LED on mute button
+- Add missing process coefficient which affects the output amplifier
+- Volume control synchronization between B&O soundbar and side speakers
+- Unmute headset output on several HP Envy models
+- Auto-enable headset mic when plugged
+
+This patch was tested on HP Envy x360 13-AR0107AU with Realtek ALC285
+
+The only unsolved problem is output amplifier of all built-in speakers
+is too weak, which causes volume of built-in speakers cannot be loud
+as vendor's proprietary driver due to missing _DSD parameter in the
+firmware. The solution is currently on research. Expected to has another
+patch in the future.
+
+Potential fix to related issues, need test before close those issues:
+
+- https://bugzilla.kernel.org/show_bug.cgi?id=189331
+- https://bugzilla.kernel.org/show_bug.cgi?id=216632
+- https://bugzilla.kernel.org/show_bug.cgi?id=216311
+- https://bugzilla.kernel.org/show_bug.cgi?id=213507
+
+Signed-off-by: Athaariq Ardhiansyah <foss@athaariq.my.id>
+Message-ID: <20240310140249.3695-1-foss@athaariq.my.id>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 63 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 63 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 3a86f0fd78278..200d0b953d3b2 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6670,6 +6670,60 @@ static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec,
+ 	}
+ }
+ 
++static void alc285_fixup_hp_envy_x360(struct hda_codec *codec,
++				      const struct hda_fixup *fix,
++				      int action)
++{
++	static const struct coef_fw coefs[] = {
++		WRITE_COEF(0x08, 0x6a0c), WRITE_COEF(0x0d, 0xa023),
++		WRITE_COEF(0x10, 0x0320), WRITE_COEF(0x1a, 0x8c03),
++		WRITE_COEF(0x25, 0x1800), WRITE_COEF(0x26, 0x003a),
++		WRITE_COEF(0x28, 0x1dfe), WRITE_COEF(0x29, 0xb014),
++		WRITE_COEF(0x2b, 0x1dfe), WRITE_COEF(0x37, 0xfe15),
++		WRITE_COEF(0x38, 0x7909), WRITE_COEF(0x45, 0xd489),
++		WRITE_COEF(0x46, 0x00f4), WRITE_COEF(0x4a, 0x21e0),
++		WRITE_COEF(0x66, 0x03f0), WRITE_COEF(0x67, 0x1000),
++		WRITE_COEF(0x6e, 0x1005), { }
++	};
++
++	static const struct hda_pintbl pincfgs[] = {
++		{ 0x12, 0xb7a60130 },  /* Internal microphone*/
++		{ 0x14, 0x90170150 },  /* B&O soundbar speakers */
++		{ 0x17, 0x90170153 },  /* Side speakers */
++		{ 0x19, 0x03a11040 },  /* Headset microphone */
++		{ }
++	};
++
++	switch (action) {
++	case HDA_FIXUP_ACT_PRE_PROBE:
++		snd_hda_apply_pincfgs(codec, pincfgs);
++
++		/* Fixes volume control problem for side speakers */
++		alc295_fixup_disable_dac3(codec, fix, action);
++
++		/* Fixes no sound from headset speaker */
++		snd_hda_codec_amp_stereo(codec, 0x21, HDA_OUTPUT, 0, -1, 0);
++
++		/* Auto-enable headset mic when plugged */
++		snd_hda_jack_set_gating_jack(codec, 0x19, 0x21);
++
++		/* Headset mic volume enhancement */
++		snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREF50);
++		break;
++	case HDA_FIXUP_ACT_INIT:
++		alc_process_coef_fw(codec, coefs);
++		break;
++	case HDA_FIXUP_ACT_BUILD:
++		rename_ctl(codec, "Bass Speaker Playback Volume",
++			   "B&O-Tuned Playback Volume");
++		rename_ctl(codec, "Front Playback Switch",
++			   "B&O Soundbar Playback Switch");
++		rename_ctl(codec, "Bass Speaker Playback Switch",
++			   "Side Speaker Playback Switch");
++		break;
++	}
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+ 
+@@ -6877,6 +6931,7 @@ enum {
+ 	ALC280_FIXUP_HP_9480M,
+ 	ALC245_FIXUP_HP_X360_AMP,
+ 	ALC285_FIXUP_HP_SPECTRE_X360_EB1,
++	ALC285_FIXUP_HP_ENVY_X360,
+ 	ALC288_FIXUP_DELL_HEADSET_MODE,
+ 	ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 	ALC288_FIXUP_DELL_XPS_13,
+@@ -8679,6 +8734,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc285_fixup_hp_spectre_x360_eb1
+ 	},
++	[ALC285_FIXUP_HP_ENVY_X360] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc285_fixup_hp_envy_x360,
++		.chained = true,
++		.chain_id = ALC285_FIXUP_HP_GPIO_AMP_INIT,
++	},
+ 	[ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc285_fixup_ideapad_s740_coef,
+@@ -9066,6 +9127,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ 	SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
+ 	SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
++	SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360),
+ 	SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+@@ -9600,6 +9662,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"},
+ 	{.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"},
+ 	{.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"},
++	{.id = ALC285_FIXUP_HP_ENVY_X360, .name = "alc285-hp-envy-x360"},
+ 	{.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
+ 	{.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
+ 	{.id = ALC255_FIXUP_ACER_HEADPHONE_AND_MIC, .name = "alc255-acer-headphone-and-mic"},
+-- 
+2.43.0
+
diff --git a/queue-5.15/alsa-seq-fix-function-cast-warnings.patch b/queue-5.15/alsa-seq-fix-function-cast-warnings.patch
new file mode 100644
index 00000000000..620164da0f3
--- /dev/null
+++ b/queue-5.15/alsa-seq-fix-function-cast-warnings.patch
@@ -0,0 +1,95 @@
+From 242fe6d4a8d0fcb81409f65718f8b66f744e3433 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 14:53:43 +0100
+Subject: ALSA: seq: fix function cast warnings
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit d7bf73809849463f76de42aad62c850305dd6c5d ]
+
+clang-16 points out a control flow integrity (kcfi) issue when event
+callbacks get converted to incompatible types:
+
+sound/core/seq/seq_midi.c:135:30: error: cast from 'int (*)(struct snd_rawmidi_substream *, const char *, int)' to 'snd_seq_dump_func_t' (aka 'int (*)(void *, void *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  135 |                 snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream);
+      |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+sound/core/seq/seq_virmidi.c:83:31: error: cast from 'int (*)(struct snd_rawmidi_substream *, const unsigned char *, int)' to 'snd_seq_dump_func_t' (aka 'int (*)(void *, void *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   83 |                         snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
+      |                                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For addressing those errors, introduce wrapper functions that are used
+for callbacks and bridge to the actual function call with pointer
+cast.
+
+The code was originally added with the initial ALSA merge in linux-2.5.4.
+
+[ the patch description shamelessly copied from Arnd's original patch
+  -- tiwai ]
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240213101020.459183-1-arnd@kernel.org
+Link: https://lore.kernel.org/r/20240213135343.16411-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_midi.c    | 8 +++++++-
+ sound/core/seq/seq_virmidi.c | 9 ++++++++-
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c
+index 4589aac091542..b00bbf18a6f5d 100644
+--- a/sound/core/seq/seq_midi.c
++++ b/sound/core/seq/seq_midi.c
+@@ -112,6 +112,12 @@ static int dump_midi(struct snd_rawmidi_substream *substream, const char *buf, i
+ 	return 0;
+ }
+ 
++/* callback for snd_seq_dump_var_event(), bridging to dump_midi() */
++static int __dump_midi(void *ptr, void *buf, int count)
++{
++	return dump_midi(ptr, buf, count);
++}
++
+ static int event_process_midi(struct snd_seq_event *ev, int direct,
+ 			      void *private_data, int atomic, int hop)
+ {
+@@ -131,7 +137,7 @@ static int event_process_midi(struct snd_seq_event *ev, int direct,
+ 			pr_debug("ALSA: seq_midi: invalid sysex event flags = 0x%x\n", ev->flags);
+ 			return 0;
+ 		}
+-		snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream);
++		snd_seq_dump_var_event(ev, __dump_midi, substream);
+ 		snd_midi_event_reset_decode(msynth->parser);
+ 	} else {
+ 		if (msynth->parser == NULL)
+diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
+index 4abc38c70cae2..339799bfaad9d 100644
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -62,6 +62,13 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi,
+ /*
+  * decode input event and put to read buffer of each opened file
+  */
++
++/* callback for snd_seq_dump_var_event(), bridging to snd_rawmidi_receive() */
++static int dump_to_rawmidi(void *ptr, void *buf, int count)
++{
++	return snd_rawmidi_receive(ptr, buf, count);
++}
++
+ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+ 					 struct snd_seq_event *ev,
+ 					 bool atomic)
+@@ -80,7 +87,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+ 		if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
+ 			if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+ 				continue;
+-			snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
++			snd_seq_dump_var_event(ev, dump_to_rawmidi, vmidi->substream);
+ 			snd_midi_event_reset_decode(vmidi->parser);
+ 		} else {
+ 			len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev);
+-- 
+2.43.0
+
diff --git a/queue-5.15/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch b/queue-5.15/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
new file mode 100644
index 00000000000..80adcf16671
--- /dev/null
+++ b/queue-5.15/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
@@ -0,0 +1,43 @@
+From 0f735c2efb3c44f7d1f573b20b2c948d34ed6cb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 09:15:09 +0100
+Subject: ALSA: usb-audio: Stop parsing channels bits when all channels are
+ found.
+
+From: Johan Carlsson <johan.carlsson@teenage.engineering>
+
+[ Upstream commit a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7 ]
+
+If a usb audio device sets more bits than the amount of channels
+it could write outside of the map array.
+
+Signed-off-by: Johan Carlsson <johan.carlsson@teenage.engineering>
+Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support")
+Message-ID: <20240313081509.9801-1-johan.carlsson@teenage.engineering>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/stream.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 3d4add94e367d..d5409f3879455 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -300,9 +300,12 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
+ 	c = 0;
+ 
+ 	if (bits) {
+-		for (; bits && *maps; maps++, bits >>= 1)
++		for (; bits && *maps; maps++, bits >>= 1) {
+ 			if (bits & 1)
+ 				chmap->map[c++] = *maps;
++			if (c == chmap->channels)
++				break;
++		}
+ 	} else {
+ 		/* If we're missing wChannelConfig, then guess something
+ 		    to make sure the channel map is not skipped entirely */
+-- 
+2.43.0
+
diff --git a/queue-5.15/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch b/queue-5.15/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
new file mode 100644
index 00000000000..645fde79cfa
--- /dev/null
+++ b/queue-5.15/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
@@ -0,0 +1,88 @@
+From 9e7bbe38bce482d1da6092a1c5e59d8529791a16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 16:20:48 +0800
+Subject: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
+
+From: Chun-Yi Lee <jlee@suse.com>
+
+[ Upstream commit f98364e926626c678fb4b9004b75cacf92ff0662 ]
+
+This patch is against CVE-2023-6270. The description of cve is:
+
+  A flaw was found in the ATA over Ethernet (AoE) driver in the Linux
+  kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on
+  `struct net_device`, and a use-after-free can be triggered by racing
+  between the free on the struct and the access through the `skbtxq`
+  global queue. This could lead to a denial of service condition or
+  potential code execution.
+
+In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial
+code is finished. But the net_device ifp will still be used in
+later tx()->dev_queue_xmit() in kthread. Which means that the
+dev_put(ifp) should NOT be called in the success path of skb
+initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into
+use-after-free because the net_device is freed.
+
+This patch removed the dev_put(ifp) in the success path in
+aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().
+
+Link: https://nvd.nist.gov/vuln/detail/CVE-2023-6270
+Fixes: 7562f876cd93 ("[NET]: Rework dev_base via list_head (v3)")
+Signed-off-by: Chun-Yi Lee <jlee@suse.com>
+Link: https://lore.kernel.org/r/20240305082048.25526-1-jlee@suse.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/aoe/aoecmd.c | 12 ++++++------
+ drivers/block/aoe/aoenet.c |  1 +
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
+index 588889bea7c30..a6e5306f725b3 100644
+--- a/drivers/block/aoe/aoecmd.c
++++ b/drivers/block/aoe/aoecmd.c
+@@ -420,13 +420,16 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu
+ 	rcu_read_lock();
+ 	for_each_netdev_rcu(&init_net, ifp) {
+ 		dev_hold(ifp);
+-		if (!is_aoe_netif(ifp))
+-			goto cont;
++		if (!is_aoe_netif(ifp)) {
++			dev_put(ifp);
++			continue;
++		}
+ 
+ 		skb = new_skb(sizeof *h + sizeof *ch);
+ 		if (skb == NULL) {
+ 			printk(KERN_INFO "aoe: skb alloc failure\n");
+-			goto cont;
++			dev_put(ifp);
++			continue;
+ 		}
+ 		skb_put(skb, sizeof *h + sizeof *ch);
+ 		skb->dev = ifp;
+@@ -441,9 +444,6 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu
+ 		h->major = cpu_to_be16(aoemajor);
+ 		h->minor = aoeminor;
+ 		h->cmd = AOECMD_CFG;
+-
+-cont:
+-		dev_put(ifp);
+ 	}
+ 	rcu_read_unlock();
+ }
+diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
+index 63773a90581dd..1e66c7a188a12 100644
+--- a/drivers/block/aoe/aoenet.c
++++ b/drivers/block/aoe/aoenet.c
+@@ -64,6 +64,7 @@ tx(int id) __must_hold(&txlock)
+ 			pr_warn("aoe: packet could not be sent on %s.  %s\n",
+ 				ifp ? ifp->name : "netif",
+ 				"consider increasing tx_queue_len");
++		dev_put(ifp);
+ 		spin_lock_irq(&txlock);
+ 	}
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-5.15/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch b/queue-5.15/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
new file mode 100644
index 00000000000..f0807a04037
--- /dev/null
+++ b/queue-5.15/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
@@ -0,0 +1,98 @@
+From 76ee4e092c22f0635b212796bbbc97682f97ce25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 13:28:20 +0100
+Subject: arch/powerpc: Remove <linux/fb.h> from backlight code
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit 838f865802b9f26135ea7df4e30f89ac2f50c23e ]
+
+Replace <linux/fb.h> with a forward declaration in <asm/backlight.h> to
+resolve an unnecessary dependency. Remove pmac_backlight_curve_lookup()
+and struct fb_info from source and header files. The function and the
+framebuffer struct are unused. No functional changes.
+
+v3:
+	* Add Fixes tag (Christophe)
+	* fix typos in commit message (Jani)
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: d565dd3b0824 ("[PATCH] powerpc: More via-pmu backlight fixes")
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au> # (powerpc)
+Link: https://patchwork.freedesktop.org/patch/msgid/20240306122935.10626-4-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/backlight.h        |  5 ++--
+ arch/powerpc/platforms/powermac/backlight.c | 26 ---------------------
+ 2 files changed, 2 insertions(+), 29 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/backlight.h b/arch/powerpc/include/asm/backlight.h
+index 1b5eab62ed047..061a910d74929 100644
+--- a/arch/powerpc/include/asm/backlight.h
++++ b/arch/powerpc/include/asm/backlight.h
+@@ -10,15 +10,14 @@
+ #define __ASM_POWERPC_BACKLIGHT_H
+ #ifdef __KERNEL__
+ 
+-#include <linux/fb.h>
+ #include <linux/mutex.h>
+ 
++struct backlight_device;
++
+ /* For locking instructions, see the implementation file */
+ extern struct backlight_device *pmac_backlight;
+ extern struct mutex pmac_backlight_mutex;
+ 
+-extern int pmac_backlight_curve_lookup(struct fb_info *info, int value);
+-
+ extern int pmac_has_backlight_type(const char *type);
+ 
+ extern void pmac_backlight_key(int direction);
+diff --git a/arch/powerpc/platforms/powermac/backlight.c b/arch/powerpc/platforms/powermac/backlight.c
+index 32224cb489d75..eab339d2059d5 100644
+--- a/arch/powerpc/platforms/powermac/backlight.c
++++ b/arch/powerpc/platforms/powermac/backlight.c
+@@ -9,7 +9,6 @@
+  */
+ 
+ #include <linux/kernel.h>
+-#include <linux/fb.h>
+ #include <linux/backlight.h>
+ #include <linux/adb.h>
+ #include <linux/pmu.h>
+@@ -73,31 +72,6 @@ int pmac_has_backlight_type(const char *type)
+ 	return 0;
+ }
+ 
+-int pmac_backlight_curve_lookup(struct fb_info *info, int value)
+-{
+-	int level = (FB_BACKLIGHT_LEVELS - 1);
+-
+-	if (info && info->bl_dev) {
+-		int i, max = 0;
+-
+-		/* Look for biggest value */
+-		for (i = 0; i < FB_BACKLIGHT_LEVELS; i++)
+-			max = max((int)info->bl_curve[i], max);
+-
+-		/* Look for nearest value */
+-		for (i = 0; i < FB_BACKLIGHT_LEVELS; i++) {
+-			int diff = abs(info->bl_curve[i] - value);
+-			if (diff < max) {
+-				max = diff;
+-				level = i;
+-			}
+-		}
+-
+-	}
+-
+-	return level;
+-}
+-
+ static void pmac_backlight_key_worker(struct work_struct *work)
+ {
+ 	if (atomic_read(&kernel_backlight_disabled))
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm-dts-arm-realview-fix-development-chip-rom-compat.patch b/queue-5.15/arm-dts-arm-realview-fix-development-chip-rom-compat.patch
new file mode 100644
index 00000000000..9877f3b291c
--- /dev/null
+++ b/queue-5.15/arm-dts-arm-realview-fix-development-chip-rom-compat.patch
@@ -0,0 +1,43 @@
+From 5f3581b65c2e7a98218289b3a928182d9ff72b5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 17:03:04 +0200
+Subject: ARM: dts: arm: realview: Fix development chip ROM compatible value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 3baa4c5143d65ebab2de0d99a395e5f4f1f46608 ]
+
+When the development chip ROM was added, the "direct-mapped" compatible
+value was already obsolete.  In addition, the device node lacked the
+accompanying "probe-type" property, causing the old physmap_of_core
+driver to fall back to trying all available probe types.
+Unfortunately this fallback was lost when the DT and pdata cases were
+merged.
+
+Fix this by using the modern "mtd-rom" compatible value instead.
+
+Fixes: 5c3f5edbe0a1dff3 ("ARM: realview: add flash devices to the PB1176 DTS")
+Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-pb1176.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index 366687fb1ee39..e794a4bb8f1f2 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -435,7 +435,7 @@ pb1176_serial3: serial@1010f000 {
+ 
+ 		/* Direct-mapped development chip ROM */
+ 		pb1176_rom@10200000 {
+-			compatible = "direct-mapped";
++			compatible = "mtd-rom";
+ 			reg = <0x10200000 0x4000>;
+ 			bank-width = <1>;
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch b/queue-5.15/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
new file mode 100644
index 00000000000..43fcdda3df6
--- /dev/null
+++ b/queue-5.15/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
@@ -0,0 +1,42 @@
+From 72fb320731ba5e978f02579ea03a507d4abc8cae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 10:03:27 +0100
+Subject: ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Vokáč <michal.vokac@ysoft.com>
+
+[ Upstream commit 023bd910d3ab735459f84b22bb99fb9e00bd9d76 ]
+
+This change does not have any functional effect. The switch works just
+fine without this patch as it has full access to all the addresses
+on the bus. This is simply a clean-up to set the node name address
+and reg address to the same value.
+
+Fixes: 15b43e497ffd ("ARM: dts: imx6dl-yapp4: Use correct pseudo PHY address for the switch")
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+index 844f31f7c4114..76da90e858045 100644
+--- a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
++++ b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+@@ -127,7 +127,7 @@ phy_port3: phy@2 {
+ 
+ 		switch@10 {
+ 			compatible = "qca,qca8334";
+-			reg = <10>;
++			reg = <0x10>;
+ 			reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+ 
+ 			switch_ports: ports {
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm-dts-imx6dl-yapp4-move-phy-reset-into-switch-node.patch b/queue-5.15/arm-dts-imx6dl-yapp4-move-phy-reset-into-switch-node.patch
new file mode 100644
index 00000000000..f56802e470e
--- /dev/null
+++ b/queue-5.15/arm-dts-imx6dl-yapp4-move-phy-reset-into-switch-node.patch
@@ -0,0 +1,47 @@
+From dfb3b4d5aba425cedb1ae355f1b32b47070417df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 19:06:04 +0100
+Subject: ARM: dts: imx6dl-yapp4: Move phy reset into switch node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Vokáč <michal.vokac@ysoft.com>
+
+[ Upstream commit 7da7b84fee58c85a6075022023d31edea40e81a1 ]
+
+Drop the phy-reset-duration and phy-reset-gpios deprecated properties and
+move reset-gpios under the switch node.
+
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: 023bd910d3ab ("ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+index e5c4dc65fbabf..844f31f7c4114 100644
+--- a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
++++ b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+@@ -105,8 +105,6 @@ &fec {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pinctrl_enet>;
+ 	phy-mode = "rgmii-id";
+-	phy-reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+-	phy-reset-duration = <20>;
+ 	phy-supply = <&sw2_reg>;
+ 	status = "okay";
+ 
+@@ -130,6 +128,7 @@ phy_port3: phy@2 {
+ 		switch@10 {
+ 			compatible = "qca,qca8334";
+ 			reg = <10>;
++			reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+ 
+ 			switch_ports: ports {
+ 				#address-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch b/queue-5.15/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
new file mode 100644
index 00000000000..af04520b244
--- /dev/null
+++ b/queue-5.15/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
@@ -0,0 +1,98 @@
+From 46e1ab43a47e631f5605fed1414eeb50d28a99f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 10:03:28 +0100
+Subject: ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the
+ switch node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Vokáč <michal.vokac@ysoft.com>
+
+[ Upstream commit 79978bff2e4b8e05ebdf5fc3ee6b794002393484 ]
+
+We identified that the PHYs actually do not work since commit 7da7b84fee58
+("ARM: dts: imx6dl-yapp4: Move phy reset into switch node") as
+a coincidence of several circumstances.
+
+The reset signal is kept asserted by a pull-down resistor on the board
+unless it is deasserted by GPIO from the SoC. This is to keep the switch
+dead until it is configured properly by the kernel and user space.
+
+Prior to the referenced commit the switch was reset by the FEC driver
+and the reset GPIO was actively deasserted. The mdio-bus was scanned
+and the attached switch and its PHYs were found and configured.
+
+With the referenced commit the switch is reset by the qca8k driver.
+Because of another bug in the qca8k driver, functionality of the reset
+pin depends on its pre-kernel configuration. See commit c44fc98f0a8f
+("net: dsa: qca8k: fix illegal usage of GPIO")
+
+The problem did not appear until we removed support for the switch
+and configuration of its reset pin from the bootloader.
+
+To fix that, properly describe the internal mdio-bus configuration of
+the qca8334 switch. The PHYs are internal to the switch and sit on its
+internal mdio-bus.
+
+Fixes: 7da7b84fee58 ("ARM: dts: imx6dl-yapp4: Move phy reset into switch node")
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6dl-yapp4-common.dtsi | 23 ++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+index 76da90e858045..69ad1f198fa71 100644
+--- a/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
++++ b/arch/arm/boot/dts/imx6dl-yapp4-common.dtsi
+@@ -117,14 +117,6 @@ mdio {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		phy_port2: phy@1 {
+-			reg = <1>;
+-		};
+-
+-		phy_port3: phy@2 {
+-			reg = <2>;
+-		};
+-
+ 		switch@10 {
+ 			compatible = "qca,qca8334";
+ 			reg = <0x10>;
+@@ -149,15 +141,30 @@ fixed-link {
+ 				eth2: port@2 {
+ 					reg = <2>;
+ 					label = "eth2";
++					phy-mode = "internal";
+ 					phy-handle = <&phy_port2>;
+ 				};
+ 
+ 				eth1: port@3 {
+ 					reg = <3>;
+ 					label = "eth1";
++					phy-mode = "internal";
+ 					phy-handle = <&phy_port3>;
+ 				};
+ 			};
++
++			mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				phy_port2: ethernet-phy@1 {
++					reg = <1>;
++				};
++
++				phy_port3: ethernet-phy@2 {
++					reg = <2>;
++				};
++			};
+ 		};
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch b/queue-5.15/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
new file mode 100644
index 00000000000..b08ac60cd92
--- /dev/null
+++ b/queue-5.15/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
@@ -0,0 +1,82 @@
+From d3a149dc36662735a705d5a70da2174d5a8223d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 12:03:03 +0100
+Subject: ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 090c4094574705b0afc7d37825cdc5d06f0e7e02 ]
+
+External clocks should be defined as zero-Hz clocks in the SoC .dtsi,
+and overridden in the board .dts when present.
+
+Correct the clock rate of extal1 from 25 to 26 MHz, to match the crystal
+oscillator present on the APE6-EVM board.
+
+Fixes: a76809a329d6ebae ("ARM: shmobile: r8a73a4: Common clock framework DT description")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/1692bc8cd465d62168cbf110522ad62a7af3f606.1705315614.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a73a4-ape6evm.dts | 12 ++++++++++++
+ arch/arm/boot/dts/r8a73a4.dtsi        |  9 ++++++---
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/r8a73a4-ape6evm.dts b/arch/arm/boot/dts/r8a73a4-ape6evm.dts
+index b088e8e351d54..1028f721b38b0 100644
+--- a/arch/arm/boot/dts/r8a73a4-ape6evm.dts
++++ b/arch/arm/boot/dts/r8a73a4-ape6evm.dts
+@@ -208,6 +208,18 @@ &cmt1 {
+ 	status = "okay";
+ };
+ 
++&extal1_clk {
++	clock-frequency = <26000000>;
++};
++
++&extal2_clk {
++	clock-frequency = <48000000>;
++};
++
++&extalr_clk {
++	clock-frequency = <32768>;
++};
++
+ &pfc {
+ 	scifa0_pins: scifa0 {
+ 		groups = "scifa0_data";
+diff --git a/arch/arm/boot/dts/r8a73a4.dtsi b/arch/arm/boot/dts/r8a73a4.dtsi
+index c39066967053f..d1f4cbd099efb 100644
+--- a/arch/arm/boot/dts/r8a73a4.dtsi
++++ b/arch/arm/boot/dts/r8a73a4.dtsi
+@@ -450,17 +450,20 @@ clocks {
+ 		extalr_clk: extalr {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+-			clock-frequency = <32768>;
++			/* This value must be overridden by the board. */
++			clock-frequency = <0>;
+ 		};
+ 		extal1_clk: extal1 {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+-			clock-frequency = <25000000>;
++			/* This value must be overridden by the board. */
++			clock-frequency = <0>;
+ 		};
+ 		extal2_clk: extal2 {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+-			clock-frequency = <48000000>;
++			/* This value must be overridden by the board. */
++			clock-frequency = <0>;
+ 		};
+ 		fsiack_clk: fsiack {
+ 			compatible = "fixed-clock";
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-imx8mm-kontron-add-support-for-ultra-high-.patch b/queue-5.15/arm64-dts-imx8mm-kontron-add-support-for-ultra-high-.patch
new file mode 100644
index 00000000000..059df61e4a4
--- /dev/null
+++ b/queue-5.15/arm64-dts-imx8mm-kontron-add-support-for-ultra-high-.patch
@@ -0,0 +1,91 @@
+From d101f09b1d768f33c1c3469ed844807fde0d15f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Oct 2021 14:48:35 +0200
+Subject: arm64: dts: imx8mm-kontron: Add support for ultra high speed modes on
+ SD card
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit ec1e91d400bf21def54c441552bdf2976ce36e3b ]
+
+In order to use ultra high speed modes (UHS) on the SD card slot, we
+add matching pinctrls and fix the voltage switching for LDO5 of the
+PMIC, by providing the SD_VSEL pin as GPIO to the PMIC driver.
+
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: 008820524844 ("arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-kontron-n801x-s.dts  | 28 ++++++++++++++++++-
+ .../freescale/imx8mm-kontron-n801x-som.dtsi   |  2 ++
+ 2 files changed, 29 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+index 67e768032320a..25886622c8c40 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -191,8 +191,10 @@ usbnet: usbether@1 {
+ };
+ 
+ &usdhc2 {
+-	pinctrl-names = "default";
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
+ 	pinctrl-0 = <&pinctrl_usdhc2>;
++	pinctrl-1 = <&pinctrl_usdhc2_100mhz>;
++	pinctrl-2 = <&pinctrl_usdhc2_200mhz>;
+ 	vmmc-supply = <&reg_vdd_3v3>;
+ 	vqmmc-supply = <&reg_nvcc_sd>;
+ 	cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
+@@ -321,4 +323,28 @@ MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d0
+ 			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+ 		>;
+ 	};
++
++	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x194
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d4
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d4
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d4
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d4
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d4
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
++		>;
++	};
++
++	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x196
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d6
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d6
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d6
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d6
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d6
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
++		>;
++	};
+ };
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+index 646615ca4b48b..1b9fc3a926fcb 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+@@ -86,6 +86,7 @@ pca9450: pmic@25 {
+ 		pinctrl-0 = <&pinctrl_pmic>;
+ 		interrupt-parent = <&gpio1>;
+ 		interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
++		sd-vsel-gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+ 
+ 		regulators {
+ 			reg_vdd_soc: BUCK1 {
+@@ -228,6 +229,7 @@ MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x40000083
+ 	pinctrl_pmic: pmicgrp {
+ 		fsl,pins = <
+ 			MX8MM_IOMUXC_GPIO1_IO00_GPIO1_IO0		0x141
++			MX8MM_IOMUXC_GPIO1_IO04_GPIO1_IO4		0x141
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch b/queue-5.15/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
new file mode 100644
index 00000000000..51ee1f3ae7e
--- /dev/null
+++ b/queue-5.15/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
@@ -0,0 +1,80 @@
+From ecc93f64b44e72769247532f036e58d9c8feaa9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:49:03 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pull resistors for SD card
+ signals on BL board
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 008820524844326ffb3123cebceba1960c0ad0dc ]
+
+Some signals have external pullup resistors on the board and don't need
+the internal ones to be enabled. Due to silicon errata ERR050080 let's
+disable the internal pull resistors whererever possible and prevent
+any unwanted behavior in case they wear out.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-kontron-n801x-s.dts   | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+index 00dff7c33310c..134192b749942 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -314,40 +314,40 @@ MX8MM_IOMUXC_NAND_CE1_B_GPIO3_IO2		0x19
+ 
+ 	pinctrl_usdhc2: usdhc2grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x190
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x90
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d0
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ 
+ 	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x194
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x94
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d4
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ 
+ 	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x196
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x96
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d6
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch b/queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
new file mode 100644
index 00000000000..f9f51b8c039
--- /dev/null
+++ b/queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
@@ -0,0 +1,56 @@
+From 5a87540c62be9e800dd6f3904fd8cc98539411ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:48:59 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL
+ i.MX8MM
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit f19e5bb91d53264d7dac5d845a4825afadf72440 ]
+
+There are external pullup resistors on the board and due to silicon
+errata ERR050080 let's disable the internal ones to prevent any
+unwanted behavior in case they wear out.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts    | 4 ++--
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+index 49d7470812eef..362f9360b4a51 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -275,8 +275,8 @@ MX8MM_IOMUXC_SAI3_MCLK_GPIO5_IO2		0x19
+ 
+ 	pinctrl_i2c4: i2c4grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x400001c3
+-			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x400001c3
++			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x40000083
++			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x40000083
+ 		>;
+ 	};
+ 
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+index 42bbbb3f532bc..646615ca4b48b 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+@@ -220,8 +220,8 @@ MX8MM_IOMUXC_ECSPI1_SS0_GPIO5_IO9		0x19
+ 
+ 	pinctrl_i2c1: i2c1grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x400001c3
+-			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x400001c3
++			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x40000083
++			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x40000083
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch b/queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
new file mode 100644
index 00000000000..9ba54708511
--- /dev/null
+++ b/queue-5.15/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
@@ -0,0 +1,58 @@
+From 70073b8748f06481704a5647a5d4727889872826 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:49:01 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals
+ on BL board
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 162aadaa0df8217b0cc49d919dd00022fef65e78 ]
+
+These signals are actively driven by the SoC or by the onboard
+transceiver. There's no need to enable the internal pull resistors
+and due to silicon errata ERR050080 let's disable the internal ones
+to prevent any unwanted behavior in case they wear out.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-kontron-n801x-s.dts     | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+index 362f9360b4a51..67e768032320a 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -288,19 +288,19 @@ MX8MM_IOMUXC_SPDIF_RX_PWM2_OUT			0x19
+ 
+ 	pinctrl_uart1: uart1grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x140
+-			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x140
+-			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x140
+-			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x140
++			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x0
++			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x0
++			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x0
++			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x0
+ 		>;
+ 	};
+ 
+ 	pinctrl_uart2: uart2grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x140
+-			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x140
+-			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x140
+-			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x140
++			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x0
++			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x0
++			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x0
++			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x0
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-imx8mm-kontron-use-the-vselect-signal-to-s.patch b/queue-5.15/arm64-dts-imx8mm-kontron-use-the-vselect-signal-to-s.patch
new file mode 100644
index 00000000000..ac51ca5dc47
--- /dev/null
+++ b/queue-5.15/arm64-dts-imx8mm-kontron-use-the-vselect-signal-to-s.patch
@@ -0,0 +1,82 @@
+From 0b215de6bfc40e4d7faf0e4902bf7be11c3fbcd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Aug 2022 10:03:50 +0200
+Subject: arm64: dts: imx8mm-kontron: Use the VSELECT signal to switch SD card
+ IO voltage
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit eef2c0217e02b6c7ed5b10b82ea944127145e113 ]
+
+It turns out that it is not necessary to declare the VSELECT signal as
+GPIO and let the PMIC driver set it to a fixed high level. This switches
+the voltage between 3.3V and 1.8V by setting the PMIC register for LDO5
+accordingly.
+
+Instead we can do it like other boards already do and simply mux the
+VSELECT signal of the USDHC interface to the pin. This makes sure that
+the correct voltage is selected by setting the PMIC's SD_VSEL input
+to high or low accordingly.
+
+Reported-by: Heiko Thiery <heiko.thiery@gmail.com>
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Reviewed-by: Heiko Thiery <heiko.thiery@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: 008820524844 ("arm64: dts: imx8mm-kontron: Disable pull resistors for SD card signals on BL board")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts    | 3 +++
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 2 --
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+index 25886622c8c40..00dff7c33310c 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-s.dts
+@@ -321,6 +321,7 @@ MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d0
+ 			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+ 		>;
+ 	};
+ 
+@@ -333,6 +334,7 @@ MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d4
+ 			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+ 		>;
+ 	};
+ 
+@@ -345,6 +347,7 @@ MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d6
+ 			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
+ 		>;
+ 	};
+ };
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+index 1b9fc3a926fcb..646615ca4b48b 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi
+@@ -86,7 +86,6 @@ pca9450: pmic@25 {
+ 		pinctrl-0 = <&pinctrl_pmic>;
+ 		interrupt-parent = <&gpio1>;
+ 		interrupts = <0 IRQ_TYPE_LEVEL_LOW>;
+-		sd-vsel-gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+ 
+ 		regulators {
+ 			reg_vdd_soc: BUCK1 {
+@@ -229,7 +228,6 @@ MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x40000083
+ 	pinctrl_pmic: pmicgrp {
+ 		fsl,pins = <
+ 			MX8MM_IOMUXC_GPIO1_IO00_GPIO1_IO0		0x141
+-			MX8MM_IOMUXC_GPIO1_IO04_GPIO1_IO4		0x141
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch b/queue-5.15/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
new file mode 100644
index 00000000000..5d21866eac2
--- /dev/null
+++ b/queue-5.15/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
@@ -0,0 +1,85 @@
+From fc9ba587d276a5eed044815531c1e2893ff40c9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 15:30:46 -0800
+Subject: arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit ec2cb52fcfef5d58574f2cfbc9a99ffc20ae5a9d ]
+
+The GW71xx does not have a gpio controlled vbus regulator but it does
+require some pinctrl. Remove the regulator and move the valid pinctrl
+into the usbotg1 node.
+
+Fixes: bd306fdb4e60 ("arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS")
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-venice-gw71xx.dtsi   | 29 ++++++-------------
+ 1 file changed, 9 insertions(+), 20 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
+index 7ea909a4c1d5e..6de00c9dcd349 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
+@@ -40,17 +40,6 @@ pps {
+ 		gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>;
+ 		status = "okay";
+ 	};
+-
+-	reg_usb_otg1_vbus: regulator-usb-otg1 {
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_reg_usb1_en>;
+-		compatible = "regulator-fixed";
+-		regulator-name = "usb_otg1_vbus";
+-		gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>;
+-		enable-active-high;
+-		regulator-min-microvolt = <5000000>;
+-		regulator-max-microvolt = <5000000>;
+-	};
+ };
+ 
+ /* off-board header */
+@@ -102,9 +91,10 @@ &uart3 {
+ };
+ 
+ &usbotg1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_usbotg1>;
+ 	dr_mode = "otg";
+ 	over-current-active-low;
+-	vbus-supply = <&reg_usb_otg1_vbus>;
+ 	status = "okay";
+ };
+ 
+@@ -156,14 +146,6 @@ MX8MM_IOMUXC_GPIO1_IO15_GPIO1_IO15	0x41
+ 		>;
+ 	};
+ 
+-	pinctrl_reg_usb1_en: regusb1grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_GPIO1_IO10_GPIO1_IO10	0x41
+-			MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12	0x141
+-			MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC	0x41
+-		>;
+-	};
+-
+ 	pinctrl_spi2: spi2grp {
+ 		fsl,pins = <
+ 			MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK	0xd6
+@@ -186,4 +168,11 @@ MX8MM_IOMUXC_UART3_RXD_UART3_DCE_RX	0x140
+ 			MX8MM_IOMUXC_UART3_TXD_UART3_DCE_TX	0x140
+ 		>;
+ 	};
++
++	pinctrl_usbotg1: usbotg1grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12	0x141
++			MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC	0x41
++		>;
++	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch b/queue-5.15/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
new file mode 100644
index 00000000000..df150e45561
--- /dev/null
+++ b/queue-5.15/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
@@ -0,0 +1,88 @@
+From af03ea77607aba493d8c0e636b78d4a97cfb3ede Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 13:22:58 +0100
+Subject: arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit ec55a22149d64f9ac41845d923b884d4a666bf4d ]
+
+Match order specified in binding documentation. It says "mem" should be
+the last interrupt.
+
+This fixes:
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:0: 'ring0' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:1: 'ring1' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:2: 'ring2' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:3: 'ring3' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:4: 'eip' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:5: 'mem' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-37xx.dtsi  | 10 +++++-----
+ arch/arm64/boot/dts/marvell/armada-cp11x.dtsi | 10 +++++-----
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index 0adc194e46d15..9d147af115831 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -414,14 +414,14 @@ xor11 {
+ 			crypto: crypto@90000 {
+ 				compatible = "inside-secure,safexcel-eip97ies";
+ 				reg = <0x90000 0x20000>;
+-				interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
+-					     <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
++				interrupts = <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
+ 					     <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
+ 					     <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
+ 					     <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
+-					     <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
+-				interrupt-names = "mem", "ring0", "ring1",
+-						  "ring2", "ring3", "eip";
++					     <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "ring0", "ring1", "ring2",
++						  "ring3", "eip", "mem";
+ 				clocks = <&nb_periph_clk 15>;
+ 			};
+ 
+diff --git a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
+index 3bd2182817fb8..408fc9bfc9627 100644
+--- a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
+@@ -506,14 +506,14 @@ CP11X_LABEL(sdhci0): sdhci@780000 {
+ 		CP11X_LABEL(crypto): crypto@800000 {
+ 			compatible = "inside-secure,safexcel-eip197b";
+ 			reg = <0x800000 0x200000>;
+-			interrupts = <87 IRQ_TYPE_LEVEL_HIGH>,
+-				<88 IRQ_TYPE_LEVEL_HIGH>,
++			interrupts = <88 IRQ_TYPE_LEVEL_HIGH>,
+ 				<89 IRQ_TYPE_LEVEL_HIGH>,
+ 				<90 IRQ_TYPE_LEVEL_HIGH>,
+ 				<91 IRQ_TYPE_LEVEL_HIGH>,
+-				<92 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "mem", "ring0", "ring1",
+-				"ring2", "ring3", "eip";
++				<92 IRQ_TYPE_LEVEL_HIGH>,
++				<87 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "ring0", "ring1", "ring2", "ring3",
++					  "eip", "mem";
+ 			clock-names = "core", "reg";
+ 			clocks = <&CP11X_LABEL(clk) 1 26>,
+ 				 <&CP11X_LABEL(clk) 1 17>;
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch b/queue-5.15/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
new file mode 100644
index 00000000000..c9241d437ac
--- /dev/null
+++ b/queue-5.15/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
@@ -0,0 +1,57 @@
+From 7510d27525d9a36a53152049c53ef1ce9f5320b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 14:23:57 +0100
+Subject: arm64: dts: mediatek: mt7622: add missing "device_type" to memory
+ nodes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 99d100e00144bc01b49a697f4bc4398f2f7e7ce4 ]
+
+This fixes:
+arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: /: memory@40000000: 'device_type' is a required property
+        from schema $id: http://devicetree.org/schemas/memory.yaml#
+arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: /: memory@40000000: 'device_type' is a required property
+        from schema $id: http://devicetree.org/schemas/memory.yaml#
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240122132357.31264-1-zajec5@gmail.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 1 +
+ arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts             | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+index cdbd70bf5dd9b..483f7ab4f31c7 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -71,6 +71,7 @@ red {
+ 
+ 	memory@40000000 {
+ 		reg = <0 0x40000000 0 0x40000000>;
++		device_type = "memory";
+ 	};
+ 
+ 	reg_1p8v: regulator-1p8v {
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+index ee454a26b4597..28e17a7e2a5a6 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -57,6 +57,7 @@ wps {
+ 
+ 	memory@40000000 {
+ 		reg = <0 0x40000000 0 0x20000000>;
++		device_type = "memory";
+ 	};
+ 
+ 	reg_1p8v: regulator-1p8v {
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-mt8183-kukui-add-type-c-node.patch b/queue-5.15/arm64-dts-mt8183-kukui-add-type-c-node.patch
new file mode 100644
index 00000000000..0bc41fd03d3
--- /dev/null
+++ b/queue-5.15/arm64-dts-mt8183-kukui-add-type-c-node.patch
@@ -0,0 +1,54 @@
+From 137f911dba7622a17bedbf09614bc1d095fabf4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Dec 2021 11:51:12 -0800
+Subject: arm64: dts: mt8183: kukui: Add Type C node
+
+From: Prashant Malani <pmalani@chromium.org>
+
+[ Upstream commit fd31f778da81fec188f3ac8e03da4338642a8f08 ]
+
+Add a node describing the USB Type C connector, in order to utilize the
+Chromium OS USB Type-C driver that enumerates Type-C ports and connected
+cables/peripherals and makes them visible to userspace.
+
+Cc: Alexandru M Stan <amstan@chromium.org>
+Cc: Benson Leung <bleung@chromium.org>
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Reviewed-by: Alexandru M Stan <amstan@chromium.org>
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Link: https://lore.kernel.org/r/20211209195112.366176-1-pmalani@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Stable-dep-of: 04bd6411f506 ("arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+index 6b7a42c5d5153..30a84d888c66c 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+@@ -831,6 +831,20 @@ usbc_extcon: extcon0 {
+ 		cbas {
+ 			compatible = "google,cros-cbas";
+ 		};
++
++		typec {
++			compatible = "google,cros-ec-typec";
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			usb_c0: connector@0 {
++				compatible = "usb-c-connector";
++				reg = <0>;
++				power-role = "dual";
++				data-role = "host";
++				try-power-role = "sink";
++			};
++		};
+ 	};
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-mt8183-kukui-split-out-keyboard-node-and-d.patch b/queue-5.15/arm64-dts-mt8183-kukui-split-out-keyboard-node-and-d.patch
new file mode 100644
index 00000000000..f1cf9cd114c
--- /dev/null
+++ b/queue-5.15/arm64-dts-mt8183-kukui-split-out-keyboard-node-and-d.patch
@@ -0,0 +1,107 @@
+From 229372bda1066aa2223d4841026d2ee54a2e0dfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 May 2022 12:53:54 +0800
+Subject: arm64: dts: mt8183: kukui: Split out keyboard node and describe
+ detachables
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit 82492c4ef8f65f93cd4a35c4b52518935acbb2fa ]
+
+Kukui devices krane, kodana, and kakadu use detachable keyboards, which
+only have switches to be registered.
+
+Change the keyboard node's compatible of those boards to the newly
+introduced "google,cros-ec-keyb-switches", which won't include matrix
+properties.
+
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Link: https://lore.kernel.org/r/20220527045353.2483042-1-hsinyi@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Stable-dep-of: 04bd6411f506 ("arm64: dts: mt8183: Move CrosEC base detection node to kukui-based DTs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi | 2 ++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi  | 6 ++++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi  | 6 ++++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi   | 6 ++++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi         | 1 -
+ 5 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+index c1153580ef958..88fca67dead01 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-jacuzzi.dtsi
+@@ -4,6 +4,8 @@
+  */
+ 
+ #include "mt8183-kukui.dtsi"
++/* Must come after mt8183-kukui.dtsi to modify cros_ec */
++#include <arm/cros-ec-keyboard.dtsi>
+ 
+ / {
+ 	panel: panel {
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+index 28966a65391b0..4b419623c8dcc 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+@@ -372,6 +372,12 @@ pen_eject {
+ 	};
+ };
+ 
++&cros_ec {
++	keyboard-controller {
++		compatible = "google,cros-ec-keyb-switches";
++	};
++};
++
+ &qca_wifi {
+ 	qcom,ath10k-calibration-variant = "GO_KAKADU";
+ };
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+index 3aa79403c0c2c..e6e017260693c 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+@@ -338,6 +338,12 @@ touch_pin_reset: pin_reset {
+ 	};
+ };
+ 
++&cros_ec {
++	keyboard-controller {
++		compatible = "google,cros-ec-keyb-switches";
++	};
++};
++
+ &qca_wifi {
+ 	qcom,ath10k-calibration-variant = "GO_KODAMA";
+ };
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+index 30c183c96a54c..51bb2c23712c4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+@@ -342,6 +342,12 @@ rst_pin {
+ 	};
+ };
+ 
++&cros_ec {
++	keyboard-controller {
++		compatible = "google,cros-ec-keyb-switches";
++	};
++};
++
+ &qca_wifi {
+ 	qcom,ath10k-calibration-variant = "LE_Krane";
+ };
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+index 30a84d888c66c..f70f0f43aa52b 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+@@ -931,5 +931,4 @@ hub@1 {
+ 	};
+ };
+ 
+-#include <arm/cros-ec-keyboard.dtsi>
+ #include <arm/cros-ec-sbs.dtsi>
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch b/queue-5.15/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
new file mode 100644
index 00000000000..9a5cddbf54e
--- /dev/null
+++ b/queue-5.15/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
@@ -0,0 +1,106 @@
+From 1be56cb4ec2ded28a583193da3b406b9e817f9d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 18:38:34 -0300
+Subject: arm64: dts: mt8183: Move CrosEC base detection node to kukui-based
+ DTs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 04bd6411f506357fd1faedc2b2156e7ef206aa9a ]
+
+The cbas node is used to describe base detection functionality in the
+ChromeOS EC, which is used for units that have a detachable keyboard and
+thus rely on this functionality to switch between tablet and laptop
+mode.
+
+Despite the original commit having added the cbas node to the
+mt8183-kukui.dtsi, not all machines that include it are detachables. In
+fact all machines that include from mt8183-kukui-jacuzzi.dtsi are either
+clamshells (ie normal laptops) or convertibles, meaning the keyboard can
+be flipped but not detached. The detection for the keyboard getting
+flipped is handled by the driver bound to the keyboard-controller node
+in the EC.
+
+Move the base detection node from the base kukui dtsi to the dtsis where
+all machines are detachables, and thus actually make use of the node.
+
+Fixes: 4fa8492d1e5b ("arm64: dts: mt8183: add cbas node under cros_ec")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240116-mt8183-kukui-cbas-remove-v3-1-055e21406e86@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi  | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi        | 4 ----
+ 4 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+index 4b419623c8dcc..fa90708956945 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+@@ -373,6 +373,10 @@ pen_eject {
+ };
+ 
+ &cros_ec {
++	cbas {
++		compatible = "google,cros-cbas";
++	};
++
+ 	keyboard-controller {
+ 		compatible = "google,cros-ec-keyb-switches";
+ 	};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+index e6e017260693c..03724c80c0804 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+@@ -339,6 +339,10 @@ touch_pin_reset: pin_reset {
+ };
+ 
+ &cros_ec {
++	cbas {
++		compatible = "google,cros-cbas";
++	};
++
+ 	keyboard-controller {
+ 		compatible = "google,cros-ec-keyb-switches";
+ 	};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+index 51bb2c23712c4..be0ac786bcbc9 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+@@ -343,6 +343,10 @@ rst_pin {
+ };
+ 
+ &cros_ec {
++	cbas {
++		compatible = "google,cros-cbas";
++	};
++
+ 	keyboard-controller {
+ 		compatible = "google,cros-ec-keyb-switches";
+ 	};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+index f70f0f43aa52b..22a1c66325c29 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+@@ -828,10 +828,6 @@ usbc_extcon: extcon0 {
+ 			google,usb-port-id = <0>;
+ 		};
+ 
+-		cbas {
+-			compatible = "google,cros-cbas";
+-		};
+-
+ 		typec {
+ 			compatible = "google,cros-ec-typec";
+ 			#address-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch b/queue-5.15/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
new file mode 100644
index 00000000000..80011256f16
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
@@ -0,0 +1,42 @@
+From 4c2c69d28c95415f3cdb5f5ce02cacfc53f2ecaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 13:39:42 +0000
+Subject: arm64: dts: qcom: msm8996: Define UFS UniPro clock limits
+
+From: Yassine Oudjana <y.oudjana@protonmail.com>
+
+[ Upstream commit 68c4c20848d71b0e69c3403becb5dd23e89e5896 ]
+
+These limits were always defined as 0, but that didn't cause any issue
+since the driver had hardcoded limits. In commit b4e13e1ae95e ("scsi: ufs:
+qcom: Add multiple frequency support for MAX_CORE_CLK_1US_CYCLES") the
+hardcoded limits were removed and the driver started reading them from DT,
+causing UFS to stop working on MSM8996. Add real UniPro clock limits to fix
+UFS.
+
+Signed-off-by: Yassine Oudjana <y.oudjana@protonmail.com>
+Fixes: 57fc67ef0d35 ("arm64: dts: qcom: msm8996: Add ufs related nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218133917.78770-1-y.oudjana@protonmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 224b9f0f156a1..7be5ebe58e333 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -1761,7 +1761,7 @@ ufshc: ufshc@624000 {
+ 				<0 0>,
+ 				<0 0>,
+ 				<150000000 300000000>,
+-				<0 0>,
++				<75000000 150000000>,
+ 				<0 0>,
+ 				<0 0>,
+ 				<0 0>,
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch b/queue-5.15/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..eab524b4da3
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
@@ -0,0 +1,42 @@
+From fb8a9ed2b5929925bb3ffa570d7e700b06f1ce87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:28 +0530
+Subject: arm64: dts: qcom: msm8996: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit c83fdb4335cec507d685ba9661ed7c4ccbaf12ff ]
+
+QMP PHY used in MSM8996 requires 2 clocks:
+
+* ref - 19.2MHz reference clock from RPM
+* qref - QREF clock from GCC
+
+Fixes: 27520210e881 ("arm64: dts: qcom: msm8996: Use generic QMP driver for UFS")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-5-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index e8fe02f484bf2..224b9f0f156a1 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -1783,8 +1783,8 @@ ufsphy: phy@627000 {
+ 			#size-cells = <1>;
+ 			ranges;
+ 
+-			clocks = <&gcc GCC_UFS_CLKREF_CLK>;
+-			clock-names = "ref";
++			clocks = <&rpmcc RPM_SMD_LN_BB_CLK>, <&gcc GCC_UFS_CLKREF_CLK>;
++			clock-names = "ref", "qref";
+ 
+ 			resets = <&ufshc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-msm8996-move-clock-cells-to-qmp-phy-c.patch b/queue-5.15/arm64-dts-qcom-msm8996-move-clock-cells-to-qmp-phy-c.patch
new file mode 100644
index 00000000000..d4a37d51942
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-msm8996-move-clock-cells-to-qmp-phy-c.patch
@@ -0,0 +1,150 @@
+From 87b532489934e25275082177c5727e15a786b1f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Sep 2021 11:42:46 +0800
+Subject: arm64: dts: qcom: msm8996: Move '#clock-cells' to QMP PHY child node
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+[ Upstream commit 82d61e19fccbf2fe7c018765b3799791916e7f31 ]
+
+'#clock-cells' is a required property of QMP PHY child node, not itself.
+Move it to fix the dtbs_check warnings.
+
+There are only '#clock-cells' removal from SM8350 QMP PHY nodes, because
+child nodes already have the property.
+
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20210929034253.24570-4-shawn.guo@linaro.org
+Stable-dep-of: fc835b2311d4 ("arm64: dts: qcom: msm8998: declare VLS CLAMP register for USB3 PHY")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++--
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++--
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +-
+ arch/arm64/boot/dts/qcom/sm8350.dtsi  | 3 ---
+ 4 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq8074.dtsi b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+index 17eeff106bab7..0a4c5b847ddd5 100644
+--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi
+@@ -91,7 +91,6 @@ soc: soc {
+ 		ssphy_1: phy@58000 {
+ 			compatible = "qcom,ipq8074-qmp-usb3-phy";
+ 			reg = <0x00058000 0x1c4>;
+-			#clock-cells = <1>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges;
+@@ -112,6 +111,7 @@ usb1_ssphy: phy@58200 {
+ 				      <0x00058800 0x1f8>,     /* PCS  */
+ 				      <0x00058600 0x044>;     /* PCS misc*/
+ 				#phy-cells = <0>;
++				#clock-cells = <1>;
+ 				clocks = <&gcc GCC_USB1_PIPE_CLK>;
+ 				clock-names = "pipe0";
+ 				clock-output-names = "usb3phy_1_cc_pipe_clk";
+@@ -134,7 +134,6 @@ qusb_phy_1: phy@59000 {
+ 		ssphy_0: phy@78000 {
+ 			compatible = "qcom,ipq8074-qmp-usb3-phy";
+ 			reg = <0x00078000 0x1c4>;
+-			#clock-cells = <1>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges;
+@@ -155,6 +154,7 @@ usb0_ssphy: phy@78200 {
+ 				      <0x00078800 0x1f8>,     /* PCS  */
+ 				      <0x00078600 0x044>;     /* PCS misc*/
+ 				#phy-cells = <0>;
++				#clock-cells = <1>;
+ 				clocks = <&gcc GCC_USB0_PIPE_CLK>;
+ 				clock-names = "pipe0";
+ 				clock-output-names = "usb3phy_0_cc_pipe_clk";
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index fd9ffe8448b04..e8fe02f484bf2 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -615,7 +615,6 @@ soc: soc {
+ 		pcie_phy: phy@34000 {
+ 			compatible = "qcom,msm8996-qmp-pcie-phy";
+ 			reg = <0x00034000 0x488>;
+-			#clock-cells = <1>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges;
+@@ -637,6 +636,7 @@ pciephy_0: phy@35000 {
+ 				      <0x00035400 0x1dc>;
+ 				#phy-cells = <0>;
+ 
++				#clock-cells = <1>;
+ 				clock-output-names = "pcie_0_pipe_clk_src";
+ 				clocks = <&gcc GCC_PCIE_0_PIPE_CLK>;
+ 				clock-names = "pipe0";
+@@ -2641,7 +2641,6 @@ usb3_dwc3: dwc3@6a00000 {
+ 		usb3phy: phy@7410000 {
+ 			compatible = "qcom,msm8996-qmp-usb3-phy";
+ 			reg = <0x07410000 0x1c4>;
+-			#clock-cells = <1>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges;
+@@ -2662,6 +2661,7 @@ ssusb_phy_0: phy@7410200 {
+ 				      <0x07410600 0x1a8>;
+ 				#phy-cells = <0>;
+ 
++				#clock-cells = <1>;
+ 				clock-output-names = "usb3_phy_pipe_clk_src";
+ 				clocks = <&gcc GCC_USB3_PHY_PIPE_CLK>;
+ 				clock-names = "pipe0";
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 7eadecba0175d..6dbed85fa53e5 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1993,7 +1993,6 @@ usb3phy: phy@c010000 {
+ 			compatible = "qcom,msm8998-qmp-usb3-phy";
+ 			reg = <0x0c010000 0x18c>;
+ 			status = "disabled";
+-			#clock-cells = <1>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 			ranges;
+@@ -2014,6 +2013,7 @@ usb1_ssphy: phy@c010200 {
+ 				      <0xc010600 0x128>,
+ 				      <0xc010800 0x200>;
+ 				#phy-cells = <0>;
++				#clock-cells = <1>;
+ 				clocks = <&gcc GCC_USB3_PHY_PIPE_CLK>;
+ 				clock-names = "pipe0";
+ 				clock-output-names = "usb3_phy_pipe_clk_src";
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index b0ba63b5869d2..8506dc841c869 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -1119,7 +1119,6 @@ ufs_mem_phy: phy@1d87000 {
+ 			reg = <0 0x01d87000 0 0x1c4>;
+ 			#address-cells = <2>;
+ 			#size-cells = <2>;
+-			#clock-cells = <1>;
+ 			ranges;
+ 			clock-names = "ref",
+ 				      "ref_aux";
+@@ -1254,7 +1253,6 @@ usb_1_qmpphy: phy-wrapper@88e9000 {
+ 			      <0 0x088e8000 0 0x20>;
+ 			reg-names = "reg-base", "dp_com";
+ 			status = "disabled";
+-			#clock-cells = <1>;
+ 			#address-cells = <2>;
+ 			#size-cells = <2>;
+ 			ranges;
+@@ -1287,7 +1285,6 @@ usb_2_qmpphy: phy-wrapper@88eb000 {
+ 			compatible = "qcom,sm8350-qmp-usb3-uni-phy";
+ 			reg = <0 0x088eb000 0 0x200>;
+ 			status = "disabled";
+-			#clock-cells = <1>;
+ 			#address-cells = <2>;
+ 			#size-cells = <2>;
+ 			ranges;
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch b/queue-5.15/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
new file mode 100644
index 00000000000..9151fa2a987
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
@@ -0,0 +1,53 @@
+From 3be76fec6d411c9935a5f3c5d24dc46ca44c5733 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:04:25 +0200
+Subject: arm64: dts: qcom: msm8998: declare VLS CLAMP register for USB3 PHY
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit fc835b2311d4deb85d776c1d73562338462aa7ac ]
+
+The USB3 PHY on the MSM8998 platform doesn't have built-in
+PCS_MISC_CLAMP_ENABLE register. Instead clamping is handled separately
+via the register in the TCSR space. Declare corresponding register.
+
+Fixes: 026dad8f5873 ("arm64: dts: qcom: msm8998: Add USB-related nodes")
+Cc: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-4-a950c223f10f@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index b3b1258f2d6f8..3d32bf0986e1e 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1081,6 +1081,11 @@ tcsr_mutex_regs: syscon@1f40000 {
+ 			reg = <0x01f40000 0x40000>;
+ 		};
+ 
++		tcsr_regs_2: syscon@1fc0000 {
++			compatible = "qcom,msm8998-tcsr", "syscon";
++			reg = <0x01fc0000 0x26000>;
++		};
++
+ 		tlmm: pinctrl@3400000 {
+ 			compatible = "qcom,msm8998-pinctrl";
+ 			reg = <0x03400000 0xc00000>;
+@@ -2010,6 +2015,8 @@ usb3phy: phy@c010000 {
+ 			reset-names = "phy",
+ 				      "phy_phy";
+ 
++			qcom,tcsr-reg = <&tcsr_regs_2 0xb244>;
++
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-msm8998-drop-usb-phy-clock-index.patch b/queue-5.15/arm64-dts-qcom-msm8998-drop-usb-phy-clock-index.patch
new file mode 100644
index 00000000000..7cc9a86c1dd
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-msm8998-drop-usb-phy-clock-index.patch
@@ -0,0 +1,38 @@
+From a2775efb4ed0dd5a4f1d3525d081bc767b1ba4bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jul 2022 13:40:24 +0200
+Subject: arm64: dts: qcom: msm8998: drop USB PHY clock index
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit ed9cbbcb8c6a1925db7995214602c6a8983ff870 ]
+
+The QMP USB PHY provides a single clock so drop the redundant clock
+index.
+
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220705114032.22787-7-johan+linaro@kernel.org
+Stable-dep-of: fc835b2311d4 ("arm64: dts: qcom: msm8998: declare VLS CLAMP register for USB3 PHY")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 6dbed85fa53e5..e1b744d76251d 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -2013,7 +2013,7 @@ usb1_ssphy: phy@c010200 {
+ 				      <0xc010600 0x128>,
+ 				      <0xc010800 0x200>;
+ 				#phy-cells = <0>;
+-				#clock-cells = <1>;
++				#clock-cells = <0>;
+ 				clocks = <&gcc GCC_USB3_PHY_PIPE_CLK>;
+ 				clock-names = "pipe0";
+ 				clock-output-names = "usb3_phy_pipe_clk_src";
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch b/queue-5.15/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..4fee3a5d947
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From 352596b7c18e9c474339bb79a75e4d8de02482e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:29 +0530
+Subject: arm64: dts: qcom: msm8998: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 5e653a7ff4426242f22dd8bc6af7f29e10ee0d68 ]
+
+QMP PHY used in MSM8998 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPM
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+Fixes: cd3dbe2a4e6c ("arm64: dts: qcom: msm8998: Add UFS nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-6-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 3d32bf0986e1e..1815e10c6fda1 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1056,12 +1056,12 @@ ufsphy: phy@1da7000 {
+ 			status = "disabled";
+ 			ranges;
+ 
+-			clock-names =
+-				"ref",
+-				"ref_aux";
+-			clocks =
+-				<&gcc GCC_UFS_CLKREF_CLK>,
+-				<&gcc GCC_UFS_PHY_AUX_CLK>;
++			clocks = <&rpmcc RPM_SMD_LN_BB_CLK1>,
++				 <&gcc GCC_UFS_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_CLKREF_CLK>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			reset-names = "ufsphy";
+ 			resets = <&ufshc 0>;
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch b/queue-5.15/arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch
new file mode 100644
index 00000000000..c48a998a0dc
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch
@@ -0,0 +1,85 @@
+From 8d1c3dbaefa0a2651f8e5b4fc3381a22c3ffb84b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Aug 2023 00:19:46 +0300
+Subject: arm64: dts: qcom: msm8998: switch USB QMP PHY to new style of
+ bindings
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit b7efebfeb2e8ad8187cdabba5f0212ba2e6c1069 ]
+
+Change the USB QMP PHY to use newer style of QMP PHY bindings (single
+resource region, no per-PHY subnodes).
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230824211952.1397699-11-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: fc835b2311d4 ("arm64: dts: qcom: msm8998: declare VLS CLAMP register for USB3 PHY")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 35 +++++++++++----------------
+ 1 file changed, 14 insertions(+), 21 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index e1b744d76251d..b3b1258f2d6f8 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1982,7 +1982,7 @@ usb3_dwc3: dwc3@a800000 {
+ 				interrupts = <GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
+ 				snps,dis_u2_susphy_quirk;
+ 				snps,dis_enblslpm_quirk;
+-				phys = <&qusb2phy>, <&usb1_ssphy>;
++				phys = <&qusb2phy>, <&usb3phy>;
+ 				phy-names = "usb2-phy", "usb3-phy";
+ 				snps,has-lpm-erratum;
+ 				snps,hird-threshold = /bits/ 8 <0x10>;
+@@ -1991,33 +1991,26 @@ usb3_dwc3: dwc3@a800000 {
+ 
+ 		usb3phy: phy@c010000 {
+ 			compatible = "qcom,msm8998-qmp-usb3-phy";
+-			reg = <0x0c010000 0x18c>;
+-			status = "disabled";
+-			#address-cells = <1>;
+-			#size-cells = <1>;
+-			ranges;
++			reg = <0x0c010000 0x1000>;
+ 
+ 			clocks = <&gcc GCC_USB3_PHY_AUX_CLK>,
++				 <&gcc GCC_USB3_CLKREF_CLK>,
+ 				 <&gcc GCC_USB_PHY_CFG_AHB2PHY_CLK>,
+-				 <&gcc GCC_USB3_CLKREF_CLK>;
+-			clock-names = "aux", "cfg_ahb", "ref";
++				 <&gcc GCC_USB3_PHY_PIPE_CLK>;
++			clock-names = "aux",
++				      "ref",
++				      "cfg_ahb",
++				      "pipe";
++			clock-output-names = "usb3_phy_pipe_clk_src";
++			#clock-cells = <0>;
++			#phy-cells = <0>;
+ 
+ 			resets = <&gcc GCC_USB3_PHY_BCR>,
+ 				 <&gcc GCC_USB3PHY_PHY_BCR>;
+-			reset-names = "phy", "common";
++			reset-names = "phy",
++				      "phy_phy";
+ 
+-			usb1_ssphy: phy@c010200 {
+-				reg = <0xc010200 0x128>,
+-				      <0xc010400 0x200>,
+-				      <0xc010c00 0x20c>,
+-				      <0xc010600 0x128>,
+-				      <0xc010800 0x200>;
+-				#phy-cells = <0>;
+-				#clock-cells = <0>;
+-				clocks = <&gcc GCC_USB3_PHY_PIPE_CLK>;
+-				clock-names = "pipe0";
+-				clock-output-names = "usb3_phy_pipe_clk_src";
+-			};
++			status = "disabled";
+ 		};
+ 
+ 		qusb2phy: phy@c012000 {
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch b/queue-5.15/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..5d6c152d05f
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From f61c4cd0daa7867eea38d1b04ac1ad68ff1e27df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:30 +0530
+Subject: arm64: dts: qcom: sdm845: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit ca8fb2bd2248ae05890c011d691ba5d4a1e7d8d6 ]
+
+QMP PHY used in SDM845 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: cc16687fbd74 ("arm64: dts: qcom: sdm845: add UFS controller")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-7-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 06e160ee00dd1..f83f83dd56a53 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2292,10 +2292,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sdm845-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_MEM_CLKREF_CLK>;
+ 			clock-names = "ref",
+-				      "ref_aux";
+-			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch b/queue-5.15/arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch
new file mode 100644
index 00000000000..2346bd4e437
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch
@@ -0,0 +1,70 @@
+From 5d822459a0d30a1ca6d2b345c3fbee92b9487a94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 06:25:46 +0300
+Subject: arm64: dts: qcom: sdm845: switch UFS QMP PHY to new style of bindings
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 760baba5e79bae651c59df89d441fad2bd0be4a5 ]
+
+Change the UFS QMP PHY to use newer style of QMP PHY bindings (single
+resource region, no per-PHY subnodes).
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20231205032552.1583336-4-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: ca8fb2bd2248 ("arm64: dts: qcom: sdm845: Fix UFS PHY clocks")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 15af6c7ad06c0..06e160ee00dd1 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2244,7 +2244,7 @@ ufs_mem_hc: ufshc@1d84000 {
+ 			      <0 0x01d90000 0 0x8000>;
+ 			reg-names = "std", "ice";
+ 			interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+-			phys = <&ufs_mem_phy_lanes>;
++			phys = <&ufs_mem_phy>;
+ 			phy-names = "ufsphy";
+ 			lanes-per-direction = <2>;
+ 			power-domains = <&gcc UFS_PHY_GDSC>;
+@@ -2290,10 +2290,8 @@ ufs_mem_hc: ufshc@1d84000 {
+ 
+ 		ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sdm845-qmp-ufs-phy";
+-			reg = <0 0x01d87000 0 0x18c>;
+-			#address-cells = <2>;
+-			#size-cells = <2>;
+-			ranges;
++			reg = <0 0x01d87000 0 0x1000>;
++
+ 			clock-names = "ref",
+ 				      "ref_aux";
+ 			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+@@ -2301,16 +2299,9 @@ ufs_mem_phy: phy@1d87000 {
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-			status = "disabled";
+ 
+-			ufs_mem_phy_lanes: phy@1d87400 {
+-				reg = <0 0x01d87400 0 0x108>,
+-				      <0 0x01d87600 0 0x1e0>,
+-				      <0 0x01d87c00 0 0x1dc>,
+-				      <0 0x01d87800 0 0x108>,
+-				      <0 0x01d87a00 0 0x1e0>;
+-				#phy-cells = <0>;
+-			};
++			#phy-cells = <0>;
++			status = "disabled";
+ 		};
+ 
+ 		cryptobam: dma@1dc4000 {
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch b/queue-5.15/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..3cf67ebe978
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From 74efc2fe8b4e20ff3b3bf9c5479840ce6f690ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:34 +0530
+Subject: arm64: dts: qcom: sm8150: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit eff7496b72810ca54da8c9c4542bf2aca479dd44 ]
+
+QMP PHY used in SM8150 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: 3834a2e92229 ("arm64: dts: qcom: sm8150: Add ufs nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-11-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index c00840219a45d..860162cdd606c 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -1681,10 +1681,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm8150-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_MEM_CLKREF_CLK>;
+ 			clock-names = "ref",
+-				      "ref_aux";
+-			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch b/queue-5.15/arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch
new file mode 100644
index 00000000000..a16c9b31097
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch
@@ -0,0 +1,71 @@
+From 598c0b0c7da8d9e34a894e479b067af49cf1a882 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 06:25:49 +0300
+Subject: arm64: dts: qcom: sm8150: switch UFS QMP PHY to new style of bindings
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 935c76f7f85912962d72eceabdfa2c38c4c07f02 ]
+
+Change the UFS QMP PHY to use newer style of QMP PHY bindings (single
+resource region, no per-PHY subnodes).
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20231205032552.1583336-7-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: eff7496b7281 ("arm64: dts: qcom: sm8150: Fix UFS PHY clocks")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index a072b40c96987..c00840219a45d 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -1634,7 +1634,7 @@ ufs_mem_hc: ufshc@1d84000 {
+ 			      <0 0x01d90000 0 0x8000>;
+ 			reg-names = "std", "ice";
+ 			interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+-			phys = <&ufs_mem_phy_lanes>;
++			phys = <&ufs_mem_phy>;
+ 			phy-names = "ufsphy";
+ 			lanes-per-direction = <2>;
+ 			#reset-cells = <1>;
+@@ -1679,10 +1679,8 @@ ufs_mem_hc: ufshc@1d84000 {
+ 
+ 		ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm8150-qmp-ufs-phy";
+-			reg = <0 0x01d87000 0 0x1c0>;
+-			#address-cells = <2>;
+-			#size-cells = <2>;
+-			ranges;
++			reg = <0 0x01d87000 0 0x1000>;
++
+ 			clock-names = "ref",
+ 				      "ref_aux";
+ 			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+@@ -1690,16 +1688,10 @@ ufs_mem_phy: phy@1d87000 {
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-			status = "disabled";
+ 
+-			ufs_mem_phy_lanes: phy@1d87400 {
+-				reg = <0 0x01d87400 0 0x16c>,
+-				      <0 0x01d87600 0 0x200>,
+-				      <0 0x01d87c00 0 0x200>,
+-				      <0 0x01d87800 0 0x16c>,
+-				      <0 0x01d87a00 0 0x200>;
+-				#phy-cells = <0>;
+-			};
++			#phy-cells = <0>;
++
++			status = "disabled";
+ 		};
+ 
+ 		ipa_virt: interconnect@1e00000 {
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch b/queue-5.15/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..fd053bfa8b5
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From d17f3c37c3ab47c46e23e7d904396f486eb2c3dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:35 +0530
+Subject: arm64: dts: qcom: sm8250: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 55ee02b10bdd9577b6eabe98ebb383ec4e0674a7 ]
+
+QMP PHY used in SM8250 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: b7e2fba06622 ("arm64: dts: qcom: sm8250: Add UFS controller and PHY")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-12-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 71705b760c8b1..0ec55883a643d 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -1748,10 +1748,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm8250-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
+-			clock-names = "ref",
+-				      "ref_aux";
+ 			clocks = <&rpmhcc RPMH_CXO_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_1X_CLKREF_EN>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch b/queue-5.15/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch
new file mode 100644
index 00000000000..e92a47ff962
--- /dev/null
+++ b/queue-5.15/arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch
@@ -0,0 +1,71 @@
+From 6136c5fead9a0000a1b0f4d6bf8072d4e35ec926 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 06:25:50 +0300
+Subject: arm64: dts: qcom: sm8250: switch UFS QMP PHY to new style of bindings
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit ba865bdcc688932980b8e5ec2154eaa33cd4a981 ]
+
+Change the UFS QMP PHY to use newer style of QMP PHY bindings (single
+resource region, no per-PHY subnodes).
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20231205032552.1583336-8-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: 55ee02b10bdd ("arm64: dts: qcom: sm8250: Fix UFS PHY clocks")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 8880e9cbc9743..71705b760c8b1 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -1702,7 +1702,7 @@ ufs_mem_hc: ufshc@1d84000 {
+ 				     "jedec,ufs-2.0";
+ 			reg = <0 0x01d84000 0 0x3000>;
+ 			interrupts = <GIC_SPI 265 IRQ_TYPE_LEVEL_HIGH>;
+-			phys = <&ufs_mem_phy_lanes>;
++			phys = <&ufs_mem_phy>;
+ 			phy-names = "ufsphy";
+ 			lanes-per-direction = <2>;
+ 			#reset-cells = <1>;
+@@ -1746,10 +1746,8 @@ ufs_mem_hc: ufshc@1d84000 {
+ 
+ 		ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm8250-qmp-ufs-phy";
+-			reg = <0 0x01d87000 0 0x1c0>;
+-			#address-cells = <2>;
+-			#size-cells = <2>;
+-			ranges;
++			reg = <0 0x01d87000 0 0x1000>;
++
+ 			clock-names = "ref",
+ 				      "ref_aux";
+ 			clocks = <&rpmhcc RPMH_CXO_CLK>,
+@@ -1757,16 +1755,10 @@ ufs_mem_phy: phy@1d87000 {
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-			status = "disabled";
+ 
+-			ufs_mem_phy_lanes: phy@1d87400 {
+-				reg = <0 0x01d87400 0 0x16c>,
+-				      <0 0x01d87600 0 0x200>,
+-				      <0 0x01d87c00 0 0x200>,
+-				      <0 0x01d87800 0 0x16c>,
+-				      <0 0x01d87a00 0 0x200>;
+-				#phy-cells = <0>;
+-			};
++			#phy-cells = <0>;
++
++			status = "disabled";
+ 		};
+ 
+ 		ipa_virt: interconnect@1e00000 {
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch b/queue-5.15/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
new file mode 100644
index 00000000000..e01bc325aa1
--- /dev/null
+++ b/queue-5.15/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
@@ -0,0 +1,48 @@
+From 610296762f162b83d8bc31cece66494301cacd2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 15:21:30 +0100
+Subject: arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0c51912331f8ba5ce5fb52f46e340945160672a3 ]
+
+All Ethernet AVB instances on R-Car V3U have registers related to UDP/IP
+support, but the declared register blocks for the first two instances
+are too small to cover them.
+
+Fix this by extending the register block sizes.
+
+Fixes: 5a633320f08b8c9b ("arm64: dts: renesas: r8a779a0: Add Ethernet-AVB support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/ce6ce3c4b1495e02e7c1803fca810a7178a84500.1707660323.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+index c7d1b79692c11..ed71a10d023ee 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+@@ -584,7 +584,7 @@ hscif3: serial@e66a0000 {
+ 		avb0: ethernet@e6800000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+ 				     "renesas,etheravb-rcar-gen4";
+-			reg = <0 0xe6800000 0 0x800>;
++			reg = <0 0xe6800000 0 0x1000>;
+ 			interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 257 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 258 IRQ_TYPE_LEVEL_HIGH>,
+@@ -632,7 +632,7 @@ avb0: ethernet@e6800000 {
+ 		avb1: ethernet@e6810000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+ 				     "renesas,etheravb-rcar-gen4";
+-			reg = <0 0xe6810000 0 0x800>;
++			reg = <0 0xe6810000 0 0x1000>;
+ 			interrupts = <GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 283 IRQ_TYPE_LEVEL_HIGH>,
+-- 
+2.43.0
+
diff --git a/queue-5.15/arm64-dts-renesas-r8a779a0-update-to-r-car-gen4-comp.patch b/queue-5.15/arm64-dts-renesas-r8a779a0-update-to-r-car-gen4-comp.patch
new file mode 100644
index 00000000000..cd380694b93
--- /dev/null
+++ b/queue-5.15/arm64-dts-renesas-r8a779a0-update-to-r-car-gen4-comp.patch
@@ -0,0 +1,143 @@
+From dfcba0ce80d7d7b7779b424a17d831385b52525d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Oct 2022 12:03:52 +0200
+Subject: arm64: dts: renesas: r8a779a0: Update to R-Car Gen4 compatible values
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a1721bbbdb5c6687d157f8b8714bba837f6028ac ]
+
+Despite the name, R-Car V3U is the first member of the R-Car Gen4
+family.  Hence update the compatible properties in various device nodes
+to include family-specific compatible values for R-Car Gen4 instead of
+R-Car Gen3:
+  - DMAC,
+  - (H)SCIF,
+  - I2C,
+  - IPMMU,
+  - WDT.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/73cea9d5e1a6639422c67e4df4285042e31c9fd5.1651497071.git.geert+renesas@glider.be
+Stable-dep-of: 0c51912331f8 ("arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 24 +++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+index 26899fb768a73..c7d1b79692c11 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+@@ -583,7 +583,7 @@ hscif3: serial@e66a0000 {
+ 
+ 		avb0: ethernet@e6800000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+-				     "renesas,etheravb-rcar-gen3";
++				     "renesas,etheravb-rcar-gen4";
+ 			reg = <0 0xe6800000 0 0x800>;
+ 			interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 257 IRQ_TYPE_LEVEL_HIGH>,
+@@ -631,7 +631,7 @@ avb0: ethernet@e6800000 {
+ 
+ 		avb1: ethernet@e6810000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+-				     "renesas,etheravb-rcar-gen3";
++				     "renesas,etheravb-rcar-gen4";
+ 			reg = <0 0xe6810000 0 0x800>;
+ 			interrupts = <GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
+@@ -679,7 +679,7 @@ avb1: ethernet@e6810000 {
+ 
+ 		avb2: ethernet@e6820000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+-				     "renesas,etheravb-rcar-gen3";
++				     "renesas,etheravb-rcar-gen4";
+ 			reg = <0 0xe6820000 0 0x1000>;
+ 			interrupts = <GIC_SPI 306 IRQ_TYPE_LEVEL_HIGH>,
+ 					<GIC_SPI 307 IRQ_TYPE_LEVEL_HIGH>,
+@@ -727,7 +727,7 @@ avb2: ethernet@e6820000 {
+ 
+ 		avb3: ethernet@e6830000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+-				     "renesas,etheravb-rcar-gen3";
++				     "renesas,etheravb-rcar-gen4";
+ 			reg = <0 0xe6830000 0 0x1000>;
+ 			interrupts = <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH>,
+ 					<GIC_SPI 332 IRQ_TYPE_LEVEL_HIGH>,
+@@ -775,7 +775,7 @@ avb3: ethernet@e6830000 {
+ 
+ 		avb4: ethernet@e6840000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+-				     "renesas,etheravb-rcar-gen3";
++				     "renesas,etheravb-rcar-gen4";
+ 			reg = <0 0xe6840000 0 0x1000>;
+ 			interrupts = <GIC_SPI 356 IRQ_TYPE_LEVEL_HIGH>,
+ 					<GIC_SPI 357 IRQ_TYPE_LEVEL_HIGH>,
+@@ -823,7 +823,7 @@ avb4: ethernet@e6840000 {
+ 
+ 		avb5: ethernet@e6850000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+-				     "renesas,etheravb-rcar-gen3";
++				     "renesas,etheravb-rcar-gen4";
+ 			reg = <0 0xe6850000 0 0x1000>;
+ 			interrupts = <GIC_SPI 381 IRQ_TYPE_LEVEL_HIGH>,
+ 					<GIC_SPI 382 IRQ_TYPE_LEVEL_HIGH>,
+@@ -935,7 +935,7 @@ scif4: serial@e6c40000 {
+ 
+ 		msiof0: spi@e6e90000 {
+ 			compatible = "renesas,msiof-r8a779a0",
+-				     "renesas,rcar-gen3-msiof";
++				     "renesas,rcar-gen4-msiof";
+ 			reg = <0 0xe6e90000 0 0x0064>;
+ 			interrupts = <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 618>;
+@@ -950,7 +950,7 @@ msiof0: spi@e6e90000 {
+ 
+ 		msiof1: spi@e6ea0000 {
+ 			compatible = "renesas,msiof-r8a779a0",
+-				     "renesas,rcar-gen3-msiof";
++				     "renesas,rcar-gen4-msiof";
+ 			reg = <0 0xe6ea0000 0 0x0064>;
+ 			interrupts = <GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 619>;
+@@ -965,7 +965,7 @@ msiof1: spi@e6ea0000 {
+ 
+ 		msiof2: spi@e6c00000 {
+ 			compatible = "renesas,msiof-r8a779a0",
+-				     "renesas,rcar-gen3-msiof";
++				     "renesas,rcar-gen4-msiof";
+ 			reg = <0 0xe6c00000 0 0x0064>;
+ 			interrupts = <GIC_SPI 247 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 620>;
+@@ -980,7 +980,7 @@ msiof2: spi@e6c00000 {
+ 
+ 		msiof3: spi@e6c10000 {
+ 			compatible = "renesas,msiof-r8a779a0",
+-				     "renesas,rcar-gen3-msiof";
++				     "renesas,rcar-gen4-msiof";
+ 			reg = <0 0xe6c10000 0 0x0064>;
+ 			interrupts = <GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 621>;
+@@ -995,7 +995,7 @@ msiof3: spi@e6c10000 {
+ 
+ 		msiof4: spi@e6c20000 {
+ 			compatible = "renesas,msiof-r8a779a0",
+-				     "renesas,rcar-gen3-msiof";
++				     "renesas,rcar-gen4-msiof";
+ 			reg = <0 0xe6c20000 0 0x0064>;
+ 			interrupts = <GIC_SPI 249 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 622>;
+@@ -1010,7 +1010,7 @@ msiof4: spi@e6c20000 {
+ 
+ 		msiof5: spi@e6c28000 {
+ 			compatible = "renesas,msiof-r8a779a0",
+-				     "renesas,rcar-gen3-msiof";
++				     "renesas,rcar-gen4-msiof";
+ 			reg = <0 0xe6c28000 0 0x0064>;
+ 			interrupts = <GIC_SPI 250 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 623>;
+-- 
+2.43.0
+
diff --git a/queue-5.15/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch b/queue-5.15/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
new file mode 100644
index 00000000000..f751c2304a3
--- /dev/null
+++ b/queue-5.15/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
@@ -0,0 +1,85 @@
+From f979fa9b9b5d629f85d5c586c75dd2ca4fb2366b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 22:58:03 +0100
+Subject: ASoC: meson: aiu: fix function pointer type mismatch
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 98ac85a00f31d2e9d5452b825a9ed0153d934043 ]
+
+clang-16 warns about casting functions to incompatible types, as is done
+here to call clk_disable_unprepare:
+
+sound/soc/meson/aiu.c:243:12: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  243 |                                        (void(*)(void *))clk_disable_unprepare,
+
+The pattern of getting, enabling and setting a disable callback for a
+clock can be replaced with devm_clk_get_enabled(), which also fixes
+this warning.
+
+Fixes: 6ae9ca9ce986 ("ASoC: meson: aiu: add i2s and spdif support")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Link: https://msgid.link/r/20240213215807.3326688-2-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu.c | 19 ++++---------------
+ sound/soc/meson/aiu.h |  1 -
+ 2 files changed, 4 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/meson/aiu.c b/sound/soc/meson/aiu.c
+index d299a70db7e59..a164ca2446ecd 100644
+--- a/sound/soc/meson/aiu.c
++++ b/sound/soc/meson/aiu.c
+@@ -215,11 +215,12 @@ static const char * const aiu_spdif_ids[] = {
+ static int aiu_clk_get(struct device *dev)
+ {
+ 	struct aiu *aiu = dev_get_drvdata(dev);
++	struct clk *pclk;
+ 	int ret;
+ 
+-	aiu->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(aiu->pclk))
+-		return dev_err_probe(dev, PTR_ERR(aiu->pclk), "Can't get the aiu pclk\n");
++	pclk = devm_clk_get_enabled(dev, "pclk");
++	if (IS_ERR(pclk))
++		return dev_err_probe(dev, PTR_ERR(pclk), "Can't get the aiu pclk\n");
+ 
+ 	aiu->spdif_mclk = devm_clk_get(dev, "spdif_mclk");
+ 	if (IS_ERR(aiu->spdif_mclk))
+@@ -236,18 +237,6 @@ static int aiu_clk_get(struct device *dev)
+ 	if (ret)
+ 		return dev_err_probe(dev, ret, "Can't get the spdif clocks\n");
+ 
+-	ret = clk_prepare_enable(aiu->pclk);
+-	if (ret) {
+-		dev_err(dev, "peripheral clock enable failed\n");
+-		return ret;
+-	}
+-
+-	ret = devm_add_action_or_reset(dev,
+-				       (void(*)(void *))clk_disable_unprepare,
+-				       aiu->pclk);
+-	if (ret)
+-		dev_err(dev, "failed to add reset action on pclk");
+-
+ 	return ret;
+ }
+ 
+diff --git a/sound/soc/meson/aiu.h b/sound/soc/meson/aiu.h
+index 393b6c2307e49..0f94c8bf60818 100644
+--- a/sound/soc/meson/aiu.h
++++ b/sound/soc/meson/aiu.h
+@@ -33,7 +33,6 @@ struct aiu_platform_data {
+ };
+ 
+ struct aiu {
+-	struct clk *pclk;
+ 	struct clk *spdif_mclk;
+ 	struct aiu_interface i2s;
+ 	struct aiu_interface spdif;
+-- 
+2.43.0
+
diff --git a/queue-5.15/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch b/queue-5.15/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
new file mode 100644
index 00000000000..bda591fc358
--- /dev/null
+++ b/queue-5.15/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
@@ -0,0 +1,86 @@
+From a06808bff78f5a3a8266302791703e9c05f85119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 18:51:08 +0100
+Subject: ASoC: meson: axg-tdm-interface: add frame rate constraint
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 59c6a3a43b221cc2a211181b1298e43b2c2df782 ]
+
+According to Amlogic datasheets for the SoCs supported by this driver, the
+maximum bit clock rate is 100MHz.
+
+The tdm interface allows the rates listed by the DAI driver, regardless of
+the number slots or their width. However, these will impact the bit clock
+rate.
+
+Hitting the 100MHz limit is very unlikely for most use cases but it is
+possible.
+
+For example with 32 slots / 32 bits wide, the maximum rate is no longer
+384kHz but ~96kHz.
+
+Add the constraint accordingly if the component is not already active.
+If it is active, the rate is already constrained by the first stream rate.
+
+Fixes: d60e4f1e4be5 ("ASoC: meson: add tdm interface driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://msgid.link/r/20240223175116.2005407-3-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdm-interface.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index ac43a7ab7bcf6..60d132ab1ab78 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -12,6 +12,9 @@
+ 
+ #include "axg-tdm.h"
+ 
++/* Maximum bit clock frequency according the datasheets */
++#define MAX_SCLK 100000000 /* Hz */
++
+ enum {
+ 	TDM_IFACE_PAD,
+ 	TDM_IFACE_LOOPBACK,
+@@ -155,19 +158,27 @@ static int axg_tdm_iface_startup(struct snd_pcm_substream *substream,
+ 		return -EINVAL;
+ 	}
+ 
+-	/* Apply component wide rate symmetry */
+ 	if (snd_soc_component_active(dai->component)) {
++		/* Apply component wide rate symmetry */
+ 		ret = snd_pcm_hw_constraint_single(substream->runtime,
+ 						   SNDRV_PCM_HW_PARAM_RATE,
+ 						   iface->rate);
+-		if (ret < 0) {
+-			dev_err(dai->dev,
+-				"can't set iface rate constraint\n");
+-			return ret;
+-		}
++
++	} else {
++		/* Limit rate according to the slot number and width */
++		unsigned int max_rate =
++			MAX_SCLK / (iface->slots * iface->slot_width);
++		ret = snd_pcm_hw_constraint_minmax(substream->runtime,
++						   SNDRV_PCM_HW_PARAM_RATE,
++						   0, max_rate);
+ 	}
+ 
+-	return 0;
++	if (ret < 0)
++		dev_err(dai->dev, "can't set iface rate constraint\n");
++	else
++		ret = 0;
++
++	return ret;
+ }
+ 
+ static int axg_tdm_iface_set_stream(struct snd_pcm_substream *substream,
+-- 
+2.43.0
+
diff --git a/queue-5.15/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch b/queue-5.15/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
new file mode 100644
index 00000000000..99c41c51d3e
--- /dev/null
+++ b/queue-5.15/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
@@ -0,0 +1,49 @@
+From 16295e9dda63ce1ee174d4e20218dcb74ee79097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 18:51:07 +0100
+Subject: ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit e3741a8d28a1137f8b19ae6f3d6e3be69a454a0a ]
+
+By default, when mclk-fs is not provided, the tdm-interface driver
+requests an MCLK that is 4x the bit clock, SCLK.
+
+However there is no justification for this:
+
+* If the codec needs MCLK for its operation, mclk-fs is expected to be set
+  according to the codec requirements.
+* If the codec does not need MCLK the minimum is 2 * SCLK, because this is
+  minimum the divider between SCLK and MCLK can do.
+
+Multiplying by 4 may cause problems because the PLL limit may be reached
+sooner than it should, so use 2x instead.
+
+Fixes: d60e4f1e4be5 ("ASoC: meson: add tdm interface driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://msgid.link/r/20240223175116.2005407-2-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdm-interface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index e076ced300257..ac43a7ab7bcf6 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -266,8 +266,8 @@ static int axg_tdm_iface_set_sclk(struct snd_soc_dai *dai,
+ 	srate = iface->slots * iface->slot_width * params_rate(params);
+ 
+ 	if (!iface->mclk_rate) {
+-		/* If no specific mclk is requested, default to bit clock * 4 */
+-		clk_set_rate(iface->mclk, 4 * srate);
++		/* If no specific mclk is requested, default to bit clock * 2 */
++		clk_set_rate(iface->mclk, 2 * srate);
+ 	} else {
+ 		/* Check if we can actually get the bit clock from mclk */
+ 		if (iface->mclk_rate % srate) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch b/queue-5.15/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
new file mode 100644
index 00000000000..d1558c4375b
--- /dev/null
+++ b/queue-5.15/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
@@ -0,0 +1,83 @@
+From d83b446ab06a2118af849e91bbf579f83db3ba94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 22:58:04 +0100
+Subject: ASoC: meson: t9015: fix function pointer type mismatch
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 5ad992c71b6a8e8a547954addc7af9fbde6ca10a ]
+
+clang-16 warns about casting functions to incompatible types, as is done
+here to call clk_disable_unprepare:
+
+sound/soc/meson/t9015.c:274:4: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  274 |                         (void(*)(void *))clk_disable_unprepare,
+
+The pattern of getting, enabling and setting a disable callback for a
+clock can be replaced with devm_clk_get_enabled(), which also fixes
+this warning.
+
+Fixes: 33901f5b9b16 ("ASoC: meson: add t9015 internal DAC driver")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Link: https://msgid.link/r/20240213215807.3326688-3-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/t9015.c | 20 ++++----------------
+ 1 file changed, 4 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/meson/t9015.c b/sound/soc/meson/t9015.c
+index a9b8c4e77d405..0571549a88206 100644
+--- a/sound/soc/meson/t9015.c
++++ b/sound/soc/meson/t9015.c
+@@ -48,7 +48,6 @@
+ #define POWER_CFG	0x10
+ 
+ struct t9015 {
+-	struct clk *pclk;
+ 	struct regulator *avdd;
+ };
+ 
+@@ -250,6 +249,7 @@ static int t9015_probe(struct platform_device *pdev)
+ 	struct t9015 *priv;
+ 	void __iomem *regs;
+ 	struct regmap *regmap;
++	struct clk *pclk;
+ 	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -257,26 +257,14 @@ static int t9015_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 	platform_set_drvdata(pdev, priv);
+ 
+-	priv->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(priv->pclk))
+-		return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get core clock\n");
++	pclk = devm_clk_get_enabled(dev, "pclk");
++	if (IS_ERR(pclk))
++		return dev_err_probe(dev, PTR_ERR(pclk), "failed to get core clock\n");
+ 
+ 	priv->avdd = devm_regulator_get(dev, "AVDD");
+ 	if (IS_ERR(priv->avdd))
+ 		return dev_err_probe(dev, PTR_ERR(priv->avdd), "failed to AVDD\n");
+ 
+-	ret = clk_prepare_enable(priv->pclk);
+-	if (ret) {
+-		dev_err(dev, "core clock enable failed\n");
+-		return ret;
+-	}
+-
+-	ret = devm_add_action_or_reset(dev,
+-			(void(*)(void *))clk_disable_unprepare,
+-			priv->pclk);
+-	if (ret)
+-		return ret;
+-
+ 	ret = device_reset(dev);
+ 	if (ret) {
+ 		dev_err(dev, "reset failed\n");
+-- 
+2.43.0
+
diff --git a/queue-5.15/asoc-meson-use-dev_err_probe-helper.patch b/queue-5.15/asoc-meson-use-dev_err_probe-helper.patch
new file mode 100644
index 00000000000..c352e1d3a98
--- /dev/null
+++ b/queue-5.15/asoc-meson-use-dev_err_probe-helper.patch
@@ -0,0 +1,420 @@
+From f3601a1ac1f2e11452f1adaeb0217df7c5254913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Dec 2021 11:08:37 +0900
+Subject: ASoC: meson: Use dev_err_probe() helper
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 2ff4e003e8e105fb65c682c876a5cb0e00f854bf ]
+
+Use the dev_err_probe() helper, instead of open-coding the same
+operation.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/20211214020843.2225831-17-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 98ac85a00f31 ("ASoC: meson: aiu: fix function pointer type mismatch")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu.c               | 36 +++++++--------------
+ sound/soc/meson/axg-fifo.c          | 16 +++------
+ sound/soc/meson/axg-pdm.c           | 25 ++++-----------
+ sound/soc/meson/axg-spdifin.c       | 17 +++-------
+ sound/soc/meson/axg-spdifout.c      | 17 +++-------
+ sound/soc/meson/axg-tdm-formatter.c | 50 ++++++++---------------------
+ sound/soc/meson/axg-tdm-interface.c | 25 ++++-----------
+ sound/soc/meson/meson-card-utils.c  |  8 ++---
+ sound/soc/meson/t9015.c             | 14 +++-----
+ 9 files changed, 56 insertions(+), 152 deletions(-)
+
+diff --git a/sound/soc/meson/aiu.c b/sound/soc/meson/aiu.c
+index ba15d5762b0bf..d299a70db7e59 100644
+--- a/sound/soc/meson/aiu.c
++++ b/sound/soc/meson/aiu.c
+@@ -218,34 +218,23 @@ static int aiu_clk_get(struct device *dev)
+ 	int ret;
+ 
+ 	aiu->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(aiu->pclk)) {
+-		if (PTR_ERR(aiu->pclk) != -EPROBE_DEFER)
+-			dev_err(dev, "Can't get the aiu pclk\n");
+-		return PTR_ERR(aiu->pclk);
+-	}
++	if (IS_ERR(aiu->pclk))
++		return dev_err_probe(dev, PTR_ERR(aiu->pclk), "Can't get the aiu pclk\n");
+ 
+ 	aiu->spdif_mclk = devm_clk_get(dev, "spdif_mclk");
+-	if (IS_ERR(aiu->spdif_mclk)) {
+-		if (PTR_ERR(aiu->spdif_mclk) != -EPROBE_DEFER)
+-			dev_err(dev, "Can't get the aiu spdif master clock\n");
+-		return PTR_ERR(aiu->spdif_mclk);
+-	}
++	if (IS_ERR(aiu->spdif_mclk))
++		return dev_err_probe(dev, PTR_ERR(aiu->spdif_mclk),
++				     "Can't get the aiu spdif master clock\n");
+ 
+ 	ret = aiu_clk_bulk_get(dev, aiu_i2s_ids, ARRAY_SIZE(aiu_i2s_ids),
+ 			       &aiu->i2s);
+-	if (ret) {
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "Can't get the i2s clocks\n");
+-		return ret;
+-	}
++	if (ret)
++		return dev_err_probe(dev, ret, "Can't get the i2s clocks\n");
+ 
+ 	ret = aiu_clk_bulk_get(dev, aiu_spdif_ids, ARRAY_SIZE(aiu_spdif_ids),
+ 			       &aiu->spdif);
+-	if (ret) {
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "Can't get the spdif clocks\n");
+-		return ret;
+-	}
++	if (ret)
++		return dev_err_probe(dev, ret, "Can't get the spdif clocks\n");
+ 
+ 	ret = clk_prepare_enable(aiu->pclk);
+ 	if (ret) {
+@@ -281,11 +270,8 @@ static int aiu_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, aiu);
+ 
+ 	ret = device_reset(dev);
+-	if (ret) {
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "Failed to reset device\n");
+-		return ret;
+-	}
++	if (ret)
++		return dev_err_probe(dev, ret, "Failed to reset device\n");
+ 
+ 	regs = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(regs))
+diff --git a/sound/soc/meson/axg-fifo.c b/sound/soc/meson/axg-fifo.c
+index b9af2d513e096..bccfb770b3391 100644
+--- a/sound/soc/meson/axg-fifo.c
++++ b/sound/soc/meson/axg-fifo.c
+@@ -351,20 +351,12 @@ int axg_fifo_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	fifo->pclk = devm_clk_get(dev, NULL);
+-	if (IS_ERR(fifo->pclk)) {
+-		if (PTR_ERR(fifo->pclk) != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get pclk: %ld\n",
+-				PTR_ERR(fifo->pclk));
+-		return PTR_ERR(fifo->pclk);
+-	}
++	if (IS_ERR(fifo->pclk))
++		return dev_err_probe(dev, PTR_ERR(fifo->pclk), "failed to get pclk\n");
+ 
+ 	fifo->arb = devm_reset_control_get_exclusive(dev, NULL);
+-	if (IS_ERR(fifo->arb)) {
+-		if (PTR_ERR(fifo->arb) != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get arb reset: %ld\n",
+-				PTR_ERR(fifo->arb));
+-		return PTR_ERR(fifo->arb);
+-	}
++	if (IS_ERR(fifo->arb))
++		return dev_err_probe(dev, PTR_ERR(fifo->arb), "failed to get arb reset\n");
+ 
+ 	fifo->irq = of_irq_get(dev->of_node, 0);
+ 	if (fifo->irq <= 0) {
+diff --git a/sound/soc/meson/axg-pdm.c b/sound/soc/meson/axg-pdm.c
+index bfd37d49a73ef..672e43a9729dc 100644
+--- a/sound/soc/meson/axg-pdm.c
++++ b/sound/soc/meson/axg-pdm.c
+@@ -586,7 +586,6 @@ static int axg_pdm_probe(struct platform_device *pdev)
+ 	struct device *dev = &pdev->dev;
+ 	struct axg_pdm *priv;
+ 	void __iomem *regs;
+-	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -611,28 +610,16 @@ static int axg_pdm_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	priv->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(priv->pclk)) {
+-		ret = PTR_ERR(priv->pclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get pclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(priv->pclk))
++		return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get pclk\n");
+ 
+ 	priv->dclk = devm_clk_get(dev, "dclk");
+-	if (IS_ERR(priv->dclk)) {
+-		ret = PTR_ERR(priv->dclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get dclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(priv->dclk))
++		return dev_err_probe(dev, PTR_ERR(priv->dclk), "failed to get dclk\n");
+ 
+ 	priv->sysclk = devm_clk_get(dev, "sysclk");
+-	if (IS_ERR(priv->sysclk)) {
+-		ret = PTR_ERR(priv->sysclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get dclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(priv->sysclk))
++		return dev_err_probe(dev, PTR_ERR(priv->sysclk), "failed to get dclk\n");
+ 
+ 	return devm_snd_soc_register_component(dev, &axg_pdm_component_drv,
+ 					       &axg_pdm_dai_drv, 1);
+diff --git a/sound/soc/meson/axg-spdifin.c b/sound/soc/meson/axg-spdifin.c
+index 7aaded1fc376b..245189d2ee95f 100644
+--- a/sound/soc/meson/axg-spdifin.c
++++ b/sound/soc/meson/axg-spdifin.c
+@@ -439,7 +439,6 @@ static int axg_spdifin_probe(struct platform_device *pdev)
+ 	struct axg_spdifin *priv;
+ 	struct snd_soc_dai_driver *dai_drv;
+ 	void __iomem *regs;
+-	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -464,20 +463,12 @@ static int axg_spdifin_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	priv->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(priv->pclk)) {
+-		ret = PTR_ERR(priv->pclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get pclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(priv->pclk))
++		return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get pclk\n");
+ 
+ 	priv->refclk = devm_clk_get(dev, "refclk");
+-	if (IS_ERR(priv->refclk)) {
+-		ret = PTR_ERR(priv->refclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get mclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(priv->refclk))
++		return dev_err_probe(dev, PTR_ERR(priv->refclk), "failed to get mclk\n");
+ 
+ 	dai_drv = axg_spdifin_get_dai_drv(dev, priv);
+ 	if (IS_ERR(dai_drv)) {
+diff --git a/sound/soc/meson/axg-spdifout.c b/sound/soc/meson/axg-spdifout.c
+index e769a5ee6e27e..3960d082e1436 100644
+--- a/sound/soc/meson/axg-spdifout.c
++++ b/sound/soc/meson/axg-spdifout.c
+@@ -403,7 +403,6 @@ static int axg_spdifout_probe(struct platform_device *pdev)
+ 	struct device *dev = &pdev->dev;
+ 	struct axg_spdifout *priv;
+ 	void __iomem *regs;
+-	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+@@ -422,20 +421,12 @@ static int axg_spdifout_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	priv->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(priv->pclk)) {
+-		ret = PTR_ERR(priv->pclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get pclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(priv->pclk))
++		return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get pclk\n");
+ 
+ 	priv->mclk = devm_clk_get(dev, "mclk");
+-	if (IS_ERR(priv->mclk)) {
+-		ret = PTR_ERR(priv->mclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get mclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(priv->mclk))
++		return dev_err_probe(dev, PTR_ERR(priv->mclk), "failed to get mclk\n");
+ 
+ 	return devm_snd_soc_register_component(dev, &axg_spdifout_component_drv,
+ 			axg_spdifout_dai_drv, ARRAY_SIZE(axg_spdifout_dai_drv));
+diff --git a/sound/soc/meson/axg-tdm-formatter.c b/sound/soc/meson/axg-tdm-formatter.c
+index 4834cfd163c03..63333a2b0a9c3 100644
+--- a/sound/soc/meson/axg-tdm-formatter.c
++++ b/sound/soc/meson/axg-tdm-formatter.c
+@@ -265,7 +265,6 @@ int axg_tdm_formatter_probe(struct platform_device *pdev)
+ 	const struct axg_tdm_formatter_driver *drv;
+ 	struct axg_tdm_formatter *formatter;
+ 	void __iomem *regs;
+-	int ret;
+ 
+ 	drv = of_device_get_match_data(dev);
+ 	if (!drv) {
+@@ -292,57 +291,34 @@ int axg_tdm_formatter_probe(struct platform_device *pdev)
+ 
+ 	/* Peripharal clock */
+ 	formatter->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(formatter->pclk)) {
+-		ret = PTR_ERR(formatter->pclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get pclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(formatter->pclk))
++		return dev_err_probe(dev, PTR_ERR(formatter->pclk), "failed to get pclk\n");
+ 
+ 	/* Formatter bit clock */
+ 	formatter->sclk = devm_clk_get(dev, "sclk");
+-	if (IS_ERR(formatter->sclk)) {
+-		ret = PTR_ERR(formatter->sclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get sclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(formatter->sclk))
++		return dev_err_probe(dev, PTR_ERR(formatter->sclk), "failed to get sclk\n");
+ 
+ 	/* Formatter sample clock */
+ 	formatter->lrclk = devm_clk_get(dev, "lrclk");
+-	if (IS_ERR(formatter->lrclk)) {
+-		ret = PTR_ERR(formatter->lrclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get lrclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(formatter->lrclk))
++		return dev_err_probe(dev, PTR_ERR(formatter->lrclk), "failed to get lrclk\n");
+ 
+ 	/* Formatter bit clock input multiplexer */
+ 	formatter->sclk_sel = devm_clk_get(dev, "sclk_sel");
+-	if (IS_ERR(formatter->sclk_sel)) {
+-		ret = PTR_ERR(formatter->sclk_sel);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get sclk_sel: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(formatter->sclk_sel))
++		return dev_err_probe(dev, PTR_ERR(formatter->sclk_sel), "failed to get sclk_sel\n");
+ 
+ 	/* Formatter sample clock input multiplexer */
+ 	formatter->lrclk_sel = devm_clk_get(dev, "lrclk_sel");
+-	if (IS_ERR(formatter->lrclk_sel)) {
+-		ret = PTR_ERR(formatter->lrclk_sel);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get lrclk_sel: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(formatter->lrclk_sel))
++		return dev_err_probe(dev, PTR_ERR(formatter->lrclk_sel),
++				     "failed to get lrclk_sel\n");
+ 
+ 	/* Formatter dedicated reset line */
+ 	formatter->reset = devm_reset_control_get_optional_exclusive(dev, NULL);
+-	if (IS_ERR(formatter->reset)) {
+-		ret = PTR_ERR(formatter->reset);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get reset: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(formatter->reset))
++		return dev_err_probe(dev, PTR_ERR(formatter->reset), "failed to get reset\n");
+ 
+ 	return devm_snd_soc_register_component(dev, drv->component_drv,
+ 					       NULL, 0);
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index 87cac440b3693..e076ced300257 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -517,21 +517,13 @@ static int axg_tdm_iface_probe(struct platform_device *pdev)
+ 
+ 	/* Bit clock provided on the pad */
+ 	iface->sclk = devm_clk_get(dev, "sclk");
+-	if (IS_ERR(iface->sclk)) {
+-		ret = PTR_ERR(iface->sclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get sclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(iface->sclk))
++		return dev_err_probe(dev, PTR_ERR(iface->sclk), "failed to get sclk\n");
+ 
+ 	/* Sample clock provided on the pad */
+ 	iface->lrclk = devm_clk_get(dev, "lrclk");
+-	if (IS_ERR(iface->lrclk)) {
+-		ret = PTR_ERR(iface->lrclk);
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get lrclk: %d\n", ret);
+-		return ret;
+-	}
++	if (IS_ERR(iface->lrclk))
++		return dev_err_probe(dev, PTR_ERR(iface->lrclk), "failed to get lrclk\n");
+ 
+ 	/*
+ 	 * mclk maybe be missing when the cpu dai is in slave mode and
+@@ -542,13 +534,10 @@ static int axg_tdm_iface_probe(struct platform_device *pdev)
+ 	iface->mclk = devm_clk_get(dev, "mclk");
+ 	if (IS_ERR(iface->mclk)) {
+ 		ret = PTR_ERR(iface->mclk);
+-		if (ret == -ENOENT) {
++		if (ret == -ENOENT)
+ 			iface->mclk = NULL;
+-		} else {
+-			if (ret != -EPROBE_DEFER)
+-				dev_err(dev, "failed to get mclk: %d\n", ret);
+-			return ret;
+-		}
++		else
++			return dev_err_probe(dev, ret, "failed to get mclk\n");
+ 	}
+ 
+ 	return devm_snd_soc_register_component(dev,
+diff --git a/sound/soc/meson/meson-card-utils.c b/sound/soc/meson/meson-card-utils.c
+index 415cc0046e4b4..23ccd2a720e19 100644
+--- a/sound/soc/meson/meson-card-utils.c
++++ b/sound/soc/meson/meson-card-utils.c
+@@ -85,11 +85,9 @@ int meson_card_parse_dai(struct snd_soc_card *card,
+ 
+ 	ret = of_parse_phandle_with_args(node, "sound-dai",
+ 					 "#sound-dai-cells", 0, &args);
+-	if (ret) {
+-		if (ret != -EPROBE_DEFER)
+-			dev_err(card->dev, "can't parse dai %d\n", ret);
+-		return ret;
+-	}
++	if (ret)
++		return dev_err_probe(card->dev, ret, "can't parse dai\n");
++
+ 	*dai_of_node = args.np;
+ 
+ 	return snd_soc_get_dai_name(&args, dai_name);
+diff --git a/sound/soc/meson/t9015.c b/sound/soc/meson/t9015.c
+index 4c1349dd1e06a..a9b8c4e77d405 100644
+--- a/sound/soc/meson/t9015.c
++++ b/sound/soc/meson/t9015.c
+@@ -258,18 +258,12 @@ static int t9015_probe(struct platform_device *pdev)
+ 	platform_set_drvdata(pdev, priv);
+ 
+ 	priv->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(priv->pclk)) {
+-		if (PTR_ERR(priv->pclk) != -EPROBE_DEFER)
+-			dev_err(dev, "failed to get core clock\n");
+-		return PTR_ERR(priv->pclk);
+-	}
++	if (IS_ERR(priv->pclk))
++		return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get core clock\n");
+ 
+ 	priv->avdd = devm_regulator_get(dev, "AVDD");
+-	if (IS_ERR(priv->avdd)) {
+-		if (PTR_ERR(priv->avdd) != -EPROBE_DEFER)
+-			dev_err(dev, "failed to AVDD\n");
+-		return PTR_ERR(priv->avdd);
+-	}
++	if (IS_ERR(priv->avdd))
++		return dev_err_probe(dev, PTR_ERR(priv->avdd), "failed to AVDD\n");
+ 
+ 	ret = clk_prepare_enable(priv->pclk);
+ 	if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/backlight-da9052-fully-initialize-backlight_properti.patch b/queue-5.15/backlight-da9052-fully-initialize-backlight_properti.patch
new file mode 100644
index 00000000000..fac93a73026
--- /dev/null
+++ b/queue-5.15/backlight-da9052-fully-initialize-backlight_properti.patch
@@ -0,0 +1,37 @@
+From 9437905809ec8a7d8052aff65353379872ba73db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:35:24 +0000
+Subject: backlight: da9052: Fully initialize backlight_properties during probe
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit 0285e9efaee8276305db5c52a59baf84e9731556 ]
+
+props is stack allocated and the fields that are not explcitly set
+by the probe function need to be zeroed or we'll get undefined behaviour
+(especially so power/blank states)!
+
+Fixes: 6ede3d832aaa ("backlight: add driver for DA9052/53 PMIC v1")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220153532.76613-2-daniel.thompson@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/da9052_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/da9052_bl.c b/drivers/video/backlight/da9052_bl.c
+index 882359dd288c0..aa00379392a0f 100644
+--- a/drivers/video/backlight/da9052_bl.c
++++ b/drivers/video/backlight/da9052_bl.c
+@@ -117,6 +117,7 @@ static int da9052_backlight_probe(struct platform_device *pdev)
+ 	wleds->led_reg = platform_get_device_id(pdev)->driver_data;
+ 	wleds->state = DA9052_WLEDS_OFF;
+ 
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_RAW;
+ 	props.max_brightness = DA9052_MAX_BRIGHTNESS;
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch b/queue-5.15/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
new file mode 100644
index 00000000000..6c36e604b19
--- /dev/null
+++ b/queue-5.15/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
@@ -0,0 +1,77 @@
+From b07d9dc6e35583533512a761e122b6f69ba5006d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 00:11:20 +0100
+Subject: backlight: lm3630a: Don't set bl->props.brightness in get_brightness
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit 4bf7ddd2d2f0f8826f25f74c7eba4e2c323a1446 ]
+
+There's no need to set bl->props.brightness, the get_brightness function
+is just supposed to return the current brightness and not touch the
+struct.
+
+With that done we can also remove the 'goto out' and just return the
+value.
+
+Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220-lm3630a-fixups-v1-2-9ca62f7e4a33@z3ntu.xyz
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 371c633f1e629..a15102bf21365 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -231,7 +231,7 @@ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl)
+ 		if (rval < 0)
+ 			goto out_i2c_err;
+ 		brightness |= rval;
+-		goto out;
++		return brightness;
+ 	}
+ 
+ 	/* disable sleep */
+@@ -242,11 +242,8 @@ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl)
+ 	rval = lm3630a_read(pchip, REG_BRT_A);
+ 	if (rval < 0)
+ 		goto out_i2c_err;
+-	brightness = rval;
++	return rval;
+ 
+-out:
+-	bl->props.brightness = brightness;
+-	return bl->props.brightness;
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access register\n");
+ 	return 0;
+@@ -306,7 +303,7 @@ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl)
+ 		if (rval < 0)
+ 			goto out_i2c_err;
+ 		brightness |= rval;
+-		goto out;
++		return brightness;
+ 	}
+ 
+ 	/* disable sleep */
+@@ -317,11 +314,8 @@ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl)
+ 	rval = lm3630a_read(pchip, REG_BRT_B);
+ 	if (rval < 0)
+ 		goto out_i2c_err;
+-	brightness = rval;
++	return rval;
+ 
+-out:
+-	bl->props.brightness = brightness;
+-	return bl->props.brightness;
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access register\n");
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-5.15/backlight-lm3630a-initialize-backlight_properties-on.patch b/queue-5.15/backlight-lm3630a-initialize-backlight_properties-on.patch
new file mode 100644
index 00000000000..7dc6dc63595
--- /dev/null
+++ b/queue-5.15/backlight-lm3630a-initialize-backlight_properties-on.patch
@@ -0,0 +1,37 @@
+From 199a98354065577a926c9dcce2f6b4a843b0194a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 00:11:19 +0100
+Subject: backlight: lm3630a: Initialize backlight_properties on init
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit ad9aeb0e3aa90ebdad5fabf9c21783740eb95907 ]
+
+The backlight_properties struct should be initialized to zero before
+using, otherwise there will be some random values in the struct.
+
+Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220-lm3630a-fixups-v1-1-9ca62f7e4a33@z3ntu.xyz
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index e8b185bb6f5ee..371c633f1e629 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -339,6 +339,7 @@ static int lm3630a_backlight_register(struct lm3630a_chip *pchip)
+ 	struct backlight_properties props;
+ 	const char *label;
+ 
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_RAW;
+ 	if (pdata->leda_ctrl != LM3630A_LEDA_DISABLE) {
+ 		props.brightness = pdata->leda_init_brt;
+-- 
+2.43.0
+
diff --git a/queue-5.15/backlight-lm3639-fully-initialize-backlight_properti.patch b/queue-5.15/backlight-lm3639-fully-initialize-backlight_properti.patch
new file mode 100644
index 00000000000..a02ee0121e7
--- /dev/null
+++ b/queue-5.15/backlight-lm3639-fully-initialize-backlight_properti.patch
@@ -0,0 +1,37 @@
+From 7aaf53a9d5edd21cdf28be60f189d8e0287eb688 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:35:25 +0000
+Subject: backlight: lm3639: Fully initialize backlight_properties during probe
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit abb5a5d951fbea3feb5c4ba179b89bb96a1d3462 ]
+
+props is stack allocated and the fields that are not explcitly set
+by the probe function need to be zeroed or we'll get undefined behaviour
+(especially so power/blank states)!
+
+Fixes: 0f59858d5119 ("backlight: add new lm3639 backlight driver")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220153532.76613-3-daniel.thompson@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3639_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c
+index 48c04155a5f9d..bb617f4673e94 100644
+--- a/drivers/video/backlight/lm3639_bl.c
++++ b/drivers/video/backlight/lm3639_bl.c
+@@ -339,6 +339,7 @@ static int lm3639_probe(struct i2c_client *client,
+ 	}
+ 
+ 	/* backlight */
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_RAW;
+ 	props.brightness = pdata->init_brt_led;
+ 	props.max_brightness = pdata->max_brt_led;
+-- 
+2.43.0
+
diff --git a/queue-5.15/backlight-lp8788-fully-initialize-backlight_properti.patch b/queue-5.15/backlight-lp8788-fully-initialize-backlight_properti.patch
new file mode 100644
index 00000000000..d63e6fae069
--- /dev/null
+++ b/queue-5.15/backlight-lp8788-fully-initialize-backlight_properti.patch
@@ -0,0 +1,37 @@
+From 08c633ae63349071331e2b29baca2c4077a77a1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:35:26 +0000
+Subject: backlight: lp8788: Fully initialize backlight_properties during probe
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit 392346827fbe8a7fd573dfb145170d7949f639a6 ]
+
+props is stack allocated and the fields that are not explcitly set
+by the probe function need to be zeroed or we'll get undefined behaviour
+(especially so power/blank states)!
+
+Fixes: c5a51053cf3b ("backlight: add new lp8788 backlight driver")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220153532.76613-4-daniel.thompson@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp8788_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/lp8788_bl.c b/drivers/video/backlight/lp8788_bl.c
+index ba42f3fe0c739..d9b95dbd40d30 100644
+--- a/drivers/video/backlight/lp8788_bl.c
++++ b/drivers/video/backlight/lp8788_bl.c
+@@ -191,6 +191,7 @@ static int lp8788_backlight_register(struct lp8788_bl *bl)
+ 	int init_brt;
+ 	char *name;
+ 
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_PLATFORM;
+ 	props.max_brightness = MAX_BRIGHTNESS;
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/bluetooth-hci_core-fix-possible-buffer-overflow.patch b/queue-5.15/bluetooth-hci_core-fix-possible-buffer-overflow.patch
new file mode 100644
index 00000000000..62442a03f40
--- /dev/null
+++ b/queue-5.15/bluetooth-hci_core-fix-possible-buffer-overflow.patch
@@ -0,0 +1,36 @@
+From 15dae893ca4520327c14d8f6418beb6346244c6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 10:49:26 -0500
+Subject: Bluetooth: hci_core: Fix possible buffer overflow
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 81137162bfaa7278785b24c1fd2e9e74f082e8e4 ]
+
+struct hci_dev_info has a fixed size name[8] field so in the event that
+hdev->name is bigger than that strcpy would attempt to write past its
+size, so this fixes this problem by switching to use strscpy.
+
+Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index a8854b24f4cfb..8a3c867bdff03 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -2187,7 +2187,7 @@ int hci_get_dev_info(void __user *arg)
+ 	else
+ 		flags = hdev->flags;
+ 
+-	strcpy(di.name, hdev->name);
++	strscpy(di.name, hdev->name, sizeof(di.name));
+ 	di.bdaddr   = hdev->bdaddr;
+ 	di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
+ 	di.flags    = flags;
+-- 
+2.43.0
+
diff --git a/queue-5.15/bluetooth-hci_qca-add-support-for-qti-bluetooth-chip.patch b/queue-5.15/bluetooth-hci_qca-add-support-for-qti-bluetooth-chip.patch
new file mode 100644
index 00000000000..39925254b42
--- /dev/null
+++ b/queue-5.15/bluetooth-hci_qca-add-support-for-qti-bluetooth-chip.patch
@@ -0,0 +1,275 @@
+From cac154f4ab262ddf80f324eb7dc047a80acb09d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 18:38:10 -0500
+Subject: Bluetooth: hci_qca: Add support for QTI Bluetooth chip wcn6855
+
+From: Steev Klimaszewski <steev@kali.org>
+
+[ Upstream commit 095327fede005f4b14d40b2183b2f7965c739dbd ]
+
+Add regulators, GPIOs and changes required to power on/off wcn6855.
+Add support for firmware download for wcn6855 which is in the
+linux-firmware repository as hpbtfw21.tlv and hpnv21.bin.
+
+Based on the assumption that this is similar to the wcn6750
+
+Tested-on: BTFW.HSP.2.1.0-00538-VER_PATCHZ-1
+
+Signed-off-by: Steev Klimaszewski <steev@kali.org>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Tested-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Stable-dep-of: 56d074d26c58 ("Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btqca.c   | 14 ++++++++-
+ drivers/bluetooth/btqca.h   | 10 +++++++
+ drivers/bluetooth/hci_qca.c | 57 ++++++++++++++++++++++++++++---------
+ 3 files changed, 66 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
+index be04d74037d20..0f3943ac54179 100644
+--- a/drivers/bluetooth/btqca.c
++++ b/drivers/bluetooth/btqca.c
+@@ -566,6 +566,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
+ 		config.type = ELF_TYPE_PATCH;
+ 		snprintf(config.fwname, sizeof(config.fwname),
+ 			 "qca/msbtfw%02x.mbn", rom_ver);
++	} else if (soc_type == QCA_WCN6855) {
++		snprintf(config.fwname, sizeof(config.fwname),
++			 "qca/hpbtfw%02x.tlv", rom_ver);
+ 	} else {
+ 		snprintf(config.fwname, sizeof(config.fwname),
+ 			 "qca/rampatch_%08x.bin", soc_ver);
+@@ -600,6 +603,9 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
+ 	else if (soc_type == QCA_WCN6750)
+ 		snprintf(config.fwname, sizeof(config.fwname),
+ 			 "qca/msnv%02x.bin", rom_ver);
++	else if (soc_type == QCA_WCN6855)
++		snprintf(config.fwname, sizeof(config.fwname),
++			 "qca/hpnv%02x.bin", rom_ver);
+ 	else
+ 		snprintf(config.fwname, sizeof(config.fwname),
+ 			 "qca/nvm_%08x.bin", soc_ver);
+@@ -637,11 +643,17 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
+ 		return err;
+ 	}
+ 
+-	if (soc_type == QCA_WCN3991 || soc_type == QCA_WCN6750) {
++	switch (soc_type) {
++	case QCA_WCN3991:
++	case QCA_WCN6750:
++	case QCA_WCN6855:
+ 		/* get fw build info */
+ 		err = qca_read_fw_build_info(hdev);
+ 		if (err < 0)
+ 			return err;
++		break;
++	default:
++		break;
+ 	}
+ 
+ 	bt_dev_info(hdev, "QCA setup on UART is completed");
+diff --git a/drivers/bluetooth/btqca.h b/drivers/bluetooth/btqca.h
+index 30afa7703afd3..b83bf202ea604 100644
+--- a/drivers/bluetooth/btqca.h
++++ b/drivers/bluetooth/btqca.h
+@@ -145,6 +145,7 @@ enum qca_btsoc_type {
+ 	QCA_WCN3991,
+ 	QCA_QCA6390,
+ 	QCA_WCN6750,
++	QCA_WCN6855,
+ };
+ 
+ #if IS_ENABLED(CONFIG_BT_QCA)
+@@ -166,6 +167,10 @@ static inline bool qca_is_wcn6750(enum qca_btsoc_type soc_type)
+ {
+ 	return soc_type == QCA_WCN6750;
+ }
++static inline bool qca_is_wcn6855(enum qca_btsoc_type soc_type)
++{
++	return soc_type == QCA_WCN6855;
++}
+ 
+ #else
+ 
+@@ -204,6 +209,11 @@ static inline bool qca_is_wcn6750(enum qca_btsoc_type soc_type)
+ 	return false;
+ }
+ 
++static inline bool qca_is_wcn6855(enum qca_btsoc_type soc_type)
++{
++	return false;
++}
++
+ static inline int qca_send_pre_shutdown_cmd(struct hci_dev *hdev)
+ {
+ 	return -EOPNOTSUPP;
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index d10f1fe0f5fa8..7c641cabea7c8 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -1315,7 +1315,8 @@ static int qca_set_baudrate(struct hci_dev *hdev, uint8_t baudrate)
+ 
+ 	/* Give the controller time to process the request */
+ 	if (qca_is_wcn399x(qca_soc_type(hu)) ||
+-	    qca_is_wcn6750(qca_soc_type(hu)))
++	    qca_is_wcn6750(qca_soc_type(hu)) ||
++	    qca_is_wcn6855(qca_soc_type(hu)))
+ 		usleep_range(1000, 10000);
+ 	else
+ 		msleep(300);
+@@ -1392,7 +1393,8 @@ static unsigned int qca_get_speed(struct hci_uart *hu,
+ static int qca_check_speeds(struct hci_uart *hu)
+ {
+ 	if (qca_is_wcn399x(qca_soc_type(hu)) ||
+-	    qca_is_wcn6750(qca_soc_type(hu))) {
++	    qca_is_wcn6750(qca_soc_type(hu)) ||
++	    qca_is_wcn6855(qca_soc_type(hu))) {
+ 		if (!qca_get_speed(hu, QCA_INIT_SPEED) &&
+ 		    !qca_get_speed(hu, QCA_OPER_SPEED))
+ 			return -EINVAL;
+@@ -1426,7 +1428,8 @@ static int qca_set_speed(struct hci_uart *hu, enum qca_speed_type speed_type)
+ 		 * changing the baudrate of chip and host.
+ 		 */
+ 		if (qca_is_wcn399x(soc_type) ||
+-		    qca_is_wcn6750(soc_type))
++		    qca_is_wcn6750(soc_type) ||
++		    qca_is_wcn6855(soc_type))
+ 			hci_uart_set_flow_control(hu, true);
+ 
+ 		if (soc_type == QCA_WCN3990) {
+@@ -1444,7 +1447,8 @@ static int qca_set_speed(struct hci_uart *hu, enum qca_speed_type speed_type)
+ 
+ error:
+ 		if (qca_is_wcn399x(soc_type) ||
+-		    qca_is_wcn6750(soc_type))
++		    qca_is_wcn6750(soc_type) ||
++		    qca_is_wcn6855(soc_type))
+ 			hci_uart_set_flow_control(hu, false);
+ 
+ 		if (soc_type == QCA_WCN3990) {
+@@ -1680,7 +1684,8 @@ static int qca_power_on(struct hci_dev *hdev)
+ 		return 0;
+ 
+ 	if (qca_is_wcn399x(soc_type) ||
+-	    qca_is_wcn6750(soc_type)) {
++	    qca_is_wcn6750(soc_type) ||
++	    qca_is_wcn6855(soc_type)) {
+ 		ret = qca_regulator_init(hu);
+ 	} else {
+ 		qcadev = serdev_device_get_drvdata(hu->serdev);
+@@ -1721,7 +1726,8 @@ static int qca_setup(struct hci_uart *hu)
+ 
+ 	bt_dev_info(hdev, "setting up %s",
+ 		qca_is_wcn399x(soc_type) ? "wcn399x" :
+-		(soc_type == QCA_WCN6750) ? "wcn6750" : "ROME/QCA6390");
++		(soc_type == QCA_WCN6750) ? "wcn6750" :
++		(soc_type == QCA_WCN6855) ? "wcn6855" : "ROME/QCA6390");
+ 
+ 	qca->memdump_state = QCA_MEMDUMP_IDLE;
+ 
+@@ -1733,7 +1739,8 @@ static int qca_setup(struct hci_uart *hu)
+ 	clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
+ 
+ 	if (qca_is_wcn399x(soc_type) ||
+-	    qca_is_wcn6750(soc_type)) {
++	    qca_is_wcn6750(soc_type) ||
++	    qca_is_wcn6855(soc_type)) {
+ 		set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
+ 
+ 		ret = qca_read_soc_version(hdev, &ver, soc_type);
+@@ -1754,7 +1761,8 @@ static int qca_setup(struct hci_uart *hu)
+ 	}
+ 
+ 	if (!(qca_is_wcn399x(soc_type) ||
+-	     qca_is_wcn6750(soc_type))) {
++	      qca_is_wcn6750(soc_type) ||
++	      qca_is_wcn6855(soc_type))) {
+ 		/* Get QCA version information */
+ 		ret = qca_read_soc_version(hdev, &ver, soc_type);
+ 		if (ret)
+@@ -1880,6 +1888,20 @@ static const struct qca_device_data qca_soc_data_wcn6750 = {
+ 	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
+ };
+ 
++static const struct qca_device_data qca_soc_data_wcn6855 = {
++	.soc_type = QCA_WCN6855,
++	.vregs = (struct qca_vreg []) {
++		{ "vddio", 5000 },
++		{ "vddbtcxmx", 126000 },
++		{ "vddrfacmn", 12500 },
++		{ "vddrfa0p8", 102000 },
++		{ "vddrfa1p7", 302000 },
++		{ "vddrfa1p2", 257000 },
++	},
++	.num_vregs = 6,
++	.capabilities = QCA_CAP_WIDEBAND_SPEECH | QCA_CAP_VALID_LE_STATES,
++};
++
+ static void qca_power_shutdown(struct hci_uart *hu)
+ {
+ 	struct qca_serdev *qcadev;
+@@ -1909,7 +1931,7 @@ static void qca_power_shutdown(struct hci_uart *hu)
+ 		host_set_baudrate(hu, 2400);
+ 		qca_send_power_pulse(hu, false);
+ 		qca_regulator_disable(qcadev);
+-	} else if (soc_type == QCA_WCN6750) {
++	} else if (soc_type == QCA_WCN6750 || soc_type == QCA_WCN6855) {
+ 		gpiod_set_value_cansleep(qcadev->bt_en, 0);
+ 		msleep(100);
+ 		qca_regulator_disable(qcadev);
+@@ -2044,7 +2066,8 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 
+ 	if (data &&
+ 	    (qca_is_wcn399x(data->soc_type) ||
+-	    qca_is_wcn6750(data->soc_type))) {
++	     qca_is_wcn6750(data->soc_type) ||
++	     qca_is_wcn6855(data->soc_type))) {
+ 		qcadev->btsoc_type = data->soc_type;
+ 		qcadev->bt_power = devm_kzalloc(&serdev->dev,
+ 						sizeof(struct qca_power),
+@@ -2064,14 +2087,18 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 
+ 		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
+ 					       GPIOD_OUT_LOW);
+-		if (IS_ERR_OR_NULL(qcadev->bt_en) && data->soc_type == QCA_WCN6750) {
++		if (IS_ERR_OR_NULL(qcadev->bt_en) &&
++		    (data->soc_type == QCA_WCN6750 ||
++		     data->soc_type == QCA_WCN6855)) {
+ 			dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n");
+ 			power_ctrl_enabled = false;
+ 		}
+ 
+ 		qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
+ 					       GPIOD_IN);
+-		if (IS_ERR_OR_NULL(qcadev->sw_ctrl) && data->soc_type == QCA_WCN6750)
++		if (IS_ERR_OR_NULL(qcadev->sw_ctrl) &&
++		    (data->soc_type == QCA_WCN6750 ||
++		     data->soc_type == QCA_WCN6855))
+ 			dev_warn(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
+ 
+ 		qcadev->susclk = devm_clk_get_optional(&serdev->dev, NULL);
+@@ -2147,8 +2174,9 @@ static void qca_serdev_remove(struct serdev_device *serdev)
+ 	struct qca_power *power = qcadev->bt_power;
+ 
+ 	if ((qca_is_wcn399x(qcadev->btsoc_type) ||
+-	     qca_is_wcn6750(qcadev->btsoc_type)) &&
+-	     power->vregs_on)
++	     qca_is_wcn6750(qcadev->btsoc_type) ||
++	     qca_is_wcn6855(qcadev->btsoc_type)) &&
++	    power->vregs_on)
+ 		qca_power_shutdown(&qcadev->serdev_hu);
+ 	else if (qcadev->susclk)
+ 		clk_disable_unprepare(qcadev->susclk);
+@@ -2332,6 +2360,7 @@ static const struct of_device_id qca_bluetooth_of_match[] = {
+ 	{ .compatible = "qcom,wcn3991-bt", .data = &qca_soc_data_wcn3991},
+ 	{ .compatible = "qcom,wcn3998-bt", .data = &qca_soc_data_wcn3998},
+ 	{ .compatible = "qcom,wcn6750-bt", .data = &qca_soc_data_wcn6750},
++	{ .compatible = "qcom,wcn6855-bt", .data = &qca_soc_data_wcn6855},
+ 	{ /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, qca_bluetooth_of_match);
+-- 
+2.43.0
+
diff --git a/queue-5.15/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch b/queue-5.15/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
new file mode 100644
index 00000000000..432d29fc016
--- /dev/null
+++ b/queue-5.15/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
@@ -0,0 +1,59 @@
+From 610254cf10a1bfc8a298233c772332af2018ec21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 17:40:17 +0100
+Subject: Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with
+ gpiod_get_optional()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 56d074d26c5828773b00b2185dd7e1d08273b8e8 ]
+
+The optional variants for the gpiod_get() family of functions return NULL
+if the GPIO in question is not associated with this device. They return
+ERR_PTR() on any other error. NULL descriptors are graciously handled by
+GPIOLIB and can be safely passed to any of the GPIO consumer interfaces
+as they will return 0 and act as if the function succeeded. If one is
+using the optional variant, then there's no point in checking for NULL.
+
+Fixes: 6845667146a2 ("Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index 7c641cabea7c8..d5f408851a005 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -2087,7 +2087,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 
+ 		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
+ 					       GPIOD_OUT_LOW);
+-		if (IS_ERR_OR_NULL(qcadev->bt_en) &&
++		if (IS_ERR(qcadev->bt_en) &&
+ 		    (data->soc_type == QCA_WCN6750 ||
+ 		     data->soc_type == QCA_WCN6855)) {
+ 			dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n");
+@@ -2096,7 +2096,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 
+ 		qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
+ 					       GPIOD_IN);
+-		if (IS_ERR_OR_NULL(qcadev->sw_ctrl) &&
++		if (IS_ERR(qcadev->sw_ctrl) &&
+ 		    (data->soc_type == QCA_WCN6750 ||
+ 		     data->soc_type == QCA_WCN6855))
+ 			dev_warn(&serdev->dev, "failed to acquire SW_CTRL gpio\n");
+@@ -2120,7 +2120,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 
+ 		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
+ 					       GPIOD_OUT_LOW);
+-		if (IS_ERR_OR_NULL(qcadev->bt_en)) {
++		if (IS_ERR(qcadev->bt_en)) {
+ 			dev_warn(&serdev->dev, "failed to acquire enable gpio\n");
+ 			power_ctrl_enabled = false;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-5.15/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch b/queue-5.15/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
new file mode 100644
index 00000000000..483cabbafcd
--- /dev/null
+++ b/queue-5.15/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
@@ -0,0 +1,62 @@
+From b41962610b0058f6ebc968e1578ef599c41ae3c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 23:46:06 +0100
+Subject: Bluetooth: Remove superfluous call to hci_conn_check_pending()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Dreßler <verdre@v0yd.nl>
+
+[ Upstream commit 78e3639fc8031275010c3287ac548c0bc8de83b1 ]
+
+The "pending connections" feature was originally introduced with commit
+4c67bc74f016 ("[Bluetooth] Support concurrent connect requests") and
+6bd57416127e ("[Bluetooth] Handling pending connect attempts after
+inquiry") to handle controllers supporting only a single connection request
+at a time. Later things were extended to also cancel ongoing inquiries on
+connect() with commit 89e65975fea5 ("Bluetooth: Cancel Inquiry before
+Create Connection").
+
+With commit a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only
+opcodes"), hci_conn_check_pending() was introduced as a helper to
+consolidate a few places where we check for pending connections (indicated
+by the BT_CONNECT2 flag) and then try to connect.
+
+This refactoring commit also snuck in two more calls to
+hci_conn_check_pending():
+
+- One is in the failure callback of hci_cs_inquiry(), this one probably
+makes sense: If we send an "HCI Inquiry" command and then immediately
+after a "Create Connection" command, the "Create Connection" command might
+fail before the "HCI Inquiry" command, and then we want to retry the
+"Create Connection" on failure of the "HCI Inquiry".
+
+- The other added call to hci_conn_check_pending() is in the event handler
+for the "Remote Name" event, this seems unrelated and is possibly a
+copy-paste error, so remove that one.
+
+Fixes: a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only opcodes")
+Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index ba7242729a8fb..0be37a5c1c0c2 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3072,8 +3072,6 @@ static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ 
+ 	BT_DBG("%s", hdev->name);
+ 
+-	hci_conn_check_pending(hdev);
+-
+ 	hci_dev_lock(hdev);
+ 
+ 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+-- 
+2.43.0
+
diff --git a/queue-5.15/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch b/queue-5.15/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
new file mode 100644
index 00000000000..4081251a70b
--- /dev/null
+++ b/queue-5.15/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
@@ -0,0 +1,66 @@
+From b6c092d0f685b90b758ab88a8dc56550385ebfbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 13:03:35 +0100
+Subject: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 281d464a34f540de166cee74b723e97ac2515ec3 ]
+
+The devmap code allocates a number hash buckets equal to the next power
+of two of the max_entries value provided when creating the map. When
+rounding up to the next power of two, the 32-bit variable storing the
+number of buckets can overflow, and the code checks for overflow by
+checking if the truncated 32-bit value is equal to 0. However, on 32-bit
+arches the rounding up itself can overflow mid-way through, because it
+ends up doing a left-shift of 32 bits on an unsigned long value. If the
+size of an unsigned long is four bytes, this is undefined behaviour, so
+there is no guarantee that we'll end up with a nice and tidy 0-value at
+the end.
+
+Syzbot managed to turn this into a crash on arm32 by creating a
+DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it.
+Fix this by moving the overflow check to before the rounding up
+operation.
+
+Fixes: 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking up devices by hashed index")
+Link: https://lore.kernel.org/r/000000000000ed666a0611af6818@google.com
+Reported-and-tested-by: syzbot+8cd36f6b65f3cafd400a@syzkaller.appspotmail.com
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Message-ID: <20240307120340.99577-2-toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/devmap.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index f02d04540c0c0..b591073c5f83d 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -130,13 +130,14 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
+ 	bpf_map_init_from_attr(&dtab->map, attr);
+ 
+ 	if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+-		dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
+-
+-		if (!dtab->n_buckets) /* Overflow check */
++		/* hash table size must be power of 2; roundup_pow_of_two() can
++		 * overflow into UB on 32-bit arches, so check that first
++		 */
++		if (dtab->map.max_entries > 1UL << 31)
+ 			return -EINVAL;
+-	}
+ 
+-	if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
++		dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
++
+ 		dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets,
+ 							   dtab->map.numa_node);
+ 		if (!dtab->dev_index_head)
+-- 
+2.43.0
+
diff --git a/queue-5.15/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch b/queue-5.15/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
new file mode 100644
index 00000000000..ba71d704c19
--- /dev/null
+++ b/queue-5.15/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
@@ -0,0 +1,65 @@
+From 8ec685e1e7c0c5142136df49d68964f4fdef9769 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 13:03:36 +0100
+Subject: bpf: Fix hashtab overflow check on 32-bit arches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 6787d916c2cf9850c97a0a3f73e08c43e7d973b1 ]
+
+The hashtab code relies on roundup_pow_of_two() to compute the number of
+hash buckets, and contains an overflow check by checking if the
+resulting value is 0. However, on 32-bit arches, the roundup code itself
+can overflow by doing a 32-bit left-shift of an unsigned long value,
+which is undefined behaviour, so it is not guaranteed to truncate
+neatly. This was triggered by syzbot on the DEVMAP_HASH type, which
+contains the same check, copied from the hashtab code. So apply the same
+fix to hashtab, by moving the overflow check to before the roundup.
+
+Fixes: daaf427c6ab3 ("bpf: fix arraymap NULL deref and missing overflow and zero size checks")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Message-ID: <20240307120340.99577-3-toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/hashtab.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 28b43642c0593..f53b4f04b935c 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -504,7 +504,13 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
+ 							  num_possible_cpus());
+ 	}
+ 
+-	/* hash table size must be power of 2 */
++	/* hash table size must be power of 2; roundup_pow_of_two() can overflow
++	 * into UB on 32-bit arches, so check that first
++	 */
++	err = -E2BIG;
++	if (htab->map.max_entries > 1UL << 31)
++		goto free_htab;
++
+ 	htab->n_buckets = roundup_pow_of_two(htab->map.max_entries);
+ 
+ 	htab->elem_size = sizeof(struct htab_elem) +
+@@ -514,10 +520,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
+ 	else
+ 		htab->elem_size += round_up(htab->map.value_size, 8);
+ 
+-	err = -E2BIG;
+-	/* prevent zero size kmalloc and check for u32 overflow */
+-	if (htab->n_buckets == 0 ||
+-	    htab->n_buckets > U32_MAX / sizeof(struct bucket))
++	/* check for u32 overflow */
++	if (htab->n_buckets > U32_MAX / sizeof(struct bucket))
+ 		goto free_htab;
+ 
+ 	err = -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-5.15/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch b/queue-5.15/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
new file mode 100644
index 00000000000..a23db78d758
--- /dev/null
+++ b/queue-5.15/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
@@ -0,0 +1,61 @@
+From cd0cdbbae15f06bb9c5ee7b0a403aec093776850 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 13:03:37 +0100
+Subject: bpf: Fix stackmap overflow check on 32-bit arches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 7a4b21250bf79eef26543d35bd390448646c536b ]
+
+The stackmap code relies on roundup_pow_of_two() to compute the number
+of hash buckets, and contains an overflow check by checking if the
+resulting value is 0. However, on 32-bit arches, the roundup code itself
+can overflow by doing a 32-bit left-shift of an unsigned long value,
+which is undefined behaviour, so it is not guaranteed to truncate
+neatly. This was triggered by syzbot on the DEVMAP_HASH type, which
+contains the same check, copied from the hashtab code.
+
+The commit in the fixes tag actually attempted to fix this, but the fix
+did not account for the UB, so the fix only works on CPUs where an
+overflow does result in a neat truncation to zero, which is not
+guaranteed. Checking the value before rounding does not have this
+problem.
+
+Fixes: 6183f4d3a0a2 ("bpf: Check for integer overflow when using roundup_pow_of_two()")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Reviewed-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Message-ID: <20240307120340.99577-4-toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index f8587abef73c1..e04571c1833f6 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -113,11 +113,14 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
+ 	} else if (value_size / 8 > sysctl_perf_event_max_stack)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	/* hash table size must be power of 2 */
+-	n_buckets = roundup_pow_of_two(attr->max_entries);
+-	if (!n_buckets)
++	/* hash table size must be power of 2; roundup_pow_of_two() can overflow
++	 * into UB on 32-bit arches, so check that first
++	 */
++	if (attr->max_entries > 1UL << 31)
+ 		return ERR_PTR(-E2BIG);
+ 
++	n_buckets = roundup_pow_of_two(attr->max_entries);
++
+ 	cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
+ 	smap = bpf_map_area_alloc(cost, bpf_map_attr_numa_node(attr));
+ 	if (!smap)
+-- 
+2.43.0
+
diff --git a/queue-5.15/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch b/queue-5.15/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
new file mode 100644
index 00000000000..0a02a06f0b2
--- /dev/null
+++ b/queue-5.15/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
@@ -0,0 +1,133 @@
+From 25574b20a7f676bff2b5c60d87771bd765ee5b08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 23:01:02 -0800
+Subject: bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 178c54666f9c4d2f49f2ea661d0c11b52f0ed190 ]
+
+Currently tracing is supposed not to allow for bpf_spin_{lock,unlock}()
+helper calls. This is to prevent deadlock for the following cases:
+  - there is a prog (prog-A) calling bpf_spin_{lock,unlock}().
+  - there is a tracing program (prog-B), e.g., fentry, attached
+    to bpf_spin_lock() and/or bpf_spin_unlock().
+  - prog-B calls bpf_spin_{lock,unlock}().
+For such a case, when prog-A calls bpf_spin_{lock,unlock}(),
+a deadlock will happen.
+
+The related source codes are below in kernel/bpf/helpers.c:
+  notrace BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
+  notrace BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
+notrace is supposed to prevent fentry prog from attaching to
+bpf_spin_{lock,unlock}().
+
+But actually this is not the case and fentry prog can successfully
+attached to bpf_spin_lock(). Siddharth Chintamaneni reported
+the issue in [1]. The following is the macro definition for
+above BPF_CALL_1:
+  #define BPF_CALL_x(x, name, ...)                                               \
+        static __always_inline                                                 \
+        u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__));   \
+        typedef u64 (*btf_##name)(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \
+        u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));         \
+        u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))          \
+        {                                                                      \
+                return ((btf_##name)____##name)(__BPF_MAP(x,__BPF_CAST,__BPF_N,__VA_ARGS__));\
+        }                                                                      \
+        static __always_inline                                                 \
+        u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__))
+
+  #define BPF_CALL_1(name, ...)   BPF_CALL_x(1, name, __VA_ARGS__)
+
+The notrace attribute is actually applied to the static always_inline function
+____bpf_spin_{lock,unlock}(). The actual callback function
+bpf_spin_{lock,unlock}() is not marked with notrace, hence
+allowing fentry prog to attach to two helpers, and this
+may cause the above mentioned deadlock. Siddharth Chintamaneni
+actually has a reproducer in [2].
+
+To fix the issue, a new macro NOTRACE_BPF_CALL_1 is introduced which
+will add notrace attribute to the original function instead of
+the hidden always_inline function and this fixed the problem.
+
+  [1] https://lore.kernel.org/bpf/CAE5sdEigPnoGrzN8WU7Tx-h-iFuMZgW06qp0KHWtpvoXxf1OAQ@mail.gmail.com/
+  [2] https://lore.kernel.org/bpf/CAE5sdEg6yUc_Jz50AnUXEEUh6O73yQ1Z6NV2srJnef0ZrQkZew@mail.gmail.com/
+
+Fixes: d83525ca62cf ("bpf: introduce bpf_spin_lock")
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20240207070102.335167-1-yonghong.song@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 21 ++++++++++++---------
+ kernel/bpf/helpers.c   |  4 ++--
+ 2 files changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index a9956b681f090..2b6da8e356aab 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -496,24 +496,27 @@ static inline bool insn_is_zext(const struct bpf_insn *insn)
+ 	__BPF_MAP(n, __BPF_DECL_ARGS, __BPF_N, u64, __ur_1, u64, __ur_2,       \
+ 		  u64, __ur_3, u64, __ur_4, u64, __ur_5)
+ 
+-#define BPF_CALL_x(x, name, ...)					       \
++#define BPF_CALL_x(x, attr, name, ...)					       \
+ 	static __always_inline						       \
+ 	u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__));   \
+ 	typedef u64 (*btf_##name)(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \
+-	u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));	       \
+-	u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))	       \
++	attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));    \
++	attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))     \
+ 	{								       \
+ 		return ((btf_##name)____##name)(__BPF_MAP(x,__BPF_CAST,__BPF_N,__VA_ARGS__));\
+ 	}								       \
+ 	static __always_inline						       \
+ 	u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__))
+ 
+-#define BPF_CALL_0(name, ...)	BPF_CALL_x(0, name, __VA_ARGS__)
+-#define BPF_CALL_1(name, ...)	BPF_CALL_x(1, name, __VA_ARGS__)
+-#define BPF_CALL_2(name, ...)	BPF_CALL_x(2, name, __VA_ARGS__)
+-#define BPF_CALL_3(name, ...)	BPF_CALL_x(3, name, __VA_ARGS__)
+-#define BPF_CALL_4(name, ...)	BPF_CALL_x(4, name, __VA_ARGS__)
+-#define BPF_CALL_5(name, ...)	BPF_CALL_x(5, name, __VA_ARGS__)
++#define __NOATTR
++#define BPF_CALL_0(name, ...)	BPF_CALL_x(0, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_1(name, ...)	BPF_CALL_x(1, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_2(name, ...)	BPF_CALL_x(2, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_3(name, ...)	BPF_CALL_x(3, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_4(name, ...)	BPF_CALL_x(4, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_5(name, ...)	BPF_CALL_x(5, __NOATTR, name, __VA_ARGS__)
++
++#define NOTRACE_BPF_CALL_1(name, ...)	BPF_CALL_x(1, notrace, name, __VA_ARGS__)
+ 
+ #define bpf_ctx_range(TYPE, MEMBER)						\
+ 	offsetof(TYPE, MEMBER) ... offsetofend(TYPE, MEMBER) - 1
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 870127c895c49..273f2f0deb239 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -298,7 +298,7 @@ static inline void __bpf_spin_lock_irqsave(struct bpf_spin_lock *lock)
+ 	__this_cpu_write(irqsave_flags, flags);
+ }
+ 
+-notrace BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
++NOTRACE_BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
+ {
+ 	__bpf_spin_lock_irqsave(lock);
+ 	return 0;
+@@ -320,7 +320,7 @@ static inline void __bpf_spin_unlock_irqrestore(struct bpf_spin_lock *lock)
+ 	local_irq_restore(flags);
+ }
+ 
+-notrace BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
++NOTRACE_BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
+ {
+ 	__bpf_spin_unlock_irqrestore(lock);
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-5.15/bpf-net-change-do_ip_getsockopt-to-take-the-sockptr_.patch b/queue-5.15/bpf-net-change-do_ip_getsockopt-to-take-the-sockptr_.patch
new file mode 100644
index 00000000000..04229cdbef8
--- /dev/null
+++ b/queue-5.15/bpf-net-change-do_ip_getsockopt-to-take-the-sockptr_.patch
@@ -0,0 +1,382 @@
+From db2705c6a3512fbcfa96c101a1ab1f196bd371e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 17:28:28 -0700
+Subject: bpf: net: Change do_ip_getsockopt() to take the sockptr_t argument
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit 728f064cd7ebea8c182e99e6f152c8b4a0a6b071 ]
+
+Similar to the earlier patch that changes sk_getsockopt() to
+take the sockptr_t argument.  This patch also changes
+do_ip_getsockopt() to take the sockptr_t argument such that
+a latter patch can make bpf_getsockopt(SOL_IP) to reuse
+do_ip_getsockopt().
+
+Note on the change in ip_mc_gsfget().  This function is to
+return an array of sockaddr_storage in optval.  This function
+is shared between ip_get_mcast_msfilter() and
+compat_ip_get_mcast_msfilter().  However, the sockaddr_storage
+is stored at different offset of the optval because of
+the difference between group_filter and compat_group_filter.
+Thus, a new 'ss_offset' argument is added to ip_mc_gsfget().
+
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20220902002828.2890585-1-kafai@fb.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 5c3be3e0eb44 ("ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/igmp.h   |  4 +--
+ include/linux/mroute.h |  6 ++--
+ net/ipv4/igmp.c        | 22 +++++++-----
+ net/ipv4/ip_sockglue.c | 80 ++++++++++++++++++++++++------------------
+ net/ipv4/ipmr.c        |  9 ++---
+ 5 files changed, 68 insertions(+), 53 deletions(-)
+
+diff --git a/include/linux/igmp.h b/include/linux/igmp.h
+index 93c262ecbdc92..78890143f0790 100644
+--- a/include/linux/igmp.h
++++ b/include/linux/igmp.h
+@@ -118,9 +118,9 @@ extern int ip_mc_source(int add, int omode, struct sock *sk,
+ 		struct ip_mreq_source *mreqs, int ifindex);
+ extern int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf,int ifindex);
+ extern int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
+-		struct ip_msfilter __user *optval, int __user *optlen);
++			sockptr_t optval, sockptr_t optlen);
+ extern int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
+-			struct sockaddr_storage __user *p);
++			sockptr_t optval, size_t offset);
+ extern int ip_mc_sf_allow(struct sock *sk, __be32 local, __be32 rmt,
+ 			  int dif, int sdif);
+ extern void ip_mc_init_dev(struct in_device *);
+diff --git a/include/linux/mroute.h b/include/linux/mroute.h
+index 6cbbfe94348ce..80b8400ab8b24 100644
+--- a/include/linux/mroute.h
++++ b/include/linux/mroute.h
+@@ -17,7 +17,7 @@ static inline int ip_mroute_opt(int opt)
+ }
+ 
+ int ip_mroute_setsockopt(struct sock *, int, sockptr_t, unsigned int);
+-int ip_mroute_getsockopt(struct sock *, int, char __user *, int __user *);
++int ip_mroute_getsockopt(struct sock *, int, sockptr_t, sockptr_t);
+ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg);
+ int ipmr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg);
+ int ip_mr_init(void);
+@@ -29,8 +29,8 @@ static inline int ip_mroute_setsockopt(struct sock *sock, int optname,
+ 	return -ENOPROTOOPT;
+ }
+ 
+-static inline int ip_mroute_getsockopt(struct sock *sock, int optname,
+-				       char __user *optval, int __user *optlen)
++static inline int ip_mroute_getsockopt(struct sock *sk, int optname,
++				       sockptr_t optval, sockptr_t optlen)
+ {
+ 	return -ENOPROTOOPT;
+ }
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 88e780a168652..d2d0fb6dcff78 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -2532,11 +2532,10 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
+ 		err = ip_mc_leave_group(sk, &imr);
+ 	return err;
+ }
+-
+ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
+-	struct ip_msfilter __user *optval, int __user *optlen)
++		 sockptr_t optval, sockptr_t optlen)
+ {
+-	int err, len, count, copycount;
++	int err, len, count, copycount, msf_size;
+ 	struct ip_mreqn	imr;
+ 	__be32 addr = msf->imsf_multiaddr;
+ 	struct ip_mc_socklist *pmc;
+@@ -2579,12 +2578,15 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
+ 	copycount = count < msf->imsf_numsrc ? count : msf->imsf_numsrc;
+ 	len = flex_array_size(psl, sl_addr, copycount);
+ 	msf->imsf_numsrc = count;
+-	if (put_user(IP_MSFILTER_SIZE(copycount), optlen) ||
+-	    copy_to_user(optval, msf, IP_MSFILTER_SIZE(0))) {
++	msf_size = IP_MSFILTER_SIZE(copycount);
++	if (copy_to_sockptr(optlen, &msf_size, sizeof(int)) ||
++	    copy_to_sockptr(optval, msf, IP_MSFILTER_SIZE(0))) {
+ 		return -EFAULT;
+ 	}
+ 	if (len &&
+-	    copy_to_user(&optval->imsf_slist_flex[0], psl->sl_addr, len))
++	    copy_to_sockptr_offset(optval,
++				   offsetof(struct ip_msfilter, imsf_slist_flex),
++				   psl->sl_addr, len))
+ 		return -EFAULT;
+ 	return 0;
+ done:
+@@ -2592,7 +2594,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
+ }
+ 
+ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
+-	struct sockaddr_storage __user *p)
++		 sockptr_t optval, size_t ss_offset)
+ {
+ 	int i, count, copycount;
+ 	struct sockaddr_in *psin;
+@@ -2622,15 +2624,17 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
+ 	count = psl ? psl->sl_count : 0;
+ 	copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
+ 	gsf->gf_numsrc = count;
+-	for (i = 0; i < copycount; i++, p++) {
++	for (i = 0; i < copycount; i++) {
+ 		struct sockaddr_storage ss;
+ 
+ 		psin = (struct sockaddr_in *)&ss;
+ 		memset(&ss, 0, sizeof(ss));
+ 		psin->sin_family = AF_INET;
+ 		psin->sin_addr.s_addr = psl->sl_addr[i];
+-		if (copy_to_user(p, &ss, sizeof(ss)))
++		if (copy_to_sockptr_offset(optval, ss_offset,
++					   &ss, sizeof(ss)))
+ 			return -EFAULT;
++		ss_offset += sizeof(ss);
+ 	}
+ 	return 0;
+ }
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 540002c9f3b35..3620dc739a5bf 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1460,37 +1460,37 @@ static bool getsockopt_needs_rtnl(int optname)
+ 	return false;
+ }
+ 
+-static int ip_get_mcast_msfilter(struct sock *sk, void __user *optval,
+-		int __user *optlen, int len)
++static int ip_get_mcast_msfilter(struct sock *sk, sockptr_t optval,
++				 sockptr_t optlen, int len)
+ {
+ 	const int size0 = offsetof(struct group_filter, gf_slist_flex);
+-	struct group_filter __user *p = optval;
+ 	struct group_filter gsf;
+-	int num;
++	int num, gsf_size;
+ 	int err;
+ 
+ 	if (len < size0)
+ 		return -EINVAL;
+-	if (copy_from_user(&gsf, p, size0))
++	if (copy_from_sockptr(&gsf, optval, size0))
+ 		return -EFAULT;
+ 
+ 	num = gsf.gf_numsrc;
+-	err = ip_mc_gsfget(sk, &gsf, p->gf_slist_flex);
++	err = ip_mc_gsfget(sk, &gsf, optval,
++			   offsetof(struct group_filter, gf_slist_flex));
+ 	if (err)
+ 		return err;
+ 	if (gsf.gf_numsrc < num)
+ 		num = gsf.gf_numsrc;
+-	if (put_user(GROUP_FILTER_SIZE(num), optlen) ||
+-	    copy_to_user(p, &gsf, size0))
++	gsf_size = GROUP_FILTER_SIZE(num);
++	if (copy_to_sockptr(optlen, &gsf_size, sizeof(int)) ||
++	    copy_to_sockptr(optval, &gsf, size0))
+ 		return -EFAULT;
+ 	return 0;
+ }
+ 
+-static int compat_ip_get_mcast_msfilter(struct sock *sk, void __user *optval,
+-		int __user *optlen, int len)
++static int compat_ip_get_mcast_msfilter(struct sock *sk, sockptr_t optval,
++					sockptr_t optlen, int len)
+ {
+ 	const int size0 = offsetof(struct compat_group_filter, gf_slist_flex);
+-	struct compat_group_filter __user *p = optval;
+ 	struct compat_group_filter gf32;
+ 	struct group_filter gf;
+ 	int num;
+@@ -1498,7 +1498,7 @@ static int compat_ip_get_mcast_msfilter(struct sock *sk, void __user *optval,
+ 
+ 	if (len < size0)
+ 		return -EINVAL;
+-	if (copy_from_user(&gf32, p, size0))
++	if (copy_from_sockptr(&gf32, optval, size0))
+ 		return -EFAULT;
+ 
+ 	gf.gf_interface = gf32.gf_interface;
+@@ -1506,21 +1506,24 @@ static int compat_ip_get_mcast_msfilter(struct sock *sk, void __user *optval,
+ 	num = gf.gf_numsrc = gf32.gf_numsrc;
+ 	gf.gf_group = gf32.gf_group;
+ 
+-	err = ip_mc_gsfget(sk, &gf, p->gf_slist_flex);
++	err = ip_mc_gsfget(sk, &gf, optval,
++			   offsetof(struct compat_group_filter, gf_slist_flex));
+ 	if (err)
+ 		return err;
+ 	if (gf.gf_numsrc < num)
+ 		num = gf.gf_numsrc;
+ 	len = GROUP_FILTER_SIZE(num) - (sizeof(gf) - sizeof(gf32));
+-	if (put_user(len, optlen) ||
+-	    put_user(gf.gf_fmode, &p->gf_fmode) ||
+-	    put_user(gf.gf_numsrc, &p->gf_numsrc))
++	if (copy_to_sockptr(optlen, &len, sizeof(int)) ||
++	    copy_to_sockptr_offset(optval, offsetof(struct compat_group_filter, gf_fmode),
++				   &gf.gf_fmode, sizeof(gf.gf_fmode)) ||
++	    copy_to_sockptr_offset(optval, offsetof(struct compat_group_filter, gf_numsrc),
++				   &gf.gf_numsrc, sizeof(gf.gf_numsrc)))
+ 		return -EFAULT;
+ 	return 0;
+ }
+ 
+ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+-			    char __user *optval, int __user *optlen)
++			    sockptr_t optval, sockptr_t optlen)
+ {
+ 	struct inet_sock *inet = inet_sk(sk);
+ 	bool needs_rtnl = getsockopt_needs_rtnl(optname);
+@@ -1533,7 +1536,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ 	if (ip_mroute_opt(optname))
+ 		return ip_mroute_getsockopt(sk, optname, optval, optlen);
+ 
+-	if (get_user(len, optlen))
++	if (copy_from_sockptr(&len, optlen, sizeof(int)))
+ 		return -EFAULT;
+ 	if (len < 0)
+ 		return -EINVAL;
+@@ -1558,15 +1561,17 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ 			       inet_opt->opt.optlen);
+ 		release_sock(sk);
+ 
+-		if (opt->optlen == 0)
+-			return put_user(0, optlen);
++		if (opt->optlen == 0) {
++			len = 0;
++			return copy_to_sockptr(optlen, &len, sizeof(int));
++		}
+ 
+ 		ip_options_undo(opt);
+ 
+ 		len = min_t(unsigned int, len, opt->optlen);
+-		if (put_user(len, optlen))
++		if (copy_to_sockptr(optlen, &len, sizeof(int)))
+ 			return -EFAULT;
+-		if (copy_to_user(optval, opt->__data, len))
++		if (copy_to_sockptr(optval, opt->__data, len))
+ 			return -EFAULT;
+ 		return 0;
+ 	}
+@@ -1657,9 +1662,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ 		addr.s_addr = inet->mc_addr;
+ 		release_sock(sk);
+ 
+-		if (put_user(len, optlen))
++		if (copy_to_sockptr(optlen, &len, sizeof(int)))
+ 			return -EFAULT;
+-		if (copy_to_user(optval, &addr, len))
++		if (copy_to_sockptr(optval, &addr, len))
+ 			return -EFAULT;
+ 		return 0;
+ 	}
+@@ -1671,12 +1676,11 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ 			err = -EINVAL;
+ 			goto out;
+ 		}
+-		if (copy_from_user(&msf, optval, IP_MSFILTER_SIZE(0))) {
++		if (copy_from_sockptr(&msf, optval, IP_MSFILTER_SIZE(0))) {
+ 			err = -EFAULT;
+ 			goto out;
+ 		}
+-		err = ip_mc_msfget(sk, &msf,
+-				   (struct ip_msfilter __user *)optval, optlen);
++		err = ip_mc_msfget(sk, &msf, optval, optlen);
+ 		goto out;
+ 	}
+ 	case MCAST_MSFILTER:
+@@ -1698,8 +1702,13 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ 		if (sk->sk_type != SOCK_STREAM)
+ 			return -ENOPROTOOPT;
+ 
+-		msg.msg_control_is_user = true;
+-		msg.msg_control_user = optval;
++		if (optval.is_kernel) {
++			msg.msg_control_is_user = false;
++			msg.msg_control = optval.kernel;
++		} else {
++			msg.msg_control_is_user = true;
++			msg.msg_control_user = optval.user;
++		}
+ 		msg.msg_controllen = len;
+ 		msg.msg_flags = in_compat_syscall() ? MSG_CMSG_COMPAT : 0;
+ 
+@@ -1720,7 +1729,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ 			put_cmsg(&msg, SOL_IP, IP_TOS, sizeof(tos), &tos);
+ 		}
+ 		len -= msg.msg_controllen;
+-		return put_user(len, optlen);
++		return copy_to_sockptr(optlen, &len, sizeof(int));
+ 	}
+ 	case IP_FREEBIND:
+ 		val = inet->freebind;
+@@ -1743,15 +1752,15 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+ 	if (len < sizeof(int) && len > 0 && val >= 0 && val <= 255) {
+ 		unsigned char ucval = (unsigned char)val;
+ 		len = 1;
+-		if (put_user(len, optlen))
++		if (copy_to_sockptr(optlen, &len, sizeof(int)))
+ 			return -EFAULT;
+-		if (copy_to_user(optval, &ucval, 1))
++		if (copy_to_sockptr(optval, &ucval, 1))
+ 			return -EFAULT;
+ 	} else {
+ 		len = min_t(unsigned int, sizeof(int), len);
+-		if (put_user(len, optlen))
++		if (copy_to_sockptr(optlen, &len, sizeof(int)))
+ 			return -EFAULT;
+-		if (copy_to_user(optval, &val, len))
++		if (copy_to_sockptr(optval, &val, len))
+ 			return -EFAULT;
+ 	}
+ 	return 0;
+@@ -1768,7 +1777,8 @@ int ip_getsockopt(struct sock *sk, int level,
+ {
+ 	int err;
+ 
+-	err = do_ip_getsockopt(sk, level, optname, optval, optlen);
++	err = do_ip_getsockopt(sk, level, optname,
++			       USER_SOCKPTR(optval), USER_SOCKPTR(optlen));
+ 
+ #if IS_ENABLED(CONFIG_BPFILTER_UMH)
+ 	if (optname >= BPFILTER_IPT_SO_GET_INFO &&
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index aea29d97f8dfa..eb3c09340aef8 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1540,7 +1540,8 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, sockptr_t optval,
+ }
+ 
+ /* Getsock opt support for the multicast routing system. */
+-int ip_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, int __user *optlen)
++int ip_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
++			 sockptr_t optlen)
+ {
+ 	int olr;
+ 	int val;
+@@ -1571,14 +1572,14 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, int
+ 		return -ENOPROTOOPT;
+ 	}
+ 
+-	if (get_user(olr, optlen))
++	if (copy_from_sockptr(&olr, optlen, sizeof(int)))
+ 		return -EFAULT;
+ 	olr = min_t(unsigned int, olr, sizeof(int));
+ 	if (olr < 0)
+ 		return -EINVAL;
+-	if (put_user(olr, optlen))
++	if (copy_to_sockptr(optlen, &olr, sizeof(int)))
+ 		return -EFAULT;
+-	if (copy_to_user(optval, &val, olr))
++	if (copy_to_sockptr(optval, &val, olr))
+ 		return -EFAULT;
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/bpf-net-change-sk_getsockopt-to-take-the-sockptr_t-a.patch b/queue-5.15/bpf-net-change-sk_getsockopt-to-take-the-sockptr_t-a.patch
new file mode 100644
index 00000000000..aef53038faf
--- /dev/null
+++ b/queue-5.15/bpf-net-change-sk_getsockopt-to-take-the-sockptr_t-a.patch
@@ -0,0 +1,236 @@
+From cecfb59ff7a95c98b8355c7049ed5c270480496c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 17:28:02 -0700
+Subject: bpf: net: Change sk_getsockopt() to take the sockptr_t argument
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit 4ff09db1b79b98b4a2a7511571c640b76cab3beb ]
+
+This patch changes sk_getsockopt() to take the sockptr_t argument
+such that it can be used by bpf_getsockopt(SOL_SOCKET) in a
+latter patch.
+
+security_socket_getpeersec_stream() is not changed.  It stays
+with the __user ptr (optval.user and optlen.user) to avoid changes
+to other security hooks.  bpf_getsockopt(SOL_SOCKET) also does not
+support SO_PEERSEC.
+
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20220902002802.2888419-1-kafai@fb.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 5c3be3e0eb44 ("ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h  |  3 +--
+ include/linux/sockptr.h |  5 +++++
+ net/core/filter.c       |  5 ++---
+ net/core/sock.c         | 43 +++++++++++++++++++++++------------------
+ 4 files changed, 32 insertions(+), 24 deletions(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 2b6da8e356aab..ddaeb2afc022f 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -943,8 +943,7 @@ int sk_reuseport_attach_filter(struct sock_fprog *fprog, struct sock *sk);
+ int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk);
+ void sk_reuseport_prog_free(struct bpf_prog *prog);
+ int sk_detach_filter(struct sock *sk);
+-int sk_get_filter(struct sock *sk, struct sock_filter __user *filter,
+-		  unsigned int len);
++int sk_get_filter(struct sock *sk, sockptr_t optval, unsigned int len);
+ 
+ bool sk_filter_charge(struct sock *sk, struct sk_filter *fp);
+ void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp);
+diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h
+index ea193414298b7..38862819e77a1 100644
+--- a/include/linux/sockptr.h
++++ b/include/linux/sockptr.h
+@@ -64,6 +64,11 @@ static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset,
+ 	return 0;
+ }
+ 
++static inline int copy_to_sockptr(sockptr_t dst, const void *src, size_t size)
++{
++	return copy_to_sockptr_offset(dst, 0, src, size);
++}
++
+ static inline void *memdup_sockptr(sockptr_t src, size_t len)
+ {
+ 	void *p = kmalloc_track_caller(len, GFP_USER | __GFP_NOWARN);
+diff --git a/net/core/filter.c b/net/core/filter.c
+index f0a3cdc4d4961..457d1a164ad5d 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -10316,8 +10316,7 @@ int sk_detach_filter(struct sock *sk)
+ }
+ EXPORT_SYMBOL_GPL(sk_detach_filter);
+ 
+-int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf,
+-		  unsigned int len)
++int sk_get_filter(struct sock *sk, sockptr_t optval, unsigned int len)
+ {
+ 	struct sock_fprog_kern *fprog;
+ 	struct sk_filter *filter;
+@@ -10348,7 +10347,7 @@ int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf,
+ 		goto out;
+ 
+ 	ret = -EFAULT;
+-	if (copy_to_user(ubuf, fprog->filter, bpf_classic_proglen(fprog)))
++	if (copy_to_sockptr(optval, fprog->filter, bpf_classic_proglen(fprog)))
+ 		goto out;
+ 
+ 	/* Instead of bytes, the API requests to return the number
+diff --git a/net/core/sock.c b/net/core/sock.c
+index f8e3ba34e0a34..6f761f3c272aa 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -671,8 +671,8 @@ static int sock_setbindtodevice(struct sock *sk, sockptr_t optval, int optlen)
+ 	return ret;
+ }
+ 
+-static int sock_getbindtodevice(struct sock *sk, char __user *optval,
+-				int __user *optlen, int len)
++static int sock_getbindtodevice(struct sock *sk, sockptr_t optval,
++				sockptr_t optlen, int len)
+ {
+ 	int ret = -ENOPROTOOPT;
+ #ifdef CONFIG_NETDEVICES
+@@ -695,12 +695,12 @@ static int sock_getbindtodevice(struct sock *sk, char __user *optval,
+ 	len = strlen(devname) + 1;
+ 
+ 	ret = -EFAULT;
+-	if (copy_to_user(optval, devname, len))
++	if (copy_to_sockptr(optval, devname, len))
+ 		goto out;
+ 
+ zero:
+ 	ret = -EFAULT;
+-	if (put_user(len, optlen))
++	if (copy_to_sockptr(optlen, &len, sizeof(int)))
+ 		goto out;
+ 
+ 	ret = 0;
+@@ -1404,20 +1404,23 @@ static void cred_to_ucred(struct pid *pid, const struct cred *cred,
+ 	}
+ }
+ 
+-static int groups_to_user(gid_t __user *dst, const struct group_info *src)
++static int groups_to_user(sockptr_t dst, const struct group_info *src)
+ {
+ 	struct user_namespace *user_ns = current_user_ns();
+ 	int i;
+ 
+-	for (i = 0; i < src->ngroups; i++)
+-		if (put_user(from_kgid_munged(user_ns, src->gid[i]), dst + i))
++	for (i = 0; i < src->ngroups; i++) {
++		gid_t gid = from_kgid_munged(user_ns, src->gid[i]);
++
++		if (copy_to_sockptr_offset(dst, i * sizeof(gid), &gid, sizeof(gid)))
+ 			return -EFAULT;
++	}
+ 
+ 	return 0;
+ }
+ 
+ static int sk_getsockopt(struct sock *sk, int level, int optname,
+-			 char __user *optval, int __user *optlen)
++			 sockptr_t optval, sockptr_t optlen)
+ {
+ 	struct socket *sock = sk->sk_socket;
+ 
+@@ -1436,7 +1439,7 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 	int lv = sizeof(int);
+ 	int len;
+ 
+-	if (get_user(len, optlen))
++	if (copy_from_sockptr(&len, optlen, sizeof(int)))
+ 		return -EFAULT;
+ 	if (len < 0)
+ 		return -EINVAL;
+@@ -1578,7 +1581,7 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 		cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
+ 		spin_unlock(&sk->sk_peer_lock);
+ 
+-		if (copy_to_user(optval, &peercred, len))
++		if (copy_to_sockptr(optval, &peercred, len))
+ 			return -EFAULT;
+ 		goto lenout;
+ 	}
+@@ -1596,11 +1599,11 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 		if (len < n * sizeof(gid_t)) {
+ 			len = n * sizeof(gid_t);
+ 			put_cred(cred);
+-			return put_user(len, optlen) ? -EFAULT : -ERANGE;
++			return copy_to_sockptr(optlen, &len, sizeof(int)) ? -EFAULT : -ERANGE;
+ 		}
+ 		len = n * sizeof(gid_t);
+ 
+-		ret = groups_to_user((gid_t __user *)optval, cred->group_info);
++		ret = groups_to_user(optval, cred->group_info);
+ 		put_cred(cred);
+ 		if (ret)
+ 			return ret;
+@@ -1616,7 +1619,7 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 			return -ENOTCONN;
+ 		if (lv < len)
+ 			return -EINVAL;
+-		if (copy_to_user(optval, address, len))
++		if (copy_to_sockptr(optval, address, len))
+ 			return -EFAULT;
+ 		goto lenout;
+ 	}
+@@ -1633,7 +1636,7 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 		break;
+ 
+ 	case SO_PEERSEC:
+-		return security_socket_getpeersec_stream(sock, optval, optlen, len);
++		return security_socket_getpeersec_stream(sock, optval.user, optlen.user, len);
+ 
+ 	case SO_MARK:
+ 		v.val = sk->sk_mark;
+@@ -1661,7 +1664,7 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 		return sock_getbindtodevice(sk, optval, optlen, len);
+ 
+ 	case SO_GET_FILTER:
+-		len = sk_get_filter(sk, (struct sock_filter __user *)optval, len);
++		len = sk_get_filter(sk, optval, len);
+ 		if (len < 0)
+ 			return len;
+ 
+@@ -1711,7 +1714,7 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 		sk_get_meminfo(sk, meminfo);
+ 
+ 		len = min_t(unsigned int, len, sizeof(meminfo));
+-		if (copy_to_user(optval, &meminfo, len))
++		if (copy_to_sockptr(optval, &meminfo, len))
+ 			return -EFAULT;
+ 
+ 		goto lenout;
+@@ -1772,10 +1775,10 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ 
+ 	if (len > lv)
+ 		len = lv;
+-	if (copy_to_user(optval, &v, len))
++	if (copy_to_sockptr(optval, &v, len))
+ 		return -EFAULT;
+ lenout:
+-	if (put_user(len, optlen))
++	if (copy_to_sockptr(optlen, &len, sizeof(int)))
+ 		return -EFAULT;
+ 	return 0;
+ }
+@@ -1783,7 +1786,9 @@ static int sk_getsockopt(struct sock *sk, int level, int optname,
+ int sock_getsockopt(struct socket *sock, int level, int optname,
+ 		    char __user *optval, int __user *optlen)
+ {
+-	return sk_getsockopt(sock->sk, level, optname, optval, optlen);
++	return sk_getsockopt(sock->sk, level, optname,
++			     USER_SOCKPTR(optval),
++			     USER_SOCKPTR(optlen));
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-5.15/bpftool-silence-build-warning-about-calloc.patch b/queue-5.15/bpftool-silence-build-warning-about-calloc.patch
new file mode 100644
index 00000000000..46193796865
--- /dev/null
+++ b/queue-5.15/bpftool-silence-build-warning-about-calloc.patch
@@ -0,0 +1,54 @@
+From cc4752877c3178d5e51fd05f125db297eb13652f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 14:19:20 +0800
+Subject: bpftool: Silence build warning about calloc()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit f5f30386c78105cba520e443a6a9ee945ec1d066 ]
+
+There exists the following warning when building bpftool:
+
+  CC      prog.o
+prog.c: In function ‘profile_open_perf_events’:
+prog.c:2301:24: warning: ‘calloc’ sizes specified with ‘sizeof’ in the earlier argument and not in the later argument [-Wcalloc-transposed-args]
+ 2301 |                 sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric);
+      |                        ^~~
+prog.c:2301:24: note: earlier argument should specify number of elements, later size of each element
+
+Tested with the latest upstream GCC which contains a new warning option
+-Wcalloc-transposed-args. The first argument to calloc is documented to
+be number of elements in array, while the second argument is size of each
+element, just switch the first and second arguments of calloc() to silence
+the build warning, compile tested only.
+
+Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20240116061920.31172-1-yangtiezhu@loongson.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/prog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index bdd4d3b12f6c0..afb28fcc66786 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2098,7 +2098,7 @@ static int profile_open_perf_events(struct profiler_bpf *obj)
+ 	int map_fd;
+ 
+ 	profile_perf_events = calloc(
+-		sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric);
++		obj->rodata->num_cpu * obj->rodata->num_metric, sizeof(int));
+ 	if (!profile_perf_events) {
+ 		p_err("failed to allocate memory for perf_event array: %s",
+ 		      strerror(errno));
+-- 
+2.43.0
+
diff --git a/queue-5.15/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch b/queue-5.15/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
new file mode 100644
index 00000000000..5921d6a9337
--- /dev/null
+++ b/queue-5.15/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
@@ -0,0 +1,47 @@
+From 1c0e3203dea223e49aca2d7f865e80b3b732c309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 10:02:37 +0000
+Subject: bus: tegra-aconnect: Update dependency to ARCH_TEGRA
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 4acd21a45c1446277e2abaece97d7fa7c2e692a9 ]
+
+Update the architecture dependency to be the generic Tegra
+because the driver works on the four latest Tegra generations
+not just Tegra210, if you build a kernel with a specific
+ARCH_TEGRA_xxx_SOC option that excludes Tegra210 you don't get
+this driver.
+
+Fixes: 46a88534afb59 ("bus: Add support for Tegra ACONNECT")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
+index a4cf3d692dc30..d224f5f7a7405 100644
+--- a/drivers/bus/Kconfig
++++ b/drivers/bus/Kconfig
+@@ -175,11 +175,12 @@ config SUNXI_RSB
+ 
+ config TEGRA_ACONNECT
+ 	tristate "Tegra ACONNECT Bus Driver"
+-	depends on ARCH_TEGRA_210_SOC
++	depends on ARCH_TEGRA
+ 	depends on OF && PM
+ 	help
+ 	  Driver for the Tegra ACONNECT bus which is used to interface with
+-	  the devices inside the Audio Processing Engine (APE) for Tegra210.
++	  the devices inside the Audio Processing Engine (APE) for
++	  Tegra210 and later.
+ 
+ config TEGRA_GMI
+ 	tristate "Tegra Generic Memory Interface bus driver"
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-fix-clk_core_get-null-dereference.patch b/queue-5.15/clk-fix-clk_core_get-null-dereference.patch
new file mode 100644
index 00000000000..268cc9cbe1d
--- /dev/null
+++ b/queue-5.15/clk-fix-clk_core_get-null-dereference.patch
@@ -0,0 +1,56 @@
+From e5ad9253cf3d90683a782e63a83f2f28750f0271 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Mar 2024 00:52:14 +0000
+Subject: clk: Fix clk_core_get NULL dereference
+
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+
+[ Upstream commit e97fe4901e0f59a0bfd524578fe3768f8ca42428 ]
+
+It is possible for clk_core_get to dereference a NULL in the following
+sequence:
+
+clk_core_get()
+    of_clk_get_hw_from_clkspec()
+        __of_clk_get_hw_from_provider()
+            __clk_get_hw()
+
+__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at
+hw->core.
+
+Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based
+clk_lookups") the check IS_ERR_OR_NULL() was performed which would have
+caught the NULL.
+
+Reading the description of this function it talks about returning NULL but
+that cannot be so at the moment.
+
+Update the function to check for hw before dereferencing it and return NULL
+if hw is NULL.
+
+Fixes: dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups")
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20240302-linux-next-24-03-01-simple-clock-fixes-v1-1-25f348a5982b@linaro.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index bf9057a8fbf06..84397af4fb336 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -425,6 +425,9 @@ static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index)
+ 	if (IS_ERR(hw))
+ 		return ERR_CAST(hw);
+ 
++	if (!hw)
++		return NULL;
++
+ 	return hw->core;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch b/queue-5.15/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
new file mode 100644
index 00000000000..cf9c0ddf949
--- /dev/null
+++ b/queue-5.15/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
@@ -0,0 +1,39 @@
+From cada6785ff4192c47d8e025aecc996a909898df2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 19:58:21 +0100
+Subject: clk: hisilicon: hi3519: Release the correct number of gates in
+ hi3519_clk_unregister()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 74e39f526d95c0c119ada1874871ee328c59fbee ]
+
+The gates are stored in 'hi3519_gate_clks', not 'hi3519_mux_clks'.
+This is also in line with how hisi_clk_register_gate() is called in the
+probe.
+
+Fixes: 224b3b262c52 ("clk: hisilicon: hi3519: add driver remove path and fix some issues")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/c3f1877c9a0886fa35c949c8f0ef25547f284f18.1704912510.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/hisilicon/clk-hi3519.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/hisilicon/clk-hi3519.c b/drivers/clk/hisilicon/clk-hi3519.c
+index ad0c7f350cf03..60d8a27a90824 100644
+--- a/drivers/clk/hisilicon/clk-hi3519.c
++++ b/drivers/clk/hisilicon/clk-hi3519.c
+@@ -130,7 +130,7 @@ static void hi3519_clk_unregister(struct platform_device *pdev)
+ 	of_clk_del_provider(pdev->dev.of_node);
+ 
+ 	hisi_clk_unregister_gate(hi3519_gate_clks,
+-				ARRAY_SIZE(hi3519_mux_clks),
++				ARRAY_SIZE(hi3519_gate_clks),
+ 				crg->clk_data);
+ 	hisi_clk_unregister_mux(hi3519_mux_clks,
+ 				ARRAY_SIZE(hi3519_mux_clks),
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch b/queue-5.15/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
new file mode 100644
index 00000000000..c0fda55aa6c
--- /dev/null
+++ b/queue-5.15/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
@@ -0,0 +1,42 @@
+From f7f109dab9d67d9a5ca563679cf584bb9cc0509f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jan 2024 16:16:24 +0100
+Subject: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 64c6a38136b74a2f18c42199830975edd9fbc379 ]
+
+'p_clk' is an array allocated just before the for loop for all clk that
+need to be registered.
+It is incremented at each loop iteration.
+
+If a clk_register() call fails, 'p_clk' may point to something different
+from what should be freed.
+
+The best we can do, is to avoid this wrong release of memory.
+
+Fixes: 6c81966107dc ("clk: hisilicon: Add clock driver for hi3559A SoC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/773fc8425c3b8f5b0ca7c1d89f15b65831a85ca9.1705850155.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/hisilicon/clk-hi3559a.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/clk/hisilicon/clk-hi3559a.c b/drivers/clk/hisilicon/clk-hi3559a.c
+index 9ea1a80acbe8b..0272276550ff1 100644
+--- a/drivers/clk/hisilicon/clk-hi3559a.c
++++ b/drivers/clk/hisilicon/clk-hi3559a.c
+@@ -491,7 +491,6 @@ static void hisi_clk_register_pll(struct hi3559av100_pll_clock *clks,
+ 
+ 		clk = clk_register(NULL, &p_clk->hw);
+ 		if (IS_ERR(clk)) {
+-			devm_kfree(dev, p_clk);
+ 			dev_err(dev, "%s: failed to register clock %s\n",
+ 			       __func__, clks[i].name);
+ 			continue;
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch b/queue-5.15/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
new file mode 100644
index 00000000000..b02e5e655d7
--- /dev/null
+++ b/queue-5.15/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
@@ -0,0 +1,83 @@
+From 1eba7908185be86a37ba91eb7973ca54e6b1d3bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 17:25:48 +0300
+Subject: clk: meson: Add missing clocks to axg_clk_regmaps
+
+From: Igor Prusov <ivprusov@salutedevices.com>
+
+[ Upstream commit ba535bce57e71463a86f8b33a0ea88c26e3a6418 ]
+
+Some clocks were missing from axg_clk_regmaps, which caused kernel panic
+during cat /sys/kernel/debug/clk/clk_summary
+
+[   57.349402] Unable to handle kernel NULL pointer dereference at virtual address 00000000000001fc
+...
+[   57.430002] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   57.436900] pc : regmap_read+0x1c/0x88
+[   57.440608] lr : clk_regmap_gate_is_enabled+0x3c/0xb0
+[   57.445611] sp : ffff800082f1b690
+[   57.448888] x29: ffff800082f1b690 x28: 0000000000000000 x27: ffff800080eb9a70
+[   57.455961] x26: 0000000000000007 x25: 0000000000000016 x24: 0000000000000000
+[   57.463033] x23: ffff800080e8b488 x22: 0000000000000015 x21: ffff00000e7e7000
+[   57.470106] x20: ffff00000400ec00 x19: 0000000000000000 x18: ffffffffffffffff
+[   57.477178] x17: 0000000000000000 x16: 0000000000000000 x15: ffff0000042a3000
+[   57.484251] x14: 0000000000000000 x13: ffff0000042a2fec x12: 0000000005f5e100
+[   57.491323] x11: abcc77118461cefd x10: 0000000000000020 x9 : ffff8000805e4b24
+[   57.498396] x8 : ffff0000028063c0 x7 : ffff800082f1b710 x6 : ffff800082f1b710
+[   57.505468] x5 : 00000000ffffffd0 x4 : ffff800082f1b6e0 x3 : 0000000000001000
+[   57.512541] x2 : ffff800082f1b6e4 x1 : 000000000000012c x0 : 0000000000000000
+[   57.519615] Call trace:
+[   57.522030]  regmap_read+0x1c/0x88
+[   57.525393]  clk_regmap_gate_is_enabled+0x3c/0xb0
+[   57.530050]  clk_core_is_enabled+0x44/0x120
+[   57.534190]  clk_summary_show_subtree+0x154/0x2f0
+[   57.538847]  clk_summary_show_subtree+0x220/0x2f0
+[   57.543505]  clk_summary_show_subtree+0x220/0x2f0
+[   57.548162]  clk_summary_show_subtree+0x220/0x2f0
+[   57.552820]  clk_summary_show_subtree+0x220/0x2f0
+[   57.557477]  clk_summary_show_subtree+0x220/0x2f0
+[   57.562135]  clk_summary_show_subtree+0x220/0x2f0
+[   57.566792]  clk_summary_show_subtree+0x220/0x2f0
+[   57.571450]  clk_summary_show+0x84/0xb8
+[   57.575245]  seq_read_iter+0x1bc/0x4b8
+[   57.578954]  seq_read+0x8c/0xd0
+[   57.582059]  full_proxy_read+0x68/0xc8
+[   57.585767]  vfs_read+0xb0/0x268
+[   57.588959]  ksys_read+0x70/0x108
+[   57.592236]  __arm64_sys_read+0x24/0x38
+[   57.596031]  invoke_syscall+0x50/0x128
+[   57.599740]  el0_svc_common.constprop.0+0x48/0xf8
+[   57.604397]  do_el0_svc+0x28/0x40
+[   57.607675]  el0_svc+0x34/0xb8
+[   57.610694]  el0t_64_sync_handler+0x13c/0x158
+[   57.615006]  el0t_64_sync+0x190/0x198
+[   57.618635] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (b941fc00)
+[   57.624668] ---[ end trace 0000000000000000 ]---
+
+[jbrunet: add missing Fixes tag]
+Signed-off-by: Igor Prusov <ivprusov@salutedevices.com>
+Link: https://lore.kernel.org/r/20240202172537.1.I64656c75d84284bc91e6126b50b33c502be7c42a@changeid
+Fixes: 14ebb3154b8f ("clk: meson: axg: add Video Clocks")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/axg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index 2ad3801398dc1..7802dabb26f6d 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -2144,7 +2144,9 @@ static struct clk_regmap *const axg_clk_regmaps[] = {
+ 	&axg_vclk_input,
+ 	&axg_vclk2_input,
+ 	&axg_vclk_div,
++	&axg_vclk_div1,
+ 	&axg_vclk2_div,
++	&axg_vclk2_div1,
+ 	&axg_vclk_div2_en,
+ 	&axg_vclk_div4_en,
+ 	&axg_vclk_div6_en,
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch b/queue-5.15/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
new file mode 100644
index 00000000000..94e3da677ea
--- /dev/null
+++ b/queue-5.15/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
@@ -0,0 +1,38 @@
+From 8e81ff6e512500b19fe2b028639b85c0b11d41fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 21:20:18 +0100
+Subject: clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 117e7dc697c2739d754db8fe0c1e2d4f1f5d5f82 ]
+
+SDM845 downstream uses non-default values for GDSC internal waits.
+Program them accordingly to avoid surprises.
+
+Fixes: 81351776c9fb ("clk: qcom: Add display clock controller driver for SDM845")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Tested-by: Caleb Connolly <caleb.connolly@linaro.org> # OnePlus 6
+Link: https://lore.kernel.org/r/20240103-topic-845gdsc-v1-1-368efbe1a61d@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sdm845.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/qcom/dispcc-sdm845.c b/drivers/clk/qcom/dispcc-sdm845.c
+index 735adfefc3798..e792e0b130d33 100644
+--- a/drivers/clk/qcom/dispcc-sdm845.c
++++ b/drivers/clk/qcom/dispcc-sdm845.c
+@@ -759,6 +759,8 @@ static struct clk_branch disp_cc_mdss_vsync_clk = {
+ 
+ static struct gdsc mdss_gdsc = {
+ 	.gdscr = 0x3000,
++	.en_few_wait_val = 0x6,
++	.en_rest_wait_val = 0x5,
+ 	.pd = {
+ 		.name = "mdss_gdsc",
+ 	},
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch b/queue-5.15/clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch
new file mode 100644
index 00000000000..0d7f6b4d22a
--- /dev/null
+++ b/queue-5.15/clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch
@@ -0,0 +1,84 @@
+From 91c3f74ccf62e25656e556f75f436041e6e90838 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:27 +0530
+Subject: clk: qcom: gcc-sc8180x: Add missing UFS QREF clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit bb5c0229285fb12a5f433b2b8c5fd0ec2e4795e2 ]
+
+Add missing QREF clocks for UFS MEM and UFS CARD controllers.
+
+Fixes: 4433594bbe5d ("clk: qcom: gcc: Add global clock controller driver for SC8180x")
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-4-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sc8180x.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/drivers/clk/qcom/gcc-sc8180x.c b/drivers/clk/qcom/gcc-sc8180x.c
+index c41b9f0105853..b421f67221dc1 100644
+--- a/drivers/clk/qcom/gcc-sc8180x.c
++++ b/drivers/clk/qcom/gcc-sc8180x.c
+@@ -3348,6 +3348,19 @@ static struct clk_branch gcc_ufs_card_2_unipro_core_clk = {
+ 	},
+ };
+ 
++static struct clk_branch gcc_ufs_card_clkref_en = {
++	.halt_reg = 0x8c004,
++	.halt_check = BRANCH_HALT,
++	.clkr = {
++		.enable_reg = 0x8c004,
++		.enable_mask = BIT(0),
++		.hw.init = &(const struct clk_init_data) {
++			.name = "gcc_ufs_card_clkref_en",
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
+ static struct clk_branch gcc_ufs_card_ahb_clk = {
+ 	.halt_reg = 0x75014,
+ 	.halt_check = BRANCH_HALT,
+@@ -3562,6 +3575,19 @@ static struct clk_branch gcc_ufs_card_unipro_core_hw_ctl_clk = {
+ 	},
+ };
+ 
++static struct clk_branch gcc_ufs_mem_clkref_en = {
++	.halt_reg = 0x8c000,
++	.halt_check = BRANCH_HALT,
++	.clkr = {
++		.enable_reg = 0x8c000,
++		.enable_mask = BIT(0),
++		.hw.init = &(const struct clk_init_data) {
++			.name = "gcc_ufs_mem_clkref_en",
++			.ops = &clk_branch2_ops,
++		},
++	},
++};
++
+ static struct clk_branch gcc_ufs_phy_ahb_clk = {
+ 	.halt_reg = 0x77014,
+ 	.halt_check = BRANCH_HALT,
+@@ -4414,6 +4440,7 @@ static struct clk_regmap *gcc_sc8180x_clocks[] = {
+ 	[GCC_UFS_CARD_2_TX_SYMBOL_0_CLK] = &gcc_ufs_card_2_tx_symbol_0_clk.clkr,
+ 	[GCC_UFS_CARD_2_UNIPRO_CORE_CLK] = &gcc_ufs_card_2_unipro_core_clk.clkr,
+ 	[GCC_UFS_CARD_2_UNIPRO_CORE_CLK_SRC] = &gcc_ufs_card_2_unipro_core_clk_src.clkr,
++	[GCC_UFS_CARD_CLKREF_EN] = &gcc_ufs_card_clkref_en.clkr,
+ 	[GCC_UFS_CARD_AHB_CLK] = &gcc_ufs_card_ahb_clk.clkr,
+ 	[GCC_UFS_CARD_AXI_CLK] = &gcc_ufs_card_axi_clk.clkr,
+ 	[GCC_UFS_CARD_AXI_CLK_SRC] = &gcc_ufs_card_axi_clk_src.clkr,
+@@ -4430,6 +4457,7 @@ static struct clk_regmap *gcc_sc8180x_clocks[] = {
+ 	[GCC_UFS_CARD_UNIPRO_CORE_CLK] = &gcc_ufs_card_unipro_core_clk.clkr,
+ 	[GCC_UFS_CARD_UNIPRO_CORE_CLK_SRC] = &gcc_ufs_card_unipro_core_clk_src.clkr,
+ 	[GCC_UFS_CARD_UNIPRO_CORE_HW_CTL_CLK] = &gcc_ufs_card_unipro_core_hw_ctl_clk.clkr,
++	[GCC_UFS_MEM_CLKREF_EN] = &gcc_ufs_mem_clkref_en.clkr,
+ 	[GCC_UFS_PHY_AHB_CLK] = &gcc_ufs_phy_ahb_clk.clkr,
+ 	[GCC_UFS_PHY_AXI_CLK] = &gcc_ufs_phy_axi_clk.clkr,
+ 	[GCC_UFS_PHY_AXI_CLK_SRC] = &gcc_ufs_phy_axi_clk_src.clkr,
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-qcom-reset-commonize-the-de-assert-functions.patch b/queue-5.15/clk-qcom-reset-commonize-the-de-assert-functions.patch
new file mode 100644
index 00000000000..7df38458caa
--- /dev/null
+++ b/queue-5.15/clk-qcom-reset-commonize-the-de-assert-functions.patch
@@ -0,0 +1,69 @@
+From 44e94d3a676bc7197b3a3b1ce922ab46096a2eed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 19:43:35 +0100
+Subject: clk: qcom: reset: Commonize the de/assert functions
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit eda40d9c583e95e0b6ac69d2950eec10f802e0e8 ]
+
+They do the same thing, except the last argument of the last function
+call differs. Commonize them.
+
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240105-topic-venus_reset-v2-2-c37eba13b5ce@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: 2f8cf2c3f3e3 ("clk: qcom: reset: Ensure write completion on reset de/assertion")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/reset.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
+index e45e32804d2c7..20d1d35aaf229 100644
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -22,8 +22,8 @@ static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id)
+ 	return 0;
+ }
+ 
+-static int
+-qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
++static int qcom_reset_set_assert(struct reset_controller_dev *rcdev,
++				 unsigned long id, bool assert)
+ {
+ 	struct qcom_reset_controller *rst;
+ 	const struct qcom_reset_map *map;
+@@ -33,21 +33,17 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+ 	map = &rst->reset_map[id];
+ 	mask = map->bitmask ? map->bitmask : BIT(map->bit);
+ 
+-	return regmap_update_bits(rst->regmap, map->reg, mask, mask);
++	return regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0);
+ }
+ 
+-static int
+-qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
++static int qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+ {
+-	struct qcom_reset_controller *rst;
+-	const struct qcom_reset_map *map;
+-	u32 mask;
+-
+-	rst = to_qcom_reset_controller(rcdev);
+-	map = &rst->reset_map[id];
+-	mask = map->bitmask ? map->bitmask : BIT(map->bit);
++	return qcom_reset_set_assert(rcdev, id, true);
++}
+ 
+-	return regmap_update_bits(rst->regmap, map->reg, mask, 0);
++static int qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
++{
++	return qcom_reset_set_assert(rcdev, id, false);
+ }
+ 
+ const struct reset_control_ops qcom_reset_ops = {
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch b/queue-5.15/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
new file mode 100644
index 00000000000..b5782270e3f
--- /dev/null
+++ b/queue-5.15/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
@@ -0,0 +1,45 @@
+From 8868296bd18185dcafebf92bf5a4e83edc4f43ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 19:43:36 +0100
+Subject: clk: qcom: reset: Ensure write completion on reset de/assertion
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 2f8cf2c3f3e3f7ef61bd19abb4b0bb797ad50aaf ]
+
+Trying to toggle the resets in a rapid fashion can lead to the changes
+not actually arriving at the clock controller block when we expect them
+to. This was observed at least on SM8250.
+
+Read back the value after regmap_update_bits to ensure write completion.
+
+Fixes: b36ba30c8ac6 ("clk: qcom: Add reset controller support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240105-topic-venus_reset-v2-3-c37eba13b5ce@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/reset.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
+index 20d1d35aaf229..d96c96a9089f4 100644
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -33,7 +33,12 @@ static int qcom_reset_set_assert(struct reset_controller_dev *rcdev,
+ 	map = &rst->reset_map[id];
+ 	mask = map->bitmask ? map->bitmask : BIT(map->bit);
+ 
+-	return regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0);
++	regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0);
++
++	/* Read back the register to ensure write completion, ignore the value */
++	regmap_read(rst->regmap, map->reg, &mask);
++
++	return 0;
+ }
+ 
+ static int qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+-- 
+2.43.0
+
diff --git a/queue-5.15/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch b/queue-5.15/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
new file mode 100644
index 00000000000..3b33204fe1f
--- /dev/null
+++ b/queue-5.15/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
@@ -0,0 +1,74 @@
+From 63b7836bda7e3dd1d094feaa0f279c5f6fd88f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 16:44:37 +0800
+Subject: clk: zynq: Prevent null pointer dereference caused by kmalloc failure
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 7938e9ce39d6779d2f85d822cc930f73420e54a6 ]
+
+The kmalloc() in zynq_clk_setup() will return null if the
+physical memory has run out. As a result, if we use snprintf()
+to write data to the null address, the null pointer dereference
+bug will happen.
+
+This patch uses a stack variable to replace the kmalloc().
+
+Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver")
+Suggested-by: Michal Simek <michal.simek@amd.com>
+Suggested-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynq/clkc.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
+index 204b83d911b90..c615664505a55 100644
+--- a/drivers/clk/zynq/clkc.c
++++ b/drivers/clk/zynq/clkc.c
+@@ -42,6 +42,7 @@ static void __iomem *zynq_clkc_base;
+ #define SLCR_SWDT_CLK_SEL		(zynq_clkc_base + 0x204)
+ 
+ #define NUM_MIO_PINS	54
++#define CLK_NAME_LEN	16
+ 
+ #define DBG_CLK_CTRL_CLKACT_TRC		BIT(0)
+ #define DBG_CLK_CTRL_CPU_1XCLKACT	BIT(1)
+@@ -215,7 +216,7 @@ static void __init zynq_clk_setup(struct device_node *np)
+ 	int i;
+ 	u32 tmp;
+ 	int ret;
+-	char *clk_name;
++	char clk_name[CLK_NAME_LEN];
+ 	unsigned int fclk_enable = 0;
+ 	const char *clk_output_name[clk_max];
+ 	const char *cpu_parents[4];
+@@ -425,12 +426,10 @@ static void __init zynq_clk_setup(struct device_node *np)
+ 			"gem1_emio_mux", CLK_SET_RATE_PARENT,
+ 			SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
+ 
+-	tmp = strlen("mio_clk_00x");
+-	clk_name = kmalloc(tmp, GFP_KERNEL);
+ 	for (i = 0; i < NUM_MIO_PINS; i++) {
+ 		int idx;
+ 
+-		snprintf(clk_name, tmp, "mio_clk_%2.2d", i);
++		snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i);
+ 		idx = of_property_match_string(np, "clock-names", clk_name);
+ 		if (idx >= 0)
+ 			can_mio_mux_parents[i] = of_clk_get_parent_name(np,
+@@ -438,7 +437,6 @@ static void __init zynq_clk_setup(struct device_node *np)
+ 		else
+ 			can_mio_mux_parents[i] = dummy_nm;
+ 	}
+-	kfree(clk_name);
+ 	clk_register_mux(NULL, "can_mux", periph_parents, 4,
+ 			CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0,
+ 			&canclk_lock);
+-- 
+2.43.0
+
diff --git a/queue-5.15/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch b/queue-5.15/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
new file mode 100644
index 00000000000..e08c778ccb0
--- /dev/null
+++ b/queue-5.15/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
@@ -0,0 +1,39 @@
+From 57e4bc8518de4e51fe37bba019694533ef3e0987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 10:12:20 +0300
+Subject: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return
+ value
+
+From: Anastasia Belova <abelova@astralinux.ru>
+
+[ Upstream commit f661017e6d326ee187db24194cabb013d81bc2a6 ]
+
+cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it
+and return 0 in case of error.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index f644c5e325fb2..38ec0fedb247f 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -481,6 +481,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv)
+ static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
+ {
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
++	if (!policy)
++		return 0;
+ 	struct private_data *priv = policy->driver_data;
+ 
+ 	cpufreq_cpu_put(policy);
+-- 
+2.43.0
+
diff --git a/queue-5.15/cpufreq-explicitly-include-correct-dt-includes.patch b/queue-5.15/cpufreq-explicitly-include-correct-dt-includes.patch
new file mode 100644
index 00000000000..7da51a562b4
--- /dev/null
+++ b/queue-5.15/cpufreq-explicitly-include-correct-dt-includes.patch
@@ -0,0 +1,157 @@
+From 11655e2eada3bf81424ad15bc9cf5e021baabf43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jul 2023 11:44:13 -0600
+Subject: cpufreq: Explicitly include correct DT includes
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit a70eb93a2477371638ef481aaae7bb7b760d3004 ]
+
+The DT of_device.h and of_platform.h date back to the separate
+of_platform_bus_type before it as merged into the regular platform bus.
+As part of that merge prepping Arm DT support 13 years ago, they
+"temporarily" include each other. They also include platform_device.h
+and of.h. As a result, there's a pretty much random mix of those include
+files used throughout the tree. In order to detangle these headers and
+replace the implicit includes with struct declarations, users need to
+explicitly include the correct includes.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Stable-dep-of: 788715b5f21c ("cpufreq: mediatek-hw: Wait for CPU supplies before probing")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/armada-37xx-cpufreq.c  | 4 +---
+ drivers/cpufreq/mediatek-cpufreq-hw.c  | 3 ++-
+ drivers/cpufreq/ppc_cbe_cpufreq.c      | 2 +-
+ drivers/cpufreq/ppc_cbe_cpufreq_pmi.c  | 1 -
+ drivers/cpufreq/qcom-cpufreq-nvmem.c   | 1 -
+ drivers/cpufreq/scpi-cpufreq.c         | 2 +-
+ drivers/cpufreq/sti-cpufreq.c          | 2 +-
+ drivers/cpufreq/ti-cpufreq.c           | 2 +-
+ drivers/cpufreq/vexpress-spc-cpufreq.c | 1 -
+ 9 files changed, 7 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c
+index b74289a95a171..bea41ccabf1f0 100644
+--- a/drivers/cpufreq/armada-37xx-cpufreq.c
++++ b/drivers/cpufreq/armada-37xx-cpufreq.c
+@@ -14,10 +14,8 @@
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/mfd/syscon.h>
++#include <linux/mod_devicetable.h>
+ #include <linux/module.h>
+-#include <linux/of_address.h>
+-#include <linux/of_device.h>
+-#include <linux/of_irq.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_opp.h>
+ #include <linux/regmap.h>
+diff --git a/drivers/cpufreq/mediatek-cpufreq-hw.c b/drivers/cpufreq/mediatek-cpufreq-hw.c
+index 0cf18dd46b923..8a4e52b22eed7 100644
+--- a/drivers/cpufreq/mediatek-cpufreq-hw.c
++++ b/drivers/cpufreq/mediatek-cpufreq-hw.c
+@@ -10,8 +10,9 @@
+ #include <linux/iopoll.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+-#include <linux/of_address.h>
++#include <linux/of.h>
+ #include <linux/of_platform.h>
++#include <linux/platform_device.h>
+ #include <linux/slab.h>
+ 
+ #define LUT_MAX_ENTRIES			32U
+diff --git a/drivers/cpufreq/ppc_cbe_cpufreq.c b/drivers/cpufreq/ppc_cbe_cpufreq.c
+index c58abb4cca3a2..acaa8db57812d 100644
+--- a/drivers/cpufreq/ppc_cbe_cpufreq.c
++++ b/drivers/cpufreq/ppc_cbe_cpufreq.c
+@@ -9,7 +9,7 @@
+ 
+ #include <linux/cpufreq.h>
+ #include <linux/module.h>
+-#include <linux/of_platform.h>
++#include <linux/of.h>
+ 
+ #include <asm/machdep.h>
+ #include <asm/prom.h>
+diff --git a/drivers/cpufreq/ppc_cbe_cpufreq_pmi.c b/drivers/cpufreq/ppc_cbe_cpufreq_pmi.c
+index 037fe23bc6ed0..e85fa0f41991c 100644
+--- a/drivers/cpufreq/ppc_cbe_cpufreq_pmi.c
++++ b/drivers/cpufreq/ppc_cbe_cpufreq_pmi.c
+@@ -11,7 +11,6 @@
+ #include <linux/types.h>
+ #include <linux/timer.h>
+ #include <linux/init.h>
+-#include <linux/of_platform.h>
+ #include <linux/pm_qos.h>
+ 
+ #include <asm/processor.h>
+diff --git a/drivers/cpufreq/qcom-cpufreq-nvmem.c b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+index 6e011e8bfb6a9..63fc879e23096 100644
+--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c
++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c
+@@ -22,7 +22,6 @@
+ #include <linux/module.h>
+ #include <linux/nvmem-consumer.h>
+ #include <linux/of.h>
+-#include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_domain.h>
+ #include <linux/pm_opp.h>
+diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c
+index bda3e7d429647..763692e327b18 100644
+--- a/drivers/cpufreq/scpi-cpufreq.c
++++ b/drivers/cpufreq/scpi-cpufreq.c
+@@ -22,7 +22,7 @@
+ #include <linux/cpumask.h>
+ #include <linux/export.h>
+ #include <linux/module.h>
+-#include <linux/of_platform.h>
++#include <linux/platform_device.h>
+ #include <linux/pm_opp.h>
+ #include <linux/scpi_protocol.h>
+ #include <linux/slab.h>
+diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c
+index fdb0a722d8812..f1cde44670689 100644
+--- a/drivers/cpufreq/sti-cpufreq.c
++++ b/drivers/cpufreq/sti-cpufreq.c
+@@ -13,7 +13,7 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+-#include <linux/of_platform.h>
++#include <linux/platform_device.h>
+ #include <linux/pm_opp.h>
+ #include <linux/regmap.h>
+ 
+diff --git a/drivers/cpufreq/ti-cpufreq.c b/drivers/cpufreq/ti-cpufreq.c
+index 8f9fdd864391a..88bffa0bd0139 100644
+--- a/drivers/cpufreq/ti-cpufreq.c
++++ b/drivers/cpufreq/ti-cpufreq.c
+@@ -12,7 +12,7 @@
+ #include <linux/module.h>
+ #include <linux/init.h>
+ #include <linux/of.h>
+-#include <linux/of_platform.h>
++#include <linux/platform_device.h>
+ #include <linux/pm_opp.h>
+ #include <linux/regmap.h>
+ #include <linux/slab.h>
+diff --git a/drivers/cpufreq/vexpress-spc-cpufreq.c b/drivers/cpufreq/vexpress-spc-cpufreq.c
+index d295f405c4bb0..865e501648034 100644
+--- a/drivers/cpufreq/vexpress-spc-cpufreq.c
++++ b/drivers/cpufreq/vexpress-spc-cpufreq.c
+@@ -18,7 +18,6 @@
+ #include <linux/device.h>
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+-#include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_opp.h>
+ #include <linux/slab.h>
+-- 
+2.43.0
+
diff --git a/queue-5.15/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch b/queue-5.15/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
new file mode 100644
index 00000000000..404658d4bb0
--- /dev/null
+++ b/queue-5.15/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
@@ -0,0 +1,48 @@
+From 1ded2a00690ccd0648458ba67e06b7bcce7e609d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 17:31:43 -0300
+Subject: cpufreq: mediatek-hw: Don't error out if supply is not found
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit eaffb10b51bf74415c9252fd8fb4dd77122501ee ]
+
+devm_regulator_get_optional() returns -ENODEV if no supply can be found.
+By introducing its usage, commit 788715b5f21c ("cpufreq: mediatek-hw:
+Wait for CPU supplies before probing") caused the driver to fail probe
+if no supply was present in any of the CPU DT nodes.
+
+Use devm_regulator_get() instead since the CPUs do require supplies
+even if not described in the DT. It will gracefully return a dummy
+regulator if none is found in the DT node, allowing probe to succeed.
+
+Fixes: 788715b5f21c ("cpufreq: mediatek-hw: Wait for CPU supplies before probing")
+Reported-by: kernelci.org bot <bot@kernelci.org>
+Closes: https://linux.kernelci.org/test/case/id/65b0b169710edea22852a3fa/
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq-hw.c b/drivers/cpufreq/mediatek-cpufreq-hw.c
+index 4a7478a91fb61..314c1cb6e8f4d 100644
+--- a/drivers/cpufreq/mediatek-cpufreq-hw.c
++++ b/drivers/cpufreq/mediatek-cpufreq-hw.c
+@@ -280,7 +280,7 @@ static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev)
+ 			return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
+ 					     "Failed to get cpu%d device\n", cpu);
+ 
+-		cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu");
++		cpu_reg = devm_regulator_get(cpu_dev, "cpu");
+ 		if (IS_ERR(cpu_reg))
+ 			return dev_err_probe(&pdev->dev, PTR_ERR(cpu_reg),
+ 					     "CPU%d regulator get failed\n", cpu);
+-- 
+2.43.0
+
diff --git a/queue-5.15/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch b/queue-5.15/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
new file mode 100644
index 00000000000..c87cd555ff5
--- /dev/null
+++ b/queue-5.15/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
@@ -0,0 +1,72 @@
+From ac261a51bc8278e977259bbac7ce8523ca590b75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 11:23:02 -0300
+Subject: cpufreq: mediatek-hw: Wait for CPU supplies before probing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 788715b5f21c6455264fe00a1779e61bec407fe2 ]
+
+Before proceeding with the probe and enabling frequency scaling for the
+CPUs, make sure that all supplies feeding the CPUs have probed.
+
+This fixes an issue observed on MT8195-Tomato where if the
+mediatek-cpufreq-hw driver enabled the hardware (by writing to
+REG_FREQ_ENABLE) before the SPMI controller driver (spmi-mtk-pmif),
+behind which lies the big CPU supply, probed the platform would hang
+shortly after with "rcu: INFO: rcu_preempt detected stalls on
+CPUs/tasks" being printed in the log.
+
+Fixes: 4855e26bcf4d ("cpufreq: mediatek-hw: Add support for CPUFREQ HW")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq-hw.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq-hw.c b/drivers/cpufreq/mediatek-cpufreq-hw.c
+index 8a4e52b22eed7..4a7478a91fb61 100644
+--- a/drivers/cpufreq/mediatek-cpufreq-hw.c
++++ b/drivers/cpufreq/mediatek-cpufreq-hw.c
+@@ -13,6 +13,7 @@
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
+ #include <linux/slab.h>
+ 
+ #define LUT_MAX_ENTRIES			32U
+@@ -268,7 +269,23 @@ static struct cpufreq_driver cpufreq_mtk_hw_driver = {
+ static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev)
+ {
+ 	const void *data;
+-	int ret;
++	int ret, cpu;
++	struct device *cpu_dev;
++	struct regulator *cpu_reg;
++
++	/* Make sure that all CPU supplies are available before proceeding. */
++	for_each_possible_cpu(cpu) {
++		cpu_dev = get_cpu_device(cpu);
++		if (!cpu_dev)
++			return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
++					     "Failed to get cpu%d device\n", cpu);
++
++		cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu");
++		if (IS_ERR(cpu_reg))
++			return dev_err_probe(&pdev->dev, PTR_ERR(cpu_reg),
++					     "CPU%d regulator get failed\n", cpu);
++	}
++
+ 
+ 	data = of_device_get_match_data(&pdev->dev);
+ 	if (!data)
+-- 
+2.43.0
+
diff --git a/queue-5.15/crypto-arm-sha-fix-function-cast-warnings.patch b/queue-5.15/crypto-arm-sha-fix-function-cast-warnings.patch
new file mode 100644
index 00000000000..fd5f492f7a1
--- /dev/null
+++ b/queue-5.15/crypto-arm-sha-fix-function-cast-warnings.patch
@@ -0,0 +1,115 @@
+From 0599ffbb96dd9adda56b5d7ed0a1bc24b2221602 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 14:49:46 +0100
+Subject: crypto: arm/sha - fix function cast warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 53cc9baeb9bc2a187eb9c9790d30995148852b12 ]
+
+clang-16 warns about casting between incompatible function types:
+
+arch/arm/crypto/sha256_glue.c:37:5: error: cast from 'void (*)(u32 *, const void *, unsigned int)' (aka 'void (*)(unsigned int *, const void *, unsigned int)') to 'sha256_block_fn *' (aka 'void (*)(struct sha256_state *, const unsigned char *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   37 |                                 (sha256_block_fn *)sha256_block_data_order);
+      |                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+arch/arm/crypto/sha512-glue.c:34:3: error: cast from 'void (*)(u64 *, const u8 *, int)' (aka 'void (*)(unsigned long long *, const unsigned char *, int)') to 'sha512_block_fn *' (aka 'void (*)(struct sha512_state *, const unsigned char *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   34 |                 (sha512_block_fn *)sha512_block_data_order);
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix the prototypes for the assembler functions to match the typedef.
+The code already relies on the digest being the first part of the
+state structure, so there is no change in behavior.
+
+Fixes: c80ae7ca3726 ("crypto: arm/sha512 - accelerated SHA-512 using ARM generic ASM and NEON")
+Fixes: b59e2ae3690c ("crypto: arm/sha256 - move SHA-224/256 ASM/NEON implementation to base layer")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/crypto/sha256_glue.c | 13 +++++--------
+ arch/arm/crypto/sha512-glue.c | 12 +++++-------
+ 2 files changed, 10 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arm/crypto/sha256_glue.c b/arch/arm/crypto/sha256_glue.c
+index 433ee4ddce6c8..f85933fdec75f 100644
+--- a/arch/arm/crypto/sha256_glue.c
++++ b/arch/arm/crypto/sha256_glue.c
+@@ -24,8 +24,8 @@
+ 
+ #include "sha256_glue.h"
+ 
+-asmlinkage void sha256_block_data_order(u32 *digest, const void *data,
+-					unsigned int num_blks);
++asmlinkage void sha256_block_data_order(struct sha256_state *state,
++					const u8 *data, int num_blks);
+ 
+ int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data,
+ 			     unsigned int len)
+@@ -33,23 +33,20 @@ int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data,
+ 	/* make sure casting to sha256_block_fn() is safe */
+ 	BUILD_BUG_ON(offsetof(struct sha256_state, state) != 0);
+ 
+-	return sha256_base_do_update(desc, data, len,
+-				(sha256_block_fn *)sha256_block_data_order);
++	return sha256_base_do_update(desc, data, len, sha256_block_data_order);
+ }
+ EXPORT_SYMBOL(crypto_sha256_arm_update);
+ 
+ static int crypto_sha256_arm_final(struct shash_desc *desc, u8 *out)
+ {
+-	sha256_base_do_finalize(desc,
+-				(sha256_block_fn *)sha256_block_data_order);
++	sha256_base_do_finalize(desc, sha256_block_data_order);
+ 	return sha256_base_finish(desc, out);
+ }
+ 
+ int crypto_sha256_arm_finup(struct shash_desc *desc, const u8 *data,
+ 			    unsigned int len, u8 *out)
+ {
+-	sha256_base_do_update(desc, data, len,
+-			      (sha256_block_fn *)sha256_block_data_order);
++	sha256_base_do_update(desc, data, len, sha256_block_data_order);
+ 	return crypto_sha256_arm_final(desc, out);
+ }
+ EXPORT_SYMBOL(crypto_sha256_arm_finup);
+diff --git a/arch/arm/crypto/sha512-glue.c b/arch/arm/crypto/sha512-glue.c
+index 0635a65aa488b..1be5bd498af36 100644
+--- a/arch/arm/crypto/sha512-glue.c
++++ b/arch/arm/crypto/sha512-glue.c
+@@ -25,27 +25,25 @@ MODULE_ALIAS_CRYPTO("sha512");
+ MODULE_ALIAS_CRYPTO("sha384-arm");
+ MODULE_ALIAS_CRYPTO("sha512-arm");
+ 
+-asmlinkage void sha512_block_data_order(u64 *state, u8 const *src, int blocks);
++asmlinkage void sha512_block_data_order(struct sha512_state *state,
++					u8 const *src, int blocks);
+ 
+ int sha512_arm_update(struct shash_desc *desc, const u8 *data,
+ 		      unsigned int len)
+ {
+-	return sha512_base_do_update(desc, data, len,
+-		(sha512_block_fn *)sha512_block_data_order);
++	return sha512_base_do_update(desc, data, len, sha512_block_data_order);
+ }
+ 
+ static int sha512_arm_final(struct shash_desc *desc, u8 *out)
+ {
+-	sha512_base_do_finalize(desc,
+-		(sha512_block_fn *)sha512_block_data_order);
++	sha512_base_do_finalize(desc, sha512_block_data_order);
+ 	return sha512_base_finish(desc, out);
+ }
+ 
+ int sha512_arm_finup(struct shash_desc *desc, const u8 *data,
+ 		     unsigned int len, u8 *out)
+ {
+-	sha512_base_do_update(desc, data, len,
+-		(sha512_block_fn *)sha512_block_data_order);
++	sha512_base_do_update(desc, data, len, sha512_block_data_order);
+ 	return sha512_arm_final(desc, out);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/crypto-xilinx-call-finalize-with-bh-disabled.patch b/queue-5.15/crypto-xilinx-call-finalize-with-bh-disabled.patch
new file mode 100644
index 00000000000..600a1318942
--- /dev/null
+++ b/queue-5.15/crypto-xilinx-call-finalize-with-bh-disabled.patch
@@ -0,0 +1,72 @@
+From 394edd5ff6d6f0b5aa3da3476e6716110ecbeb44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 12:29:06 +0800
+Subject: crypto: xilinx - call finalize with bh disabled
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit a853450bf4c752e664abab0b2fad395b7ad7701c ]
+
+When calling crypto_finalize_request, BH should be disabled to avoid
+triggering the following calltrace:
+
+    ------------[ cut here ]------------
+    WARNING: CPU: 2 PID: 74 at crypto/crypto_engine.c:58 crypto_finalize_request+0xa0/0x118
+    Modules linked in: cryptodev(O)
+    CPU: 2 PID: 74 Comm: firmware:zynqmp Tainted: G           O       6.8.0-rc1-yocto-standard #323
+    Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
+    pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+    pc : crypto_finalize_request+0xa0/0x118
+    lr : crypto_finalize_request+0x104/0x118
+    sp : ffffffc085353ce0
+    x29: ffffffc085353ce0 x28: 0000000000000000 x27: ffffff8808ea8688
+    x26: ffffffc081715038 x25: 0000000000000000 x24: ffffff880100db00
+    x23: ffffff880100da80 x22: 0000000000000000 x21: 0000000000000000
+    x20: ffffff8805b14000 x19: ffffff880100da80 x18: 0000000000010450
+    x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
+    x14: 0000000000000003 x13: 0000000000000000 x12: ffffff880100dad0
+    x11: 0000000000000000 x10: ffffffc0832dcd08 x9 : ffffffc0812416d8
+    x8 : 00000000000001f4 x7 : ffffffc0830d2830 x6 : 0000000000000001
+    x5 : ffffffc082091000 x4 : ffffffc082091658 x3 : 0000000000000000
+    x2 : ffffffc7f9653000 x1 : 0000000000000000 x0 : ffffff8802d20000
+    Call trace:
+     crypto_finalize_request+0xa0/0x118
+     crypto_finalize_aead_request+0x18/0x30
+     zynqmp_handle_aes_req+0xcc/0x388
+     crypto_pump_work+0x168/0x2d8
+     kthread_worker_fn+0xfc/0x3a0
+     kthread+0x118/0x138
+     ret_from_fork+0x10/0x20
+    irq event stamp: 40
+    hardirqs last  enabled at (39): [<ffffffc0812416f8>] _raw_spin_unlock_irqrestore+0x70/0xb0
+    hardirqs last disabled at (40): [<ffffffc08122d208>] el1_dbg+0x28/0x90
+    softirqs last  enabled at (36): [<ffffffc080017dec>] kernel_neon_begin+0x8c/0xf0
+    softirqs last disabled at (34): [<ffffffc080017dc0>] kernel_neon_begin+0x60/0xf0
+    ---[ end trace 0000000000000000 ]---
+
+Fixes: 4d96f7d48131 ("crypto: xilinx - Add Xilinx AES driver")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/xilinx/zynqmp-aes-gcm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/xilinx/zynqmp-aes-gcm.c b/drivers/crypto/xilinx/zynqmp-aes-gcm.c
+index bf1f421e05f25..74bd3eb63734d 100644
+--- a/drivers/crypto/xilinx/zynqmp-aes-gcm.c
++++ b/drivers/crypto/xilinx/zynqmp-aes-gcm.c
+@@ -231,7 +231,10 @@ static int zynqmp_handle_aes_req(struct crypto_engine *engine,
+ 		err = zynqmp_aes_aead_cipher(areq);
+ 	}
+ 
++	local_bh_disable();
+ 	crypto_finalize_aead_request(engine, areq, err);
++	local_bh_enable();
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/dm-call-the-resume-method-on-internal-suspend.patch b/queue-5.15/dm-call-the-resume-method-on-internal-suspend.patch
new file mode 100644
index 00000000000..5d3e94a1740
--- /dev/null
+++ b/queue-5.15/dm-call-the-resume-method-on-internal-suspend.patch
@@ -0,0 +1,123 @@
+From 9624472a2a7a86f5071e1b50ebd96e317de1fa93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 15:06:39 +0100
+Subject: dm: call the resume method on internal suspend
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 65e8fbde64520001abf1c8d0e573561b4746ef38 ]
+
+There is this reported crash when experimenting with the lvm2 testsuite.
+The list corruption is caused by the fact that the postsuspend and resume
+methods were not paired correctly; there were two consecutive calls to the
+origin_postsuspend function. The second call attempts to remove the
+"hash_list" entry from a list, while it was already removed by the first
+call.
+
+Fix __dm_internal_resume so that it calls the preresume and resume
+methods of the table's targets.
+
+If a preresume method of some target fails, we are in a tricky situation.
+We can't return an error because dm_internal_resume isn't supposed to
+return errors. We can't return success, because then the "resume" and
+"postsuspend" methods would not be paired correctly. So, we set the
+DMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace
+tools, but it won't cause a kernel crash.
+
+------------[ cut here ]------------
+kernel BUG at lib/list_debug.c:56!
+invalid opcode: 0000 [#1] PREEMPT SMP
+CPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
+RIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0
+<snip>
+RSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282
+RAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000
+RDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff
+RBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058
+R10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001
+R13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0
+FS:  00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000
+CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
+CR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0
+Call Trace:
+ <TASK>
+ ? die+0x2d/0x80
+ ? do_trap+0xeb/0xf0
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ ? do_error_trap+0x60/0x80
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ ? exc_invalid_op+0x49/0x60
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ ? asm_exc_invalid_op+0x16/0x20
+ ? table_deps+0x1b0/0x1b0 [dm_mod]
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ origin_postsuspend+0x1a/0x50 [dm_snapshot]
+ dm_table_postsuspend_targets+0x34/0x50 [dm_mod]
+ dm_suspend+0xd8/0xf0 [dm_mod]
+ dev_suspend+0x1f2/0x2f0 [dm_mod]
+ ? table_deps+0x1b0/0x1b0 [dm_mod]
+ ctl_ioctl+0x300/0x5f0 [dm_mod]
+ dm_compat_ctl_ioctl+0x7/0x10 [dm_mod]
+ __x64_compat_sys_ioctl+0x104/0x170
+ do_syscall_64+0x184/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x46/0x4e
+RIP: 0033:0xf7e6aead
+<snip>
+---[ end trace 0000000000000000 ]---
+
+Fixes: ffcc39364160 ("dm: enhance internal suspend and resume interface")
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index d6285a23dc3ed..fd9bb8b53219a 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2641,6 +2641,9 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned suspend_fla
+ 
+ static void __dm_internal_resume(struct mapped_device *md)
+ {
++	int r;
++	struct dm_table *map;
++
+ 	BUG_ON(!md->internal_suspend_count);
+ 
+ 	if (--md->internal_suspend_count)
+@@ -2649,12 +2652,23 @@ static void __dm_internal_resume(struct mapped_device *md)
+ 	if (dm_suspended_md(md))
+ 		goto done; /* resume from nested suspend */
+ 
+-	/*
+-	 * NOTE: existing callers don't need to call dm_table_resume_targets
+-	 * (which may fail -- so best to avoid it for now by passing NULL map)
+-	 */
+-	(void) __dm_resume(md, NULL);
+-
++	map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock));
++	r = __dm_resume(md, map);
++	if (r) {
++		/*
++		 * If a preresume method of some target failed, we are in a
++		 * tricky situation. We can't return an error to the caller. We
++		 * can't fake success because then the "resume" and
++		 * "postsuspend" methods would not be paired correctly, and it
++		 * would break various targets, for example it would cause list
++		 * corruption in the "origin" target.
++		 *
++		 * So, we fake normal suspend here, to make sure that the
++		 * "resume" and "postsuspend" methods will be paired correctly.
++		 */
++		DMERR("Preresume method failed: %d", r);
++		set_bit(DMF_SUSPENDED, &md->flags);
++	}
+ done:
+ 	clear_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
+ 	smp_mb__after_atomic();
+-- 
+2.43.0
+
diff --git a/queue-5.15/dm-raid-fix-false-positive-for-requeue-needed-during.patch b/queue-5.15/dm-raid-fix-false-positive-for-requeue-needed-during.patch
new file mode 100644
index 00000000000..c54e52fb1db
--- /dev/null
+++ b/queue-5.15/dm-raid-fix-false-positive-for-requeue-needed-during.patch
@@ -0,0 +1,46 @@
+From c95f5ce2313f166d6711075b8e1c8d19e32f7d9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 13:42:55 -0400
+Subject: dm raid: fix false positive for requeue needed during reshape
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit b25b8f4b8ecef0f48c05f0c3572daeabefe16526 ]
+
+An empty flush doesn't have a payload, so it should never be looked at
+when considering to possibly requeue a bio for the case when a reshape
+is in progress.
+
+Fixes: 9dbd1aa3a81c ("dm raid: add reshaping support to the target")
+Reported-by: Patrick Plenefisch <simonpatp@gmail.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-raid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 8d489933d5792..04769fb20cf7f 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3329,14 +3329,14 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
+ 	struct mddev *mddev = &rs->md;
+ 
+ 	/*
+-	 * If we're reshaping to add disk(s)), ti->len and
++	 * If we're reshaping to add disk(s), ti->len and
+ 	 * mddev->array_sectors will differ during the process
+ 	 * (ti->len > mddev->array_sectors), so we have to requeue
+ 	 * bios with addresses > mddev->array_sectors here or
+ 	 * there will occur accesses past EOD of the component
+ 	 * data images thus erroring the raid set.
+ 	 */
+-	if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
++	if (unlikely(bio_has_data(bio) && bio_end_sector(bio) > mddev->array_sectors))
+ 		return DM_MAPIO_REQUEUE;
+ 
+ 	md_handle_request(mddev, bio);
+-- 
+2.43.0
+
diff --git a/queue-5.15/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch b/queue-5.15/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
new file mode 100644
index 00000000000..82e0ae410df
--- /dev/null
+++ b/queue-5.15/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
@@ -0,0 +1,60 @@
+From b601aa20c7b5f40db47b96ae08021078909bef2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 09:32:56 +0000
+Subject: dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 33b7db45533af240fe44e809f9dc4d604cf82d07 ]
+
+Update the architecture dependency to be the generic Tegra
+because the driver works on the four latest Tegra generations
+not just T210, if you build a kernel with a specific
+ARCH_TEGRA_xxx_SOC option that excludes 210 you don't get
+this driver.
+
+Fixes: 433de642a76c9 ("dmaengine: tegra210-adma: add support for Tegra186/Tegra194")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Thierry Reding <treding@nvidia.com>
+Cc: Sameer Pujar <spujar@nvidia.com>
+Cc: Laxman Dewangan <ldewangan@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20240112093310.329642-2-pbrobinson@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/Kconfig | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index e1beddcc8c84a..143fb0f8c07fa 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -645,16 +645,16 @@ config TEGRA20_APB_DMA
+ 
+ config TEGRA210_ADMA
+ 	tristate "NVIDIA Tegra210 ADMA support"
+-	depends on (ARCH_TEGRA_210_SOC || COMPILE_TEST)
++	depends on (ARCH_TEGRA || COMPILE_TEST)
+ 	select DMA_ENGINE
+ 	select DMA_VIRTUAL_CHANNELS
+ 	help
+-	  Support for the NVIDIA Tegra210 ADMA controller driver. The
+-	  DMA controller has multiple DMA channels and is used to service
+-	  various audio clients in the Tegra210 audio processing engine
+-	  (APE). This DMA controller transfers data from memory to
+-	  peripheral and vice versa. It does not support memory to
+-	  memory data transfer.
++	  Support for the NVIDIA Tegra210/Tegra186/Tegra194/Tegra234 ADMA
++	  controller driver. The DMA controller has multiple DMA channels
++	  and is used to service various audio clients in the Tegra210
++	  audio processing engine (APE). This DMA controller transfers
++	  data from memory to peripheral and vice versa. It does not
++	  support memory to memory data transfer.
+ 
+ config TIMB_DMA
+ 	tristate "Timberdale FPGA DMA support"
+-- 
+2.43.0
+
diff --git a/queue-5.15/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch b/queue-5.15/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
new file mode 100644
index 00000000000..5d24de8dc9d
--- /dev/null
+++ b/queue-5.15/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
@@ -0,0 +1,72 @@
+From 3958653355f6dcb508a02756b2b9bd2d28cbba05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 07:39:06 -0800
+Subject: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 3948abaa4e2be938ccdfc289385a27342fb13d43 ]
+
+syzbot identified a kernel information leak vulnerability in
+do_sys_name_to_handle() and issued the following report [1].
+
+[1]
+"BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
+BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40
+ instrument_copy_to_user include/linux/instrumented.h:114 [inline]
+ _copy_to_user+0xbc/0x100 lib/usercopy.c:40
+ copy_to_user include/linux/uaccess.h:191 [inline]
+ do_sys_name_to_handle fs/fhandle.c:73 [inline]
+ __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]
+ __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94
+ __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94
+ ...
+
+Uninit was created at:
+ slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
+ slab_alloc_node mm/slub.c:3478 [inline]
+ __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517
+ __do_kmalloc_node mm/slab_common.c:1006 [inline]
+ __kmalloc+0x121/0x3c0 mm/slab_common.c:1020
+ kmalloc include/linux/slab.h:604 [inline]
+ do_sys_name_to_handle fs/fhandle.c:39 [inline]
+ __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]
+ __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94
+ __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94
+ ...
+
+Bytes 18-19 of 20 are uninitialized
+Memory access of size 20 starts at ffff888128a46380
+Data copied to user address 0000000020000240"
+
+Per Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to
+solve the problem.
+
+Fixes: 990d6c2d7aee ("vfs: Add name to file handle conversion support")
+Suggested-by: Chuck Lever III <chuck.lever@oracle.com>
+Reported-and-tested-by: <syzbot+09b349b3066c2e0b1e96@syzkaller.appspotmail.com>
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20240119153906.4367-1-n.zhandarovich@fintech.ru
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fhandle.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index 6630c69c23a2a..55e5ffacc0e40 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -37,7 +37,7 @@ static long do_sys_name_to_handle(struct path *path,
+ 	if (f_handle.handle_bytes > MAX_HANDLE_SZ)
+ 		return -EINVAL;
+ 
+-	handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
++	handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
+ 			 GFP_KERNEL);
+ 	if (!handle)
+ 		return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch b/queue-5.15/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
new file mode 100644
index 00000000000..abe5efcd311
--- /dev/null
+++ b/queue-5.15/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
@@ -0,0 +1,46 @@
+From 880ffec73eddc65c0f32e7f86bc4745d3cccb965 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 20:18:07 +0530
+Subject: drm/amd/display: Fix a potential buffer overflow in
+ 'dp_dsc_clock_en_read()'
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 4b09715f1504f1b6e8dff0e9643630610bc05141 ]
+
+Tell snprintf() to store at most 10 bytes in the output buffer
+instead of 30.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1508 dp_dsc_clock_en_read() error: snprintf() is printing too much 30 vs 10
+
+Fixes: c06e09b76639 ("drm/amd/display: Add DSC parameters logging to debugfs")
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+index 6d694cea24201..ed2f6802b0e20 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -1304,7 +1304,7 @@ static ssize_t dp_dsc_clock_en_read(struct file *f, char __user *buf,
+ 	const uint32_t rd_buf_size = 10;
+ 	struct pipe_ctx *pipe_ctx;
+ 	ssize_t result = 0;
+-	int i, r, str_len = 30;
++	int i, r, str_len = 10;
+ 
+ 	rd_buf = kcalloc(rd_buf_size, sizeof(char), GFP_KERNEL);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-amd-display-fix-potential-null-pointer-dereferen.patch b/queue-5.15/drm-amd-display-fix-potential-null-pointer-dereferen.patch
new file mode 100644
index 00000000000..b14db87477b
--- /dev/null
+++ b/queue-5.15/drm-amd-display-fix-potential-null-pointer-dereferen.patch
@@ -0,0 +1,57 @@
+From 7e6d08a822fb9374f101bf841ca820010afe03ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 21:16:04 +0530
+Subject: drm/amd/display: Fix potential NULL pointer dereferences in
+ 'dcn10_set_output_transfer_func()'
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 9ccfe80d022df7c595f1925afb31de2232900656 ]
+
+The 'stream' pointer is used in dcn10_set_output_transfer_func() before
+the check if 'stream' is NULL.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875)
+
+Fixes: ddef02de0d71 ("drm/amd/display: add null checks before logging")
+Cc: Wyatt Wood <wyatt.wood@amd.com>
+Cc: Anthony Koo <Anthony.Koo@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+index aa5a1fa68da05..bc603c8af3b66 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+@@ -1745,6 +1745,9 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,
+ {
+ 	struct dpp *dpp = pipe_ctx->plane_res.dpp;
+ 
++	if (!stream)
++		return false;
++
+ 	if (dpp == NULL)
+ 		return false;
+ 
+@@ -1767,8 +1770,8 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,
+ 	} else
+ 		dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, OPP_REGAMMA_BYPASS);
+ 
+-	if (stream != NULL && stream->ctx != NULL &&
+-			stream->out_transfer_func != NULL) {
++	if (stream->ctx &&
++	    stream->out_transfer_func) {
+ 		log_tf(stream->ctx,
+ 				stream->out_transfer_func,
+ 				dpp->regamma_params.hw_points_num);
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch b/queue-5.15/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
new file mode 100644
index 00000000000..01a6d46b0d7
--- /dev/null
+++ b/queue-5.15/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
@@ -0,0 +1,48 @@
+From bed66d7c0b846dbb3d9fa5e724c85725ee771900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 07:48:52 +0530
+Subject: drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of
+ atom_get_src_int()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 7cf1ad2fe10634238b38442a851d89514cb14ea2 ]
+
+Missing break statement in the ATOM_ARG_IMM case of a switch statement,
+adds the missing break statement, ensuring that the program's control
+flow is as intended.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/atom.c:323 atom_get_src_int() warn: ignoring unreachable code.
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Cc: Jammy Zhou <Jammy.Zhou@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/atom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
+index 6fa2229b72292..c279718d22fba 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atom.c
++++ b/drivers/gpu/drm/amd/amdgpu/atom.c
+@@ -311,7 +311,7 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
+ 				DEBUG("IMM 0x%02X\n", val);
+ 			return val;
+ 		}
+-		return 0;
++		break;
+ 	case ATOM_ARG_PLL:
+ 		idx = U8(*ptr);
+ 		(*ptr)++;
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch b/queue-5.15/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
new file mode 100644
index 00000000000..ade5b00601d
--- /dev/null
+++ b/queue-5.15/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
@@ -0,0 +1,41 @@
+From b672fbcbc532c7f740c1eb5b929df4b8f82a19b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 11:36:20 -0500
+Subject: drm: Don't treat 0 as -1 in drm_fixp2int_ceil
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit cf8837d7204481026335461629b84ac7f4538fa5 ]
+
+Unit testing this in VKMS shows that passing 0 into
+this function returns -1, which is highly counter-
+intuitive. Fix it by checking whether the input is
+>= 0 instead of > 0.
+
+Fixes: 64566b5e767f ("drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil")
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Simon Ser <contact@emersion.fr>
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231108163647.106853-2-harry.wentland@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_fixed.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
+index 553210c02ee0f..627efa56e59fb 100644
+--- a/include/drm/drm_fixed.h
++++ b/include/drm/drm_fixed.h
+@@ -88,7 +88,7 @@ static inline int drm_fixp2int(s64 a)
+ 
+ static inline int drm_fixp2int_ceil(s64 a)
+ {
+-	if (a > 0)
++	if (a >= 0)
+ 		return drm_fixp2int(a + DRM_FIXED_ALMOST_ONE);
+ 	else
+ 		return drm_fixp2int(a - DRM_FIXED_ALMOST_ONE);
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch b/queue-5.15/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
new file mode 100644
index 00000000000..8a65eaaf22e
--- /dev/null
+++ b/queue-5.15/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
@@ -0,0 +1,72 @@
+From dc4e63a3b7a80830910fe342ffa0fccfa6f21502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 15:13:28 +0800
+Subject: drm/lima: fix a memleak in lima_heap_alloc
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 04ae3eb470e52a3c41babe85ff8cee195e4dcbea ]
+
+When lima_vm_map_bo fails, the resources need to be deallocated, or
+there will be memleaks.
+
+Fixes: 6aebc51d7aef ("drm/lima: support heap buffer creation")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Qiang Yu <yuq825@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240117071328.3811480-1-alexious@zju.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/lima/lima_gem.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/lima/lima_gem.c b/drivers/gpu/drm/lima/lima_gem.c
+index 09ea621a4806c..65c4327b6d10c 100644
+--- a/drivers/gpu/drm/lima/lima_gem.c
++++ b/drivers/gpu/drm/lima/lima_gem.c
+@@ -74,29 +74,34 @@ int lima_heap_alloc(struct lima_bo *bo, struct lima_vm *vm)
+ 	} else {
+ 		bo->base.sgt = kmalloc(sizeof(*bo->base.sgt), GFP_KERNEL);
+ 		if (!bo->base.sgt) {
+-			sg_free_table(&sgt);
+-			return -ENOMEM;
++			ret = -ENOMEM;
++			goto err_out0;
+ 		}
+ 	}
+ 
+ 	ret = dma_map_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
+-	if (ret) {
+-		sg_free_table(&sgt);
+-		kfree(bo->base.sgt);
+-		bo->base.sgt = NULL;
+-		return ret;
+-	}
++	if (ret)
++		goto err_out1;
+ 
+ 	*bo->base.sgt = sgt;
+ 
+ 	if (vm) {
+ 		ret = lima_vm_map_bo(vm, bo, old_size >> PAGE_SHIFT);
+ 		if (ret)
+-			return ret;
++			goto err_out2;
+ 	}
+ 
+ 	bo->heap_size = new_size;
+ 	return 0;
++
++err_out2:
++	dma_unmap_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
++err_out1:
++	kfree(bo->base.sgt);
++	bo->base.sgt = NULL;
++err_out0:
++	sg_free_table(&sgt);
++	return ret;
+ }
+ 
+ int lima_gem_create_handle(struct drm_device *dev, struct drm_file *file,
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch b/queue-5.15/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
new file mode 100644
index 00000000000..a1887979631
--- /dev/null
+++ b/queue-5.15/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
@@ -0,0 +1,78 @@
+From 9c878675760ca7038c004c1a74130e41c8f902f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 09:53:09 +0100
+Subject: drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit fae6f815505301b92d9113764f4d76d0bfe45607 ]
+
+The register bits definitions for RGB666 formats are wrong in multiple
+ways: first, in the DSI_PS_SEL bits region, the Packed 18-bits RGB666
+format is selected with bit 1, while the Loosely Packed one is bit 2,
+and second - the definition name "LOOSELY_PS_18BIT_RGB666" is wrong
+because the loosely packed format is 24 bits instead!
+
+Either way, functions mtk_dsi_ps_control_vact() and mtk_dsi_ps_control()
+do not even agree on the DSI_PS_SEL bit to set in DSI_PSCTRL: one sets
+loosely packed (24) on RGB666, the other sets packed (18), and the other
+way around for RGB666_PACKED.
+
+Fixing this entire stack of issues is done in one go:
+ - Use the correct bit for the Loosely Packed RGB666 definition
+ - Rename LOOSELY_PS_18BIT_RGB666 to LOOSELY_PS_24BIT_RGB666
+ - Change ps_bpp_mode in mtk_dsi_ps_control_vact() to set:
+    - Loosely Packed, 24-bits for MIPI_DSI_FMT_RGB666
+    - Packed, 18-bits for MIPI_DSI_FMT_RGB666_PACKED
+
+Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver")
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240215085316.56835-3-angelogioacchino.delregno@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dsi.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index 57eaf111b6a8a..3b55a83b7cdff 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -70,8 +70,8 @@
+ #define DSI_PS_WC			0x3fff
+ #define DSI_PS_SEL			(3 << 16)
+ #define PACKED_PS_16BIT_RGB565		(0 << 16)
+-#define LOOSELY_PS_18BIT_RGB666		(1 << 16)
+-#define PACKED_PS_18BIT_RGB666		(2 << 16)
++#define PACKED_PS_18BIT_RGB666		(1 << 16)
++#define LOOSELY_PS_24BIT_RGB666		(2 << 16)
+ #define PACKED_PS_24BIT_RGB888		(3 << 16)
+ 
+ #define DSI_VSA_NL		0x20
+@@ -366,10 +366,10 @@ static void mtk_dsi_ps_control_vact(struct mtk_dsi *dsi)
+ 		ps_bpp_mode |= PACKED_PS_24BIT_RGB888;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666:
+-		ps_bpp_mode |= PACKED_PS_18BIT_RGB666;
++		ps_bpp_mode |= LOOSELY_PS_24BIT_RGB666;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666_PACKED:
+-		ps_bpp_mode |= LOOSELY_PS_18BIT_RGB666;
++		ps_bpp_mode |= PACKED_PS_18BIT_RGB666;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB565:
+ 		ps_bpp_mode |= PACKED_PS_16BIT_RGB565;
+@@ -423,7 +423,7 @@ static void mtk_dsi_ps_control(struct mtk_dsi *dsi)
+ 		dsi_tmp_buf_bpp = 3;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666:
+-		tmp_reg = LOOSELY_PS_18BIT_RGB666;
++		tmp_reg = LOOSELY_PS_24BIT_RGB666;
+ 		dsi_tmp_buf_bpp = 3;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666_PACKED:
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch b/queue-5.15/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
new file mode 100644
index 00000000000..ea0e5a800b6
--- /dev/null
+++ b/queue-5.15/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
@@ -0,0 +1,81 @@
+From 20d325748cda37223314ebcfaba81b7ae034d972 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 13:23:29 -0800
+Subject: drm/mediatek: Fix a null pointer crash in
+ mtk_drm_crtc_finish_page_flip
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit c958e86e9cc1b48cac004a6e245154dfba8e163b ]
+
+It's possible that mtk_crtc->event is NULL in
+mtk_drm_crtc_finish_page_flip().
+
+pending_needs_vblank value is set by mtk_crtc->event, but in
+mtk_drm_crtc_atomic_flush(), it's is not guarded by the same
+lock in mtk_drm_finish_page_flip(), thus a race condition happens.
+
+Consider the following case:
+
+CPU1                              CPU2
+step 1:
+mtk_drm_crtc_atomic_begin()
+mtk_crtc->event is not null,
+                                  step 1:
+                                  mtk_drm_crtc_atomic_flush:
+                                  mtk_drm_crtc_update_config(
+                                      !!mtk_crtc->event)
+step 2:
+mtk_crtc_ddp_irq ->
+mtk_drm_finish_page_flip:
+lock
+mtk_crtc->event set to null,
+pending_needs_vblank set to false
+unlock
+                                  pending_needs_vblank set to true,
+
+                                  step 2:
+                                  mtk_crtc_ddp_irq ->
+                                  mtk_drm_finish_page_flip called again,
+                                  pending_needs_vblank is still true
+                                  //null pointer
+
+Instead of guarding the entire mtk_drm_crtc_atomic_flush(), it's more
+efficient to just check if mtk_crtc->event is null before use.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240223212404.3709690-1-hsinyi@chromium.org/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index d6781e54b3356..1a038fa004668 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -92,11 +92,13 @@ static void mtk_drm_crtc_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
+ 	struct drm_crtc *crtc = &mtk_crtc->base;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&crtc->dev->event_lock, flags);
+-	drm_crtc_send_vblank_event(crtc, mtk_crtc->event);
+-	drm_crtc_vblank_put(crtc);
+-	mtk_crtc->event = NULL;
+-	spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
++	if (mtk_crtc->event) {
++		spin_lock_irqsave(&crtc->dev->event_lock, flags);
++		drm_crtc_send_vblank_event(crtc, mtk_crtc->event);
++		drm_crtc_vblank_put(crtc);
++		mtk_crtc->event = NULL;
++		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
++	}
+ }
+ 
+ static void mtk_drm_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch b/queue-5.15/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
new file mode 100644
index 00000000000..056dd72b41c
--- /dev/null
+++ b/queue-5.15/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
@@ -0,0 +1,49 @@
+From 191cfd2b079d4b161b93ccd65ab79ef154ca90b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 11:39:47 -0800
+Subject: drm/msm/dpu: add division of drm_display_mode's hskew parameter
+
+From: Paloma Arellano <quic_parellan@quicinc.com>
+
+[ Upstream commit 551ee0f210991d25f336bc27262353bfe99d3eed ]
+
+Setting up the timing engine when the physical encoder has a split role
+neglects dividing the drm_display_mode's hskew parameter. Let's fix this
+since this must also be done in preparation for implementing YUV420 over
+DP.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Paloma Arellano <quic_parellan@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/579605/
+Link: https://lore.kernel.org/r/20240222194025.25329-3-quic_parellan@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+index 185379b185725..7c58e9ba71b77 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+@@ -267,12 +267,14 @@ static void dpu_encoder_phys_vid_setup_timing_engine(
+ 		mode.htotal >>= 1;
+ 		mode.hsync_start >>= 1;
+ 		mode.hsync_end >>= 1;
++		mode.hskew >>= 1;
+ 
+ 		DPU_DEBUG_VIDENC(phys_enc,
+-			"split_role %d, halve horizontal %d %d %d %d\n",
++			"split_role %d, halve horizontal %d %d %d %d %d\n",
+ 			phys_enc->split_role,
+ 			mode.hdisplay, mode.htotal,
+-			mode.hsync_start, mode.hsync_end);
++			mode.hsync_start, mode.hsync_end,
++			mode.hskew);
+ 	}
+ 
+ 	drm_mode_to_intf_timing_params(phys_enc, &mode, &timing_params);
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch b/queue-5.15/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
new file mode 100644
index 00000000000..ade92c2c95f
--- /dev/null
+++ b/queue-5.15/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
@@ -0,0 +1,39 @@
+From bdd4414520628a928eac34d0942e40e05770173c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:48:14 -0800
+Subject: drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit c4891d979c7668b195a0a75787967ec95a24ecef ]
+
+Clean up a typo in pr_err() erroneously printing NI MC 'rdev->mc_fw->size'
+during SMC firmware load. Log 'rdev->smc_fw->size' instead.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 6596afd48af4 ("drm/radeon/kms: add dpm support for btc (v3)")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/ni.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 4a364ca7a1be7..b041b6bfaeca6 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -813,7 +813,7 @@ int ni_init_microcode(struct radeon_device *rdev)
+ 			err = 0;
+ 		} else if (rdev->smc_fw->size != smc_req_size) {
+ 			pr_err("ni_mc: Bogus length %zu in firmware \"%s\"\n",
+-			       rdev->mc_fw->size, fw_name);
++			       rdev->smc_fw->size, fw_name);
+ 			err = -EINVAL;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-rockchip-inno_hdmi-fix-video-timing.patch b/queue-5.15/drm-rockchip-inno_hdmi-fix-video-timing.patch
new file mode 100644
index 00000000000..eb3393035af
--- /dev/null
+++ b/queue-5.15/drm-rockchip-inno_hdmi-fix-video-timing.patch
@@ -0,0 +1,51 @@
+From 2e20e836e08a5e6e0a6b9a836a80a763ad544065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Dec 2023 18:41:54 +0100
+Subject: drm/rockchip: inno_hdmi: Fix video timing
+
+From: Alex Bee <knaerzche@gmail.com>
+
+[ Upstream commit 47a145c03484d33e65d773169d5ca1b9fe2a492e ]
+
+The controller wants the difference between *total and *sync_start in the
+HDMI_VIDEO_EXT_*DELAY registers. Otherwise the signal is very unstable for
+certain non-VIC modes. See downstream commit [0].
+
+[0] https://github.com/rockchip-linux/kernel/commit/8eb559f2502c
+
+Fixes: 412d4ae6b7a5 ("drm/rockchip: hdmi: add Innosilicon HDMI support")
+Co-developed-by: Zheng Yang <zhengyang@rock-chips.com>
+Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
+Signed-off-by: Alex Bee <knaerzche@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231222174220.55249-4-knaerzche@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/inno_hdmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/inno_hdmi.c b/drivers/gpu/drm/rockchip/inno_hdmi.c
+index 78120da5e63aa..27540d308ccb9 100644
+--- a/drivers/gpu/drm/rockchip/inno_hdmi.c
++++ b/drivers/gpu/drm/rockchip/inno_hdmi.c
+@@ -402,7 +402,7 @@ static int inno_hdmi_config_video_timing(struct inno_hdmi *hdmi,
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HBLANK_L, value & 0xFF);
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HBLANK_H, (value >> 8) & 0xFF);
+ 
+-	value = mode->hsync_start - mode->hdisplay;
++	value = mode->htotal - mode->hsync_start;
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HDELAY_L, value & 0xFF);
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HDELAY_H, (value >> 8) & 0xFF);
+ 
+@@ -417,7 +417,7 @@ static int inno_hdmi_config_video_timing(struct inno_hdmi *hdmi,
+ 	value = mode->vtotal - mode->vdisplay;
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_VBLANK, value & 0xFF);
+ 
+-	value = mode->vsync_start - mode->vdisplay;
++	value = mode->vtotal - mode->vsync_start;
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_VDELAY, value & 0xFF);
+ 
+ 	value = mode->vsync_end - mode->vsync_start;
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-rockchip-lvds-do-not-overwrite-error-code.patch b/queue-5.15/drm-rockchip-lvds-do-not-overwrite-error-code.patch
new file mode 100644
index 00000000000..ea33a6fd14d
--- /dev/null
+++ b/queue-5.15/drm-rockchip-lvds-do-not-overwrite-error-code.patch
@@ -0,0 +1,38 @@
+From 72ae749140ad563315f5878f92af7abba9644add Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:29:48 +0100
+Subject: drm/rockchip: lvds: do not overwrite error code
+
+From: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+
+[ Upstream commit 79b09453c4e369ca81cfb670d0136d089e3b92f0 ]
+
+ret variable stores the return value of drm_of_find_panel_or_bridge
+which can return error codes different from EPROBE_DEFER. Therefore,
+let's just return that error code instead of forcing it to EPROBE_DEFER.
+
+Fixes: 34cc0aa25456 ("drm/rockchip: Add support for Rockchip Soc LVDS")
+Cc: Quentin Schulz <foss+kernel@0leil.net>
+Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231120-rk-lvds-defer-msg-v2-1-9c59a5779cf9@theobroma-systems.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_lvds.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+index 2550429df49fe..4cae30979a790 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c
++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+@@ -573,7 +573,6 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master,
+ 		goto err_put_port;
+ 	} else if (ret) {
+ 		DRM_DEV_ERROR(dev, "failed to find panel and bridge node\n");
+-		ret = -EPROBE_DEFER;
+ 		goto err_put_port;
+ 	}
+ 	if (lvds->panel)
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch b/queue-5.15/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
new file mode 100644
index 00000000000..b0d2ed03b3d
--- /dev/null
+++ b/queue-5.15/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
@@ -0,0 +1,41 @@
+From 042bb636af2e4edbd458406d6101e235196126a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:29:49 +0100
+Subject: drm/rockchip: lvds: do not print scary message when probing defer
+
+From: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+
+[ Upstream commit 52d11c863ac92e36a0365249f7f6d27ac48c78bc ]
+
+This scary message can misled the user into thinking something bad has
+happened and needs to be fixed, however it could simply be part of a
+normal boot process where EPROBE_DEFER is taken into account. Therefore,
+let's use dev_err_probe so that this message doesn't get shown (by
+default) when the return code is EPROBE_DEFER.
+
+Fixes: 34cc0aa25456 ("drm/rockchip: Add support for Rockchip Soc LVDS")
+Cc: Quentin Schulz <foss+kernel@0leil.net>
+Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231120-rk-lvds-defer-msg-v2-2-9c59a5779cf9@theobroma-systems.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_lvds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+index 4cae30979a790..d3a7f8d94b781 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c
++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+@@ -572,7 +572,7 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master,
+ 		ret = -EINVAL;
+ 		goto err_put_port;
+ 	} else if (ret) {
+-		DRM_DEV_ERROR(dev, "failed to find panel and bridge node\n");
++		dev_err_probe(dev, ret, "failed to find panel and bridge node\n");
+ 		goto err_put_port;
+ 	}
+ 	if (lvds->panel)
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-dc-rgb-allow-changing-plld-rate-on-tegra30.patch b/queue-5.15/drm-tegra-dc-rgb-allow-changing-plld-rate-on-tegra30.patch
new file mode 100644
index 00000000000..23e8800625c
--- /dev/null
+++ b/queue-5.15/drm-tegra-dc-rgb-allow-changing-plld-rate-on-tegra30.patch
@@ -0,0 +1,244 @@
+From 1628a4d95f9616f303acfab73dadf84d03c78529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Sep 2021 01:28:05 +0300
+Subject: drm/tegra: dc: rgb: Allow changing PLLD rate on Tegra30+
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 0c921b6d4ba06bc899fd84d3ce1c1afd3d00bc1c ]
+
+Asus Transformer TF700T is a Tegra30 tablet device which uses RGB->DSI
+bridge that requires a precise clock rate in order to operate properly.
+Tegra30 has a dedicated PLL for each display controller, hence the PLL
+rate can be changed freely. Allow PLL rate changes on Tegra30+ for RGB
+output. Configure the clock rate before display controller is enabled
+since DC itself may be running off this PLL and it's not okay to change
+the rate of the active PLL that doesn't support dynamic frequency
+switching since hardware will hang.
+
+Tested-by: Maxim Schwalm <maxim.schwalm@gmail.com> #TF700T
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Stable-dep-of: bc456b5d93db ("drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dc.c  | 27 ++++++++++++--------
+ drivers/gpu/drm/tegra/dc.h  |  1 +
+ drivers/gpu/drm/tegra/rgb.c | 49 +++++++++++++++++++++++++++++++++++--
+ 3 files changed, 65 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
+index abb409b08bc64..f44a64e896587 100644
+--- a/drivers/gpu/drm/tegra/dc.c
++++ b/drivers/gpu/drm/tegra/dc.c
+@@ -1762,10 +1762,9 @@ int tegra_dc_state_setup_clock(struct tegra_dc *dc,
+ 	return 0;
+ }
+ 
+-static void tegra_dc_commit_state(struct tegra_dc *dc,
+-				  struct tegra_dc_state *state)
++static void tegra_dc_set_clock_rate(struct tegra_dc *dc,
++				    struct tegra_dc_state *state)
+ {
+-	u32 value;
+ 	int err;
+ 
+ 	err = clk_set_parent(dc->clk, state->clk);
+@@ -1796,11 +1795,6 @@ static void tegra_dc_commit_state(struct tegra_dc *dc,
+ 	DRM_DEBUG_KMS("rate: %lu, div: %u\n", clk_get_rate(dc->clk),
+ 		      state->div);
+ 	DRM_DEBUG_KMS("pclk: %lu\n", state->pclk);
+-
+-	if (!dc->soc->has_nvdisplay) {
+-		value = SHIFT_CLK_DIVIDER(state->div) | PIXEL_CLK_DIVIDER_PCD1;
+-		tegra_dc_writel(dc, value, DC_DISP_DISP_CLOCK_CONTROL);
+-	}
+ }
+ 
+ static void tegra_dc_stop(struct tegra_dc *dc)
+@@ -2002,6 +1996,9 @@ static void tegra_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	u32 value;
+ 	int err;
+ 
++	/* apply PLL changes */
++	tegra_dc_set_clock_rate(dc, crtc_state);
++
+ 	err = host1x_client_resume(&dc->client);
+ 	if (err < 0) {
+ 		dev_err(dc->dev, "failed to resume: %d\n", err);
+@@ -2076,8 +2073,11 @@ static void tegra_crtc_atomic_enable(struct drm_crtc *crtc,
+ 	else
+ 		tegra_dc_writel(dc, 0, DC_DISP_BORDER_COLOR);
+ 
+-	/* apply PLL and pixel clock changes */
+-	tegra_dc_commit_state(dc, crtc_state);
++	/* apply pixel clock changes */
++	if (!dc->soc->has_nvdisplay) {
++		value = SHIFT_CLK_DIVIDER(crtc_state->div) | PIXEL_CLK_DIVIDER_PCD1;
++		tegra_dc_writel(dc, value, DC_DISP_DISP_CLOCK_CONTROL);
++	}
+ 
+ 	/* program display mode */
+ 	tegra_dc_set_timings(dc, mode);
+@@ -2685,6 +2685,7 @@ static const struct tegra_dc_soc_info tegra20_dc_soc_info = {
+ 	.has_win_b_vfilter_mem_client = true,
+ 	.has_win_c_without_vert_filter = true,
+ 	.plane_tiled_memory_bandwidth_x2 = false,
++	.has_pll_d2_out0 = false,
+ };
+ 
+ static const struct tegra_dc_soc_info tegra30_dc_soc_info = {
+@@ -2707,6 +2708,7 @@ static const struct tegra_dc_soc_info tegra30_dc_soc_info = {
+ 	.has_win_b_vfilter_mem_client = true,
+ 	.has_win_c_without_vert_filter = false,
+ 	.plane_tiled_memory_bandwidth_x2 = true,
++	.has_pll_d2_out0 = true,
+ };
+ 
+ static const struct tegra_dc_soc_info tegra114_dc_soc_info = {
+@@ -2729,6 +2731,7 @@ static const struct tegra_dc_soc_info tegra114_dc_soc_info = {
+ 	.has_win_b_vfilter_mem_client = false,
+ 	.has_win_c_without_vert_filter = false,
+ 	.plane_tiled_memory_bandwidth_x2 = true,
++	.has_pll_d2_out0 = true,
+ };
+ 
+ static const struct tegra_dc_soc_info tegra124_dc_soc_info = {
+@@ -2751,6 +2754,7 @@ static const struct tegra_dc_soc_info tegra124_dc_soc_info = {
+ 	.has_win_b_vfilter_mem_client = false,
+ 	.has_win_c_without_vert_filter = false,
+ 	.plane_tiled_memory_bandwidth_x2 = false,
++	.has_pll_d2_out0 = true,
+ };
+ 
+ static const struct tegra_dc_soc_info tegra210_dc_soc_info = {
+@@ -2773,6 +2777,7 @@ static const struct tegra_dc_soc_info tegra210_dc_soc_info = {
+ 	.has_win_b_vfilter_mem_client = false,
+ 	.has_win_c_without_vert_filter = false,
+ 	.plane_tiled_memory_bandwidth_x2 = false,
++	.has_pll_d2_out0 = true,
+ };
+ 
+ static const struct tegra_windowgroup_soc tegra186_dc_wgrps[] = {
+@@ -2823,6 +2828,7 @@ static const struct tegra_dc_soc_info tegra186_dc_soc_info = {
+ 	.wgrps = tegra186_dc_wgrps,
+ 	.num_wgrps = ARRAY_SIZE(tegra186_dc_wgrps),
+ 	.plane_tiled_memory_bandwidth_x2 = false,
++	.has_pll_d2_out0 = false,
+ };
+ 
+ static const struct tegra_windowgroup_soc tegra194_dc_wgrps[] = {
+@@ -2873,6 +2879,7 @@ static const struct tegra_dc_soc_info tegra194_dc_soc_info = {
+ 	.wgrps = tegra194_dc_wgrps,
+ 	.num_wgrps = ARRAY_SIZE(tegra194_dc_wgrps),
+ 	.plane_tiled_memory_bandwidth_x2 = false,
++	.has_pll_d2_out0 = false,
+ };
+ 
+ static const struct of_device_id tegra_dc_of_match[] = {
+diff --git a/drivers/gpu/drm/tegra/dc.h b/drivers/gpu/drm/tegra/dc.h
+index 40378308d527a..c9c4c45c05183 100644
+--- a/drivers/gpu/drm/tegra/dc.h
++++ b/drivers/gpu/drm/tegra/dc.h
+@@ -76,6 +76,7 @@ struct tegra_dc_soc_info {
+ 	bool has_win_b_vfilter_mem_client;
+ 	bool has_win_c_without_vert_filter;
+ 	bool plane_tiled_memory_bandwidth_x2;
++	bool has_pll_d2_out0;
+ };
+ 
+ struct tegra_dc {
+diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
+index 606c78a2b988f..a84aee2f4acd0 100644
+--- a/drivers/gpu/drm/tegra/rgb.c
++++ b/drivers/gpu/drm/tegra/rgb.c
+@@ -17,6 +17,8 @@ struct tegra_rgb {
+ 	struct tegra_output output;
+ 	struct tegra_dc *dc;
+ 
++	struct clk *pll_d_out0;
++	struct clk *pll_d2_out0;
+ 	struct clk *clk_parent;
+ 	struct clk *clk;
+ };
+@@ -123,6 +125,18 @@ static void tegra_rgb_encoder_enable(struct drm_encoder *encoder)
+ 	tegra_dc_commit(rgb->dc);
+ }
+ 
++static bool tegra_rgb_pll_rate_change_allowed(struct tegra_rgb *rgb)
++{
++	if (!rgb->pll_d2_out0)
++		return false;
++
++	if (!clk_is_match(rgb->clk_parent, rgb->pll_d_out0) &&
++	    !clk_is_match(rgb->clk_parent, rgb->pll_d2_out0))
++		return false;
++
++	return true;
++}
++
+ static int
+ tegra_rgb_encoder_atomic_check(struct drm_encoder *encoder,
+ 			       struct drm_crtc_state *crtc_state,
+@@ -151,8 +165,17 @@ tegra_rgb_encoder_atomic_check(struct drm_encoder *encoder,
+ 	 * and hope that the desired frequency can be matched (or at least
+ 	 * matched sufficiently close that the panel will still work).
+ 	 */
+-	div = ((clk_get_rate(rgb->clk) * 2) / pclk) - 2;
+-	pclk = 0;
++	if (tegra_rgb_pll_rate_change_allowed(rgb)) {
++		/*
++		 * Set display controller clock to x2 of PCLK in order to
++		 * produce higher resolution pulse positions.
++		 */
++		div = 2;
++		pclk *= 2;
++	} else {
++		div = ((clk_get_rate(rgb->clk) * 2) / pclk) - 2;
++		pclk = 0;
++	}
+ 
+ 	err = tegra_dc_state_setup_clock(dc, crtc_state, rgb->clk_parent,
+ 					 pclk, div);
+@@ -210,6 +233,22 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 		return err;
+ 	}
+ 
++	rgb->pll_d_out0 = clk_get_sys(NULL, "pll_d_out0");
++	if (IS_ERR(rgb->pll_d_out0)) {
++		err = PTR_ERR(rgb->pll_d_out0);
++		dev_err(dc->dev, "failed to get pll_d_out0: %d\n", err);
++		return err;
++	}
++
++	if (dc->soc->has_pll_d2_out0) {
++		rgb->pll_d2_out0 = clk_get_sys(NULL, "pll_d2_out0");
++		if (IS_ERR(rgb->pll_d2_out0)) {
++			err = PTR_ERR(rgb->pll_d2_out0);
++			dev_err(dc->dev, "failed to get pll_d2_out0: %d\n", err);
++			return err;
++		}
++	}
++
+ 	dc->rgb = &rgb->output;
+ 
+ 	return 0;
+@@ -217,9 +256,15 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 
+ int tegra_dc_rgb_remove(struct tegra_dc *dc)
+ {
++	struct tegra_rgb *rgb;
++
+ 	if (!dc->rgb)
+ 		return 0;
+ 
++	rgb = to_rgb(dc->rgb);
++	clk_put(rgb->pll_d2_out0);
++	clk_put(rgb->pll_d_out0);
++
+ 	tegra_output_remove(dc->rgb);
+ 	dc->rgb = NULL;
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch b/queue-5.15/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
new file mode 100644
index 00000000000..61e8d34d008
--- /dev/null
+++ b/queue-5.15/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
@@ -0,0 +1,77 @@
+From bc83476a067a2a4064848e9b30a85aa52323ae63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 22:10:55 +0800
+Subject: drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit 0800880f4eb789b7d299db40f2e86e056bd33a4e ]
+
+The pm_runtime_enable function increases the power disable depth,
+which means that we must perform a matching decrement on the error
+handling path to maintain balance within the given context.
+Additionally, we need to address the same issue for pm_runtime_get_sync.
+We fix this by invoking pm_runtime_disable and pm_runtime_put_sync
+when error returns.
+
+Fixes: 82b81b3ec1a7 ("drm/tegra: dpaux: Implement runtime PM")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/tencent_B13DB7F6C0023C46157250A524966F326A09@qq.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dpaux.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
+index 12a92d09ac909..a99f82dc7e6f7 100644
+--- a/drivers/gpu/drm/tegra/dpaux.c
++++ b/drivers/gpu/drm/tegra/dpaux.c
+@@ -525,7 +525,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	if (err < 0) {
+ 		dev_err(dpaux->dev, "failed to request IRQ#%u: %d\n",
+ 			dpaux->irq, err);
+-		return err;
++		goto err_pm_disable;
+ 	}
+ 
+ 	disable_irq(dpaux->irq);
+@@ -545,7 +545,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	 */
+ 	err = tegra_dpaux_pad_config(dpaux, DPAUX_PADCTL_FUNC_I2C);
+ 	if (err < 0)
+-		return err;
++		goto err_pm_disable;
+ 
+ #ifdef CONFIG_GENERIC_PINCONF
+ 	dpaux->desc.name = dev_name(&pdev->dev);
+@@ -558,7 +558,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	dpaux->pinctrl = devm_pinctrl_register(&pdev->dev, &dpaux->desc, dpaux);
+ 	if (IS_ERR(dpaux->pinctrl)) {
+ 		dev_err(&pdev->dev, "failed to register pincontrol\n");
+-		return PTR_ERR(dpaux->pinctrl);
++		err = PTR_ERR(dpaux->pinctrl);
++		goto err_pm_disable;
+ 	}
+ #endif
+ 	/* enable and clear all interrupts */
+@@ -574,10 +575,15 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	err = devm_of_dp_aux_populate_ep_devices(&dpaux->aux);
+ 	if (err < 0) {
+ 		dev_err(dpaux->dev, "failed to populate AUX bus: %d\n", err);
+-		return err;
++		goto err_pm_disable;
+ 	}
+ 
+ 	return 0;
++
++err_pm_disable:
++	pm_runtime_put_sync(&pdev->dev);
++	pm_runtime_disable(&pdev->dev);
++	return err;
+ }
+ 
+ static int tegra_dpaux_remove(struct platform_device *pdev)
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-dpaux-populate-aux-bus.patch b/queue-5.15/drm-tegra-dpaux-populate-aux-bus.patch
new file mode 100644
index 00000000000..7407762a110
--- /dev/null
+++ b/queue-5.15/drm-tegra-dpaux-populate-aux-bus.patch
@@ -0,0 +1,62 @@
+From 8c8ba5c8ad1f5c6ad30147a9167668865a238ded Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Dec 2021 11:28:22 +0100
+Subject: drm/tegra: dpaux: Populate AUX bus
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 8913e1aea4b32a866343b14e565c62cec54f3f78 ]
+
+The DPAUX hardware block exposes an DP AUX interface that provides
+access to an AUX bus and the devices on that bus. Use the DP AUX bus
+infrastructure that was recently introduced to probe devices on this
+bus from DT.
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Stable-dep-of: 0800880f4eb7 ("drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/Kconfig | 1 +
+ drivers/gpu/drm/tegra/dpaux.c | 7 +++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/tegra/Kconfig b/drivers/gpu/drm/tegra/Kconfig
+index 1650a448eabd6..b09a500934f73 100644
+--- a/drivers/gpu/drm/tegra/Kconfig
++++ b/drivers/gpu/drm/tegra/Kconfig
+@@ -5,6 +5,7 @@ config DRM_TEGRA
+ 	depends on COMMON_CLK
+ 	depends on DRM
+ 	depends on OF
++	select DRM_DP_AUX_BUS
+ 	select DRM_KMS_HELPER
+ 	select DRM_MIPI_DSI
+ 	select DRM_PANEL
+diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
+index c96c07c6458c3..12a92d09ac909 100644
+--- a/drivers/gpu/drm/tegra/dpaux.c
++++ b/drivers/gpu/drm/tegra/dpaux.c
+@@ -19,6 +19,7 @@
+ #include <linux/workqueue.h>
+ 
+ #include <drm/drm_dp_helper.h>
++#include <drm/drm_dp_aux_bus.h>
+ #include <drm/drm_panel.h>
+ 
+ #include "dp.h"
+@@ -570,6 +571,12 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	list_add_tail(&dpaux->list, &dpaux_list);
+ 	mutex_unlock(&dpaux_lock);
+ 
++	err = devm_of_dp_aux_populate_ep_devices(&dpaux->aux);
++	if (err < 0) {
++		dev_err(dpaux->dev, "failed to populate AUX bus: %d\n", err);
++		return err;
++	}
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch b/queue-5.15/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
new file mode 100644
index 00000000000..d439a8d827f
--- /dev/null
+++ b/queue-5.15/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
@@ -0,0 +1,41 @@
+From 6685df2366031f3e0f5a46b8c858bad04ca42b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 08:07:38 +0000
+Subject: drm/tegra: dsi: Add missing check for of_find_device_by_node
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit afe6fcb9775882230cd29b529203eabd5d2a638d ]
+
+Add check for the return value of of_find_device_by_node() and return
+the error if it fails in order to avoid NULL pointer dereference.
+
+Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231024080738.825553-1-nichen@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index de1333dc0d867..0adce882f157b 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1534,9 +1534,11 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)
+ 	np = of_parse_phandle(dsi->dev->of_node, "nvidia,ganged-mode", 0);
+ 	if (np) {
+ 		struct platform_device *gangster = of_find_device_by_node(np);
++		of_node_put(np);
++		if (!gangster)
++			return -EPROBE_DEFER;
+ 
+ 		dsi->slave = platform_get_drvdata(gangster);
+-		of_node_put(np);
+ 
+ 		if (!dsi->slave) {
+ 			put_device(&gangster->dev);
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch b/queue-5.15/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
new file mode 100644
index 00000000000..ac1423245f6
--- /dev/null
+++ b/queue-5.15/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
@@ -0,0 +1,37 @@
+From 8ab96fea515a6c0b80e0f9ac7e877d530da08765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:09 +0200
+Subject: drm/tegra: dsi: Fix missing pm_runtime_disable() in the error
+ handling path of tegra_dsi_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5286a9fc280c45b6b307ee1b07f7a997e042252c ]
+
+If an error occurs after calling pm_runtime_enable(), pm_runtime_disable()
+should be called as already done in the remove function.
+
+Fixes: ef8187d75265 ("drm/tegra: dsi: Implement runtime PM")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/ee4a15c9cd4b574a55cd67c30d2411239ba2cee9.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index 815e32e05f600..7bb26655cb3cc 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1665,6 +1665,7 @@ static int tegra_dsi_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ unregister:
++	pm_runtime_disable(&pdev->dev);
+ 	mipi_dsi_host_unregister(&dsi->host);
+ mipi_free:
+ 	tegra_mipi_free(dsi->mipi);
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch b/queue-5.15/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
new file mode 100644
index 00000000000..1dde14796d3
--- /dev/null
+++ b/queue-5.15/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
@@ -0,0 +1,116 @@
+From f1df8e62bf7790834ccb480a35dd3cde6c80e95f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:08 +0200
+Subject: drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 830c1ded356369cd1303e8bb87ce3fea6e744de8 ]
+
+If an error occurs after calling tegra_output_probe(),
+tegra_output_remove() should be called as already done in the remove
+function.
+
+Fixes: dec727399a4b ("drm/tegra: Add DSI support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/16820073278d031f6c474a08d5f22a255158585e.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 54 ++++++++++++++++++++++++-------------
+ 1 file changed, 35 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index 6cbba2adb6e5a..815e32e05f600 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1586,44 +1586,58 @@ static int tegra_dsi_probe(struct platform_device *pdev)
+ 
+ 	if (!pdev->dev.pm_domain) {
+ 		dsi->rst = devm_reset_control_get(&pdev->dev, "dsi");
+-		if (IS_ERR(dsi->rst))
+-			return PTR_ERR(dsi->rst);
++		if (IS_ERR(dsi->rst)) {
++			err = PTR_ERR(dsi->rst);
++			goto remove;
++		}
+ 	}
+ 
+ 	dsi->clk = devm_clk_get(&pdev->dev, NULL);
+-	if (IS_ERR(dsi->clk))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk),
+-				     "cannot get DSI clock\n");
++	if (IS_ERR(dsi->clk)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk),
++				    "cannot get DSI clock\n");
++		goto remove;
++	}
+ 
+ 	dsi->clk_lp = devm_clk_get(&pdev->dev, "lp");
+-	if (IS_ERR(dsi->clk_lp))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_lp),
+-				     "cannot get low-power clock\n");
++	if (IS_ERR(dsi->clk_lp)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_lp),
++				    "cannot get low-power clock\n");
++		goto remove;
++	}
+ 
+ 	dsi->clk_parent = devm_clk_get(&pdev->dev, "parent");
+-	if (IS_ERR(dsi->clk_parent))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_parent),
+-				     "cannot get parent clock\n");
++	if (IS_ERR(dsi->clk_parent)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_parent),
++				    "cannot get parent clock\n");
++		goto remove;
++	}
+ 
+ 	dsi->vdd = devm_regulator_get(&pdev->dev, "avdd-dsi-csi");
+-	if (IS_ERR(dsi->vdd))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->vdd),
+-				     "cannot get VDD supply\n");
++	if (IS_ERR(dsi->vdd)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->vdd),
++				    "cannot get VDD supply\n");
++		goto remove;
++	}
+ 
+ 	err = tegra_dsi_setup_clocks(dsi);
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "cannot setup clocks\n");
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	dsi->regs = devm_ioremap_resource(&pdev->dev, regs);
+-	if (IS_ERR(dsi->regs))
+-		return PTR_ERR(dsi->regs);
++	if (IS_ERR(dsi->regs)) {
++		err = PTR_ERR(dsi->regs);
++		goto remove;
++	}
+ 
+ 	dsi->mipi = tegra_mipi_request(&pdev->dev, pdev->dev.of_node);
+-	if (IS_ERR(dsi->mipi))
+-		return PTR_ERR(dsi->mipi);
++	if (IS_ERR(dsi->mipi)) {
++		err = PTR_ERR(dsi->mipi);
++		goto remove;
++	}
+ 
+ 	dsi->host.ops = &tegra_dsi_host_ops;
+ 	dsi->host.dev = &pdev->dev;
+@@ -1654,6 +1668,8 @@ static int tegra_dsi_probe(struct platform_device *pdev)
+ 	mipi_dsi_host_unregister(&dsi->host);
+ mipi_free:
+ 	tegra_mipi_free(dsi->mipi);
++remove:
++	tegra_output_remove(&dsi->output);
+ 	return err;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-dsi-make-use-of-the-helper-function-dev_er.patch b/queue-5.15/drm-tegra-dsi-make-use-of-the-helper-function-dev_er.patch
new file mode 100644
index 00000000000..59baed6be67
--- /dev/null
+++ b/queue-5.15/drm-tegra-dsi-make-use-of-the-helper-function-dev_er.patch
@@ -0,0 +1,71 @@
+From 96fce838ad39c2ee45ef0ba43d3a4c2b6b1531d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 18:56:40 +0800
+Subject: drm/tegra: dsi: Make use of the helper function dev_err_probe()
+
+From: Cai Huoqing <caihuoqing@baidu.com>
+
+[ Upstream commit fc75e4fcbd1e4252a0481ebb23cd4516c127a8e2 ]
+
+When possible use dev_err_probe help to properly deal with the
+PROBE_DEFER error, the benefit is that DEFER issue will be logged
+in the devices_deferred debugfs file.
+And using dev_err_probe() can reduce code size, the error value
+gets printed.
+
+Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Stable-dep-of: 830c1ded3563 ("drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 28 ++++++++++++----------------
+ 1 file changed, 12 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index 0adce882f157b..6cbba2adb6e5a 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1591,28 +1591,24 @@ static int tegra_dsi_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	dsi->clk = devm_clk_get(&pdev->dev, NULL);
+-	if (IS_ERR(dsi->clk)) {
+-		dev_err(&pdev->dev, "cannot get DSI clock\n");
+-		return PTR_ERR(dsi->clk);
+-	}
++	if (IS_ERR(dsi->clk))
++		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk),
++				     "cannot get DSI clock\n");
+ 
+ 	dsi->clk_lp = devm_clk_get(&pdev->dev, "lp");
+-	if (IS_ERR(dsi->clk_lp)) {
+-		dev_err(&pdev->dev, "cannot get low-power clock\n");
+-		return PTR_ERR(dsi->clk_lp);
+-	}
++	if (IS_ERR(dsi->clk_lp))
++		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_lp),
++				     "cannot get low-power clock\n");
+ 
+ 	dsi->clk_parent = devm_clk_get(&pdev->dev, "parent");
+-	if (IS_ERR(dsi->clk_parent)) {
+-		dev_err(&pdev->dev, "cannot get parent clock\n");
+-		return PTR_ERR(dsi->clk_parent);
+-	}
++	if (IS_ERR(dsi->clk_parent))
++		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_parent),
++				     "cannot get parent clock\n");
+ 
+ 	dsi->vdd = devm_regulator_get(&pdev->dev, "avdd-dsi-csi");
+-	if (IS_ERR(dsi->vdd)) {
+-		dev_err(&pdev->dev, "cannot get VDD supply\n");
+-		return PTR_ERR(dsi->vdd);
+-	}
++	if (IS_ERR(dsi->vdd))
++		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->vdd),
++				     "cannot get VDD supply\n");
+ 
+ 	err = tegra_dsi_setup_clocks(dsi);
+ 	if (err < 0) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch b/queue-5.15/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
new file mode 100644
index 00000000000..ff6dd94ebeb
--- /dev/null
+++ b/queue-5.15/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
@@ -0,0 +1,75 @@
+From 2f9ae4da73c5ff62270830356c2c67181bbb39fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:13 +0200
+Subject: drm/tegra: output: Fix missing i2c_put_adapter() in the error
+ handling paths of tegra_output_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 2db4578ef6ffb2b52115ca0ebf897b60ec559556 ]
+
+If an error occurs after a successful of_get_i2c_adapter_by_node() call, it
+should be undone by a corresponding i2c_put_adapter().
+
+Add the missing i2c_put_adapter() call.
+
+Fixes: 9be7d864cf07 ("drm/tegra: Implement panel support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/b38604178991e1f08b2cda219103be266be2d680.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/output.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
+index 47d26b5d99456..7ccd010a821b7 100644
+--- a/drivers/gpu/drm/tegra/output.c
++++ b/drivers/gpu/drm/tegra/output.c
+@@ -139,8 +139,10 @@ int tegra_output_probe(struct tegra_output *output)
+ 						       GPIOD_IN,
+ 						       "HDMI hotplug detect");
+ 	if (IS_ERR(output->hpd_gpio)) {
+-		if (PTR_ERR(output->hpd_gpio) != -ENOENT)
+-			return PTR_ERR(output->hpd_gpio);
++		if (PTR_ERR(output->hpd_gpio) != -ENOENT) {
++			err = PTR_ERR(output->hpd_gpio);
++			goto put_i2c;
++		}
+ 
+ 		output->hpd_gpio = NULL;
+ 	}
+@@ -149,7 +151,7 @@ int tegra_output_probe(struct tegra_output *output)
+ 		err = gpiod_to_irq(output->hpd_gpio);
+ 		if (err < 0) {
+ 			dev_err(output->dev, "gpiod_to_irq(): %d\n", err);
+-			return err;
++			goto put_i2c;
+ 		}
+ 
+ 		output->hpd_irq = err;
+@@ -162,7 +164,7 @@ int tegra_output_probe(struct tegra_output *output)
+ 		if (err < 0) {
+ 			dev_err(output->dev, "failed to request IRQ#%u: %d\n",
+ 				output->hpd_irq, err);
+-			return err;
++			goto put_i2c;
+ 		}
+ 
+ 		output->connector.polled = DRM_CONNECTOR_POLL_HPD;
+@@ -176,6 +178,12 @@ int tegra_output_probe(struct tegra_output *output)
+ 	}
+ 
+ 	return 0;
++
++put_i2c:
++	if (output->ddc)
++		i2c_put_adapter(output->ddc);
++
++	return err;
+ }
+ 
+ void tegra_output_remove(struct tegra_output *output)
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch b/queue-5.15/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
new file mode 100644
index 00000000000..e66582ea6f3
--- /dev/null
+++ b/queue-5.15/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
@@ -0,0 +1,40 @@
+From 975ab34386bd11a37e7419e651b387d120db2511 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 12:33:55 +0300
+Subject: drm/tegra: put drm_gem_object ref on error in tegra_fb_create
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 32e5a120a5105bce01561978ee55aee8e40ac0dc ]
+
+Inside tegra_fb_create(), drm_gem_object_lookup() increments ref count of
+the found object. But if the following size check fails then the last
+found object's ref count should be put there as the unreferencing loop
+can't detect this situation.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231215093356.12067-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/tegra/fb.c b/drivers/gpu/drm/tegra/fb.c
+index cae8b8cbe9dd0..6e35c7951dfb2 100644
+--- a/drivers/gpu/drm/tegra/fb.c
++++ b/drivers/gpu/drm/tegra/fb.c
+@@ -165,6 +165,7 @@ struct drm_framebuffer *tegra_fb_create(struct drm_device *drm,
+ 
+ 		if (gem->size < size) {
+ 			err = -EINVAL;
++			drm_gem_object_put(gem);
+ 			goto unreference;
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch b/queue-5.15/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
new file mode 100644
index 00000000000..aa288f08c15
--- /dev/null
+++ b/queue-5.15/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
@@ -0,0 +1,50 @@
+From 681a87f55a842a0b360516201c19381de7ded5ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:12 +0200
+Subject: drm/tegra: rgb: Fix missing clk_put() in the error handling paths of
+ tegra_dc_rgb_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 45c8034db47842b25a3ab6139d71e13b4e67b9b3 ]
+
+If clk_get_sys(..., "pll_d2_out0") fails, the clk_get_sys() call must be
+undone.
+
+Add the missing clk_put and a new 'put_pll_d_out0' label in the error
+handling path, and use it.
+
+Fixes: 0c921b6d4ba0 ("drm/tegra: dc: rgb: Allow changing PLLD rate on Tegra30+")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/0182895ead4e4730426616b0d9995954c960b634.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/rgb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
+index 51144faa70f7c..761cfd49c4876 100644
+--- a/drivers/gpu/drm/tegra/rgb.c
++++ b/drivers/gpu/drm/tegra/rgb.c
+@@ -247,7 +247,7 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 		if (IS_ERR(rgb->pll_d2_out0)) {
+ 			err = PTR_ERR(rgb->pll_d2_out0);
+ 			dev_err(dc->dev, "failed to get pll_d2_out0: %d\n", err);
+-			goto remove;
++			goto put_pll;
+ 		}
+ 	}
+ 
+@@ -255,6 +255,8 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 
+ 	return 0;
+ 
++put_pll:
++	clk_put(rgb->pll_d_out0);
+ remove:
+ 	tegra_output_remove(&rgb->output);
+ 	return err;
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch b/queue-5.15/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
new file mode 100644
index 00000000000..e9d39588c3b
--- /dev/null
+++ b/queue-5.15/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
@@ -0,0 +1,81 @@
+From e99f0716507bb84103d632c84ebde402d6a84afc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:11 +0200
+Subject: drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit bc456b5d93dbfdbd89f2a036f4f3d8026595f9e4 ]
+
+If an error occurs after calling tegra_output_probe(),
+tegra_output_remove() should be called as already done in the remove
+function.
+
+Fixes: 59d29c0ec93f ("drm/tegra: Allocate resources at probe time")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/0001f61eb89048bc36241629b564195689cf54b6.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/rgb.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
+index a84aee2f4acd0..51144faa70f7c 100644
+--- a/drivers/gpu/drm/tegra/rgb.c
++++ b/drivers/gpu/drm/tegra/rgb.c
+@@ -218,26 +218,28 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 	rgb->clk = devm_clk_get(dc->dev, NULL);
+ 	if (IS_ERR(rgb->clk)) {
+ 		dev_err(dc->dev, "failed to get clock\n");
+-		return PTR_ERR(rgb->clk);
++		err = PTR_ERR(rgb->clk);
++		goto remove;
+ 	}
+ 
+ 	rgb->clk_parent = devm_clk_get(dc->dev, "parent");
+ 	if (IS_ERR(rgb->clk_parent)) {
+ 		dev_err(dc->dev, "failed to get parent clock\n");
+-		return PTR_ERR(rgb->clk_parent);
++		err = PTR_ERR(rgb->clk_parent);
++		goto remove;
+ 	}
+ 
+ 	err = clk_set_parent(rgb->clk, rgb->clk_parent);
+ 	if (err < 0) {
+ 		dev_err(dc->dev, "failed to set parent clock: %d\n", err);
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	rgb->pll_d_out0 = clk_get_sys(NULL, "pll_d_out0");
+ 	if (IS_ERR(rgb->pll_d_out0)) {
+ 		err = PTR_ERR(rgb->pll_d_out0);
+ 		dev_err(dc->dev, "failed to get pll_d_out0: %d\n", err);
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	if (dc->soc->has_pll_d2_out0) {
+@@ -245,13 +247,17 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 		if (IS_ERR(rgb->pll_d2_out0)) {
+ 			err = PTR_ERR(rgb->pll_d2_out0);
+ 			dev_err(dc->dev, "failed to get pll_d2_out0: %d\n", err);
+-			return err;
++			goto remove;
+ 		}
+ 	}
+ 
+ 	dc->rgb = &rgb->output;
+ 
+ 	return 0;
++
++remove:
++	tegra_output_remove(&rgb->output);
++	return err;
+ }
+ 
+ int tegra_dc_rgb_remove(struct tegra_dc *dc)
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-tidss-fix-initial-plane-zpos-values.patch b/queue-5.15/drm-tidss-fix-initial-plane-zpos-values.patch
new file mode 100644
index 00000000000..10e9a66dcbb
--- /dev/null
+++ b/queue-5.15/drm-tidss-fix-initial-plane-zpos-values.patch
@@ -0,0 +1,56 @@
+From bcb91b1ae11a58755f08ec88f052814e17012a1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 10:16:36 +0200
+Subject: drm/tidss: Fix initial plane zpos values
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 3ec948ccb2c4b99e8fbfdd950adbe92ea577b395 ]
+
+When the driver sets up the zpos property it sets the default zpos value
+to the HW id of the plane. That is fine as such, but as on many DSS
+versions the driver arranges the DRM planes in a different order than
+the HW planes (to keep the non-scalable planes first), this leads to odd
+initial zpos values. An example is J721e, where the initial zpos values
+for DRM planes are 1, 3, 0, 2.
+
+In theory the userspace should configure the zpos values properly when
+using multiple planes, and in that sense the initial zpos values
+shouldn't matter, but there's really no reason not to fix this and help
+the userspace apps which don't handle zpos perfectly. In particular,
+some versions of Weston seem to have issues dealing with the planes
+with the current default zpos values.
+
+So let's change the zpos values for the DRM planes to 0, 1, 2, 3.
+
+Another option would be to configure the planes marked as primary planes
+to zpos 0. On a two display system this would give us plane zpos values
+of 0, 0, 1, 2. The end result and behavior would be very similar in this
+option, and I'm not aware that this would actually help us in any way.
+So, to keep the code simple, I opted for the 0, 1, 2, 3 values.
+
+Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240213-tidss-fixes-v1-1-d709e8dfa505@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_plane.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_plane.c b/drivers/gpu/drm/tidss/tidss_plane.c
+index 217415ec8eea1..8ccd7d31c01b3 100644
+--- a/drivers/gpu/drm/tidss/tidss_plane.c
++++ b/drivers/gpu/drm/tidss/tidss_plane.c
+@@ -210,7 +210,7 @@ struct tidss_plane *tidss_plane_create(struct tidss_device *tidss,
+ 
+ 	drm_plane_helper_add(&tplane->plane, &tidss_plane_helper_funcs);
+ 
+-	drm_plane_create_zpos_property(&tplane->plane, hw_plane_id, 0,
++	drm_plane_create_zpos_property(&tplane->plane, tidss->num_planes, 0,
+ 				       num_planes - 1);
+ 
+ 	ret = drm_plane_create_color_properties(&tplane->plane,
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-ttm-add-ttm_resource_fini-v2.patch b/queue-5.15/drm-ttm-add-ttm_resource_fini-v2.patch
new file mode 100644
index 00000000000..cdd195dd3b7
--- /dev/null
+++ b/queue-5.15/drm-ttm-add-ttm_resource_fini-v2.patch
@@ -0,0 +1,300 @@
+From 1d324cd3663e09d39ae44b7b0c4caffbdcc0399f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Jul 2021 15:18:39 +0200
+Subject: drm/ttm: add ttm_resource_fini v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+[ Upstream commit de3688e469b08be958914674e8b01cb0cea42388 ]
+
+Make sure we call the common cleanup function in all
+implementations of the resource manager.
+
+v2: fix missing case in i915, rudimentary kerneldoc, should be
+    filled in more when we add more functionality
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220124122514.1832-2-christian.koenig@amd.com
+Stable-dep-of: 89709105a609 ("drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c   |  2 ++
+ .../gpu/drm/amd/amdgpu/amdgpu_preempt_mgr.c   |  1 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c  |  2 ++
+ drivers/gpu/drm/i915/i915_ttm_buddy_manager.c |  2 ++
+ drivers/gpu/drm/nouveau/nouveau_mem.c         |  3 ++-
+ drivers/gpu/drm/nouveau/nouveau_mem.h         |  3 ++-
+ drivers/gpu/drm/nouveau/nouveau_ttm.c         |  9 ++++----
+ drivers/gpu/drm/ttm/ttm_range_manager.c       |  2 ++
+ drivers/gpu/drm/ttm/ttm_resource.c            | 23 +++++++++++++++++++
+ drivers/gpu/drm/ttm/ttm_sys_manager.c         |  1 +
+ drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c |  2 ++
+ .../gpu/drm/vmwgfx/vmwgfx_system_manager.c    |  1 +
+ include/drm/ttm/ttm_resource.h                |  3 +++
+ 13 files changed, 48 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c
+index 675a72ef305da..ea5470c8c9212 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c
+@@ -169,6 +169,7 @@ static int amdgpu_gtt_mgr_new(struct ttm_resource_manager *man,
+ 	return 0;
+ 
+ err_free:
++	ttm_resource_fini(man, &node->base.base);
+ 	kfree(node);
+ 
+ err_out:
+@@ -200,6 +201,7 @@ static void amdgpu_gtt_mgr_del(struct ttm_resource_manager *man,
+ 	if (!(res->placement & TTM_PL_FLAG_TEMPORARY))
+ 		atomic64_sub(res->num_pages, &mgr->used);
+ 
++	ttm_resource_fini(man, res);
+ 	kfree(node);
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_preempt_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_preempt_mgr.c
+index d02c8637f909f..ffddec08e931f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_preempt_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_preempt_mgr.c
+@@ -95,6 +95,7 @@ static void amdgpu_preempt_mgr_del(struct ttm_resource_manager *man,
+ 	struct amdgpu_preempt_mgr *mgr = to_preempt_mgr(man);
+ 
+ 	atomic64_sub(res->num_pages, &mgr->used);
++	ttm_resource_fini(man, res);
+ 	kfree(res);
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+index 7b2b0980ec412..55d68408951d1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c
+@@ -476,6 +476,7 @@ static int amdgpu_vram_mgr_new(struct ttm_resource_manager *man,
+ 	while (i--)
+ 		drm_mm_remove_node(&node->mm_nodes[i]);
+ 	spin_unlock(&mgr->lock);
++	ttm_resource_fini(man, &node->base);
+ 	kvfree(node);
+ 
+ error_sub:
+@@ -515,6 +516,7 @@ static void amdgpu_vram_mgr_del(struct ttm_resource_manager *man,
+ 	atomic64_sub(usage, &mgr->usage);
+ 	atomic64_sub(vis_usage, &mgr->vis_usage);
+ 
++	ttm_resource_fini(man, res);
+ 	kvfree(node);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/i915_ttm_buddy_manager.c b/drivers/gpu/drm/i915/i915_ttm_buddy_manager.c
+index 6877362f6b85f..5740087f9ce93 100644
+--- a/drivers/gpu/drm/i915/i915_ttm_buddy_manager.c
++++ b/drivers/gpu/drm/i915/i915_ttm_buddy_manager.c
+@@ -109,6 +109,7 @@ static int i915_ttm_buddy_man_alloc(struct ttm_resource_manager *man,
+ 	i915_buddy_free_list(mm, &bman_res->blocks);
+ 	mutex_unlock(&bman->lock);
+ err_free_res:
++	ttm_resource_fini(man, &bman_res->base);
+ 	kfree(bman_res);
+ 	return err;
+ }
+@@ -123,6 +124,7 @@ static void i915_ttm_buddy_man_free(struct ttm_resource_manager *man,
+ 	i915_buddy_free_list(&bman->mm, &bman_res->blocks);
+ 	mutex_unlock(&bman->lock);
+ 
++	ttm_resource_fini(man, res);
+ 	kfree(bman_res);
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
+index 2ca3207c13fcd..2e517cdc24c9c 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
+@@ -162,11 +162,12 @@ nouveau_mem_vram(struct ttm_resource *reg, bool contig, u8 page)
+ }
+ 
+ void
+-nouveau_mem_del(struct ttm_resource *reg)
++nouveau_mem_del(struct ttm_resource_manager *man, struct ttm_resource *reg)
+ {
+ 	struct nouveau_mem *mem = nouveau_mem(reg);
+ 
+ 	nouveau_mem_fini(mem);
++	ttm_resource_fini(man, reg);
+ 	kfree(mem);
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.h b/drivers/gpu/drm/nouveau/nouveau_mem.h
+index 2c01166a90f25..325551eba5cd4 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_mem.h
++++ b/drivers/gpu/drm/nouveau/nouveau_mem.h
+@@ -23,7 +23,8 @@ nouveau_mem(struct ttm_resource *reg)
+ 
+ int nouveau_mem_new(struct nouveau_cli *, u8 kind, u8 comp,
+ 		    struct ttm_resource **);
+-void nouveau_mem_del(struct ttm_resource *);
++void nouveau_mem_del(struct ttm_resource_manager *man,
++		     struct ttm_resource *);
+ int nouveau_mem_vram(struct ttm_resource *, bool contig, u8 page);
+ int nouveau_mem_host(struct ttm_resource *, struct ttm_tt *);
+ void nouveau_mem_fini(struct nouveau_mem *);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+index 2ca9d9a9e5d5e..91ef33f8f22cb 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+@@ -36,9 +36,10 @@
+ #include <core/tegra.h>
+ 
+ static void
+-nouveau_manager_del(struct ttm_resource_manager *man, struct ttm_resource *reg)
++nouveau_manager_del(struct ttm_resource_manager *man,
++		    struct ttm_resource *reg)
+ {
+-	nouveau_mem_del(reg);
++	nouveau_mem_del(man, reg);
+ }
+ 
+ static int
+@@ -62,7 +63,7 @@ nouveau_vram_manager_new(struct ttm_resource_manager *man,
+ 
+ 	ret = nouveau_mem_vram(*res, nvbo->contig, nvbo->page);
+ 	if (ret) {
+-		nouveau_mem_del(*res);
++		nouveau_mem_del(man, *res);
+ 		return ret;
+ 	}
+ 
+@@ -118,7 +119,7 @@ nv04_gart_manager_new(struct ttm_resource_manager *man,
+ 	ret = nvif_vmm_get(&mem->cli->vmm.vmm, PTES, false, 12, 0,
+ 			   (long)(*res)->num_pages << PAGE_SHIFT, &mem->vma[0]);
+ 	if (ret) {
+-		nouveau_mem_del(*res);
++		nouveau_mem_del(man, *res);
+ 		return ret;
+ 	}
+ 
+diff --git a/drivers/gpu/drm/ttm/ttm_range_manager.c b/drivers/gpu/drm/ttm/ttm_range_manager.c
+index f4b08a8705b32..69962b5769c54 100644
+--- a/drivers/gpu/drm/ttm/ttm_range_manager.c
++++ b/drivers/gpu/drm/ttm/ttm_range_manager.c
+@@ -89,6 +89,7 @@ static int ttm_range_man_alloc(struct ttm_resource_manager *man,
+ 	spin_unlock(&rman->lock);
+ 
+ 	if (unlikely(ret)) {
++		ttm_resource_fini(man, *res);
+ 		kfree(node);
+ 		return ret;
+ 	}
+@@ -108,6 +109,7 @@ static void ttm_range_man_free(struct ttm_resource_manager *man,
+ 	drm_mm_remove_node(&node->mm_nodes[0]);
+ 	spin_unlock(&rman->lock);
+ 
++	ttm_resource_fini(man, res);
+ 	kfree(node);
+ }
+ 
+diff --git a/drivers/gpu/drm/ttm/ttm_resource.c b/drivers/gpu/drm/ttm/ttm_resource.c
+index 2431717376e70..2c590b4c46cb7 100644
+--- a/drivers/gpu/drm/ttm/ttm_resource.c
++++ b/drivers/gpu/drm/ttm/ttm_resource.c
+@@ -29,6 +29,14 @@
+ #include <drm/ttm/ttm_resource.h>
+ #include <drm/ttm/ttm_bo_driver.h>
+ 
++/**
++ * ttm_resource_init - resource object constructure
++ * @bo: buffer object this resources is allocated for
++ * @place: placement of the resource
++ * @res: the resource object to inistilize
++ *
++ * Initialize a new resource object. Counterpart of &ttm_resource_fini.
++ */
+ void ttm_resource_init(struct ttm_buffer_object *bo,
+                        const struct ttm_place *place,
+                        struct ttm_resource *res)
+@@ -44,6 +52,21 @@ void ttm_resource_init(struct ttm_buffer_object *bo,
+ }
+ EXPORT_SYMBOL(ttm_resource_init);
+ 
++/**
++ * ttm_resource_fini - resource destructor
++ * @man: the resource manager this resource belongs to
++ * @res: the resource to clean up
++ *
++ * Should be used by resource manager backends to clean up the TTM resource
++ * objects before freeing the underlying structure. Counterpart of
++ * &ttm_resource_init
++ */
++void ttm_resource_fini(struct ttm_resource_manager *man,
++		       struct ttm_resource *res)
++{
++}
++EXPORT_SYMBOL(ttm_resource_fini);
++
+ int ttm_resource_alloc(struct ttm_buffer_object *bo,
+ 		       const struct ttm_place *place,
+ 		       struct ttm_resource **res_ptr)
+diff --git a/drivers/gpu/drm/ttm/ttm_sys_manager.c b/drivers/gpu/drm/ttm/ttm_sys_manager.c
+index 63aca52f75e12..135394dcca95a 100644
+--- a/drivers/gpu/drm/ttm/ttm_sys_manager.c
++++ b/drivers/gpu/drm/ttm/ttm_sys_manager.c
+@@ -23,6 +23,7 @@ static int ttm_sys_man_alloc(struct ttm_resource_manager *man,
+ static void ttm_sys_man_free(struct ttm_resource_manager *man,
+ 			     struct ttm_resource *res)
+ {
++	ttm_resource_fini(man, res);
+ 	kfree(res);
+ }
+ 
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+index b2c4af331c9d5..bfd686bb8d194 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+@@ -116,6 +116,7 @@ static int vmw_gmrid_man_get_node(struct ttm_resource_manager *man,
+ 	gman->used_gmr_pages -= (*res)->num_pages;
+ 	spin_unlock(&gman->lock);
+ 	ida_free(&gman->gmr_ida, id);
++	ttm_resource_fini(man, *res);
+ 	kfree(*res);
+ 	return -ENOSPC;
+ }
+@@ -129,6 +130,7 @@ static void vmw_gmrid_man_put_node(struct ttm_resource_manager *man,
+ 	spin_lock(&gman->lock);
+ 	gman->used_gmr_pages -= res->num_pages;
+ 	spin_unlock(&gman->lock);
++	ttm_resource_fini(man, res);
+ 	kfree(res);
+ }
+ 
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_system_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_system_manager.c
+index b0005b03a6174..a64188c7268d5 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_system_manager.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_system_manager.c
+@@ -49,6 +49,7 @@ static int vmw_sys_man_alloc(struct ttm_resource_manager *man,
+ static void vmw_sys_man_free(struct ttm_resource_manager *man,
+ 			     struct ttm_resource *res)
+ {
++	ttm_resource_fini(man, res);
+ 	kfree(res);
+ }
+ 
+diff --git a/include/drm/ttm/ttm_resource.h b/include/drm/ttm/ttm_resource.h
+index 140b6b9a8bbe6..dd6929f0c4f6d 100644
+--- a/include/drm/ttm/ttm_resource.h
++++ b/include/drm/ttm/ttm_resource.h
+@@ -262,6 +262,9 @@ ttm_resource_manager_cleanup(struct ttm_resource_manager *man)
+ void ttm_resource_init(struct ttm_buffer_object *bo,
+                        const struct ttm_place *place,
+                        struct ttm_resource *res);
++void ttm_resource_fini(struct ttm_resource_manager *man,
++		       struct ttm_resource *res);
++
+ int ttm_resource_alloc(struct ttm_buffer_object *bo,
+ 		       const struct ttm_place *place,
+ 		       struct ttm_resource **res);
+-- 
+2.43.0
+
diff --git a/queue-5.15/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch b/queue-5.15/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
new file mode 100644
index 00000000000..6370a33e7cb
--- /dev/null
+++ b/queue-5.15/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
@@ -0,0 +1,41 @@
+From 6174a9dc79057b0391dc2851327a3280bce802c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 17:14:16 +0800
+Subject: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 89709105a6091948ffb6ec2427954cbfe45358ce ]
+
+When ida_alloc_max fails, resources allocated before should be freed,
+including *res allocated by kmalloc and ttm_resource_init.
+
+Fixes: d3bcb4b02fe9 ("drm/vmwgfx: switch the TTM backends to self alloc")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231204091416.3308430-1-alexious@zju.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+index bfd686bb8d194..eef7bab8bc3a6 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+@@ -64,8 +64,11 @@ static int vmw_gmrid_man_get_node(struct ttm_resource_manager *man,
+ 	ttm_resource_init(bo, place, *res);
+ 
+ 	id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL);
+-	if (id < 0)
++	if (id < 0) {
++		ttm_resource_fini(man, *res);
++		kfree(*res);
+ 		return id;
++	}
+ 
+ 	spin_lock(&gman->lock);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch b/queue-5.15/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch
new file mode 100644
index 00000000000..938001aecae
--- /dev/null
+++ b/queue-5.15/dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch
@@ -0,0 +1,38 @@
+From 4884af96dd2ef7132a19795949edc65367bd07f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:26 +0530
+Subject: dt-bindings: clock: qcom: Add missing UFS QREF clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 26447dad8119fd084d7c6f167c3026700b701666 ]
+
+Add missing QREF clocks for UFS MEM and UFS CARD controllers.
+
+Fixes: 0fadcdfdcf57 ("dt-bindings: clock: Add SC8180x GCC binding")
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-3-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: bb5c0229285f ("clk: qcom: gcc-sc8180x: Add missing UFS QREF clocks")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/dt-bindings/clock/qcom,gcc-sc8180x.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/dt-bindings/clock/qcom,gcc-sc8180x.h b/include/dt-bindings/clock/qcom,gcc-sc8180x.h
+index e893415ae13d0..90c6e021a0356 100644
+--- a/include/dt-bindings/clock/qcom,gcc-sc8180x.h
++++ b/include/dt-bindings/clock/qcom,gcc-sc8180x.h
+@@ -246,6 +246,8 @@
+ #define GCC_PCIE_3_CLKREF_CLK					236
+ #define GCC_USB3_PRIM_CLKREF_CLK				237
+ #define GCC_USB3_SEC_CLKREF_CLK					238
++#define GCC_UFS_MEM_CLKREF_EN					239
++#define GCC_UFS_CARD_CLKREF_EN					240
+ 
+ #define GCC_EMAC_BCR						0
+ #define GCC_GPU_BCR						1
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch b/queue-5.15/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
new file mode 100644
index 00000000000..ff1b65e3f3c
--- /dev/null
+++ b/queue-5.15/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
@@ -0,0 +1,132 @@
+From 2e43e62a603a7366752fecd9220b8643a9e68bc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 11:47:46 +0800
+Subject: f2fs: compress: fix reserve_cblocks counting error when out of space
+
+From: Xiuhong Wang <xiuhong.wang@unisoc.com>
+
+[ Upstream commit 2f6d721e14b69d6e1251f69fa238b48e8374e25f ]
+
+When a file only needs one direct_node, performing the following
+operations will cause the file to be unrepairable:
+
+unisoc # ./f2fs_io compress test.apk
+unisoc #df -h | grep dm-48
+/dev/block/dm-48 112G 112G 1.2M 100% /data
+
+unisoc # ./f2fs_io release_cblocks test.apk
+924
+unisoc # df -h | grep dm-48
+/dev/block/dm-48 112G 112G 4.8M 100% /data
+
+unisoc # dd if=/dev/random of=file4 bs=1M count=3
+3145728 bytes (3.0 M) copied, 0.025 s, 120 M/s
+unisoc # df -h | grep dm-48
+/dev/block/dm-48 112G 112G 1.8M 100% /data
+
+unisoc # ./f2fs_io reserve_cblocks test.apk
+F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device
+
+adb reboot
+unisoc # df -h  | grep dm-48
+/dev/block/dm-48             112G 112G   11M 100% /data
+unisoc # ./f2fs_io reserve_cblocks test.apk
+0
+
+This is because the file has only one direct_node. After returning
+to -ENOSPC, reserved_blocks += ret will not be executed. As a result,
+the reserved_blocks at this time is still 0, which is not the real
+number of reserved blocks. Therefore, fsck cannot be set to repair
+the file.
+
+After this patch, the fsck flag will be set to fix this problem.
+
+unisoc # df -h | grep dm-48
+/dev/block/dm-48             112G 112G  1.8M 100% /data
+unisoc # ./f2fs_io reserve_cblocks test.apk
+F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device
+
+adb reboot then fsck will be executed
+unisoc # df -h  | grep dm-48
+/dev/block/dm-48             112G 112G   11M 100% /data
+unisoc # ./f2fs_io reserve_cblocks test.apk
+924
+
+Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS")
+Signed-off-by: Xiuhong Wang <xiuhong.wang@unisoc.com>
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index bab83ce4fe091..378ab6bd1b8d8 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3532,10 +3532,10 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)
+ 	return ret;
+ }
+ 
+-static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
++static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count,
++		unsigned int *reserved_blocks)
+ {
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
+-	unsigned int reserved_blocks = 0;
+ 	int cluster_size = F2FS_I(dn->inode)->i_cluster_size;
+ 	block_t blkaddr;
+ 	int i;
+@@ -3596,12 +3596,12 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 
+ 		f2fs_i_compr_blocks_update(dn->inode, compr_blocks, true);
+ 
+-		reserved_blocks += reserved;
++		*reserved_blocks += reserved;
+ next:
+ 		count -= cluster_size;
+ 	}
+ 
+-	return reserved_blocks;
++	return 0;
+ }
+ 
+ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+@@ -3662,7 +3662,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 		count = min(end_offset - dn.ofs_in_node, last_idx - page_idx);
+ 		count = round_up(count, F2FS_I(inode)->i_cluster_size);
+ 
+-		ret = reserve_compress_blocks(&dn, count);
++		ret = reserve_compress_blocks(&dn, count, &reserved_blocks);
+ 
+ 		f2fs_put_dnode(&dn);
+ 
+@@ -3670,13 +3670,12 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 			break;
+ 
+ 		page_idx += count;
+-		reserved_blocks += ret;
+ 	}
+ 
+ 	filemap_invalidate_unlock(inode->i_mapping);
+ 	up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ 
+-	if (ret >= 0) {
++	if (!ret) {
+ 		clear_inode_flag(inode, FI_COMPRESS_RELEASED);
+ 		inode->i_ctime = current_time(inode);
+ 		f2fs_mark_inode_dirty_sync(inode, true);
+@@ -3686,7 +3685,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ out:
+ 	mnt_drop_write_file(filp);
+ 
+-	if (ret >= 0) {
++	if (!ret) {
+ 		ret = put_user(reserved_blocks, (u64 __user *)arg);
+ 	} else if (reserved_blocks &&
+ 			atomic_read(&F2FS_I(inode)->i_compr_blocks)) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch b/queue-5.15/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
new file mode 100644
index 00000000000..1feae3dad8f
--- /dev/null
+++ b/queue-5.15/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
@@ -0,0 +1,56 @@
+From b9cf7b897b32b52a18f1c264fa4d18e7c7111dde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 03:41:29 +0800
+Subject: f2fs: compress: fix to check unreleased compressed cluster
+
+From: Sheng Yong <shengyong@oppo.com>
+
+[ Upstream commit eb8fbaa53374e0a2d4381190abfe708481517bbb ]
+
+Compressed cluster may not be released due to we can fail in
+release_compress_blocks(), fix to handle reserved compressed
+cluster correctly in reserve_compress_blocks().
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Sheng Yong <shengyong@oppo.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 489854d841e75..bab83ce4fe091 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3566,7 +3566,13 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 				goto next;
+ 			}
+ 
+-			if (__is_valid_data_blkaddr(blkaddr)) {
++			/*
++			 * compressed cluster was not released due to it
++			 * fails in release_compress_blocks(), so NEW_ADDR
++			 * is a possible case.
++			 */
++			if (blkaddr == NEW_ADDR ||
++				__is_valid_data_blkaddr(blkaddr)) {
+ 				compr_blocks++;
+ 				continue;
+ 			}
+@@ -3576,6 +3582,11 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 		}
+ 
+ 		reserved = cluster_size - compr_blocks;
++
++		/* for the case all blocks in cluster were reserved */
++		if (reserved == 1)
++			goto next;
++
+ 		ret = inc_valid_block_count(sbi, dn->inode, &reserved);
+ 		if (ret)
+ 			return ret;
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch b/queue-5.15/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
new file mode 100644
index 00000000000..86f42ad61d6
--- /dev/null
+++ b/queue-5.15/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
@@ -0,0 +1,125 @@
+From 77697e0956d804a9aa3d5db116f264f14c1d9352 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 03:41:28 +0800
+Subject: f2fs: compress: fix to cover normal cluster write with cp_rwsem
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit fd244524c2cf07b5f4c3fe8abd6a99225c76544b ]
+
+When we overwrite compressed cluster w/ normal cluster, we should
+not unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data
+will be corrupted if partial blocks were persisted before CP & SPOR,
+due to cluster metadata wasn't updated atomically.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 27 ++++++++++++++++++---------
+ fs/f2fs/data.c     |  3 ++-
+ 2 files changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index f8de64cb8fbcc..88799c6ebd7de 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1445,12 +1445,14 @@ void f2fs_compress_write_end_io(struct bio *bio, struct page *page)
+ }
+ 
+ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+-					int *submitted,
++					int *submitted_p,
+ 					struct writeback_control *wbc,
+ 					enum iostat_type io_type)
+ {
+ 	struct address_space *mapping = cc->inode->i_mapping;
+-	int _submitted, compr_blocks, ret, i;
++	struct f2fs_sb_info *sbi = F2FS_M_SB(mapping);
++	int submitted, compr_blocks, i;
++	int ret = 0;
+ 
+ 	compr_blocks = f2fs_compressed_blocks(cc);
+ 
+@@ -1465,6 +1467,10 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 	if (compr_blocks < 0)
+ 		return compr_blocks;
+ 
++	/* overwrite compressed cluster w/ normal cluster */
++	if (compr_blocks > 0)
++		f2fs_lock_op(sbi);
++
+ 	for (i = 0; i < cc->cluster_size; i++) {
+ 		if (!cc->rpages[i])
+ 			continue;
+@@ -1489,7 +1495,7 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 		if (!clear_page_dirty_for_io(cc->rpages[i]))
+ 			goto continue_unlock;
+ 
+-		ret = f2fs_write_single_data_page(cc->rpages[i], &_submitted,
++		ret = f2fs_write_single_data_page(cc->rpages[i], &submitted,
+ 						NULL, NULL, wbc, io_type,
+ 						compr_blocks, false);
+ 		if (ret) {
+@@ -1497,26 +1503,29 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 				unlock_page(cc->rpages[i]);
+ 				ret = 0;
+ 			} else if (ret == -EAGAIN) {
++				ret = 0;
+ 				/*
+ 				 * for quota file, just redirty left pages to
+ 				 * avoid deadlock caused by cluster update race
+ 				 * from foreground operation.
+ 				 */
+ 				if (IS_NOQUOTA(cc->inode))
+-					return 0;
+-				ret = 0;
++					goto out;
+ 				f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 				goto retry_write;
+ 			}
+-			return ret;
++			goto out;
+ 		}
+ 
+-		*submitted += _submitted;
++		*submitted_p += submitted;
+ 	}
+ 
+-	f2fs_balance_fs(F2FS_M_SB(mapping), true);
++out:
++	if (compr_blocks > 0)
++		f2fs_unlock_op(sbi);
+ 
+-	return 0;
++	f2fs_balance_fs(sbi, true);
++	return ret;
+ }
+ 
+ int f2fs_write_multi_pages(struct compress_ctx *cc,
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index cb63352589390..ecf7f1b5a3658 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2802,7 +2802,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 		.encrypted_page = NULL,
+ 		.submitted = 0,
+ 		.compr_blocks = compr_blocks,
+-		.need_lock = LOCK_RETRY,
++		.need_lock = compr_blocks ? LOCK_DONE : LOCK_RETRY,
+ 		.post_read = f2fs_post_read_required(inode) ? 1 : 0,
+ 		.io_type = io_type,
+ 		.io_wbc = wbc,
+@@ -2887,6 +2887,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 	if (err == -EAGAIN) {
+ 		err = f2fs_do_write_data_page(&fio);
+ 		if (err == -EAGAIN) {
++			f2fs_bug_on(sbi, compr_blocks);
+ 			fio.need_lock = LOCK_REQ;
+ 			err = f2fs_do_write_data_page(&fio);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-fix-to-invalidate-meta_mapping-before-dio-write.patch b/queue-5.15/f2fs-fix-to-invalidate-meta_mapping-before-dio-write.patch
new file mode 100644
index 00000000000..21d74126c04
--- /dev/null
+++ b/queue-5.15/f2fs-fix-to-invalidate-meta_mapping-before-dio-write.patch
@@ -0,0 +1,89 @@
+From d60b914d413f36966b52d694f56847bb1bc2a469 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jul 2022 14:30:15 +0800
+Subject: f2fs: fix to invalidate META_MAPPING before DIO write
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 67ca06872eb02944b4c6f92cffa9242e92c63109 ]
+
+Quoted from commit e3b49ea36802 ("f2fs: invalidate META_MAPPING before
+IPU/DIO write")
+
+"
+Encrypted pages during GC are read and cached in META_MAPPING.
+However, due to cached pages in META_MAPPING, there is an issue where
+newly written pages are lost by IPU or DIO writes.
+
+Thread A - f2fs_gc()            Thread B
+/* phase 3 */
+down_write(i_gc_rwsem)
+ra_data_block()       ---- (a)
+up_write(i_gc_rwsem)
+                                f2fs_direct_IO() :
+                                 - down_read(i_gc_rwsem)
+                                 - __blockdev_direct_io()
+                                 - get_data_block_dio_write()
+                                 - f2fs_dio_submit_bio()  ---- (b)
+                                 - up_read(i_gc_rwsem)
+/* phase 4 */
+down_write(i_gc_rwsem)
+move_data_block()     ---- (c)
+up_write(i_gc_rwsem)
+
+(a) In phase 3 of f2fs_gc(), up-to-date page is read from storage and
+    cached in META_MAPPING.
+(b) In thread B, writing new data by IPU or DIO write on same blkaddr as
+    read in (a). cached page in META_MAPPING become out-dated.
+(c) In phase 4 of f2fs_gc(), out-dated page in META_MAPPING is copied to
+    new blkaddr. In conclusion, the newly written data in (b) is lost.
+
+To address this issue, invalidating pages in META_MAPPING before IPU or
+DIO write.
+"
+
+In previous commit, we missed to cover extent cache hit case, and passed
+wrong value for parameter @end of invalidate_mapping_pages(), fix both
+issues.
+
+Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC")
+Fixes: e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write")
+Cc: Hyeong-Jun Kim <hj514.kim@samsung.com>
+Signed-off-by: Chao Yu <chao.yu@oppo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: fd244524c2cf ("f2fs: compress: fix to cover normal cluster write with cp_rwsem")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 19b595488a27b..222af7d5f91b7 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1496,9 +1496,12 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 			*map->m_next_extent = pgofs + map->m_len;
+ 
+ 		/* for hardware encryption, but to avoid potential issue in future */
+-		if (flag == F2FS_GET_BLOCK_DIO)
++		if (flag == F2FS_GET_BLOCK_DIO) {
+ 			f2fs_wait_on_block_writeback_range(inode,
+ 						map->m_pblk, map->m_len);
++			invalidate_mapping_pages(META_MAPPING(sbi),
++				map->m_pblk, map->m_pblk + map->m_len - 1);
++		}
+ 
+ 		if (map->m_multidev_dio) {
+ 			block_t blk_addr = map->m_pblk;
+@@ -1712,7 +1715,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 		f2fs_wait_on_block_writeback_range(inode,
+ 						map->m_pblk, map->m_len);
+ 		invalidate_mapping_pages(META_MAPPING(sbi),
+-						map->m_pblk, map->m_pblk);
++				map->m_pblk, map->m_pblk + map->m_len - 1);
+ 
+ 		if (map->m_multidev_dio) {
+ 			block_t blk_addr = map->m_pblk;
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-implement-iomap-operations.patch b/queue-5.15/f2fs-implement-iomap-operations.patch
new file mode 100644
index 00000000000..8809eaee967
--- /dev/null
+++ b/queue-5.15/f2fs-implement-iomap-operations.patch
@@ -0,0 +1,123 @@
+From 7c034ba3839a712a0749c97588b5deef11b8f22d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Jul 2021 00:59:20 -0700
+Subject: f2fs: implement iomap operations
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 1517c1a7a4456f080fabc4ac9853930e4b880d14 ]
+
+Implement 'struct iomap_ops' for f2fs, in preparation for making f2fs
+use iomap for direct I/O.
+
+Note that this may be used for other things besides direct I/O in the
+future; however, for now I've only tested it for direct I/O.
+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: ec16b147a55b ("fs: Fix rw_hint validation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/Kconfig |  1 +
+ fs/f2fs/data.c  | 56 +++++++++++++++++++++++++++++++++++++++++++++++++
+ fs/f2fs/f2fs.h  |  1 +
+ 3 files changed, 58 insertions(+)
+
+diff --git a/fs/f2fs/Kconfig b/fs/f2fs/Kconfig
+index 7eea3cfd894d1..f46a7339d6cf7 100644
+--- a/fs/f2fs/Kconfig
++++ b/fs/f2fs/Kconfig
+@@ -7,6 +7,7 @@ config F2FS_FS
+ 	select CRYPTO_CRC32
+ 	select F2FS_FS_XATTR if FS_ENCRYPTION
+ 	select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
++	select FS_IOMAP
+ 	select LZ4_COMPRESS if F2FS_FS_LZ4
+ 	select LZ4_DECOMPRESS if F2FS_FS_LZ4
+ 	select LZ4HC_COMPRESS if F2FS_FS_LZ4HC
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 73a7906a49b1e..5766a9f0773b1 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -21,6 +21,7 @@
+ #include <linux/cleancache.h>
+ #include <linux/sched/signal.h>
+ #include <linux/fiemap.h>
++#include <linux/iomap.h>
+ 
+ #include "f2fs.h"
+ #include "node.h"
+@@ -4242,3 +4243,58 @@ void f2fs_destroy_bio_entry_cache(void)
+ {
+ 	kmem_cache_destroy(bio_entry_slab);
+ }
++
++static int f2fs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
++			    unsigned int flags, struct iomap *iomap,
++			    struct iomap *srcmap)
++{
++	struct f2fs_map_blocks map = {};
++	pgoff_t next_pgofs = 0;
++	int err;
++
++	map.m_lblk = bytes_to_blks(inode, offset);
++	map.m_len = bytes_to_blks(inode, offset + length - 1) - map.m_lblk + 1;
++	map.m_next_pgofs = &next_pgofs;
++	map.m_seg_type = f2fs_rw_hint_to_seg_type(inode->i_write_hint);
++	if (flags & IOMAP_WRITE)
++		map.m_may_create = true;
++
++	err = f2fs_map_blocks(inode, &map, flags & IOMAP_WRITE,
++			      F2FS_GET_BLOCK_DIO);
++	if (err)
++		return err;
++
++	iomap->offset = blks_to_bytes(inode, map.m_lblk);
++
++	if (map.m_flags & (F2FS_MAP_MAPPED | F2FS_MAP_UNWRITTEN)) {
++		iomap->length = blks_to_bytes(inode, map.m_len);
++		if (map.m_flags & F2FS_MAP_MAPPED) {
++			iomap->type = IOMAP_MAPPED;
++			iomap->flags |= IOMAP_F_MERGED;
++		} else {
++			iomap->type = IOMAP_UNWRITTEN;
++		}
++		if (WARN_ON_ONCE(!__is_valid_data_blkaddr(map.m_pblk)))
++			return -EINVAL;
++
++		iomap->bdev = map.m_bdev;
++		iomap->addr = blks_to_bytes(inode, map.m_pblk);
++	} else {
++		iomap->length = blks_to_bytes(inode, next_pgofs) -
++				iomap->offset;
++		iomap->type = IOMAP_HOLE;
++		iomap->addr = IOMAP_NULL_ADDR;
++	}
++
++	if (map.m_flags & F2FS_MAP_NEW)
++		iomap->flags |= IOMAP_F_NEW;
++	if ((inode->i_state & I_DIRTY_DATASYNC) ||
++	    offset + length > i_size_read(inode))
++		iomap->flags |= IOMAP_F_DIRTY;
++
++	return 0;
++}
++
++const struct iomap_ops f2fs_iomap_ops = {
++	.iomap_begin	= f2fs_iomap_begin,
++};
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 835ef98643bd4..4cabc37c20b90 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3650,6 +3650,7 @@ int f2fs_init_post_read_processing(void);
+ void f2fs_destroy_post_read_processing(void);
+ int f2fs_init_post_read_wq(struct f2fs_sb_info *sbi);
+ void f2fs_destroy_post_read_wq(struct f2fs_sb_info *sbi);
++extern const struct iomap_ops f2fs_iomap_ops;
+ 
+ /*
+  * gc.c
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-invalidate-meta-pages-only-for-post_read-requir.patch b/queue-5.15/f2fs-invalidate-meta-pages-only-for-post_read-requir.patch
new file mode 100644
index 00000000000..a6bcd183a0c
--- /dev/null
+++ b/queue-5.15/f2fs-invalidate-meta-pages-only-for-post_read-requir.patch
@@ -0,0 +1,108 @@
+From 92d252e60927b636a9b449b9e3c9dc6329100207 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 23:26:43 +0800
+Subject: f2fs: invalidate meta pages only for post_read required inode
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 0d5b9d8156396bbe1c982708b38ab9e188c45ec9 ]
+
+After commit e3b49ea36802 ("f2fs: invalidate META_MAPPING before
+IPU/DIO write"), invalidate_mapping_pages() will be called to
+avoid race condition in between IPU/DIO and readahead for GC.
+
+However, readahead flow is only used for post_read required inode,
+so this patch adds check condition to avoids unnecessary page cache
+invalidating for non-post_read inode.
+
+Signed-off-by: Chao Yu <chao.yu@oppo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: fd244524c2cf ("f2fs: compress: fix to cover normal cluster write with cp_rwsem")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c    | 8 ++------
+ fs/f2fs/f2fs.h    | 1 +
+ fs/f2fs/segment.c | 9 ++++++++-
+ 3 files changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 222af7d5f91b7..4f122a806cf88 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1496,12 +1496,9 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 			*map->m_next_extent = pgofs + map->m_len;
+ 
+ 		/* for hardware encryption, but to avoid potential issue in future */
+-		if (flag == F2FS_GET_BLOCK_DIO) {
++		if (flag == F2FS_GET_BLOCK_DIO)
+ 			f2fs_wait_on_block_writeback_range(inode,
+ 						map->m_pblk, map->m_len);
+-			invalidate_mapping_pages(META_MAPPING(sbi),
+-				map->m_pblk, map->m_pblk + map->m_len - 1);
+-		}
+ 
+ 		if (map->m_multidev_dio) {
+ 			block_t blk_addr = map->m_pblk;
+@@ -1714,8 +1711,6 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 		 */
+ 		f2fs_wait_on_block_writeback_range(inode,
+ 						map->m_pblk, map->m_len);
+-		invalidate_mapping_pages(META_MAPPING(sbi),
+-				map->m_pblk, map->m_pblk + map->m_len - 1);
+ 
+ 		if (map->m_multidev_dio) {
+ 			block_t blk_addr = map->m_pblk;
+@@ -2808,6 +2803,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 		.submitted = false,
+ 		.compr_blocks = compr_blocks,
+ 		.need_lock = LOCK_RETRY,
++		.post_read = f2fs_post_read_required(inode),
+ 		.io_type = io_type,
+ 		.io_wbc = wbc,
+ 		.bio = bio,
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index dfaee211f6133..d961a2779b6e7 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1177,6 +1177,7 @@ struct f2fs_io_info {
+ 	bool retry;		/* need to reallocate block address */
+ 	int compr_blocks;	/* # of compressed block addresses */
+ 	bool encrypted;		/* indicate file is encrypted */
++	bool post_read;		/* require post read */
+ 	enum iostat_type io_type;	/* io type */
+ 	struct writeback_control *io_wbc; /* writeback control */
+ 	struct bio **bio;		/* bio for ipu */
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index cbdd8d0ec8960..43fabd17bb4e7 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3620,7 +3620,8 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
+ 		goto drop_bio;
+ 	}
+ 
+-	invalidate_mapping_pages(META_MAPPING(sbi),
++	if (fio->post_read)
++		invalidate_mapping_pages(META_MAPPING(sbi),
+ 				fio->new_blkaddr, fio->new_blkaddr);
+ 
+ 	stat_inc_inplace_blocks(fio->sbi);
+@@ -3803,10 +3804,16 @@ void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr)
+ void f2fs_wait_on_block_writeback_range(struct inode *inode, block_t blkaddr,
+ 								block_t len)
+ {
++	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ 	block_t i;
+ 
++	if (!f2fs_post_read_required(inode))
++		return;
++
+ 	for (i = 0; i < len; i++)
+ 		f2fs_wait_on_block_writeback(inode, blkaddr + i);
++
++	invalidate_mapping_pages(META_MAPPING(sbi), blkaddr, blkaddr + len - 1);
+ }
+ 
+ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-invalidate-meta_mapping-before-ipu-dio-write.patch b/queue-5.15/f2fs-invalidate-meta_mapping-before-ipu-dio-write.patch
new file mode 100644
index 00000000000..3f74dbe0385
--- /dev/null
+++ b/queue-5.15/f2fs-invalidate-meta_mapping-before-ipu-dio-write.patch
@@ -0,0 +1,80 @@
+From e8859acb23a33ce1eeee3c6cf6c15038198aa75a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Nov 2021 16:10:02 +0900
+Subject: f2fs: invalidate META_MAPPING before IPU/DIO write
+
+From: Hyeong-Jun Kim <hj514.kim@samsung.com>
+
+[ Upstream commit e3b49ea36802053f312013fd4ccb6e59920a9f76 ]
+
+Encrypted pages during GC are read and cached in META_MAPPING.
+However, due to cached pages in META_MAPPING, there is an issue where
+newly written pages are lost by IPU or DIO writes.
+
+Thread A - f2fs_gc()            Thread B
+/* phase 3 */
+down_write(i_gc_rwsem)
+ra_data_block()       ---- (a)
+up_write(i_gc_rwsem)
+                                f2fs_direct_IO() :
+                                 - down_read(i_gc_rwsem)
+                                 - __blockdev_direct_io()
+                                 - get_data_block_dio_write()
+                                 - f2fs_dio_submit_bio()  ---- (b)
+                                 - up_read(i_gc_rwsem)
+/* phase 4 */
+down_write(i_gc_rwsem)
+move_data_block()     ---- (c)
+up_write(i_gc_rwsem)
+
+(a) In phase 3 of f2fs_gc(), up-to-date page is read from storage and
+    cached in META_MAPPING.
+(b) In thread B, writing new data by IPU or DIO write on same blkaddr as
+    read in (a). cached page in META_MAPPING become out-dated.
+(c) In phase 4 of f2fs_gc(), out-dated page in META_MAPPING is copied to
+    new blkaddr. In conclusion, the newly written data in (b) is lost.
+
+To address this issue, invalidating pages in META_MAPPING before IPU or
+DIO write.
+
+Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC")
+Signed-off-by: Hyeong-Jun Kim <hj514.kim@samsung.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: fd244524c2cf ("f2fs: compress: fix to cover normal cluster write with cp_rwsem")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c    | 2 ++
+ fs/f2fs/segment.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index e005f97fd273e..25dafd1261d71 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1711,6 +1711,8 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 		 */
+ 		f2fs_wait_on_block_writeback_range(inode,
+ 						map->m_pblk, map->m_len);
++		invalidate_mapping_pages(META_MAPPING(sbi),
++						map->m_pblk, map->m_pblk);
+ 
+ 		if (map->m_multidev_dio) {
+ 			block_t blk_addr = map->m_pblk;
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 25d53617a50e6..5eca50e50e16b 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3622,6 +3622,9 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
+ 		goto drop_bio;
+ 	}
+ 
++	invalidate_mapping_pages(META_MAPPING(sbi),
++				fio->new_blkaddr, fio->new_blkaddr);
++
+ 	stat_inc_inplace_blocks(fio->sbi);
+ 
+ 	if (fio->bio && !(SM_I(sbi)->ipu_policy & (1 << F2FS_IPU_NOCACHE)))
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-multidevice-support-direct-io.patch b/queue-5.15/f2fs-multidevice-support-direct-io.patch
new file mode 100644
index 00000000000..06f5d762a47
--- /dev/null
+++ b/queue-5.15/f2fs-multidevice-support-direct-io.patch
@@ -0,0 +1,390 @@
+From 325c5eef7092bcad9329adb0e71d5fec2fc5f21b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Sep 2021 14:39:20 +0800
+Subject: f2fs: multidevice: support direct IO
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 71f2c8206202584c644eef5ca7efe91fc8305c1f ]
+
+Commit 3c62be17d4f5 ("f2fs: support multiple devices") missed
+to support direct IO for multiple device feature, this patch
+adds to support the missing part of multidevice feature.
+
+In addition, for multiple device image, we should be aware of
+any issued direct write IO rather than just buffered write IO,
+so that fsync and syncfs can issue a preflush command to the
+device where direct write IO goes, to persist user data for
+posix compliant.
+
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: fd244524c2cf ("f2fs: compress: fix to cover normal cluster write with cp_rwsem")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c              | 57 +++++++++++++++++++++++++++++++++++--
+ fs/f2fs/f2fs.h              | 25 ++++++++++++++--
+ fs/f2fs/segment.c           | 35 ++++++++++++++---------
+ fs/f2fs/super.c             |  7 +++++
+ include/trace/events/f2fs.h | 21 ++++++++++----
+ 5 files changed, 120 insertions(+), 25 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 5766a9f0773b1..e005f97fd273e 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1468,10 +1468,15 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 	struct extent_info ei = {0, };
+ 	block_t blkaddr;
+ 	unsigned int start_pgofs;
++	int bidx = 0;
+ 
+ 	if (!maxblocks)
+ 		return 0;
+ 
++	map->m_bdev = inode->i_sb->s_bdev;
++	map->m_multidev_dio =
++		f2fs_allow_multi_device_dio(F2FS_I_SB(inode), flag);
++
+ 	map->m_len = 0;
+ 	map->m_flags = 0;
+ 
+@@ -1494,6 +1499,21 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 		if (flag == F2FS_GET_BLOCK_DIO)
+ 			f2fs_wait_on_block_writeback_range(inode,
+ 						map->m_pblk, map->m_len);
++
++		if (map->m_multidev_dio) {
++			block_t blk_addr = map->m_pblk;
++
++			bidx = f2fs_target_device_index(sbi, map->m_pblk);
++
++			map->m_bdev = FDEV(bidx).bdev;
++			map->m_pblk -= FDEV(bidx).start_blk;
++			map->m_len = min(map->m_len,
++				FDEV(bidx).end_blk + 1 - map->m_pblk);
++
++			if (map->m_may_create)
++				f2fs_update_device_state(sbi, inode->i_ino,
++							blk_addr, map->m_len);
++		}
+ 		goto out;
+ 	}
+ 
+@@ -1612,6 +1632,9 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 	if (flag == F2FS_GET_BLOCK_PRE_AIO)
+ 		goto skip;
+ 
++	if (map->m_multidev_dio)
++		bidx = f2fs_target_device_index(sbi, blkaddr);
++
+ 	if (map->m_len == 0) {
+ 		/* preallocated unwritten block should be mapped for fiemap. */
+ 		if (blkaddr == NEW_ADDR)
+@@ -1620,10 +1643,15 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 
+ 		map->m_pblk = blkaddr;
+ 		map->m_len = 1;
++
++		if (map->m_multidev_dio)
++			map->m_bdev = FDEV(bidx).bdev;
+ 	} else if ((map->m_pblk != NEW_ADDR &&
+ 			blkaddr == (map->m_pblk + ofs)) ||
+ 			(map->m_pblk == NEW_ADDR && blkaddr == NEW_ADDR) ||
+ 			flag == F2FS_GET_BLOCK_PRE_DIO) {
++		if (map->m_multidev_dio && map->m_bdev != FDEV(bidx).bdev)
++			goto sync_out;
+ 		ofs++;
+ 		map->m_len++;
+ 	} else {
+@@ -1676,11 +1704,31 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 
+ sync_out:
+ 
+-	/* for hardware encryption, but to avoid potential issue in future */
+-	if (flag == F2FS_GET_BLOCK_DIO && map->m_flags & F2FS_MAP_MAPPED)
++	if (flag == F2FS_GET_BLOCK_DIO && map->m_flags & F2FS_MAP_MAPPED) {
++		/*
++		 * for hardware encryption, but to avoid potential issue
++		 * in future
++		 */
+ 		f2fs_wait_on_block_writeback_range(inode,
+ 						map->m_pblk, map->m_len);
+ 
++		if (map->m_multidev_dio) {
++			block_t blk_addr = map->m_pblk;
++
++			bidx = f2fs_target_device_index(sbi, map->m_pblk);
++
++			map->m_bdev = FDEV(bidx).bdev;
++			map->m_pblk -= FDEV(bidx).start_blk;
++
++			if (map->m_may_create)
++				f2fs_update_device_state(sbi, inode->i_ino,
++							blk_addr, map->m_len);
++
++			f2fs_bug_on(sbi, blk_addr + map->m_len >
++						FDEV(bidx).end_blk + 1);
++		}
++	}
++
+ 	if (flag == F2FS_GET_BLOCK_PRECACHE) {
+ 		if (map->m_flags & F2FS_MAP_MAPPED) {
+ 			unsigned int ofs = start_pgofs - map->m_lblk;
+@@ -1699,7 +1747,7 @@ int f2fs_map_blocks(struct inode *inode, struct f2fs_map_blocks *map,
+ 		f2fs_balance_fs(sbi, dn.node_changed);
+ 	}
+ out:
+-	trace_f2fs_map_blocks(inode, map, err);
++	trace_f2fs_map_blocks(inode, map, create, flag, err);
+ 	return err;
+ }
+ 
+@@ -1758,6 +1806,9 @@ static int __get_data_block(struct inode *inode, sector_t iblock,
+ 		map_bh(bh, inode->i_sb, map.m_pblk);
+ 		bh->b_state = (bh->b_state & ~F2FS_MAP_FLAGS) | map.m_flags;
+ 		bh->b_size = blks_to_bytes(inode, map.m_len);
++
++		if (map.m_multidev_dio)
++			bh->b_bdev = map.m_bdev;
+ 	}
+ 	return err;
+ }
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 4cabc37c20b90..e326e7efea391 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -622,6 +622,7 @@ struct extent_tree {
+ 				F2FS_MAP_UNWRITTEN)
+ 
+ struct f2fs_map_blocks {
++	struct block_device *m_bdev;	/* for multi-device dio */
+ 	block_t m_pblk;
+ 	block_t m_lblk;
+ 	unsigned int m_len;
+@@ -630,6 +631,7 @@ struct f2fs_map_blocks {
+ 	pgoff_t *m_next_extent;		/* point to next possible extent */
+ 	int m_seg_type;
+ 	bool m_may_create;		/* indicate it is from write path */
++	bool m_multidev_dio;		/* indicate it allows multi-device dio */
+ };
+ 
+ /* for flag in get_data_block */
+@@ -1736,12 +1738,15 @@ struct f2fs_sb_info {
+ 
+ 	/* For shrinker support */
+ 	struct list_head s_list;
++	struct mutex umount_mutex;
++	unsigned int shrinker_run_no;
++
++	/* For multi devices */
+ 	int s_ndevs;				/* number of devices */
+ 	struct f2fs_dev_info *devs;		/* for device list */
+ 	unsigned int dirty_device;		/* for checkpoint data flush */
+ 	spinlock_t dev_lock;			/* protect dirty_device */
+-	struct mutex umount_mutex;
+-	unsigned int shrinker_run_no;
++	bool aligned_blksize;			/* all devices has the same logical blksize */
+ 
+ 	/* For write statistics */
+ 	u64 sectors_written_start;
+@@ -3517,6 +3522,8 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,
+ 			block_t old_blkaddr, block_t *new_blkaddr,
+ 			struct f2fs_summary *sum, int type,
+ 			struct f2fs_io_info *fio);
++void f2fs_update_device_state(struct f2fs_sb_info *sbi, nid_t ino,
++					block_t blkaddr, unsigned int blkcnt);
+ void f2fs_wait_on_page_writeback(struct page *page,
+ 			enum page_type type, bool ordered, bool locked);
+ void f2fs_wait_on_block_writeback(struct inode *inode, block_t blkaddr);
+@@ -4335,6 +4342,16 @@ static inline int block_unaligned_IO(struct inode *inode,
+ 	return align & blocksize_mask;
+ }
+ 
++static inline bool f2fs_allow_multi_device_dio(struct f2fs_sb_info *sbi,
++								int flag)
++{
++	if (!f2fs_is_multi_device(sbi))
++		return false;
++	if (flag != F2FS_GET_BLOCK_DIO)
++		return false;
++	return sbi->aligned_blksize;
++}
++
+ static inline bool f2fs_force_buffered_io(struct inode *inode,
+ 				struct kiocb *iocb, struct iov_iter *iter)
+ {
+@@ -4343,7 +4360,9 @@ static inline bool f2fs_force_buffered_io(struct inode *inode,
+ 
+ 	if (f2fs_post_read_required(inode))
+ 		return true;
+-	if (f2fs_is_multi_device(sbi))
++
++	/* disallow direct IO if any of devices has unaligned blksize */
++	if (f2fs_is_multi_device(sbi) && !sbi->aligned_blksize)
+ 		return true;
+ 	/*
+ 	 * for blkzoned device, fallback direct IO to buffered IO, so
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 79ad696cddec0..25d53617a50e6 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3490,24 +3490,30 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,
+ 	up_read(&SM_I(sbi)->curseg_lock);
+ }
+ 
+-static void update_device_state(struct f2fs_io_info *fio)
++void f2fs_update_device_state(struct f2fs_sb_info *sbi, nid_t ino,
++					block_t blkaddr, unsigned int blkcnt)
+ {
+-	struct f2fs_sb_info *sbi = fio->sbi;
+-	unsigned int devidx;
+-
+ 	if (!f2fs_is_multi_device(sbi))
+ 		return;
+ 
+-	devidx = f2fs_target_device_index(sbi, fio->new_blkaddr);
++	while (1) {
++		unsigned int devidx = f2fs_target_device_index(sbi, blkaddr);
++		unsigned int blks = FDEV(devidx).end_blk - blkaddr + 1;
+ 
+-	/* update device state for fsync */
+-	f2fs_set_dirty_device(sbi, fio->ino, devidx, FLUSH_INO);
++		/* update device state for fsync */
++		f2fs_set_dirty_device(sbi, ino, devidx, FLUSH_INO);
+ 
+-	/* update device state for checkpoint */
+-	if (!f2fs_test_bit(devidx, (char *)&sbi->dirty_device)) {
+-		spin_lock(&sbi->dev_lock);
+-		f2fs_set_bit(devidx, (char *)&sbi->dirty_device);
+-		spin_unlock(&sbi->dev_lock);
++		/* update device state for checkpoint */
++		if (!f2fs_test_bit(devidx, (char *)&sbi->dirty_device)) {
++			spin_lock(&sbi->dev_lock);
++			f2fs_set_bit(devidx, (char *)&sbi->dirty_device);
++			spin_unlock(&sbi->dev_lock);
++		}
++
++		if (blkcnt <= blks)
++			break;
++		blkcnt -= blks;
++		blkaddr += blks;
+ 	}
+ }
+ 
+@@ -3534,7 +3540,7 @@ static void do_write_page(struct f2fs_summary *sum, struct f2fs_io_info *fio)
+ 		goto reallocate;
+ 	}
+ 
+-	update_device_state(fio);
++	f2fs_update_device_state(fio->sbi, fio->ino, fio->new_blkaddr, 1);
+ 
+ 	if (keep_order)
+ 		up_read(&fio->sbi->io_order_lock);
+@@ -3623,7 +3629,8 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
+ 	else
+ 		err = f2fs_submit_page_bio(fio);
+ 	if (!err) {
+-		update_device_state(fio);
++		f2fs_update_device_state(fio->sbi, fio->ino,
++						fio->new_blkaddr, 1);
+ 		f2fs_update_iostat(fio->sbi, fio->io_type, F2FS_BLKSIZE);
+ 	}
+ 
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index d4a76c2deb806..5160bf4f4a3ec 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3831,6 +3831,7 @@ static int f2fs_scan_devices(struct f2fs_sb_info *sbi)
+ {
+ 	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
+ 	unsigned int max_devices = MAX_DEVICES;
++	unsigned int logical_blksize;
+ 	int i;
+ 
+ 	/* Initialize single device information */
+@@ -3851,6 +3852,9 @@ static int f2fs_scan_devices(struct f2fs_sb_info *sbi)
+ 	if (!sbi->devs)
+ 		return -ENOMEM;
+ 
++	logical_blksize = bdev_logical_block_size(sbi->sb->s_bdev);
++	sbi->aligned_blksize = true;
++
+ 	for (i = 0; i < max_devices; i++) {
+ 
+ 		if (i > 0 && !RDEV(i).path[0])
+@@ -3887,6 +3891,9 @@ static int f2fs_scan_devices(struct f2fs_sb_info *sbi)
+ 		/* to release errored devices */
+ 		sbi->s_ndevs = i + 1;
+ 
++		if (logical_blksize != bdev_logical_block_size(FDEV(i).bdev))
++			sbi->aligned_blksize = false;
++
+ #ifdef CONFIG_BLK_DEV_ZONED
+ 		if (bdev_zoned_model(FDEV(i).bdev) == BLK_ZONED_HM &&
+ 				!f2fs_sb_has_blkzoned(sbi)) {
+diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h
+index 6033eaddcb749..8670adaa23f91 100644
+--- a/include/trace/events/f2fs.h
++++ b/include/trace/events/f2fs.h
+@@ -570,9 +570,10 @@ TRACE_EVENT(f2fs_file_write_iter,
+ );
+ 
+ TRACE_EVENT(f2fs_map_blocks,
+-	TP_PROTO(struct inode *inode, struct f2fs_map_blocks *map, int ret),
++	TP_PROTO(struct inode *inode, struct f2fs_map_blocks *map,
++				int create, int flag, int ret),
+ 
+-	TP_ARGS(inode, map, ret),
++	TP_ARGS(inode, map, create, flag, ret),
+ 
+ 	TP_STRUCT__entry(
+ 		__field(dev_t,	dev)
+@@ -583,11 +584,14 @@ TRACE_EVENT(f2fs_map_blocks,
+ 		__field(unsigned int,	m_flags)
+ 		__field(int,	m_seg_type)
+ 		__field(bool,	m_may_create)
++		__field(bool,	m_multidev_dio)
++		__field(int,	create)
++		__field(int,	flag)
+ 		__field(int,	ret)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__entry->dev		= inode->i_sb->s_dev;
++		__entry->dev		= map->m_bdev->bd_dev;
+ 		__entry->ino		= inode->i_ino;
+ 		__entry->m_lblk		= map->m_lblk;
+ 		__entry->m_pblk		= map->m_pblk;
+@@ -595,12 +599,16 @@ TRACE_EVENT(f2fs_map_blocks,
+ 		__entry->m_flags	= map->m_flags;
+ 		__entry->m_seg_type	= map->m_seg_type;
+ 		__entry->m_may_create	= map->m_may_create;
++		__entry->m_multidev_dio	= map->m_multidev_dio;
++		__entry->create		= create;
++		__entry->flag		= flag;
+ 		__entry->ret		= ret;
+ 	),
+ 
+ 	TP_printk("dev = (%d,%d), ino = %lu, file offset = %llu, "
+-		"start blkaddr = 0x%llx, len = 0x%llx, flags = %u,"
+-		"seg_type = %d, may_create = %d, err = %d",
++		"start blkaddr = 0x%llx, len = 0x%llx, flags = %u, "
++		"seg_type = %d, may_create = %d, multidevice = %d, "
++		"create = %d, flag = %d, err = %d",
+ 		show_dev_ino(__entry),
+ 		(unsigned long long)__entry->m_lblk,
+ 		(unsigned long long)__entry->m_pblk,
+@@ -608,6 +616,9 @@ TRACE_EVENT(f2fs_map_blocks,
+ 		__entry->m_flags,
+ 		__entry->m_seg_type,
+ 		__entry->m_may_create,
++		__entry->m_multidev_dio,
++		__entry->create,
++		__entry->flag,
+ 		__entry->ret)
+ );
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-reduce-stack-memory-cost-by-using-bitfield-in-s.patch b/queue-5.15/f2fs-reduce-stack-memory-cost-by-using-bitfield-in-s.patch
new file mode 100644
index 00000000000..c9b8feeb1d8
--- /dev/null
+++ b/queue-5.15/f2fs-reduce-stack-memory-cost-by-using-bitfield-in-s.patch
@@ -0,0 +1,231 @@
+From 4b9f76e8b38bf03ffc04feb6d69e1c89279e8c9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 15:04:56 +0800
+Subject: f2fs: reduce stack memory cost by using bitfield in struct
+ f2fs_io_info
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 2eae077e6e46f9046d383631145750e043820dce ]
+
+This patch tries to use bitfield in struct f2fs_io_info to improve
+memory usage.
+
+struct f2fs_io_info {
+...
+	unsigned int need_lock:8;	/* indicate we need to lock cp_rwsem */
+	unsigned int version:8;		/* version of the node */
+	unsigned int submitted:1;	/* indicate IO submission */
+	unsigned int in_list:1;		/* indicate fio is in io_list */
+	unsigned int is_por:1;		/* indicate IO is from recovery or not */
+	unsigned int retry:1;		/* need to reallocate block address */
+	unsigned int encrypted:1;	/* indicate file is encrypted */
+	unsigned int post_read:1;	/* require post read */
+...
+};
+
+After this patch, size of struct f2fs_io_info reduces from 136 to 120.
+
+[Nathan: fix a compile warning (single-bit-bitfield-constant-conversion)]
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Stable-dep-of: fd244524c2cf ("f2fs: compress: fix to cover normal cluster write with cp_rwsem")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/checkpoint.c |  6 +++---
+ fs/f2fs/compress.c   |  5 +++--
+ fs/f2fs/data.c       | 10 +++++-----
+ fs/f2fs/f2fs.h       | 18 +++++++++---------
+ fs/f2fs/gc.c         |  8 ++++----
+ fs/f2fs/node.c       |  2 +-
+ fs/f2fs/segment.c    |  6 +++---
+ 7 files changed, 28 insertions(+), 27 deletions(-)
+
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index d6ae6de35af20..7d3e7418d8fd5 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -66,7 +66,7 @@ static struct page *__get_meta_page(struct f2fs_sb_info *sbi, pgoff_t index,
+ 		.old_blkaddr = index,
+ 		.new_blkaddr = index,
+ 		.encrypted_page = NULL,
+-		.is_por = !is_meta,
++		.is_por = !is_meta ? 1 : 0,
+ 	};
+ 	int err;
+ 
+@@ -229,8 +229,8 @@ int f2fs_ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
+ 		.op = REQ_OP_READ,
+ 		.op_flags = sync ? (REQ_META | REQ_PRIO) : REQ_RAHEAD,
+ 		.encrypted_page = NULL,
+-		.in_list = false,
+-		.is_por = (type == META_POR),
++		.in_list = 0,
++		.is_por = (type == META_POR) ? 1 : 0,
+ 	};
+ 	struct blk_plug plug;
+ 	int err;
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index c640e4c63909a..f8de64cb8fbcc 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1233,10 +1233,11 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc,
+ 		.page = NULL,
+ 		.encrypted_page = NULL,
+ 		.compressed_page = NULL,
+-		.submitted = false,
++		.submitted = 0,
+ 		.io_type = io_type,
+ 		.io_wbc = wbc,
+-		.encrypted = fscrypt_inode_uses_fs_layer_crypto(cc->inode),
++		.encrypted = fscrypt_inode_uses_fs_layer_crypto(cc->inode) ?
++									1 : 0,
+ 	};
+ 	struct dnode_of_data dn;
+ 	struct node_info ni;
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 4f122a806cf88..cb63352589390 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -933,7 +933,7 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 		bio_page = fio->page;
+ 
+ 	/* set submitted = true as a return value */
+-	fio->submitted = true;
++	fio->submitted = 1;
+ 
+ 	inc_page_count(sbi, WB_DATA_TYPE(bio_page));
+ 
+@@ -949,7 +949,7 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 				(fio->type == DATA || fio->type == NODE) &&
+ 				fio->new_blkaddr & F2FS_IO_SIZE_MASK(sbi)) {
+ 			dec_page_count(sbi, WB_DATA_TYPE(bio_page));
+-			fio->retry = true;
++			fio->retry = 1;
+ 			goto skip;
+ 		}
+ 		io->bio = __bio_alloc(fio, BIO_MAX_VECS);
+@@ -2800,10 +2800,10 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 		.old_blkaddr = NULL_ADDR,
+ 		.page = page,
+ 		.encrypted_page = NULL,
+-		.submitted = false,
++		.submitted = 0,
+ 		.compr_blocks = compr_blocks,
+ 		.need_lock = LOCK_RETRY,
+-		.post_read = f2fs_post_read_required(inode),
++		.post_read = f2fs_post_read_required(inode) ? 1 : 0,
+ 		.io_type = io_type,
+ 		.io_wbc = wbc,
+ 		.bio = bio,
+@@ -2931,7 +2931,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 	}
+ 
+ 	if (submitted)
+-		*submitted = fio.submitted ? 1 : 0;
++		*submitted = fio.submitted;
+ 
+ 	return 0;
+ 
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index d961a2779b6e7..0eafefc242b11 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1170,19 +1170,19 @@ struct f2fs_io_info {
+ 	struct page *encrypted_page;	/* encrypted page */
+ 	struct page *compressed_page;	/* compressed page */
+ 	struct list_head list;		/* serialize IOs */
+-	bool submitted;		/* indicate IO submission */
+-	int need_lock;		/* indicate we need to lock cp_rwsem */
+-	bool in_list;		/* indicate fio is in io_list */
+-	bool is_por;		/* indicate IO is from recovery or not */
+-	bool retry;		/* need to reallocate block address */
+-	int compr_blocks;	/* # of compressed block addresses */
+-	bool encrypted;		/* indicate file is encrypted */
+-	bool post_read;		/* require post read */
++	unsigned int compr_blocks;	/* # of compressed block addresses */
++	unsigned int need_lock:8;	/* indicate we need to lock cp_rwsem */
++	unsigned int version:8;		/* version of the node */
++	unsigned int submitted:1;	/* indicate IO submission */
++	unsigned int in_list:1;		/* indicate fio is in io_list */
++	unsigned int is_por:1;		/* indicate IO is from recovery or not */
++	unsigned int retry:1;		/* need to reallocate block address */
++	unsigned int encrypted:1;	/* indicate file is encrypted */
++	unsigned int post_read:1;	/* require post read */
+ 	enum iostat_type io_type;	/* io type */
+ 	struct writeback_control *io_wbc; /* writeback control */
+ 	struct bio **bio;		/* bio for ipu */
+ 	sector_t *last_block;		/* last block number in bio */
+-	unsigned char version;		/* version of the node */
+ };
+ 
+ struct bio_entry {
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 2c13f308c74e3..9a57754e6e0c1 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1080,8 +1080,8 @@ static int ra_data_block(struct inode *inode, pgoff_t index)
+ 		.op = REQ_OP_READ,
+ 		.op_flags = 0,
+ 		.encrypted_page = NULL,
+-		.in_list = false,
+-		.retry = false,
++		.in_list = 0,
++		.retry = 0,
+ 	};
+ 	int err;
+ 
+@@ -1167,8 +1167,8 @@ static int move_data_block(struct inode *inode, block_t bidx,
+ 		.op = REQ_OP_READ,
+ 		.op_flags = 0,
+ 		.encrypted_page = NULL,
+-		.in_list = false,
+-		.retry = false,
++		.in_list = 0,
++		.retry = 0,
+ 	};
+ 	struct dnode_of_data dn;
+ 	struct f2fs_summary sum;
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 195658263f0a4..dc85dd55314cc 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1583,7 +1583,7 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted,
+ 		.op_flags = wbc_to_write_flags(wbc),
+ 		.page = page,
+ 		.encrypted_page = NULL,
+-		.submitted = false,
++		.submitted = 0,
+ 		.io_type = io_type,
+ 		.io_wbc = wbc,
+ 	};
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 43fabd17bb4e7..b454496ca67a1 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3473,10 +3473,10 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,
+ 		struct f2fs_bio_info *io;
+ 
+ 		if (F2FS_IO_ALIGNED(sbi))
+-			fio->retry = false;
++			fio->retry = 0;
+ 
+ 		INIT_LIST_HEAD(&fio->list);
+-		fio->in_list = true;
++		fio->in_list = 1;
+ 		io = sbi->write_io[fio->type] + fio->temp;
+ 		spin_lock(&io->io_lock);
+ 		list_add_tail(&fio->list, &io->io_list);
+@@ -3557,7 +3557,7 @@ void f2fs_do_write_meta_page(struct f2fs_sb_info *sbi, struct page *page,
+ 		.new_blkaddr = page->index,
+ 		.page = page,
+ 		.encrypted_page = NULL,
+-		.in_list = false,
++		.in_list = 0,
+ 	};
+ 
+ 	if (unlikely(page->index >= MAIN_BLKADDR(sbi)))
+-- 
+2.43.0
+
diff --git a/queue-5.15/f2fs-replace-congestion_wait-calls-with-io_schedule_.patch b/queue-5.15/f2fs-replace-congestion_wait-calls-with-io_schedule_.patch
new file mode 100644
index 00000000000..7a8eab74778
--- /dev/null
+++ b/queue-5.15/f2fs-replace-congestion_wait-calls-with-io_schedule_.patch
@@ -0,0 +1,150 @@
+From 9ac41501f4122eea53f747b19dabaff9a9393555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Mar 2022 14:39:13 -0700
+Subject: f2fs: replace congestion_wait() calls with io_schedule_timeout()
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit a64239d0ef345208d8c15d7841a028a43a34c068 ]
+
+As congestion is no longer tracked, congestion_wait() is effectively
+equivalent to io_schedule_timeout().
+
+So introduce f2fs_io_schedule_timeout() which sets TASK_UNINTERRUPTIBLE
+and call that instead.
+
+Link: https://lkml.kernel.org/r/164549983744.9187.6425865370954230902.stgit@noble.brown
+Signed-off-by: NeilBrown <neilb@suse.de>
+Cc: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Cc: Chao Yu <chao@kernel.org>
+Cc: Darrick J. Wong <djwong@kernel.org>
+Cc: Ilya Dryomov <idryomov@gmail.com>
+Cc: Jaegeuk Kim <jaegeuk@kernel.org>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Jeff Layton <jlayton@kernel.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Lars Ellenberg <lars.ellenberg@linbit.com>
+Cc: Miklos Szeredi <miklos@szeredi.hu>
+Cc: Paolo Valente <paolo.valente@linaro.org>
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: Ryusuke Konishi <konishi.ryusuke@gmail.com>
+Cc: Trond Myklebust <trond.myklebust@hammerspace.com>
+Cc: Wu Fengguang <fengguang.wu@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Stable-dep-of: fd244524c2cf ("f2fs: compress: fix to cover normal cluster write with cp_rwsem")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 4 +---
+ fs/f2fs/data.c     | 3 +--
+ fs/f2fs/f2fs.h     | 6 ++++++
+ fs/f2fs/segment.c  | 8 +++-----
+ fs/f2fs/super.c    | 6 ++----
+ 5 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 7b4479d5b5315..c640e4c63909a 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1504,9 +1504,7 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 				if (IS_NOQUOTA(cc->inode))
+ 					return 0;
+ 				ret = 0;
+-				cond_resched();
+-				congestion_wait(BLK_RW_ASYNC,
+-						DEFAULT_IO_TIMEOUT);
++				f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 				goto retry_write;
+ 			}
+ 			return ret;
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 25dafd1261d71..19b595488a27b 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -3158,8 +3158,7 @@ static int f2fs_write_cache_pages(struct address_space *mapping,
+ 				} else if (ret == -EAGAIN) {
+ 					ret = 0;
+ 					if (wbc->sync_mode == WB_SYNC_ALL) {
+-						cond_resched();
+-						congestion_wait(BLK_RW_ASYNC,
++						f2fs_io_schedule_timeout(
+ 							DEFAULT_IO_TIMEOUT);
+ 						goto retry_write;
+ 					}
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index e326e7efea391..dfaee211f6133 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -4413,6 +4413,12 @@ static inline bool f2fs_block_unit_discard(struct f2fs_sb_info *sbi)
+ 	return F2FS_OPTION(sbi).discard_unit == DISCARD_UNIT_BLOCK;
+ }
+ 
++static inline void f2fs_io_schedule_timeout(long timeout)
++{
++	set_current_state(TASK_UNINTERRUPTIBLE);
++	io_schedule_timeout(timeout);
++}
++
+ #define EFSBADCRC	EBADMSG		/* Bad CRC detected */
+ #define EFSCORRUPTED	EUCLEAN		/* Filesystem is corrupted */
+ 
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 5eca50e50e16b..cbdd8d0ec8960 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -313,8 +313,7 @@ void f2fs_drop_inmem_pages_all(struct f2fs_sb_info *sbi, bool gc_failure)
+ skip:
+ 		iput(inode);
+ 	}
+-	congestion_wait(BLK_RW_ASYNC, DEFAULT_IO_TIMEOUT);
+-	cond_resched();
++	f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 	if (gc_failure) {
+ 		if (++looped >= count)
+ 			return;
+@@ -789,8 +788,7 @@ int f2fs_flush_device_cache(struct f2fs_sb_info *sbi)
+ 		do {
+ 			ret = __submit_flush_wait(sbi, FDEV(i).bdev);
+ 			if (ret)
+-				congestion_wait(BLK_RW_ASYNC,
+-						DEFAULT_IO_TIMEOUT);
++				f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 		} while (ret && --count);
+ 
+ 		if (ret) {
+@@ -3106,7 +3104,7 @@ static unsigned int __issue_discard_cmd_range(struct f2fs_sb_info *sbi,
+ 			blk_finish_plug(&plug);
+ 			mutex_unlock(&dcc->cmd_lock);
+ 			trimmed += __wait_all_discard_cmd(sbi, NULL);
+-			congestion_wait(BLK_RW_ASYNC, DEFAULT_IO_TIMEOUT);
++			f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 			goto next;
+ 		}
+ skip:
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 5160bf4f4a3ec..df1e5496352c2 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2168,8 +2168,7 @@ static void f2fs_enable_checkpoint(struct f2fs_sb_info *sbi)
+ 	/* we should flush all the data to keep data consistency */
+ 	do {
+ 		sync_inodes_sb(sbi->sb);
+-		cond_resched();
+-		congestion_wait(BLK_RW_ASYNC, DEFAULT_IO_TIMEOUT);
++		f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 	} while (get_pages(sbi, F2FS_DIRTY_DATA) && retry--);
+ 
+ 	if (unlikely(retry < 0))
+@@ -2540,8 +2539,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type,
+ 							&page, &fsdata);
+ 		if (unlikely(err)) {
+ 			if (err == -ENOMEM) {
+-				congestion_wait(BLK_RW_ASYNC,
+-						DEFAULT_IO_TIMEOUT);
++				f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 				goto retry;
+ 			}
+ 			set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR);
+-- 
+2.43.0
+
diff --git a/queue-5.15/fs-select-rework-stack-allocation-hack-for-clang.patch b/queue-5.15/fs-select-rework-stack-allocation-hack-for-clang.patch
new file mode 100644
index 00000000000..a360819aaf8
--- /dev/null
+++ b/queue-5.15/fs-select-rework-stack-allocation-hack-for-clang.patch
@@ -0,0 +1,67 @@
+From 1d05f0c3253c69beeec2f612c141d3eeaeb44a74 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 21:23:34 +0100
+Subject: fs/select: rework stack allocation hack for clang
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit ddb9fd7a544088ed70eccbb9f85e9cc9952131c1 ]
+
+A while ago, we changed the way that select() and poll() preallocate
+a temporary buffer just under the size of the static warning limit of
+1024 bytes, as clang was frequently going slightly above that limit.
+
+The warnings have recently returned and I took another look. As it turns
+out, clang is not actually inherently worse at reserving stack space,
+it just happens to inline do_select() into core_sys_select(), while gcc
+never inlines it.
+
+Annotate do_select() to never be inlined and in turn remove the special
+case for the allocation size. This should give the same behavior for
+both clang and gcc all the time and once more avoids those warnings.
+
+Fixes: ad312f95d41c ("fs/select: avoid clang stack usage warning")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240216202352.2492798-1-arnd@kernel.org
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/select.c          | 2 +-
+ include/linux/poll.h | 4 ----
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/fs/select.c b/fs/select.c
+index 5edffee1162c2..668a5200503ae 100644
+--- a/fs/select.c
++++ b/fs/select.c
+@@ -475,7 +475,7 @@ static inline void wait_key_set(poll_table *wait, unsigned long in,
+ 		wait->_key |= POLLOUT_SET;
+ }
+ 
+-static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
++static noinline_for_stack int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
+ {
+ 	ktime_t expire, *to = NULL;
+ 	struct poll_wqueues table;
+diff --git a/include/linux/poll.h b/include/linux/poll.h
+index 1cdc32b1f1b08..7e0fdcf905d2e 100644
+--- a/include/linux/poll.h
++++ b/include/linux/poll.h
+@@ -16,11 +16,7 @@
+ extern struct ctl_table epoll_table[]; /* for sysctl */
+ /* ~832 bytes of stack space used max in sys_select/sys_poll before allocating
+    additional memory. */
+-#ifdef __clang__
+-#define MAX_STACK_ALLOC 768
+-#else
+ #define MAX_STACK_ALLOC 832
+-#endif
+ #define FRONTEND_STACK_ALLOC	256
+ #define SELECT_STACK_ALLOC	FRONTEND_STACK_ALLOC
+ #define POLL_STACK_ALLOC	FRONTEND_STACK_ALLOC
+-- 
+2.43.0
+
diff --git a/queue-5.15/hid-amd_sfh-update-hpd-sensor-structure-elements.patch b/queue-5.15/hid-amd_sfh-update-hpd-sensor-structure-elements.patch
new file mode 100644
index 00000000000..3ad39c55f18
--- /dev/null
+++ b/queue-5.15/hid-amd_sfh-update-hpd-sensor-structure-elements.patch
@@ -0,0 +1,44 @@
+From 2beacef82f51c5fea3e15578160c13b083b708a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 20:11:41 +0530
+Subject: HID: amd_sfh: Update HPD sensor structure elements
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit bbf0dec30696638b8bdc28cb2f5bf23f8d760b52 ]
+
+HPD sensor data is not populating properly because of wrong order of HPD
+sensor structure elements. So update the order of structure elements to
+match the HPD sensor data received from the firmware.
+
+Fixes: 24a31ea94922 ("HID: amd_sfh: Add initial support for HPD sensor")
+Co-developed-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
+Signed-off-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_pcie.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
+index 2d3203d3daeb3..90f39bfe8050e 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
+@@ -119,10 +119,10 @@ enum mem_use_type {
+ struct hpd_status {
+ 	union {
+ 		struct {
+-			u32 human_presence_report : 4;
+-			u32 human_presence_actual : 4;
+-			u32 probablity		  : 8;
+ 			u32 object_distance       : 16;
++			u32 probablity		  : 8;
++			u32 human_presence_actual : 4;
++			u32 human_presence_report : 4;
+ 		} shpd;
+ 		u32 val;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-5.15/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch b/queue-5.15/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
new file mode 100644
index 00000000000..ddd7d2f1e2e
--- /dev/null
+++ b/queue-5.15/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
@@ -0,0 +1,134 @@
+From 0d06c178dc09c2568f604194a2ddf41ff89cb5d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Dec 2023 21:12:13 +0200
+Subject: HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
+
+From: Mikhail Khvainitski <me@khvoinitsky.org>
+
+[ Upstream commit 2814646f76f8518326964f12ff20aaee70ba154d ]
+
+Previous attempt to autodetect well-behaving patched firmware
+introduced in commit 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw
+on cptkbd and stop applying workaround") has shown that there are
+false-positives on original firmware (on both 1st gen and 2nd gen
+keyboards) which causes the middle button click workaround to be
+mistakenly disabled.
+
+This commit adds explicit parameter to sysfs to control this
+workaround.
+
+Fixes: 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround")
+Fixes: 43527a0094c1 ("HID: lenovo: Restrict detection of patched firmware only to USB cptkbd")
+Signed-off-by: Mikhail Khvainitski <me@khvoinitsky.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-lenovo.c | 57 +++++++++++++++++++++++++++-------------
+ 1 file changed, 39 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index 965bddaa90aee..44fd4a05ace38 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -53,10 +53,10 @@ struct lenovo_drvdata {
+ 	/* 0: Up
+ 	 * 1: Down (undecided)
+ 	 * 2: Scrolling
+-	 * 3: Patched firmware, disable workaround
+ 	 */
+ 	u8 middlebutton_state;
+ 	bool fn_lock;
++	bool middleclick_workaround_cptkbd;
+ };
+ 
+ #define map_key_clear(c) hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c))
+@@ -469,6 +469,36 @@ static ssize_t attr_sensitivity_store_cptkbd(struct device *dev,
+ 	return count;
+ }
+ 
++static ssize_t attr_middleclick_workaround_show_cptkbd(struct device *dev,
++		struct device_attribute *attr,
++		char *buf)
++{
++	struct hid_device *hdev = to_hid_device(dev);
++	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
++
++	return snprintf(buf, PAGE_SIZE, "%u\n",
++		cptkbd_data->middleclick_workaround_cptkbd);
++}
++
++static ssize_t attr_middleclick_workaround_store_cptkbd(struct device *dev,
++		struct device_attribute *attr,
++		const char *buf,
++		size_t count)
++{
++	struct hid_device *hdev = to_hid_device(dev);
++	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
++	int value;
++
++	if (kstrtoint(buf, 10, &value))
++		return -EINVAL;
++	if (value < 0 || value > 1)
++		return -EINVAL;
++
++	cptkbd_data->middleclick_workaround_cptkbd = !!value;
++
++	return count;
++}
++
+ 
+ static struct device_attribute dev_attr_fn_lock =
+ 	__ATTR(fn_lock, S_IWUSR | S_IRUGO,
+@@ -480,10 +510,16 @@ static struct device_attribute dev_attr_sensitivity_cptkbd =
+ 			attr_sensitivity_show_cptkbd,
+ 			attr_sensitivity_store_cptkbd);
+ 
++static struct device_attribute dev_attr_middleclick_workaround_cptkbd =
++	__ATTR(middleclick_workaround, S_IWUSR | S_IRUGO,
++			attr_middleclick_workaround_show_cptkbd,
++			attr_middleclick_workaround_store_cptkbd);
++
+ 
+ static struct attribute *lenovo_attributes_cptkbd[] = {
+ 	&dev_attr_fn_lock.attr,
+ 	&dev_attr_sensitivity_cptkbd.attr,
++	&dev_attr_middleclick_workaround_cptkbd.attr,
+ 	NULL
+ };
+ 
+@@ -534,23 +570,7 @@ static int lenovo_event_cptkbd(struct hid_device *hdev,
+ {
+ 	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
+ 
+-	if (cptkbd_data->middlebutton_state != 3) {
+-		/* REL_X and REL_Y events during middle button pressed
+-		 * are only possible on patched, bug-free firmware
+-		 * so set middlebutton_state to 3
+-		 * to never apply workaround anymore
+-		 */
+-		if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD &&
+-				cptkbd_data->middlebutton_state == 1 &&
+-				usage->type == EV_REL &&
+-				(usage->code == REL_X || usage->code == REL_Y)) {
+-			cptkbd_data->middlebutton_state = 3;
+-			/* send middle button press which was hold before */
+-			input_event(field->hidinput->input,
+-				EV_KEY, BTN_MIDDLE, 1);
+-			input_sync(field->hidinput->input);
+-		}
+-
++	if (cptkbd_data->middleclick_workaround_cptkbd) {
+ 		/* "wheel" scroll events */
+ 		if (usage->type == EV_REL && (usage->code == REL_WHEEL ||
+ 				usage->code == REL_HWHEEL)) {
+@@ -1015,6 +1035,7 @@ static int lenovo_probe_cptkbd(struct hid_device *hdev)
+ 	cptkbd_data->middlebutton_state = 0;
+ 	cptkbd_data->fn_lock = true;
+ 	cptkbd_data->sensitivity = 0x05;
++	cptkbd_data->middleclick_workaround_cptkbd = true;
+ 	lenovo_features_set_cptkbd(hdev);
+ 
+ 	ret = sysfs_create_group(&hdev->dev.kobj, &lenovo_attr_group_cptkbd);
+-- 
+2.43.0
+
diff --git a/queue-5.15/igb-fix-missing-time-sync-events.patch b/queue-5.15/igb-fix-missing-time-sync-events.patch
new file mode 100644
index 00000000000..919f027c87f
--- /dev/null
+++ b/queue-5.15/igb-fix-missing-time-sync-events.patch
@@ -0,0 +1,94 @@
+From 754328384c8e0637cf4213a434f3babcf85b1c99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:57:11 -0800
+Subject: igb: Fix missing time sync events
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit ee14cc9ea19ba9678177e2224a9c58cce5937c73 ]
+
+Fix "double" clearing of interrupts, which can cause external events
+or timestamps to be missed.
+
+The E1000_TSIRC Time Sync Interrupt Cause register can be cleared in two
+ways, by either reading it or by writing '1' into the specific cause
+bit. This is documented in section 8.16.1.
+
+The following flow was used:
+    1. read E1000_TSIRC into 'tsicr';
+    2. handle the interrupts present into 'tsirc' and mark them in 'ack';
+    3. write 'ack' into E1000_TSICR;
+
+As both (1) and (3) will clear the interrupt cause, if the same
+interrupt happens again between (1) and (3) it will be ignored,
+causing events to be missed.
+
+Remove the extra clear in (3).
+
+Fixes: 00c65578b47b ("igb: enable internal PPS for the i210")
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 23 +++++------------------
+ 1 file changed, 5 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index eec0ad98c445f..03a4da6a14478 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -6800,44 +6800,31 @@ static void igb_extts(struct igb_adapter *adapter, int tsintr_tt)
+ static void igb_tsync_interrupt(struct igb_adapter *adapter)
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+-	u32 ack = 0, tsicr = rd32(E1000_TSICR);
++	u32 tsicr = rd32(E1000_TSICR);
+ 	struct ptp_clock_event event;
+ 
+ 	if (tsicr & TSINTR_SYS_WRAP) {
+ 		event.type = PTP_CLOCK_PPS;
+ 		if (adapter->ptp_caps.pps)
+ 			ptp_clock_event(adapter->ptp_clock, &event);
+-		ack |= TSINTR_SYS_WRAP;
+ 	}
+ 
+ 	if (tsicr & E1000_TSICR_TXTS) {
+ 		/* retrieve hardware timestamp */
+ 		schedule_work(&adapter->ptp_tx_work);
+-		ack |= E1000_TSICR_TXTS;
+ 	}
+ 
+-	if (tsicr & TSINTR_TT0) {
++	if (tsicr & TSINTR_TT0)
+ 		igb_perout(adapter, 0);
+-		ack |= TSINTR_TT0;
+-	}
+ 
+-	if (tsicr & TSINTR_TT1) {
++	if (tsicr & TSINTR_TT1)
+ 		igb_perout(adapter, 1);
+-		ack |= TSINTR_TT1;
+-	}
+ 
+-	if (tsicr & TSINTR_AUTT0) {
++	if (tsicr & TSINTR_AUTT0)
+ 		igb_extts(adapter, 0);
+-		ack |= TSINTR_AUTT0;
+-	}
+ 
+-	if (tsicr & TSINTR_AUTT1) {
++	if (tsicr & TSINTR_AUTT1)
+ 		igb_extts(adapter, 1);
+-		ack |= TSINTR_AUTT1;
+-	}
+-
+-	/* acknowledge the interrupts */
+-	wr32(E1000_TSICR, ack);
+ }
+ 
+ static irqreturn_t igb_msix_other(int irq, void *data)
+-- 
+2.43.0
+
diff --git a/queue-5.15/igb-move-perout-and-extts-isr-logic-to-separate-func.patch b/queue-5.15/igb-move-perout-and-extts-isr-logic-to-separate-func.patch
new file mode 100644
index 00000000000..f63d8dd25ce
--- /dev/null
+++ b/queue-5.15/igb-move-perout-and-extts-isr-logic-to-separate-func.patch
@@ -0,0 +1,141 @@
+From e432156a27f925d7057d7e71361ad031fe8c1241 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Oct 2021 16:34:57 +0200
+Subject: igb: move PEROUT and EXTTS isr logic to separate functions
+
+From: Ruud Bos <kernel.hbk@gmail.com>
+
+[ Upstream commit cf99c1dd7b7729091043374b90807c7a5f9fd9b1 ]
+
+Remove code duplication in the tsync interrupt handler function by moving
+this logic to separate functions. This keeps the interrupt handler readable
+and allows the new functions to be extended for adapter types other than
+i210.
+
+Signed-off-by: Ruud Bos <kernel.hbk@gmail.com>
+Tested-by: Gurucharan G <gurucharanx.g@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Stable-dep-of: ee14cc9ea19b ("igb: Fix missing time sync events")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 81 +++++++++++++----------
+ 1 file changed, 46 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index 7c42a99be5065..eec0ad98c445f 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -6756,12 +6756,52 @@ void igb_update_stats(struct igb_adapter *adapter)
+ 	}
+ }
+ 
++static void igb_perout(struct igb_adapter *adapter, int tsintr_tt)
++{
++	int pin = ptp_find_pin(adapter->ptp_clock, PTP_PF_PEROUT, tsintr_tt);
++	struct e1000_hw *hw = &adapter->hw;
++	struct timespec64 ts;
++	u32 tsauxc;
++
++	if (pin < 0 || pin >= IGB_N_PEROUT)
++		return;
++
++	spin_lock(&adapter->tmreg_lock);
++	ts = timespec64_add(adapter->perout[pin].start,
++			    adapter->perout[pin].period);
++	/* u32 conversion of tv_sec is safe until y2106 */
++	wr32((tsintr_tt == 1) ? E1000_TRGTTIML1 : E1000_TRGTTIML0, ts.tv_nsec);
++	wr32((tsintr_tt == 1) ? E1000_TRGTTIMH1 : E1000_TRGTTIMH0, (u32)ts.tv_sec);
++	tsauxc = rd32(E1000_TSAUXC);
++	tsauxc |= TSAUXC_EN_TT0;
++	wr32(E1000_TSAUXC, tsauxc);
++	adapter->perout[pin].start = ts;
++	spin_unlock(&adapter->tmreg_lock);
++}
++
++static void igb_extts(struct igb_adapter *adapter, int tsintr_tt)
++{
++	int pin = ptp_find_pin(adapter->ptp_clock, PTP_PF_EXTTS, tsintr_tt);
++	struct e1000_hw *hw = &adapter->hw;
++	struct ptp_clock_event event;
++	u32 sec, nsec;
++
++	if (pin < 0 || pin >= IGB_N_EXTTS)
++		return;
++
++	nsec = rd32((tsintr_tt == 1) ? E1000_AUXSTMPL1 : E1000_AUXSTMPL0);
++	sec  = rd32((tsintr_tt == 1) ? E1000_AUXSTMPH1 : E1000_AUXSTMPH0);
++	event.type = PTP_CLOCK_EXTTS;
++	event.index = tsintr_tt;
++	event.timestamp = sec * 1000000000ULL + nsec;
++	ptp_clock_event(adapter->ptp_clock, &event);
++}
++
+ static void igb_tsync_interrupt(struct igb_adapter *adapter)
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
++	u32 ack = 0, tsicr = rd32(E1000_TSICR);
+ 	struct ptp_clock_event event;
+-	struct timespec64 ts;
+-	u32 ack = 0, tsauxc, sec, nsec, tsicr = rd32(E1000_TSICR);
+ 
+ 	if (tsicr & TSINTR_SYS_WRAP) {
+ 		event.type = PTP_CLOCK_PPS;
+@@ -6777,51 +6817,22 @@ static void igb_tsync_interrupt(struct igb_adapter *adapter)
+ 	}
+ 
+ 	if (tsicr & TSINTR_TT0) {
+-		spin_lock(&adapter->tmreg_lock);
+-		ts = timespec64_add(adapter->perout[0].start,
+-				    adapter->perout[0].period);
+-		/* u32 conversion of tv_sec is safe until y2106 */
+-		wr32(E1000_TRGTTIML0, ts.tv_nsec);
+-		wr32(E1000_TRGTTIMH0, (u32)ts.tv_sec);
+-		tsauxc = rd32(E1000_TSAUXC);
+-		tsauxc |= TSAUXC_EN_TT0;
+-		wr32(E1000_TSAUXC, tsauxc);
+-		adapter->perout[0].start = ts;
+-		spin_unlock(&adapter->tmreg_lock);
++		igb_perout(adapter, 0);
+ 		ack |= TSINTR_TT0;
+ 	}
+ 
+ 	if (tsicr & TSINTR_TT1) {
+-		spin_lock(&adapter->tmreg_lock);
+-		ts = timespec64_add(adapter->perout[1].start,
+-				    adapter->perout[1].period);
+-		wr32(E1000_TRGTTIML1, ts.tv_nsec);
+-		wr32(E1000_TRGTTIMH1, (u32)ts.tv_sec);
+-		tsauxc = rd32(E1000_TSAUXC);
+-		tsauxc |= TSAUXC_EN_TT1;
+-		wr32(E1000_TSAUXC, tsauxc);
+-		adapter->perout[1].start = ts;
+-		spin_unlock(&adapter->tmreg_lock);
++		igb_perout(adapter, 1);
+ 		ack |= TSINTR_TT1;
+ 	}
+ 
+ 	if (tsicr & TSINTR_AUTT0) {
+-		nsec = rd32(E1000_AUXSTMPL0);
+-		sec  = rd32(E1000_AUXSTMPH0);
+-		event.type = PTP_CLOCK_EXTTS;
+-		event.index = 0;
+-		event.timestamp = sec * 1000000000ULL + nsec;
+-		ptp_clock_event(adapter->ptp_clock, &event);
++		igb_extts(adapter, 0);
+ 		ack |= TSINTR_AUTT0;
+ 	}
+ 
+ 	if (tsicr & TSINTR_AUTT1) {
+-		nsec = rd32(E1000_AUXSTMPL1);
+-		sec  = rd32(E1000_AUXSTMPH1);
+-		event.type = PTP_CLOCK_EXTTS;
+-		event.index = 1;
+-		event.timestamp = sec * 1000000000ULL + nsec;
+-		ptp_clock_event(adapter->ptp_clock, &event);
++		igb_extts(adapter, 1);
+ 		ack |= TSINTR_AUTT1;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/inet_diag-annotate-data-races-around-inet_diag_table.patch b/queue-5.15/inet_diag-annotate-data-races-around-inet_diag_table.patch
new file mode 100644
index 00000000000..cfd50eaac8f
--- /dev/null
+++ b/queue-5.15/inet_diag-annotate-data-races-around-inet_diag_table.patch
@@ -0,0 +1,58 @@
+From b135ec095d4736df754e45b915a5ff66391d8424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 11:25:56 +0000
+Subject: inet_diag: annotate data-races around inet_diag_table[]
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e50e10ae5d81ddb41547114bfdc5edc04422f082 ]
+
+inet_diag_lock_handler() reads inet_diag_table[proto] locklessly.
+
+Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.
+
+Fixes: d523a328fb02 ("[INET]: Fix inet_diag dead-lock regression")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_diag.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 09cabed358fd0..3aeba9e2b22cd 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -57,7 +57,7 @@ static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
+ 		return ERR_PTR(-ENOENT);
+ 	}
+ 
+-	if (!inet_diag_table[proto])
++	if (!READ_ONCE(inet_diag_table[proto]))
+ 		sock_load_diag_module(AF_INET, proto);
+ 
+ 	mutex_lock(&inet_diag_table_mutex);
+@@ -1419,7 +1419,7 @@ int inet_diag_register(const struct inet_diag_handler *h)
+ 	mutex_lock(&inet_diag_table_mutex);
+ 	err = -EEXIST;
+ 	if (!inet_diag_table[type]) {
+-		inet_diag_table[type] = h;
++		WRITE_ONCE(inet_diag_table[type], h);
+ 		err = 0;
+ 	}
+ 	mutex_unlock(&inet_diag_table_mutex);
+@@ -1436,7 +1436,7 @@ void inet_diag_unregister(const struct inet_diag_handler *h)
+ 		return;
+ 
+ 	mutex_lock(&inet_diag_table_mutex);
+-	inet_diag_table[type] = NULL;
++	WRITE_ONCE(inet_diag_table[type], NULL);
+ 	mutex_unlock(&inet_diag_table_mutex);
+ }
+ EXPORT_SYMBOL_GPL(inet_diag_unregister);
+-- 
+2.43.0
+
diff --git a/queue-5.15/iommu-amd-mark-interrupt-as-managed.patch b/queue-5.15/iommu-amd-mark-interrupt-as-managed.patch
new file mode 100644
index 00000000000..748a758ee57
--- /dev/null
+++ b/queue-5.15/iommu-amd-mark-interrupt-as-managed.patch
@@ -0,0 +1,69 @@
+From 509816292b74c40fbc630a20febdc54ec7dfa315 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 17:34:00 -0600
+Subject: iommu/amd: Mark interrupt as managed
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 0feda94c868d396fac3b3cb14089d2d989a07c72 ]
+
+On many systems that have an AMD IOMMU the following sequence of
+warnings is observed during bootup.
+
+```
+pci 0000:00:00.2  can't derive routing for PCI INT A
+pci 0000:00:00.2: PCI INT A: not connected
+```
+
+This series of events happens because of the IOMMU initialization
+sequence order and the lack of _PRT entries for the IOMMU.
+
+During initialization the IOMMU driver first enables the PCI device
+using pci_enable_device().  This will call acpi_pci_irq_enable()
+which will check if the interrupt is declared in a PCI routing table
+(_PRT) entry. According to the PCI spec [1] these routing entries
+are only required under PCI root bridges:
+	The _PRT object is required under all PCI root bridges
+
+The IOMMU is directly connected to the root complex, so there is no
+parent bridge to look for a _PRT entry. The first warning is emitted
+since no entry could be found in the hierarchy. The second warning is
+then emitted because the interrupt hasn't yet been configured to any
+value.  The pin was configured in pci_read_irq() but the byte in
+PCI_INTERRUPT_LINE return 0xff which means "Unknown".
+
+After that sequence of events pci_enable_msi() is called and this
+will allocate an interrupt.
+
+That is both of these warnings are totally harmless because the IOMMU
+uses MSI for interrupts.  To avoid even trying to probe for a _PRT
+entry mark the IOMMU as IRQ managed. This avoids both warnings.
+
+Link: https://uefi.org/htmlspecs/ACPI_Spec_6_4_html/06_Device_Configuration/Device_Configuration.html?highlight=_prt#prt-pci-routing-table [1]
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Fixes: cffe0a2b5a34 ("x86, irq: Keep balance of IOAPIC pin reference count")
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Link: https://lore.kernel.org/r/20240122233400.1802-1-mario.limonciello@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index 50ea582be5910..ef855495c210e 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -1821,6 +1821,9 @@ static int __init iommu_init_pci(struct amd_iommu *iommu)
+ 	/* Prevent binding other PCI device drivers to IOMMU devices */
+ 	iommu->dev->match_driver = false;
+ 
++	/* ACPI _PRT won't have an IRQ for IOMMU */
++	iommu->dev->irq_managed = 1;
++
+ 	pci_read_config_dword(iommu->dev, cap_ptr + MMIO_CAP_HDR_OFFSET,
+ 			      &iommu->cap);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch b/queue-5.15/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
new file mode 100644
index 00000000000..7e8ad29b82d
--- /dev/null
+++ b/queue-5.15/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
@@ -0,0 +1,203 @@
+From f711069ed8153f8386d0552aa36db7e6d924f35b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 20:21:15 +0800
+Subject: iommu/vt-d: Don't issue ATS Invalidation request when device is
+ disconnected
+
+From: Ethan Zhao <haifeng.zhao@linux.intel.com>
+
+[ Upstream commit 4fc82cd907ac075648789cc3a00877778aa1838b ]
+
+For those endpoint devices connect to system via hotplug capable ports,
+users could request a hot reset to the device by flapping device's link
+through setting the slot's link control register, as pciehp_ist() DLLSC
+interrupt sequence response, pciehp will unload the device driver and
+then power it off. thus cause an IOMMU device-TLB invalidation (Intel
+VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence
+target device to be sent and deadly loop to retry that request after ITE
+fault triggered in interrupt context.
+
+That would cause following continuous hard lockup warning and system hang
+
+[ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down
+[ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present
+[ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144
+[ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S
+         OE    kernel version xxxx
+[ 4223.822623] Hardware name: vendorname xxxx 666-106,
+BIOS 01.01.02.03.01 05/15/2023
+[ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490
+[ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b
+ 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1
+0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39
+[ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093
+[ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005
+[ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340
+[ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000
+[ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200
+[ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004
+[ 4223.822626] FS:  0000000000000000(0000) GS:ffffa237ae400000(0000)
+knlGS:0000000000000000
+[ 4223.822627] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0
+[ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+[ 4223.822628] PKRU: 55555554
+[ 4223.822628] Call Trace:
+[ 4223.822628]  qi_flush_dev_iotlb+0xb1/0xd0
+[ 4223.822628]  __dmar_remove_one_dev_info+0x224/0x250
+[ 4223.822629]  dmar_remove_one_dev_info+0x3e/0x50
+[ 4223.822629]  intel_iommu_release_device+0x1f/0x30
+[ 4223.822629]  iommu_release_device+0x33/0x60
+[ 4223.822629]  iommu_bus_notifier+0x7f/0x90
+[ 4223.822630]  blocking_notifier_call_chain+0x60/0x90
+[ 4223.822630]  device_del+0x2e5/0x420
+[ 4223.822630]  pci_remove_bus_device+0x70/0x110
+[ 4223.822630]  pciehp_unconfigure_device+0x7c/0x130
+[ 4223.822631]  pciehp_disable_slot+0x6b/0x100
+[ 4223.822631]  pciehp_handle_presence_or_link_change+0xd8/0x320
+[ 4223.822631]  pciehp_ist+0x176/0x180
+[ 4223.822631]  ? irq_finalize_oneshot.part.50+0x110/0x110
+[ 4223.822632]  irq_thread_fn+0x19/0x50
+[ 4223.822632]  irq_thread+0x104/0x190
+[ 4223.822632]  ? irq_forced_thread_fn+0x90/0x90
+[ 4223.822632]  ? irq_thread_check_affinity+0xe0/0xe0
+[ 4223.822633]  kthread+0x114/0x130
+[ 4223.822633]  ? __kthread_cancel_work+0x40/0x40
+[ 4223.822633]  ret_from_fork+0x1f/0x30
+[ 4223.822633] Kernel panic - not syncing: Hard LOCKUP
+[ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S
+         OE     kernel version xxxx
+[ 4223.822634] Hardware name: vendorname xxxx 666-106,
+BIOS 01.01.02.03.01 05/15/2023
+[ 4223.822634] Call Trace:
+[ 4223.822634]  <NMI>
+[ 4223.822635]  dump_stack+0x6d/0x88
+[ 4223.822635]  panic+0x101/0x2d0
+[ 4223.822635]  ? ret_from_fork+0x11/0x30
+[ 4223.822635]  nmi_panic.cold.14+0xc/0xc
+[ 4223.822636]  watchdog_overflow_callback.cold.8+0x6d/0x81
+[ 4223.822636]  __perf_event_overflow+0x4f/0xf0
+[ 4223.822636]  handle_pmi_common+0x1ef/0x290
+[ 4223.822636]  ? __set_pte_vaddr+0x28/0x40
+[ 4223.822637]  ? flush_tlb_one_kernel+0xa/0x20
+[ 4223.822637]  ? __native_set_fixmap+0x24/0x30
+[ 4223.822637]  ? ghes_copy_tofrom_phys+0x70/0x100
+[ 4223.822637]  ? __ghes_peek_estatus.isra.16+0x49/0xa0
+[ 4223.822637]  intel_pmu_handle_irq+0xba/0x2b0
+[ 4223.822638]  perf_event_nmi_handler+0x24/0x40
+[ 4223.822638]  nmi_handle+0x4d/0xf0
+[ 4223.822638]  default_do_nmi+0x49/0x100
+[ 4223.822638]  exc_nmi+0x134/0x180
+[ 4223.822639]  end_repeat_nmi+0x16/0x67
+[ 4223.822639] RIP: 0010:qi_submit_sync+0x2c0/0x490
+[ 4223.822639] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b
+ 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 10
+ 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39
+[ 4223.822640] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093
+[ 4223.822640] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005
+[ 4223.822640] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340
+[ 4223.822641] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000
+[ 4223.822641] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200
+[ 4223.822641] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004
+[ 4223.822641]  ? qi_submit_sync+0x2c0/0x490
+[ 4223.822642]  ? qi_submit_sync+0x2c0/0x490
+[ 4223.822642]  </NMI>
+[ 4223.822642]  qi_flush_dev_iotlb+0xb1/0xd0
+[ 4223.822642]  __dmar_remove_one_dev_info+0x224/0x250
+[ 4223.822643]  dmar_remove_one_dev_info+0x3e/0x50
+[ 4223.822643]  intel_iommu_release_device+0x1f/0x30
+[ 4223.822643]  iommu_release_device+0x33/0x60
+[ 4223.822643]  iommu_bus_notifier+0x7f/0x90
+[ 4223.822644]  blocking_notifier_call_chain+0x60/0x90
+[ 4223.822644]  device_del+0x2e5/0x420
+[ 4223.822644]  pci_remove_bus_device+0x70/0x110
+[ 4223.822644]  pciehp_unconfigure_device+0x7c/0x130
+[ 4223.822644]  pciehp_disable_slot+0x6b/0x100
+[ 4223.822645]  pciehp_handle_presence_or_link_change+0xd8/0x320
+[ 4223.822645]  pciehp_ist+0x176/0x180
+[ 4223.822645]  ? irq_finalize_oneshot.part.50+0x110/0x110
+[ 4223.822645]  irq_thread_fn+0x19/0x50
+[ 4223.822646]  irq_thread+0x104/0x190
+[ 4223.822646]  ? irq_forced_thread_fn+0x90/0x90
+[ 4223.822646]  ? irq_thread_check_affinity+0xe0/0xe0
+[ 4223.822646]  kthread+0x114/0x130
+[ 4223.822647]  ? __kthread_cancel_work+0x40/0x40
+[ 4223.822647]  ret_from_fork+0x1f/0x30
+[ 4223.822647] Kernel Offset: 0x6400000 from 0xffffffff81000000 (relocation
+range: 0xffffffff80000000-0xffffffffbfffffff)
+
+Such issue could be triggered by all kinds of regular surprise removal
+hotplug operation. like:
+
+1. pull EP(endpoint device) out directly.
+2. turn off EP's power.
+3. bring the link down.
+etc.
+
+this patch aims to work for regular safe removal and surprise removal
+unplug. these hot unplug handling process could be optimized for fix the
+ATS Invalidation hang issue by calling pci_dev_is_disconnected() in
+function devtlb_invalidation_with_pasid() to check target device state to
+avoid sending meaningless ATS Invalidation request to iommu when device is
+gone. (see IMPLEMENTATION NOTE in PCIe spec r6.1 section 10.3.1)
+
+For safe removal, device wouldn't be removed until the whole software
+handling process is done, it wouldn't trigger the hard lock up issue
+caused by too long ATS Invalidation timeout wait. In safe removal path,
+device state isn't set to pci_channel_io_perm_failure in
+pciehp_unconfigure_device() by checking 'presence' parameter, calling
+pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return
+false there, wouldn't break the function.
+
+For surprise removal, device state is set to pci_channel_io_perm_failure in
+pciehp_unconfigure_device(), means device is already gone (disconnected)
+call pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will
+return true to break the function not to send ATS Invalidation request to
+the disconnected device blindly, thus avoid to trigger further ITE fault,
+and ITE fault will block all invalidation request to be handled.
+furthermore retry the timeout request could trigger hard lockup.
+
+safe removal (present) & surprise removal (not present)
+
+pciehp_ist()
+   pciehp_handle_presence_or_link_change()
+     pciehp_disable_slot()
+       remove_board()
+         pciehp_unconfigure_device(presence) {
+           if (!presence)
+                pci_walk_bus(parent, pci_dev_set_disconnected, NULL);
+           }
+
+this patch works for regular safe removal and surprise removal of ATS
+capable endpoint on PCIe switch downstream ports.
+
+Fixes: 6f7db75e1c46 ("iommu/vt-d: Add second level page table interface")
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Tested-by: Haorong Ye <yehaorong@bytedance.com>
+Signed-off-by: Ethan Zhao <haifeng.zhao@linux.intel.com>
+Link: https://lore.kernel.org/r/20240301080727.3529832-3-haifeng.zhao@linux.intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/pasid.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index dc9d665d7365c..589b97ff5433c 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -508,6 +508,9 @@ devtlb_invalidation_with_pasid(struct intel_iommu *iommu,
+ 	if (!info || !info->ats_enabled)
+ 		return;
+ 
++	if (pci_dev_is_disconnected(to_pci_dev(dev)))
++		return;
++
+ 	sid = info->bus << 8 | info->devfn;
+ 	qdep = info->ats_qdep;
+ 	pfsid = info->pfsid;
+-- 
+2.43.0
+
diff --git a/queue-5.15/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch b/queue-5.15/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
new file mode 100644
index 00000000000..495a0530287
--- /dev/null
+++ b/queue-5.15/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
@@ -0,0 +1,45 @@
+From cc5fc0056b42ed7483bd8508c08d638cabeba0d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: ipmr: fix incorrect parameter validation in the
+ ip_mroute_getsockopt() function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 5c3be3e0eb44b7f978bb6cbb20ad956adb93f736 ]
+
+The 'olr' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'olr' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ipmr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index eb3c09340aef8..c9a633559258c 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1574,9 +1574,11 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
+ 
+ 	if (copy_from_sockptr(&olr, optlen, sizeof(int)))
+ 		return -EFAULT;
+-	olr = min_t(unsigned int, olr, sizeof(int));
+ 	if (olr < 0)
+ 		return -EINVAL;
++
++	olr = min_t(unsigned int, olr, sizeof(int));
++
+ 	if (copy_to_sockptr(optlen, &olr, sizeof(int)))
+ 		return -EFAULT;
+ 	if (copy_to_sockptr(optval, &val, olr))
+-- 
+2.43.0
+
diff --git a/queue-5.15/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch b/queue-5.15/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
new file mode 100644
index 00000000000..ae93f28e565
--- /dev/null
+++ b/queue-5.15/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
@@ -0,0 +1,55 @@
+From aaade97ab9fd87fe2e71550e50057edcb9633012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 18:01:57 +0800
+Subject: ipv6: fib6_rules: flush route cache when rule is changed
+
+From: Shiming Cheng <shiming.cheng@mediatek.com>
+
+[ Upstream commit c4386ab4f6c600f75fdfd21143f89bac3e625d0d ]
+
+When rule policy is changed, ipv6 socket cache is not refreshed.
+The sock's skb still uses a outdated route cache and was sent to
+a wrong interface.
+
+To avoid this error we should update fib node's version when
+rule is changed. Then skb's route will be reroute checked as
+route cache version is already different with fib node version.
+The route cache is refreshed to match the latest rule.
+
+Fixes: 101367c2f8c4 ("[IPV6]: Policy Routing Rules")
+Signed-off-by: Shiming Cheng <shiming.cheng@mediatek.com>
+Signed-off-by: Lena Wang <lena.wang@mediatek.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/fib6_rules.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
+index dcedfe29d9d93..8e9e80eb0f329 100644
+--- a/net/ipv6/fib6_rules.c
++++ b/net/ipv6/fib6_rules.c
+@@ -446,6 +446,11 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
+ 	       + nla_total_size(16); /* src */
+ }
+ 
++static void fib6_rule_flush_cache(struct fib_rules_ops *ops)
++{
++	rt_genid_bump_ipv6(ops->fro_net);
++}
++
+ static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
+ 	.family			= AF_INET6,
+ 	.rule_size		= sizeof(struct fib6_rule),
+@@ -458,6 +463,7 @@ static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
+ 	.compare		= fib6_rule_compare,
+ 	.fill			= fib6_rule_fill,
+ 	.nlmsg_payload		= fib6_rule_nlmsg_payload,
++	.flush_cache		= fib6_rule_flush_cache,
+ 	.nlgroup		= RTNLGRP_IPV6_RULE,
+ 	.policy			= fib6_rule_policy,
+ 	.owner			= THIS_MODULE,
+-- 
+2.43.0
+
diff --git a/queue-5.15/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch b/queue-5.15/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
new file mode 100644
index 00000000000..55f5113c982
--- /dev/null
+++ b/queue-5.15/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
@@ -0,0 +1,43 @@
+From 400ceb8080e9a8a3b6e5698d118cfac0038ee58e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 15:30:56 +0000
+Subject: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 17ef8efc00b34918b966388b2af0993811895a8c ]
+
+As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops
+in igmp6_event_query() and igmp6_event_report()")) I think the
+synchronize_net() call in ipv6_mc_down() is not needed.
+
+Under load, synchronize_net() can last between 200 usec and 5 ms.
+
+KASAN seems to agree as well.
+
+Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Taehee Yoo <ap420073@gmail.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/mcast.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 0ea7d97cdc025..6e5d1ade48a89 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2722,7 +2722,6 @@ void ipv6_mc_down(struct inet6_dev *idev)
+ 	/* Should stop work after group drop. or we will
+ 	 * start work again in mld_ifc_event()
+ 	 */
+-	synchronize_net();
+ 	mld_query_stop_work(idev);
+ 	mld_report_stop_work(idev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch b/queue-5.15/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
new file mode 100644
index 00000000000..f487b49df7a
--- /dev/null
+++ b/queue-5.15/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
@@ -0,0 +1,47 @@
+From ab76634b01c2a54dc0d23a14e5776a767bee9002 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 955e9876ba4ee26eeaab1b13517f5b2c88e73d55 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core")
+Reviewed-by: Tom Parkin <tparkin@katalix.com>
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/l2tp/l2tp_ppp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 9cef8e080f644..55de42b000d8a 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1357,11 +1357,11 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	err = -ENOTCONN;
+ 	if (!sk->sk_user_data)
+ 		goto end;
+-- 
+2.43.0
+
diff --git a/queue-5.15/leds-aw2013-unlock-mutex-before-destroying-it.patch b/queue-5.15/leds-aw2013-unlock-mutex-before-destroying-it.patch
new file mode 100644
index 00000000000..53ba3bef7b8
--- /dev/null
+++ b/queue-5.15/leds-aw2013-unlock-mutex-before-destroying-it.patch
@@ -0,0 +1,37 @@
+From 382078a1ccae44ac8521b5beb2e6913a71d229f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 20:36:05 +0300
+Subject: leds: aw2013: Unlock mutex before destroying it
+
+From: George Stark <gnstark@salutedevices.com>
+
+[ Upstream commit 6969d0a2ba1adc9ba6a49b9805f24080896c255c ]
+
+In the probe() callback in case of error mutex is destroyed being locked
+which is not allowed so unlock the mutex before destroying.
+
+Fixes: 59ea3c9faf32 ("leds: add aw2013 driver")
+Signed-off-by: George Stark <gnstark@salutedevices.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20231214173614.2820929-2-gnstark@salutedevices.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-aw2013.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/leds/leds-aw2013.c b/drivers/leds/leds-aw2013.c
+index 80d937454aeef..f7d9795ce5e1f 100644
+--- a/drivers/leds/leds-aw2013.c
++++ b/drivers/leds/leds-aw2013.c
+@@ -397,6 +397,7 @@ static int aw2013_probe(struct i2c_client *client)
+ 	regulator_disable(chip->vcc_regulator);
+ 
+ error:
++	mutex_unlock(&chip->mutex);
+ 	mutex_destroy(&chip->mutex);
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch b/queue-5.15/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
new file mode 100644
index 00000000000..bcf6491a676
--- /dev/null
+++ b/queue-5.15/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
@@ -0,0 +1,41 @@
+From e29d91307c29c5dfb4656e65a4fb96785501f058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 20:11:30 +0100
+Subject: leds: sgm3140: Add missing timer cleanup and flash gpio control
+
+From: Ondrej Jirman <megi@xff.cz>
+
+[ Upstream commit 205c29887a333ee4b37596e6533373e38cb23947 ]
+
+Enabling strobe and then setting brightness to 0 causes the driver to enter
+invalid state after strobe end timer fires. We should cancel strobe mode
+resources when changing brightness (aka torch mode).
+
+Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
+Signed-off-by: Ondrej Jirman <megi@xff.cz>
+Link: https://lore.kernel.org/r/20240217191133.1757553-1-megi@xff.cz
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/flash/leds-sgm3140.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
+index f4f831570f11c..e72017b11098b 100644
+--- a/drivers/leds/flash/leds-sgm3140.c
++++ b/drivers/leds/flash/leds-sgm3140.c
+@@ -114,8 +114,11 @@ static int sgm3140_brightness_set(struct led_classdev *led_cdev,
+ 				"failed to enable regulator: %d\n", ret);
+ 			return ret;
+ 		}
++		gpiod_set_value_cansleep(priv->flash_gpio, 0);
+ 		gpiod_set_value_cansleep(priv->enable_gpio, 1);
+ 	} else {
++		del_timer_sync(&priv->powerdown_timer);
++		gpiod_set_value_cansleep(priv->flash_gpio, 0);
+ 		gpiod_set_value_cansleep(priv->enable_gpio, 0);
+ 		ret = regulator_disable(priv->vin_regulator);
+ 		if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch b/queue-5.15/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
new file mode 100644
index 00000000000..08784e6e93d
--- /dev/null
+++ b/queue-5.15/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
@@ -0,0 +1,43 @@
+From 186f385d9b8ea43f4cffccc6150c566a113b817f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:15 +0800
+Subject: lib/cmdline: Fix an invalid format specifier in an assertion msg
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit d2733a026fc7247ba42d7a8e1b737cf14bf1df21 ]
+
+The correct format specifier for p - n (both p and n are pointers) is
+%td, as the type should be ptrdiff_t.
+
+This was discovered by annotating KUnit assertion macros with gcc's
+printf specifier, but note that gcc incorrectly suggested a %d or %ld
+specifier (depending on the pointer size of the architecture being
+built).
+
+Fixes: 0ea09083116d ("lib/cmdline: Allow get_options() to take 0 to validate the input")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Daniel Latypov <dlatypov@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/cmdline_kunit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/cmdline_kunit.c b/lib/cmdline_kunit.c
+index a72a2c16066ef..de7fb7476cb9a 100644
+--- a/lib/cmdline_kunit.c
++++ b/lib/cmdline_kunit.c
+@@ -124,7 +124,7 @@ static void cmdline_do_one_range_test(struct kunit *test, const char *in,
+ 			    n, e[0], r[0]);
+ 
+ 	p = memchr_inv(&r[1], 0, sizeof(r) - sizeof(r[0]));
+-	KUNIT_EXPECT_PTR_EQ_MSG(test, p, NULL, "in test %u at %u out of bound", n, p - r);
++	KUNIT_EXPECT_PTR_EQ_MSG(test, p, NULL, "in test %u at %td out of bound", n, p - r);
+ }
+ 
+ static void cmdline_test_range(struct kunit *test)
+-- 
+2.43.0
+
diff --git a/queue-5.15/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch b/queue-5.15/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
new file mode 100644
index 00000000000..69a8c568136
--- /dev/null
+++ b/queue-5.15/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
@@ -0,0 +1,54 @@
+From 7af28eea8e6e3091d5d4cf4ae98ef4d0a57f5b8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:06:18 +0300
+Subject: libbpf: Apply map_set_def_max_entries() for inner_maps on creation
+
+From: Andrey Grafin <conquistador@yandex-team.ru>
+
+[ Upstream commit f04deb90e516e8e48bf8693397529bc942a9e80b ]
+
+This patch allows to auto create BPF_MAP_TYPE_ARRAY_OF_MAPS and
+BPF_MAP_TYPE_HASH_OF_MAPS with values of BPF_MAP_TYPE_PERF_EVENT_ARRAY
+by bpf_object__load().
+
+Previous behaviour created a zero filled btf_map_def for inner maps and
+tried to use it for a map creation but the linux kernel forbids to create
+a BPF_MAP_TYPE_PERF_EVENT_ARRAY map with max_entries=0.
+
+Fixes: 646f02ffdd49 ("libbpf: Add BTF-defined map-in-map support")
+Signed-off-by: Andrey Grafin <conquistador@yandex-team.ru>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/bpf/20240117130619.9403-1-conquistador@yandex-team.ru
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 0c201f07d8aef..e45f831a12c2b 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -71,6 +71,7 @@
+ 
+ static struct bpf_map *bpf_object__add_map(struct bpf_object *obj);
+ static bool prog_is_subprog(const struct bpf_object *obj, const struct bpf_program *prog);
++static int map_set_def_max_entries(struct bpf_map *map);
+ 
+ static int __base_pr(enum libbpf_print_level level, const char *format,
+ 		     va_list args)
+@@ -4617,6 +4618,9 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
+ 
+ 	if (bpf_map_type__is_map_in_map(def->type)) {
+ 		if (map->inner_map) {
++			err = map_set_def_max_entries(map->inner_map);
++			if (err)
++				return err;
+ 			err = bpf_object__create_map(obj, map->inner_map, true);
+ 			if (err) {
+ 				pr_warn("map '%s': failed to create inner map: %d\n",
+-- 
+2.43.0
+
diff --git a/queue-5.15/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch b/queue-5.15/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
new file mode 100644
index 00000000000..4640426caa6
--- /dev/null
+++ b/queue-5.15/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
@@ -0,0 +1,73 @@
+From eeef3dcc11c20d2f1adceadccbf3537fe4298dd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 11:14:40 +0800
+Subject: md: Don't clear MD_CLOSING when the raid is about to stop
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 9674f54e41fffaf06f6a60202e1fa4cc13de3cf5 ]
+
+The raid should not be opened anymore when it is about to be stopped.
+However, other processes can open it again if the flag MD_CLOSING is
+cleared before exiting. From now on, this flag will not be cleared when
+the raid will be stopped.
+
+Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20240226031444.3606764-6-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index a17f2f725822a..c937ad7f6b73a 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6230,7 +6230,15 @@ static void md_clean(struct mddev *mddev)
+ 	mddev->persistent = 0;
+ 	mddev->level = LEVEL_NONE;
+ 	mddev->clevel[0] = 0;
+-	mddev->flags = 0;
++	/*
++	 * Don't clear MD_CLOSING, or mddev can be opened again.
++	 * 'hold_active != 0' means mddev is still in the creation
++	 * process and will be used later.
++	 */
++	if (mddev->hold_active)
++		mddev->flags = 0;
++	else
++		mddev->flags &= BIT_ULL_MASK(MD_CLOSING);
+ 	mddev->sb_flags = 0;
+ 	mddev->ro = MD_RDWR;
+ 	mddev->metadata_type[0] = 0;
+@@ -7550,7 +7558,6 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
+ 	int err = 0;
+ 	void __user *argp = (void __user *)arg;
+ 	struct mddev *mddev = NULL;
+-	bool did_set_md_closing = false;
+ 
+ 	if (!md_ioctl_valid(cmd))
+ 		return -ENOTTY;
+@@ -7637,7 +7644,6 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
+ 			err = -EBUSY;
+ 			goto out;
+ 		}
+-		did_set_md_closing = true;
+ 		mutex_unlock(&mddev->open_mutex);
+ 		sync_blockdev(bdev);
+ 	}
+@@ -7800,7 +7806,7 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
+ 		mddev->hold_active = 0;
+ 	mddev_unlock(mddev);
+ out:
+-	if(did_set_md_closing)
++	if (cmd == STOP_ARRAY_RO || (err && cmd == STOP_ARRAY))
+ 		clear_bit(MD_CLOSING, &mddev->flags);
+ 	return err;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch b/queue-5.15/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
new file mode 100644
index 00000000000..a3976a3ff7d
--- /dev/null
+++ b/queue-5.15/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
@@ -0,0 +1,95 @@
+From cf8dc58388f9c7b5135901146c9e1ce2da2808aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 17:31:44 +0100
+Subject: media: dvb-frontends: avoid stack overflow warnings with clang
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7a4cf27d1f0538f779bf31b8c99eda394e277119 ]
+
+A previous patch worked around a KASAN issue in stv0367, now a similar
+problem showed up with clang:
+
+drivers/media/dvb-frontends/stv0367.c:1222:12: error: stack frame size (3624) exceeds limit (2048) in 'stv0367ter_set_frontend' [-Werror,-Wframe-larger-than]
+ 1214 | static int stv0367ter_set_frontend(struct dvb_frontend *fe)
+
+Rework the stv0367_writereg() function to be simpler and mark both
+register access functions as noinline_for_stack so the temporary
+i2c_msg structures do not get duplicated on the stack when KASAN_STACK
+is enabled.
+
+Fixes: 3cd890dbe2a4 ("media: dvb-frontends: fix i2c access helpers for KASAN")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/stv0367.c | 34 +++++++--------------------
+ 1 file changed, 8 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
+index 0bfca1174e9e7..8cbae8235b174 100644
+--- a/drivers/media/dvb-frontends/stv0367.c
++++ b/drivers/media/dvb-frontends/stv0367.c
+@@ -118,50 +118,32 @@ static const s32 stv0367cab_RF_LookUp2[RF_LOOKUP_TABLE2_SIZE][RF_LOOKUP_TABLE2_S
+ 	}
+ };
+ 
+-static
+-int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
++static noinline_for_stack
++int stv0367_writereg(struct stv0367_state *state, u16 reg, u8 data)
+ {
+-	u8 buf[MAX_XFER_SIZE];
++	u8 buf[3] = { MSB(reg), LSB(reg), data };
+ 	struct i2c_msg msg = {
+ 		.addr = state->config->demod_address,
+ 		.flags = 0,
+ 		.buf = buf,
+-		.len = len + 2
++		.len = 3,
+ 	};
+ 	int ret;
+ 
+-	if (2 + len > sizeof(buf)) {
+-		printk(KERN_WARNING
+-		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+-		       KBUILD_MODNAME, reg, len);
+-		return -EINVAL;
+-	}
+-
+-
+-	buf[0] = MSB(reg);
+-	buf[1] = LSB(reg);
+-	memcpy(buf + 2, data, len);
+-
+ 	if (i2cdebug)
+ 		printk(KERN_DEBUG "%s: [%02x] %02x: %02x\n", __func__,
+-			state->config->demod_address, reg, buf[2]);
++			state->config->demod_address, reg, data);
+ 
+ 	ret = i2c_transfer(state->i2c, &msg, 1);
+ 	if (ret != 1)
+ 		printk(KERN_ERR "%s: i2c write error! ([%02x] %02x: %02x)\n",
+-			__func__, state->config->demod_address, reg, buf[2]);
++			__func__, state->config->demod_address, reg, data);
+ 
+ 	return (ret != 1) ? -EREMOTEIO : 0;
+ }
+ 
+-static int stv0367_writereg(struct stv0367_state *state, u16 reg, u8 data)
+-{
+-	u8 tmp = data; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */
+-
+-	return stv0367_writeregs(state, reg, &tmp, 1);
+-}
+-
+-static u8 stv0367_readreg(struct stv0367_state *state, u16 reg)
++static noinline_for_stack
++u8 stv0367_readreg(struct stv0367_state *state, u16 reg)
+ {
+ 	u8 b0[] = { 0, 0 };
+ 	u8 b1[] = { 0 };
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-edia-dvbdev-fix-a-use-after-free.patch b/queue-5.15/media-edia-dvbdev-fix-a-use-after-free.patch
new file mode 100644
index 00000000000..ae6d97e4425
--- /dev/null
+++ b/queue-5.15/media-edia-dvbdev-fix-a-use-after-free.patch
@@ -0,0 +1,84 @@
+From b4164803bb6ba11888383ed322e6b066873f0094 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Feb 2024 14:40:43 +0100
+Subject: media: edia: dvbdev: fix a use-after-free
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 ]
+
+In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed
+in several error-handling paths. However, *pdvbdev is not set to NULL
+after dvbdev's deallocation, causing use-after-frees in many places,
+for example, in the following call chain:
+
+budget_register
+  |-> dvb_dmxdev_init
+        |-> dvb_register_device
+  |-> dvb_dmxdev_release
+        |-> dvb_unregister_device
+              |-> dvb_remove_device
+                    |-> dvb_device_put
+                          |-> kref_put
+
+When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in
+dvb_register_device) could point to memory that had been freed in
+dvb_register_device. Thereafter, this pointer is transferred to
+kref_put and triggering a use-after-free.
+
+Link: https://lore.kernel.org/linux-media/20240203134046.3120099-1-alexious@zju.edu.cn
+Fixes: b61901024776 ("V4L/DVB (5244): Dvbdev: fix illegal re-usage of fileoperations struct")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dvbdev.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index 3a83e8e092568..23a0c209744dc 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -504,6 +504,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);
+ 		if (!dvbdevfops) {
+ 			kfree(dvbdev);
++			*pdvbdev = NULL;
+ 			mutex_unlock(&dvbdev_register_lock);
+ 			return -ENOMEM;
+ 		}
+@@ -512,6 +513,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		if (!new_node) {
+ 			kfree(dvbdevfops);
+ 			kfree(dvbdev);
++			*pdvbdev = NULL;
+ 			mutex_unlock(&dvbdev_register_lock);
+ 			return -ENOMEM;
+ 		}
+@@ -545,6 +547,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		}
+ 		list_del (&dvbdev->list_head);
+ 		kfree(dvbdev);
++		*pdvbdev = NULL;
+ 		up_write(&minor_rwsem);
+ 		mutex_unlock(&dvbdev_register_lock);
+ 		return -EINVAL;
+@@ -567,6 +570,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		dvb_media_device_free(dvbdev);
+ 		list_del (&dvbdev->list_head);
+ 		kfree(dvbdev);
++		*pdvbdev = NULL;
+ 		mutex_unlock(&dvbdev_register_lock);
+ 		return ret;
+ 	}
+@@ -585,6 +589,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		dvb_media_device_free(dvbdev);
+ 		list_del (&dvbdev->list_head);
+ 		kfree(dvbdev);
++		*pdvbdev = NULL;
+ 		mutex_unlock(&dvbdev_register_lock);
+ 		return PTR_ERR(clsdev);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-em28xx-annotate-unchecked-call-to-media_device.patch b/queue-5.15/media-em28xx-annotate-unchecked-call-to-media_device.patch
new file mode 100644
index 00000000000..c5a16ebb302
--- /dev/null
+++ b/queue-5.15/media-em28xx-annotate-unchecked-call-to-media_device.patch
@@ -0,0 +1,42 @@
+From 6d1218760a9e4bf97653187184b67266c732a1ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 05:42:26 -0800
+Subject: media: em28xx: annotate unchecked call to media_device_register()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit fd61d77a3d28444b2635f0c8b5a2ecd6a4d94026 ]
+
+Static analyzers generate alerts for an unchecked call to
+`media_device_register()`. However, in this case, the device will work
+reliably without the media controller API.
+
+Add a comment above the call to prevent future unnecessary changes.
+
+Suggested-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 92d867fc519c4..8ab10518957c4 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -4099,6 +4099,10 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 	 * topology will likely change after the load of the em28xx subdrivers.
+ 	 */
+ #ifdef CONFIG_MEDIA_CONTROLLER
++	/*
++	 * No need to check the return value, the device will still be
++	 * usable without media controller API.
++	 */
+ 	retval = media_device_register(dev->media_dev);
+ #endif
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-go7007-add-check-of-return-value-of-go7007_rea.patch b/queue-5.15/media-go7007-add-check-of-return-value-of-go7007_rea.patch
new file mode 100644
index 00000000000..89f7ffcc036
--- /dev/null
+++ b/queue-5.15/media-go7007-add-check-of-return-value-of-go7007_rea.patch
@@ -0,0 +1,40 @@
+From 227930ccbeeda39bc3a8ccbfaabb003c55cc0918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 07:07:05 -0800
+Subject: media: go7007: add check of return value of go7007_read_addr()
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 0b70530ee740861f4776ff724fcc25023df1799a ]
+
+If go7007_read_addr() returns error channel is not assigned a value.
+In this case go to allocfail.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 866b8695d67e ("Staging: add the go7007 video driver")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-usb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
+index eeb85981e02b6..762c13e49bfa5 100644
+--- a/drivers/media/usb/go7007/go7007-usb.c
++++ b/drivers/media/usb/go7007/go7007-usb.c
+@@ -1201,7 +1201,9 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ 				u16 channel;
+ 
+ 				/* read channel number from GPIO[1:0] */
+-				go7007_read_addr(go, 0x3c81, &channel);
++				if (go7007_read_addr(go, 0x3c81, &channel))
++					goto allocfail;
++
+ 				channel &= 0x3;
+ 				go->board_id = GO7007_BOARDID_ADLINK_MPG24;
+ 				usb->board = board = &board_adlink_mpg24;
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch b/queue-5.15/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
new file mode 100644
index 00000000000..7465d6d5960
--- /dev/null
+++ b/queue-5.15/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
@@ -0,0 +1,57 @@
+From 1390d8785f0b6f7274a332fb9a84b86e4d0b9be7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 12:37:13 +0800
+Subject: media: go7007: fix a memleak in go7007_load_encoder
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit b9b683844b01d171a72b9c0419a2d760d946ee12 ]
+
+In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
+a deallocation thereafter. After the following call chain:
+
+saa7134_go7007_init
+  |-> go7007_boot_encoder
+        |-> go7007_load_encoder
+  |-> kfree(go)
+
+go is freed and thus bounce is leaked.
+
+Fixes: 95ef39403f89 ("[media] go7007: remember boot firmware")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-driver.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
+index 6650eab913d81..3c66542ce284a 100644
+--- a/drivers/media/usb/go7007/go7007-driver.c
++++ b/drivers/media/usb/go7007/go7007-driver.c
+@@ -80,7 +80,7 @@ static int go7007_load_encoder(struct go7007 *go)
+ 	const struct firmware *fw_entry;
+ 	char fw_name[] = "go7007/go7007fw.bin";
+ 	void *bounce;
+-	int fw_len, rv = 0;
++	int fw_len;
+ 	u16 intr_val, intr_data;
+ 
+ 	if (go->boot_fw == NULL) {
+@@ -109,9 +109,11 @@ static int go7007_load_encoder(struct go7007 *go)
+ 	    go7007_read_interrupt(go, &intr_val, &intr_data) < 0 ||
+ 			(intr_val & ~0x1) != 0x5a5a) {
+ 		v4l2_err(go, "error transferring firmware\n");
+-		rv = -1;
++		kfree(go->boot_fw);
++		go->boot_fw = NULL;
++		return -1;
+ 	}
+-	return rv;
++	return 0;
+ }
+ 
+ MODULE_FIRMWARE("go7007/go7007fw.bin");
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch b/queue-5.15/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
new file mode 100644
index 00000000000..9f2fd134120
--- /dev/null
+++ b/queue-5.15/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
@@ -0,0 +1,35 @@
+From a352378ca19357f641775268529368e001d71dfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 13:00:33 +0100
+Subject: media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit 4797a3dd46f220e6d83daf54d70c5b33db6deb01 ]
+
+Free the memory allocated in v4l2_ctrl_handler_init on release.
+
+Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-csc-scaler.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
+index eb6da9b9d8ba8..c29a950639e46 100644
+--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
++++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
+@@ -803,6 +803,7 @@ static int ipu_csc_scaler_release(struct file *file)
+ 
+ 	dev_dbg(priv->dev, "Releasing instance %p\n", ctx);
+ 
++	v4l2_ctrl_handler_free(&ctx->ctrl_hdlr);
+ 	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+ 	v4l2_fh_del(&ctx->fh);
+ 	v4l2_fh_exit(&ctx->fh);
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch b/queue-5.15/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
new file mode 100644
index 00000000000..7f05257f862
--- /dev/null
+++ b/queue-5.15/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
@@ -0,0 +1,93 @@
+From 6f4d9294c4a14a691cbaea614cab63cbb1e463a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 13:10:22 +0100
+Subject: media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bfb1b99802ef16045402deb855c197591dc78886 ]
+
+The ipi handler here tries hard to maintain const-ness of its argument,
+but by doing that causes a warning about function type casts:
+
+drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c:38:32: error: cast from 'mtk_vcodec_ipi_handler' (aka 'void (*)(void *, unsigned int, void *)') to 'ipi_handler_t' (aka 'void (*)(const void *, unsigned int, void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   38 |         ipi_handler_t handler_const = (ipi_handler_t)handler;
+      |                                       ^~~~~~~~~~~~~~~~~~~~~~
+
+Remove the hack and just use a non-const argument.
+
+Fixes: bf1d556ad4e0 ("media: mtk-vcodec: abstract firmware interface")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c          |  2 +-
+ drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 10 +---------
+ drivers/media/platform/mtk-vpu/mtk_vpu.c              |  2 +-
+ drivers/media/platform/mtk-vpu/mtk_vpu.h              |  2 +-
+ 4 files changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c b/drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c
+index b065ccd069140..378a1cba0144f 100644
+--- a/drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c
++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_vpu.c
+@@ -26,7 +26,7 @@ static void mtk_mdp_vpu_handle_init_ack(const struct mdp_ipi_comm_ack *msg)
+ 	vpu->inst_addr = msg->vpu_inst_addr;
+ }
+ 
+-static void mtk_mdp_vpu_ipi_handler(const void *data, unsigned int len,
++static void mtk_mdp_vpu_ipi_handler(void *data, unsigned int len,
+ 				    void *priv)
+ {
+ 	const struct mdp_ipi_comm_ack *msg = data;
+diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c
+index cfc7ebed8fb7a..1ec29f1b163a1 100644
+--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c
+@@ -29,15 +29,7 @@ static int mtk_vcodec_vpu_set_ipi_register(struct mtk_vcodec_fw *fw, int id,
+ 					   mtk_vcodec_ipi_handler handler,
+ 					   const char *name, void *priv)
+ {
+-	/*
+-	 * The handler we receive takes a void * as its first argument. We
+-	 * cannot change this because it needs to be passed down to the rproc
+-	 * subsystem when SCP is used. VPU takes a const argument, which is
+-	 * more constrained, so the conversion below is safe.
+-	 */
+-	ipi_handler_t handler_const = (ipi_handler_t)handler;
+-
+-	return vpu_ipi_register(fw->pdev, id, handler_const, name, priv);
++	return vpu_ipi_register(fw->pdev, id, handler, name, priv);
+ }
+ 
+ static int mtk_vcodec_vpu_ipi_send(struct mtk_vcodec_fw *fw, int id, void *buf,
+diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c
+index af59cc52fdd73..e282bbae8f668 100644
+--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c
++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c
+@@ -635,7 +635,7 @@ int vpu_load_firmware(struct platform_device *pdev)
+ }
+ EXPORT_SYMBOL_GPL(vpu_load_firmware);
+ 
+-static void vpu_init_ipi_handler(const void *data, unsigned int len, void *priv)
++static void vpu_init_ipi_handler(void *data, unsigned int len, void *priv)
+ {
+ 	struct mtk_vpu *vpu = priv;
+ 	const struct vpu_run *run = data;
+diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.h b/drivers/media/platform/mtk-vpu/mtk_vpu.h
+index a56053ff135af..da05f3e740810 100644
+--- a/drivers/media/platform/mtk-vpu/mtk_vpu.h
++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.h
+@@ -17,7 +17,7 @@
+  * VPU interfaces with other blocks by share memory and interrupt.
+  */
+ 
+-typedef void (*ipi_handler_t) (const void *data,
++typedef void (*ipi_handler_t) (void *data,
+ 			       unsigned int len,
+ 			       void *priv);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-pvrusb2-fix-pvr2_stream_callback-casts.patch b/queue-5.15/media-pvrusb2-fix-pvr2_stream_callback-casts.patch
new file mode 100644
index 00000000000..151d27db11f
--- /dev/null
+++ b/queue-5.15/media-pvrusb2-fix-pvr2_stream_callback-casts.patch
@@ -0,0 +1,115 @@
+From 4d0f11b9dbbbff68717e326fd4d3709258f879cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:04:27 +0100
+Subject: media: pvrusb2: fix pvr2_stream_callback casts
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 30baa4a96b23add91a87305baaeba82c4e109e1f ]
+
+clang-16 complains about a control flow integrity (KCFI) issue in pvrusb2,
+which casts three different prototypes into pvr2_stream_callback:
+
+drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1070:30: error: cast from 'void (*)(struct pvr2_v4l2_fh *)' to 'pvr2_stream_callback' (aka 'void (*)(void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1070 |         pvr2_stream_set_callback(sp,(pvr2_stream_callback)pvr2_v4l2_notify,fh);
+      |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/media/usb/pvrusb2/pvrusb2-context.c:110:6: error: cast from 'void (*)(struct pvr2_context *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  110 |                                         (void (*)(void *))pvr2_context_notify,
+      |                                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/media/usb/pvrusb2/pvrusb2-dvb.c:152:6: error: cast from 'void (*)(struct pvr2_dvb_adapter *)' to 'pvr2_stream_callback' (aka 'void (*)(void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  152 |                                  (pvr2_stream_callback) pvr2_dvb_notify, adap);
+      |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Change the functions to actually take a void* argument so the cast is no longer
+needed.
+
+Fixes: bb8ce9d9143c ("V4L/DVB (7682): pvrusb2-dvb: finish up stream & buffer handling")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-context.c | 8 ++++----
+ drivers/media/usb/pvrusb2/pvrusb2-dvb.c     | 6 ++++--
+ drivers/media/usb/pvrusb2/pvrusb2-v4l2.c    | 6 ++++--
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+index 1764674de98bc..58f2f3ff10ee2 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+@@ -90,8 +90,10 @@ static void pvr2_context_destroy(struct pvr2_context *mp)
+ }
+ 
+ 
+-static void pvr2_context_notify(struct pvr2_context *mp)
++static void pvr2_context_notify(void *ptr)
+ {
++	struct pvr2_context *mp = ptr;
++
+ 	pvr2_context_set_notify(mp,!0);
+ }
+ 
+@@ -106,9 +108,7 @@ static void pvr2_context_check(struct pvr2_context *mp)
+ 		pvr2_trace(PVR2_TRACE_CTXT,
+ 			   "pvr2_context %p (initialize)", mp);
+ 		/* Finish hardware initialization */
+-		if (pvr2_hdw_initialize(mp->hdw,
+-					(void (*)(void *))pvr2_context_notify,
+-					mp)) {
++		if (pvr2_hdw_initialize(mp->hdw, pvr2_context_notify, mp)) {
+ 			mp->video_stream.stream =
+ 				pvr2_hdw_get_video_stream(mp->hdw);
+ 			/* Trigger interface initialization.  By doing this
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-dvb.c b/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
+index 6954584526a32..1b768e7466721 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
+@@ -88,8 +88,10 @@ static int pvr2_dvb_feed_thread(void *data)
+ 	return stat;
+ }
+ 
+-static void pvr2_dvb_notify(struct pvr2_dvb_adapter *adap)
++static void pvr2_dvb_notify(void *ptr)
+ {
++	struct pvr2_dvb_adapter *adap = ptr;
++
+ 	wake_up(&adap->buffer_wait_data);
+ }
+ 
+@@ -149,7 +151,7 @@ static int pvr2_dvb_stream_do_start(struct pvr2_dvb_adapter *adap)
+ 	}
+ 
+ 	pvr2_stream_set_callback(pvr->video_stream.stream,
+-				 (pvr2_stream_callback) pvr2_dvb_notify, adap);
++				 pvr2_dvb_notify, adap);
+ 
+ 	ret = pvr2_stream_set_buffer_count(stream, PVR2_DVB_BUFFER_COUNT);
+ 	if (ret < 0) return ret;
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+index c872868becbdc..29f2e767f236f 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+@@ -1037,8 +1037,10 @@ static int pvr2_v4l2_open(struct file *file)
+ }
+ 
+ 
+-static void pvr2_v4l2_notify(struct pvr2_v4l2_fh *fhp)
++static void pvr2_v4l2_notify(void *ptr)
+ {
++	struct pvr2_v4l2_fh *fhp = ptr;
++
+ 	wake_up(&fhp->wait_data);
+ }
+ 
+@@ -1071,7 +1073,7 @@ static int pvr2_v4l2_iosetup(struct pvr2_v4l2_fh *fh)
+ 
+ 	hdw = fh->channel.mc_head->hdw;
+ 	sp = fh->pdi->stream->stream;
+-	pvr2_stream_set_callback(sp,(pvr2_stream_callback)pvr2_v4l2_notify,fh);
++	pvr2_stream_set_callback(sp, pvr2_v4l2_notify, fh);
+ 	pvr2_hdw_set_stream_type(hdw,fh->pdi->config);
+ 	if ((ret = pvr2_hdw_set_streaming(hdw,!0)) < 0) return ret;
+ 	return pvr2_ioread_set_enabled(fh->rhp,!0);
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch b/queue-5.15/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
new file mode 100644
index 00000000000..9925eedfbf4
--- /dev/null
+++ b/queue-5.15/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
@@ -0,0 +1,75 @@
+From 8b5f149eb5391f61619e71986b71fb3758738bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 15:30:47 +0800
+Subject: media: pvrusb2: fix uaf in pvr2_context_set_notify
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit 0a0b79ea55de8514e1750884e5fec77f9fdd01ee ]
+
+[Syzbot reported]
+BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35
+Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26
+
+CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:377 [inline]
+ print_report+0xc4/0x620 mm/kasan/report.c:488
+ kasan_report+0xda/0x110 mm/kasan/report.c:601
+ pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35
+ pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]
+ pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272
+
+Freed by task 906:
+kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
+kasan_save_track+0x14/0x30 mm/kasan/common.c:68
+kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
+poison_slab_object mm/kasan/common.c:241 [inline]
+__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257
+kasan_slab_free include/linux/kasan.h:184 [inline]
+slab_free_hook mm/slub.c:2121 [inline]
+slab_free mm/slub.c:4299 [inline]
+kfree+0x105/0x340 mm/slub.c:4409
+pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]
+pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
+
+[Analyze]
+Task A set disconnect_flag = !0, which resulted in Task B's condition being met
+and releasing mp, leading to this issue.
+
+[Fix]
+Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect()
+to avoid this issue.
+
+Reported-and-tested-by: syzbot+ce750e124675d4599449@syzkaller.appspotmail.com
+Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload")
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+index 58f2f3ff10ee2..73c95ba2328a4 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+@@ -267,9 +267,9 @@ static void pvr2_context_exit(struct pvr2_context *mp)
+ void pvr2_context_disconnect(struct pvr2_context *mp)
+ {
+ 	pvr2_hdw_disconnect(mp->hdw);
+-	mp->disconnect_flag = !0;
+ 	if (!pvr2_context_shutok())
+ 		pvr2_context_notify(mp);
++	mp->disconnect_flag = !0;
+ }
+ 
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-pvrusb2-remove-redundant-null-check.patch b/queue-5.15/media-pvrusb2-remove-redundant-null-check.patch
new file mode 100644
index 00000000000..adb024d6f99
--- /dev/null
+++ b/queue-5.15/media-pvrusb2-remove-redundant-null-check.patch
@@ -0,0 +1,41 @@
+From ad3140c61037f2a2c3a4e7bf1d8693c83c4b72a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 07:07:25 -0800
+Subject: media: pvrusb2: remove redundant NULL check
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 95ac1210fb2753f968ebce0730d4fbc553c2a3dc ]
+
+Pointer dip->stream cannot be NULL due to a shift, thus remove redundant
+NULL check.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: c74e0062684b ("V4L/DVB (5059): Pvrusb2: Be smarter about mode restoration")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+index 9657c18833116..c872868becbdc 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+@@ -1202,11 +1202,6 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
+ 		dip->minor_type = pvr2_v4l_type_video;
+ 		nr_ptr = video_nr;
+ 		caps |= V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_AUDIO;
+-		if (!dip->stream) {
+-			pr_err(KBUILD_MODNAME
+-				": Failed to set up pvrusb2 v4l video dev due to missing stream instance\n");
+-			return;
+-		}
+ 		break;
+ 	case VFL_TYPE_VBI:
+ 		dip->config = pvr2_config_vbi;
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-sun8i-di-fix-chroma-difference-threshold.patch b/queue-5.15/media-sun8i-di-fix-chroma-difference-threshold.patch
new file mode 100644
index 00000000000..1b9a3e25f41
--- /dev/null
+++ b/queue-5.15/media-sun8i-di-fix-chroma-difference-threshold.patch
@@ -0,0 +1,36 @@
+From 0adf7b77861770849f9a9a4cd57619e275d1eb4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 14:34:22 +0100
+Subject: media: sun8i-di: Fix chroma difference threshold
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 856525e8db272b0ce6d9c6e6c2eeb97892b485a6 ]
+
+While there is no good explanation what this value does, vendor driver
+uses value 31 for it. Align driver with it.
+
+Fixes: a4260ea49547 ("media: sun4i: Add H3 deinterlace driver")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sunxi/sun8i-di/sun8i-di.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+index 8faf93c418ed5..dd289c7c93bc2 100644
+--- a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
++++ b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+@@ -304,7 +304,7 @@ static void deinterlace_init(struct deinterlace_dev *dev)
+ 
+ 	deinterlace_clr_set_bits(dev, DEINTERLACE_CHROMA_DIFF,
+ 				 DEINTERLACE_CHROMA_DIFF_TH_MSK,
+-				 DEINTERLACE_CHROMA_DIFF_TH(5));
++				 DEINTERLACE_CHROMA_DIFF_TH(31));
+ }
+ 
+ static inline struct deinterlace_ctx *deinterlace_file2ctx(struct file *file)
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-sun8i-di-fix-coefficient-writes.patch b/queue-5.15/media-sun8i-di-fix-coefficient-writes.patch
new file mode 100644
index 00000000000..a494de0face
--- /dev/null
+++ b/queue-5.15/media-sun8i-di-fix-coefficient-writes.patch
@@ -0,0 +1,102 @@
+From e366ecd4140fa89e800c31c1dfd04d79a5fc768c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 14:34:20 +0100
+Subject: media: sun8i-di: Fix coefficient writes
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 794b581f8c6eb7b60fe468ccb96dd3cd38ff779f ]
+
+Currently coefficients are applied only once, since they don't change.
+However, this is done before enable bit is set and thus it doesn't get
+applied properly.
+
+Fix that by applying coefficients after enable bit is set. While this
+means that it will be done evey time, it doesn't bring much time
+penalty.
+
+Fixes: a4260ea49547 ("media: sun4i: Add H3 deinterlace driver")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/sunxi/sun8i-di/sun8i-di.c  | 42 +++++++++----------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+index 671e4a928993d..073a61c094183 100644
+--- a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
++++ b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+@@ -66,6 +66,7 @@ static void deinterlace_device_run(void *priv)
+ 	struct vb2_v4l2_buffer *src, *dst;
+ 	unsigned int hstep, vstep;
+ 	dma_addr_t addr;
++	int i;
+ 
+ 	src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ 	dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+@@ -160,6 +161,26 @@ static void deinterlace_device_run(void *priv)
+ 	deinterlace_write(dev, DEINTERLACE_CH1_HORZ_FACT, hstep);
+ 	deinterlace_write(dev, DEINTERLACE_CH1_VERT_FACT, vstep);
+ 
++	/* neutral filter coefficients */
++	deinterlace_set_bits(dev, DEINTERLACE_FRM_CTRL,
++			     DEINTERLACE_FRM_CTRL_COEF_ACCESS);
++	readl_poll_timeout(dev->base + DEINTERLACE_STATUS, val,
++			   val & DEINTERLACE_STATUS_COEF_STATUS, 2, 40);
++
++	for (i = 0; i < 32; i++) {
++		deinterlace_write(dev, DEINTERLACE_CH0_HORZ_COEF0 + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++		deinterlace_write(dev, DEINTERLACE_CH0_VERT_COEF + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++		deinterlace_write(dev, DEINTERLACE_CH1_HORZ_COEF0 + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++		deinterlace_write(dev, DEINTERLACE_CH1_VERT_COEF + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++	}
++
++	deinterlace_clr_set_bits(dev, DEINTERLACE_FRM_CTRL,
++				 DEINTERLACE_FRM_CTRL_COEF_ACCESS, 0);
++
+ 	deinterlace_clr_set_bits(dev, DEINTERLACE_FIELD_CTRL,
+ 				 DEINTERLACE_FIELD_CTRL_FIELD_CNT_MSK,
+ 				 DEINTERLACE_FIELD_CTRL_FIELD_CNT(ctx->field));
+@@ -248,7 +269,6 @@ static irqreturn_t deinterlace_irq(int irq, void *data)
+ static void deinterlace_init(struct deinterlace_dev *dev)
+ {
+ 	u32 val;
+-	int i;
+ 
+ 	deinterlace_write(dev, DEINTERLACE_BYPASS,
+ 			  DEINTERLACE_BYPASS_CSC);
+@@ -285,26 +305,6 @@ static void deinterlace_init(struct deinterlace_dev *dev)
+ 	deinterlace_clr_set_bits(dev, DEINTERLACE_CHROMA_DIFF,
+ 				 DEINTERLACE_CHROMA_DIFF_TH_MSK,
+ 				 DEINTERLACE_CHROMA_DIFF_TH(5));
+-
+-	/* neutral filter coefficients */
+-	deinterlace_set_bits(dev, DEINTERLACE_FRM_CTRL,
+-			     DEINTERLACE_FRM_CTRL_COEF_ACCESS);
+-	readl_poll_timeout(dev->base + DEINTERLACE_STATUS, val,
+-			   val & DEINTERLACE_STATUS_COEF_STATUS, 2, 40);
+-
+-	for (i = 0; i < 32; i++) {
+-		deinterlace_write(dev, DEINTERLACE_CH0_HORZ_COEF0 + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-		deinterlace_write(dev, DEINTERLACE_CH0_VERT_COEF + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-		deinterlace_write(dev, DEINTERLACE_CH1_HORZ_COEF0 + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-		deinterlace_write(dev, DEINTERLACE_CH1_VERT_COEF + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-	}
+-
+-	deinterlace_clr_set_bits(dev, DEINTERLACE_FRM_CTRL,
+-				 DEINTERLACE_FRM_CTRL_COEF_ACCESS, 0);
+ }
+ 
+ static inline struct deinterlace_ctx *deinterlace_file2ctx(struct file *file)
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-sun8i-di-fix-power-on-off-sequences.patch b/queue-5.15/media-sun8i-di-fix-power-on-off-sequences.patch
new file mode 100644
index 00000000000..0ac5de5d748
--- /dev/null
+++ b/queue-5.15/media-sun8i-di-fix-power-on-off-sequences.patch
@@ -0,0 +1,88 @@
+From a2e9e24c7abde9f1a786794306fb82923d18b162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 14:34:21 +0100
+Subject: media: sun8i-di: Fix power on/off sequences
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit cff104e33bad38f4b2c8d58816a7accfaa2879f9 ]
+
+According to user manual, reset line should be deasserted before clocks
+are enabled. Also fix power down sequence to be reverse of that.
+
+Fixes: a4260ea49547 ("media: sun4i: Add H3 deinterlace driver")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/sunxi/sun8i-di/sun8i-di.c  | 25 ++++++++++---------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+index 073a61c094183..8faf93c418ed5 100644
+--- a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
++++ b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+@@ -933,11 +933,18 @@ static int deinterlace_runtime_resume(struct device *device)
+ 		return ret;
+ 	}
+ 
++	ret = reset_control_deassert(dev->rstc);
++	if (ret) {
++		dev_err(dev->dev, "Failed to apply reset\n");
++
++		goto err_exclusive_rate;
++	}
++
+ 	ret = clk_prepare_enable(dev->bus_clk);
+ 	if (ret) {
+ 		dev_err(dev->dev, "Failed to enable bus clock\n");
+ 
+-		goto err_exclusive_rate;
++		goto err_rst;
+ 	}
+ 
+ 	ret = clk_prepare_enable(dev->mod_clk);
+@@ -954,23 +961,16 @@ static int deinterlace_runtime_resume(struct device *device)
+ 		goto err_mod_clk;
+ 	}
+ 
+-	ret = reset_control_deassert(dev->rstc);
+-	if (ret) {
+-		dev_err(dev->dev, "Failed to apply reset\n");
+-
+-		goto err_ram_clk;
+-	}
+-
+ 	deinterlace_init(dev);
+ 
+ 	return 0;
+ 
+-err_ram_clk:
+-	clk_disable_unprepare(dev->ram_clk);
+ err_mod_clk:
+ 	clk_disable_unprepare(dev->mod_clk);
+ err_bus_clk:
+ 	clk_disable_unprepare(dev->bus_clk);
++err_rst:
++	reset_control_assert(dev->rstc);
+ err_exclusive_rate:
+ 	clk_rate_exclusive_put(dev->mod_clk);
+ 
+@@ -981,11 +981,12 @@ static int deinterlace_runtime_suspend(struct device *device)
+ {
+ 	struct deinterlace_dev *dev = dev_get_drvdata(device);
+ 
+-	reset_control_assert(dev->rstc);
+-
+ 	clk_disable_unprepare(dev->ram_clk);
+ 	clk_disable_unprepare(dev->mod_clk);
+ 	clk_disable_unprepare(dev->bus_clk);
++
++	reset_control_assert(dev->rstc);
++
+ 	clk_rate_exclusive_put(dev->mod_clk);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-tc358743-register-v4l2-async-device-only-after.patch b/queue-5.15/media-tc358743-register-v4l2-async-device-only-after.patch
new file mode 100644
index 00000000000..86854a49059
--- /dev/null
+++ b/queue-5.15/media-tc358743-register-v4l2-async-device-only-after.patch
@@ -0,0 +1,51 @@
+From 93193bb528514bb842c1db6982972e9b6b864b4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 10:01:11 +0100
+Subject: media: tc358743: register v4l2 async device only after successful
+ setup
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 87399f1ff92203d65f1febf5919429f4bb613a02 ]
+
+Ensure the device has been setup correctly before registering the v4l2
+async device, thus allowing userspace to access.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Fixes: 4c5211a10039 ("[media] tc358743: register v4l2 asynchronous subdevice")
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240110090111.458115-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358743.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 3205cd8298dd8..4c6852dc40a90 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -2108,9 +2108,6 @@ static int tc358743_probe(struct i2c_client *client)
+ 	state->mbus_fmt_code = MEDIA_BUS_FMT_RGB888_1X24;
+ 
+ 	sd->dev = &client->dev;
+-	err = v4l2_async_register_subdev(sd);
+-	if (err < 0)
+-		goto err_hdl;
+ 
+ 	mutex_init(&state->confctl_mutex);
+ 
+@@ -2168,6 +2165,10 @@ static int tc358743_probe(struct i2c_client *client)
+ 	if (err)
+ 		goto err_work_queues;
+ 
++	err = v4l2_async_register_subdev(sd);
++	if (err < 0)
++		goto err_work_queues;
++
+ 	v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
+ 		  client->addr << 1, client->adapter->name);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch b/queue-5.15/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
new file mode 100644
index 00000000000..6d3b4b0b6a3
--- /dev/null
+++ b/queue-5.15/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
@@ -0,0 +1,52 @@
+From 50fd6a3a2dff53262d0c2f38a85940a710950925 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 13:17:04 +0800
+Subject: media: ttpci: fix two memleaks in budget_av_attach
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit d0b07f712bf61e1a3cf23c87c663791c42e50837 ]
+
+When saa7146_register_device and saa7146_vv_init fails, budget_av_attach
+should free the resources it allocates, like the error-handling of
+ttpci_budget_init does. Besides, there are two fixme comment refers to
+such deallocations.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ttpci/budget-av.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/ttpci/budget-av.c b/drivers/media/pci/ttpci/budget-av.c
+index 3cb83005cf09b..519f85e0a397d 100644
+--- a/drivers/media/pci/ttpci/budget-av.c
++++ b/drivers/media/pci/ttpci/budget-av.c
+@@ -1462,7 +1462,8 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
+ 		budget_av->has_saa7113 = 1;
+ 		err = saa7146_vv_init(dev, &vv_data);
+ 		if (err != 0) {
+-			/* fixme: proper cleanup here */
++			ttpci_budget_deinit(&budget_av->budget);
++			kfree(budget_av);
+ 			ERR("cannot init vv subsystem\n");
+ 			return err;
+ 		}
+@@ -1471,9 +1472,10 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
+ 		vv_data.vid_ops.vidioc_s_input = vidioc_s_input;
+ 
+ 		if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_VIDEO))) {
+-			/* fixme: proper cleanup here */
+-			ERR("cannot register capture v4l2 device\n");
+ 			saa7146_vv_release(dev);
++			ttpci_budget_deinit(&budget_av->budget);
++			kfree(budget_av);
++			ERR("cannot register capture v4l2 device\n");
+ 			return err;
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch b/queue-5.15/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
new file mode 100644
index 00000000000..64d37b46bfa
--- /dev/null
+++ b/queue-5.15/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
@@ -0,0 +1,48 @@
+From 7c7f6b8ff22660d2eef2d40e5b8d6c0f5a0036eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 20:48:44 +0800
+Subject: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 8f94b49a5b5d386c038e355bef6347298aabd211 ]
+
+The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity
+but isn't freed in its following error-handling paths. This patch
+adds such deallocation to prevent memleak of entity->name.
+
+Fixes: be2fff656322 ("media: add helpers for memory-to-memory media controller")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-mem2mem.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
+index 8aeed39c415f2..5677bccd583e9 100644
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -1062,11 +1062,17 @@ static int v4l2_m2m_register_entity(struct media_device *mdev,
+ 	entity->function = function;
+ 
+ 	ret = media_entity_pads_init(entity, num_pads, pads);
+-	if (ret)
++	if (ret) {
++		kfree(entity->name);
++		entity->name = NULL;
+ 		return ret;
++	}
+ 	ret = media_device_register_entity(mdev, entity);
+-	if (ret)
++	if (ret) {
++		kfree(entity->name);
++		entity->name = NULL;
+ 		return ret;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch b/queue-5.15/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
new file mode 100644
index 00000000000..d6f98d15433
--- /dev/null
+++ b/queue-5.15/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
@@ -0,0 +1,112 @@
+From 58c8ea9cb2fe03c4bd410fe4353e4b4c272b0fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 20:47:53 +0800
+Subject: media: v4l2-tpg: fix some memleaks in tpg_alloc
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 8cf9c5051076e0eb958f4361d50d8b0c3ee6691c ]
+
+In tpg_alloc, resources should be deallocated in each and every
+error-handling paths, since they are allocated in for statements.
+Otherwise there would be memleaks because tpg_free is called only when
+tpg_alloc return 0.
+
+Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 52 +++++++++++++++----
+ 1 file changed, 42 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index 7607b516a7c43..68968bfa2edc1 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -113,6 +113,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
+ {
+ 	unsigned pat;
+ 	unsigned plane;
++	int ret = 0;
+ 
+ 	tpg->max_line_width = max_w;
+ 	for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++) {
+@@ -121,14 +122,18 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
+ 
+ 			tpg->lines[pat][plane] =
+ 				vzalloc(array3_size(max_w, 2, pixelsz));
+-			if (!tpg->lines[pat][plane])
+-				return -ENOMEM;
++			if (!tpg->lines[pat][plane]) {
++				ret = -ENOMEM;
++				goto free_lines;
++			}
+ 			if (plane == 0)
+ 				continue;
+ 			tpg->downsampled_lines[pat][plane] =
+ 				vzalloc(array3_size(max_w, 2, pixelsz));
+-			if (!tpg->downsampled_lines[pat][plane])
+-				return -ENOMEM;
++			if (!tpg->downsampled_lines[pat][plane]) {
++				ret = -ENOMEM;
++				goto free_lines;
++			}
+ 		}
+ 	}
+ 	for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
+@@ -136,18 +141,45 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
+ 
+ 		tpg->contrast_line[plane] =
+ 			vzalloc(array_size(pixelsz, max_w));
+-		if (!tpg->contrast_line[plane])
+-			return -ENOMEM;
++		if (!tpg->contrast_line[plane]) {
++			ret = -ENOMEM;
++			goto free_contrast_line;
++		}
+ 		tpg->black_line[plane] =
+ 			vzalloc(array_size(pixelsz, max_w));
+-		if (!tpg->black_line[plane])
+-			return -ENOMEM;
++		if (!tpg->black_line[plane]) {
++			ret = -ENOMEM;
++			goto free_contrast_line;
++		}
+ 		tpg->random_line[plane] =
+ 			vzalloc(array3_size(max_w, 2, pixelsz));
+-		if (!tpg->random_line[plane])
+-			return -ENOMEM;
++		if (!tpg->random_line[plane]) {
++			ret = -ENOMEM;
++			goto free_contrast_line;
++		}
+ 	}
+ 	return 0;
++
++free_contrast_line:
++	for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
++		vfree(tpg->contrast_line[plane]);
++		vfree(tpg->black_line[plane]);
++		vfree(tpg->random_line[plane]);
++		tpg->contrast_line[plane] = NULL;
++		tpg->black_line[plane] = NULL;
++		tpg->random_line[plane] = NULL;
++	}
++free_lines:
++	for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++)
++		for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
++			vfree(tpg->lines[pat][plane]);
++			tpg->lines[pat][plane] = NULL;
++			if (plane == 0)
++				continue;
++			vfree(tpg->downsampled_lines[pat][plane]);
++			tpg->downsampled_lines[pat][plane] = NULL;
++		}
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(tpg_alloc);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch b/queue-5.15/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
new file mode 100644
index 00000000000..df0d18c7dd4
--- /dev/null
+++ b/queue-5.15/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
@@ -0,0 +1,42 @@
+From 6ddb597cc1bdd57f0c8f8d670a57969b391fadea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 11:50:12 +0000
+Subject: mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle()
+ takes a ref
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+[ Upstream commit e28c28a34ee9fa2ea671a20e5e7064e6220d55e7 ]
+
+of_parse_phandle() returns a device_node with refcount incremented, which
+the callee needs to call of_node_put() on when done. We should only call
+of_node_put() when the property argument is provided though as otherwise
+nothing has taken a reference on the node.
+
+Fixes: f36e789a1f8d ("mfd: altera-sysmgr: Add SOCFPGA System Manager")
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Link: https://lore.kernel.org/r/20240220115012.471689-4-peter.griffin@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/altera-sysmgr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/altera-sysmgr.c b/drivers/mfd/altera-sysmgr.c
+index 5d3715a28b28e..dbe1009943718 100644
+--- a/drivers/mfd/altera-sysmgr.c
++++ b/drivers/mfd/altera-sysmgr.c
+@@ -110,7 +110,9 @@ struct regmap *altr_sysmgr_regmap_lookup_by_phandle(struct device_node *np,
+ 
+ 	dev = driver_find_device_by_of_node(&altr_sysmgr_driver.driver,
+ 					    (void *)sysmgr_np);
+-	of_node_put(sysmgr_np);
++	if (property)
++		of_node_put(sysmgr_np);
++
+ 	if (!dev)
+ 		return ERR_PTR(-EPROBE_DEFER);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch b/queue-5.15/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
new file mode 100644
index 00000000000..733bb1dbd46
--- /dev/null
+++ b/queue-5.15/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
@@ -0,0 +1,42 @@
+From abd8fb04df987d68d8472738d5accc2bdd995fbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 11:50:10 +0000
+Subject: mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a
+ ref
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+[ Upstream commit d2b0680cf3b05490b579e71b0df6e07451977745 ]
+
+of_parse_phandle() returns a device_node with refcount incremented, which
+the callee needs to call of_node_put() on when done. We should only call
+of_node_put() when the property argument is provided though as otherwise
+nothing has taken a reference on the node.
+
+Fixes: 45330bb43421 ("mfd: syscon: Allow property as NULL in syscon_regmap_lookup_by_phandle")
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Link: https://lore.kernel.org/r/20240220115012.471689-2-peter.griffin@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/syscon.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
+index 552b1861adad4..75c732ee9ed6e 100644
+--- a/drivers/mfd/syscon.c
++++ b/drivers/mfd/syscon.c
+@@ -224,7 +224,9 @@ struct regmap *syscon_regmap_lookup_by_phandle(struct device_node *np,
+ 		return ERR_PTR(-ENODEV);
+ 
+ 	regmap = syscon_node_to_regmap(syscon_np);
+-	of_node_put(syscon_np);
++
++	if (property)
++		of_node_put(syscon_np);
+ 
+ 	return regmap;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch b/queue-5.15/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
new file mode 100644
index 00000000000..0a339519a3d
--- /dev/null
+++ b/queue-5.15/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
@@ -0,0 +1,50 @@
+From ad41583f93cbb5d89598dbb8cde08b03fd6dc8cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 22:37:39 +0100
+Subject: mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the
+ .remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ae5004a40a262d329039b99b62bd3fe7645b66ad ]
+
+This looks strange to call release_mem_region() in a remove function
+without any request_mem_region() in the probe or "struct resource"
+somewhere.
+
+So remove the corresponding code.
+
+Fixes: 3a96dff0f828 ("mmc: SD/MMC Host Controller for Wondermedia WM8505/WM8650")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/bb0bb1ed1e18de55e8c0547625bde271e64b8c31.1708983064.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/wmt-sdmmc.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
+index 3933195488575..3fcc81e48ad66 100644
+--- a/drivers/mmc/host/wmt-sdmmc.c
++++ b/drivers/mmc/host/wmt-sdmmc.c
+@@ -889,7 +889,6 @@ static int wmt_mci_remove(struct platform_device *pdev)
+ {
+ 	struct mmc_host *mmc;
+ 	struct wmt_mci_priv *priv;
+-	struct resource *res;
+ 	u32 reg_tmp;
+ 
+ 	mmc = platform_get_drvdata(pdev);
+@@ -917,9 +916,6 @@ static int wmt_mci_remove(struct platform_device *pdev)
+ 	clk_disable_unprepare(priv->clk_sdmmc);
+ 	clk_put(priv->clk_sdmmc);
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	release_mem_region(res->start, resource_size(res));
+-
+ 	mmc_free_host(mmc);
+ 
+ 	dev_info(&pdev->dev, "WMT MCI device removed\n");
+-- 
+2.43.0
+
diff --git a/queue-5.15/module-add-support-for-default-value-for-module-asyn.patch b/queue-5.15/module-add-support-for-default-value-for-module-asyn.patch
new file mode 100644
index 00000000000..76d958364b0
--- /dev/null
+++ b/queue-5.15/module-add-support-for-default-value-for-module-asyn.patch
@@ -0,0 +1,100 @@
+From 5e71cd2829f5ca192a3a7a0f010406489823bf45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jun 2022 18:01:00 -0700
+Subject: module: Add support for default value for module async_probe
+
+From: Saravana Kannan <saravanak@google.com>
+
+[ Upstream commit ae39e9ed964f8e450d0de410b5a757e19581dfc5 ]
+
+Add a module.async_probe kernel command line option that allows enabling
+async probing for all modules. When this command line option is used,
+there might still be some modules for which we want to explicitly force
+synchronous probing, so extend <modulename>.async_probe to take an
+optional bool input so that async probing can be disabled for a specific
+module.
+
+Signed-off-by: Saravana Kannan <saravanak@google.com>
+Reviewed-by: Aaron Tomlin <atomlin@redhat.com>
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Stable-dep-of: 8f8cd6c0a43e ("modules: wait do_free_init correctly")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 17 +++++++++++++++--
+ kernel/module.c                                 | 11 ++++++++++-
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 34b093e7f8910..c4c7273419bda 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1084,8 +1084,12 @@
+ 	nopku		[X86] Disable Memory Protection Keys CPU feature found
+ 			in some Intel CPUs.
+ 
+-	<module>.async_probe [KNL]
+-			Enable asynchronous probe on this module.
++	<module>.async_probe[=<bool>] [KNL]
++			If no <bool> value is specified or if the value
++			specified is not a valid <bool>, enable asynchronous
++			probe on this module.  Otherwise, enable/disable
++			asynchronous probe on this module as indicated by the
++			<bool> value. See also: module.async_probe
+ 
+ 	early_ioremap_debug [KNL]
+ 			Enable debug messages in early_ioremap support. This
+@@ -3137,6 +3141,15 @@
+ 			For details see:
+ 			Documentation/admin-guide/hw-vuln/processor_mmio_stale_data.rst
+ 
++	module.async_probe=<bool>
++			[KNL] When set to true, modules will use async probing
++			by default. To enable/disable async probing for a
++			specific module, use the module specific control that
++			is documented under <module>.async_probe. When both
++			module.async_probe and <module>.async_probe are
++			specified, <module>.async_probe takes precedence for
++			the specific module.
++
+ 	module.sig_enforce
+ 			[KNL] When CONFIG_MODULE_SIG is set, this means that
+ 			modules without (valid) signatures will fail to load.
+diff --git a/kernel/module.c b/kernel/module.c
+index ba9f2bb57889c..d8d677f01adb5 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3713,6 +3713,12 @@ static void do_free_init(struct work_struct *w)
+ 	}
+ }
+ 
++#undef MODULE_PARAM_PREFIX
++#define MODULE_PARAM_PREFIX "module."
++/* Default value for module->async_probe_requested */
++static bool async_probe;
++module_param(async_probe, bool, 0644);
++
+ /*
+  * This is where the real work happens.
+  *
+@@ -3943,7 +3949,8 @@ static int unknown_module_param_cb(char *param, char *val, const char *modname,
+ 	int ret;
+ 
+ 	if (strcmp(param, "async_probe") == 0) {
+-		mod->async_probe_requested = true;
++		if (strtobool(val, &mod->async_probe_requested))
++			mod->async_probe_requested = true;
+ 		return 0;
+ 	}
+ 
+@@ -4110,6 +4117,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
+ 	if (err)
+ 		goto bug_cleanup;
+ 
++	mod->async_probe_requested = async_probe;
++
+ 	/* Module is ready to execute: parsing args may do that. */
+ 	after_dashes = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
+ 				  -32768, 32767, mod,
+-- 
+2.43.0
+
diff --git a/queue-5.15/modules-wait-do_free_init-correctly.patch b/queue-5.15/modules-wait-do_free_init-correctly.patch
new file mode 100644
index 00000000000..7af9a19e463
--- /dev/null
+++ b/queue-5.15/modules-wait-do_free_init-correctly.patch
@@ -0,0 +1,125 @@
+From 921bb31e7c76b9e33e9eb232c74f64f2a876b9f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 10:35:46 +0800
+Subject: modules: wait do_free_init correctly
+
+From: Changbin Du <changbin.du@huawei.com>
+
+[ Upstream commit 8f8cd6c0a43ed637e620bbe45a8d0e0c2f4d5130 ]
+
+The synchronization here is to ensure the ordering of freeing of a module
+init so that it happens before W+X checking.  It is worth noting it is not
+that the freeing was not happening, it is just that our sanity checkers
+raced against the permission checkers which assume init memory is already
+gone.
+
+Commit 1a7b7d922081 ("modules: Use vmalloc special flag") moved calling
+do_free_init() into a global workqueue instead of relying on it being
+called through call_rcu(..., do_free_init), which used to allowed us call
+do_free_init() asynchronously after the end of a subsequent grace period.
+The move to a global workqueue broke the gaurantees for code which needed
+to be sure the do_free_init() would complete with rcu_barrier().  To fix
+this callers which used to rely on rcu_barrier() must now instead use
+flush_work(&init_free_wq).
+
+Without this fix, we still could encounter false positive reports in W+X
+checking since the rcu_barrier() here can not ensure the ordering now.
+
+Even worse, the rcu_barrier() can introduce significant delay.  Eric
+Chanudet reported that the rcu_barrier introduces ~0.1s delay on a
+PREEMPT_RT kernel.
+
+  [    0.291444] Freeing unused kernel memory: 5568K
+  [    0.402442] Run /sbin/init as init process
+
+With this fix, the above delay can be eliminated.
+
+Link: https://lkml.kernel.org/r/20240227023546.2490667-1-changbin.du@huawei.com
+Fixes: 1a7b7d922081 ("modules: Use vmalloc special flag")
+Signed-off-by: Changbin Du <changbin.du@huawei.com>
+Tested-by: Eric Chanudet <echanude@redhat.com>
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Xiaoyi Su <suxiaoyi@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/moduleloader.h | 8 ++++++++
+ init/main.c                  | 5 +++--
+ kernel/module.c              | 9 +++++++--
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
+index 1322652a9d0d9..7dc186ec52a29 100644
+--- a/include/linux/moduleloader.h
++++ b/include/linux/moduleloader.h
+@@ -95,6 +95,14 @@ int module_finalize(const Elf_Ehdr *hdr,
+ 		    const Elf_Shdr *sechdrs,
+ 		    struct module *mod);
+ 
++#ifdef CONFIG_MODULES
++void flush_module_init_free_work(void);
++#else
++static inline void flush_module_init_free_work(void)
++{
++}
++#endif
++
+ /* Any cleanup needed when module leaves. */
+ void module_arch_cleanup(struct module *mod);
+ 
+diff --git a/init/main.c b/init/main.c
+index 5c81d7fb2fe9c..f27e8510b1554 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -89,6 +89,7 @@
+ #include <linux/sched/task_stack.h>
+ #include <linux/context_tracking.h>
+ #include <linux/random.h>
++#include <linux/moduleloader.h>
+ #include <linux/list.h>
+ #include <linux/integrity.h>
+ #include <linux/proc_ns.h>
+@@ -1464,11 +1465,11 @@ static void mark_readonly(void)
+ 	if (rodata_enabled) {
+ 		/*
+ 		 * load_module() results in W+X mappings, which are cleaned
+-		 * up with call_rcu().  Let's make sure that queued work is
++		 * up with init_free_wq. Let's make sure that queued work is
+ 		 * flushed so that we don't hit false positives looking for
+ 		 * insecure pages which are W+X.
+ 		 */
+-		rcu_barrier();
++		flush_module_init_free_work();
+ 		mark_rodata_ro();
+ 		rodata_test();
+ 	} else
+diff --git a/kernel/module.c b/kernel/module.c
+index d8d677f01adb5..4d49c32af570c 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3713,6 +3713,11 @@ static void do_free_init(struct work_struct *w)
+ 	}
+ }
+ 
++void flush_module_init_free_work(void)
++{
++	flush_work(&init_free_wq);
++}
++
+ #undef MODULE_PARAM_PREFIX
+ #define MODULE_PARAM_PREFIX "module."
+ /* Default value for module->async_probe_requested */
+@@ -3803,8 +3808,8 @@ static noinline int do_init_module(struct module *mod)
+ 	 * Note that module_alloc() on most architectures creates W+X page
+ 	 * mappings which won't be cleaned up until do_free_init() runs.  Any
+ 	 * code such as mark_rodata_ro() which depends on those mappings to
+-	 * be cleaned up needs to sync with the queued work - ie
+-	 * rcu_barrier()
++	 * be cleaned up needs to sync with the queued work by invoking
++	 * flush_module_init_free_work().
+ 	 */
+ 	if (llist_add(&freeinit->node, &init_free_list))
+ 		schedule_work(&init_free_wq);
+-- 
+2.43.0
+
diff --git a/queue-5.15/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch b/queue-5.15/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
new file mode 100644
index 00000000000..43fa26f3463
--- /dev/null
+++ b/queue-5.15/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
@@ -0,0 +1,39 @@
+From ca95991bfcff18954d738eff25e7b766b1d386c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 12:34:18 +0200
+Subject: mtd: maps: physmap-core: fix flash size larger than 32-bit
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 3884f03edd34887514a0865a80769cd5362d5c3b ]
+
+mtd-ram can potentially be larger than 4GB. get_bitmask_order() uses
+fls() that is not guaranteed to work with values larger than 32-bit.
+Specifically on aarch64 fls() returns 0 when all 32 LSB bits are clear.
+Use fls64() instead.
+
+Fixes: ba32ce95cbd987 ("mtd: maps: Merge gpio-addr-flash.c into physmap-core.c")
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/9fbf3664ce00f8b07867f1011834015f21d162a5.1707388458.git.baruch@tkos.co.il
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/maps/physmap-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/maps/physmap-core.c b/drivers/mtd/maps/physmap-core.c
+index 9ab795f03c546..e5552093585e2 100644
+--- a/drivers/mtd/maps/physmap-core.c
++++ b/drivers/mtd/maps/physmap-core.c
+@@ -528,7 +528,7 @@ static int physmap_flash_probe(struct platform_device *dev)
+ 		if (!info->maps[i].phys)
+ 			info->maps[i].phys = res->start;
+ 
+-		info->win_order = get_bitmask_order(resource_size(res)) - 1;
++		info->win_order = fls64(resource_size(res)) - 1;
+ 		info->maps[i].size = BIT(info->win_order +
+ 					 (info->gpios ?
+ 					  info->gpios->ndescs : 0));
+-- 
+2.43.0
+
diff --git a/queue-5.15/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch b/queue-5.15/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
new file mode 100644
index 00000000000..327dbd6728e
--- /dev/null
+++ b/queue-5.15/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
@@ -0,0 +1,52 @@
+From c2a7217dfea0211d19c2b81f110e7d8a361775ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:00:09 +0100
+Subject: mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 347b828882e6334690e7003ce5e2fe5f233dc508 ]
+
+clang-16 warns about mismatched function prototypes:
+
+drivers/mtd/nand/raw/lpc32xx_mlc.c:783:29: error: cast from 'irqreturn_t (*)(int, struct lpc32xx_nand_host *)' (aka 'enum irqreturn (*)(int, struct lpc32xx_nand_host *)') to 'irq_handler_t' (aka 'enum irqreturn (*)(int, void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+
+Change the interrupt handler to the normal way of just passing
+a void* pointer and converting it inside the function..
+
+Fixes: 70f7cb78ec53 ("mtd: add LPC32xx MLC NAND driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240213100146.455811-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/lpc32xx_mlc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/lpc32xx_mlc.c b/drivers/mtd/nand/raw/lpc32xx_mlc.c
+index 452ecaf7775ac..1cfe3dd0bad4d 100644
+--- a/drivers/mtd/nand/raw/lpc32xx_mlc.c
++++ b/drivers/mtd/nand/raw/lpc32xx_mlc.c
+@@ -303,8 +303,9 @@ static int lpc32xx_nand_device_ready(struct nand_chip *nand_chip)
+ 	return 0;
+ }
+ 
+-static irqreturn_t lpc3xxx_nand_irq(int irq, struct lpc32xx_nand_host *host)
++static irqreturn_t lpc3xxx_nand_irq(int irq, void *data)
+ {
++	struct lpc32xx_nand_host *host = data;
+ 	uint8_t sr;
+ 
+ 	/* Clear interrupt flag by reading status */
+@@ -779,7 +780,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
+ 		goto release_dma_chan;
+ 	}
+ 
+-	if (request_irq(host->irq, (irq_handler_t)&lpc3xxx_nand_irq,
++	if (request_irq(host->irq, &lpc3xxx_nand_irq,
+ 			IRQF_TRIGGER_HIGH, DRV_NAME, host)) {
+ 		dev_err(&pdev->dev, "Error requesting NAND IRQ\n");
+ 		res = -ENXIO;
+-- 
+2.43.0
+
diff --git a/queue-5.15/nbd-null-check-for-nla_nest_start.patch b/queue-5.15/nbd-null-check-for-nla_nest_start.patch
new file mode 100644
index 00000000000..6c3406e18a5
--- /dev/null
+++ b/queue-5.15/nbd-null-check-for-nla_nest_start.patch
@@ -0,0 +1,43 @@
+From 55a980440fa23563cf7533dd1a272d6463c57df8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 20:25:38 -0800
+Subject: nbd: null check for nla_nest_start
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d ]
+
+nla_nest_start() may fail and return NULL. Insert a check and set errno
+based on other call sites within the same source code.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
+Fixes: 47d902b90a32 ("nbd: add a status netlink command")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20240218042534.it.206-kees@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index d379a047d4273..d12e9f1721c8e 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -2344,6 +2344,12 @@ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info)
+ 	}
+ 
+ 	dev_list = nla_nest_start_noflag(reply, NBD_ATTR_DEVICE_LIST);
++	if (!dev_list) {
++		nlmsg_free(reply);
++		ret = -EMSGSIZE;
++		goto out;
++	}
++
+ 	if (index == -1) {
+ 		ret = idr_for_each(&nbd_index_idr, &status_cb, reply);
+ 		if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch b/queue-5.15/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
new file mode 100644
index 00000000000..e8d1fd5c3dd
--- /dev/null
+++ b/queue-5.15/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
@@ -0,0 +1,49 @@
+From 7d37ee59936ec6328dda2e3014bd50482fc64dae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 07:13:29 -0800
+Subject: net: blackhole_dev: fix build warning for ethh set but not used
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 843a8851e89e2e85db04caaf88d8554818319047 ]
+
+lib/test_blackhole_dev.c sets a variable that is never read, causing
+this following building warning:
+
+	lib/test_blackhole_dev.c:32:17: warning: variable 'ethh' set but not used [-Wunused-but-set-variable]
+
+Remove the variable struct ethhdr *ethh, which is unused.
+
+Fixes: 509e56b37cc3 ("blackhole_dev: add a selftest")
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_blackhole_dev.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/lib/test_blackhole_dev.c b/lib/test_blackhole_dev.c
+index 4c40580a99a36..f247089d63c08 100644
+--- a/lib/test_blackhole_dev.c
++++ b/lib/test_blackhole_dev.c
+@@ -29,7 +29,6 @@ static int __init test_blackholedev_init(void)
+ {
+ 	struct ipv6hdr *ip6h;
+ 	struct sk_buff *skb;
+-	struct ethhdr *ethh;
+ 	struct udphdr *uh;
+ 	int data_len;
+ 	int ret;
+@@ -61,7 +60,7 @@ static int __init test_blackholedev_init(void)
+ 	ip6h->saddr = in6addr_loopback;
+ 	ip6h->daddr = in6addr_loopback;
+ 	/* Ether */
+-	ethh = (struct ethhdr *)skb_push(skb, sizeof(struct ethhdr));
++	skb_push(skb, sizeof(struct ethhdr));
+ 	skb_set_mac_header(skb, 0);
+ 
+ 	skb->protocol = htons(ETH_P_IPV6);
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-change-sock_getsockopt-to-take-the-sk-ptr-instea.patch b/queue-5.15/net-change-sock_getsockopt-to-take-the-sk-ptr-instea.patch
new file mode 100644
index 00000000000..0103e35d223
--- /dev/null
+++ b/queue-5.15/net-change-sock_getsockopt-to-take-the-sk-ptr-instea.patch
@@ -0,0 +1,80 @@
+From 1a1dbfa79840a4a94bbeb4b65081f76ba99bde6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 17:27:56 -0700
+Subject: net: Change sock_getsockopt() to take the sk ptr instead of the sock
+ ptr
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit ba74a7608dc12fbbd8ea36e660087f08a81ef26a ]
+
+A latter patch refactors bpf_getsockopt(SOL_SOCKET) with the
+sock_getsockopt() to avoid code duplication and code
+drift between the two duplicates.
+
+The current sock_getsockopt() takes sock ptr as the argument.
+The very first thing of this function is to get back the sk ptr
+by 'sk = sock->sk'.
+
+bpf_getsockopt() could be called when the sk does not have
+the sock ptr created.  Meaning sk->sk_socket is NULL.  For example,
+when a passive tcp connection has just been established but has yet
+been accept()-ed.  Thus, it cannot use the sock_getsockopt(sk->sk_socket)
+or else it will pass a NULL ptr.
+
+This patch moves all sock_getsockopt implementation to the newly
+added sk_getsockopt().  The new sk_getsockopt() takes a sk ptr
+and immediately gets the sock ptr by 'sock = sk->sk_socket'
+
+The existing sock_getsockopt(sock) is changed to call
+sk_getsockopt(sock->sk).  All existing callers have both sock->sk
+and sk->sk_socket pointer.
+
+The latter patch will make bpf_getsockopt(SOL_SOCKET) call
+sk_getsockopt(sk) directly.  The bpf_getsockopt(SOL_SOCKET) does
+not use the optnames that require sk->sk_socket, so it will
+be safe.
+
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://lore.kernel.org/r/20220902002756.2887884-1-kafai@fb.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 5c3be3e0eb44 ("ipmr: fix incorrect parameter validation in the ip_mroute_getsockopt() function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index e254790d562ef..f8e3ba34e0a34 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1416,10 +1416,10 @@ static int groups_to_user(gid_t __user *dst, const struct group_info *src)
+ 	return 0;
+ }
+ 
+-int sock_getsockopt(struct socket *sock, int level, int optname,
+-		    char __user *optval, int __user *optlen)
++static int sk_getsockopt(struct sock *sk, int level, int optname,
++			 char __user *optval, int __user *optlen)
+ {
+-	struct sock *sk = sock->sk;
++	struct socket *sock = sk->sk_socket;
+ 
+ 	union {
+ 		int val;
+@@ -1780,6 +1780,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+ 	return 0;
+ }
+ 
++int sock_getsockopt(struct socket *sock, int level, int optname,
++		    char __user *optval, int __user *optlen)
++{
++	return sk_getsockopt(sock->sk, level, optname, optval, optlen);
++}
++
+ /*
+  * Initialize an sk_lock.
+  *
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-ena-remove-ena_select_queue.patch b/queue-5.15/net-ena-remove-ena_select_queue.patch
new file mode 100644
index 00000000000..2168f9d3f25
--- /dev/null
+++ b/queue-5.15/net-ena-remove-ena_select_queue.patch
@@ -0,0 +1,66 @@
+From 0153fb78d18ac7966c3bee0724c4f780424a78bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 17:31:04 -0500
+Subject: net: ena: Remove ena_select_queue
+
+From: Kamal Heib <kheib@redhat.com>
+
+[ Upstream commit 78e886ba2b549945ecada055ee0765f0ded5707a ]
+
+Avoid the following warnings by removing the ena_select_queue() function
+and rely on the net core to do the queue selection, The issue happen
+when an skb received from an interface with more queues than ena is
+forwarded to the ena interface.
+
+[ 1176.159959] eth0 selects TX queue 11, but real number of TX queues is 8
+[ 1176.863976] eth0 selects TX queue 14, but real number of TX queues is 8
+[ 1180.767877] eth0 selects TX queue 14, but real number of TX queues is 8
+[ 1188.703742] eth0 selects TX queue 14, but real number of TX queues is 8
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Kamal Heib <kheib@redhat.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 -----------------
+ 1 file changed, 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 7d4b862be783d..43c099141e211 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -3187,22 +3187,6 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	return NETDEV_TX_OK;
+ }
+ 
+-static u16 ena_select_queue(struct net_device *dev, struct sk_buff *skb,
+-			    struct net_device *sb_dev)
+-{
+-	u16 qid;
+-	/* we suspect that this is good for in--kernel network services that
+-	 * want to loop incoming skb rx to tx in normal user generated traffic,
+-	 * most probably we will not get to this
+-	 */
+-	if (skb_rx_queue_recorded(skb))
+-		qid = skb_get_rx_queue(skb);
+-	else
+-		qid = netdev_pick_tx(dev, skb, NULL);
+-
+-	return qid;
+-}
+-
+ static void ena_config_host_info(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -3372,7 +3356,6 @@ static const struct net_device_ops ena_netdev_ops = {
+ 	.ndo_open		= ena_open,
+ 	.ndo_stop		= ena_close,
+ 	.ndo_start_xmit		= ena_start_xmit,
+-	.ndo_select_queue	= ena_select_queue,
+ 	.ndo_get_stats64	= ena_get_stats64,
+ 	.ndo_tx_timeout		= ena_tx_timeout,
+ 	.ndo_change_mtu		= ena_change_mtu,
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch b/queue-5.15/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
new file mode 100644
index 00000000000..2945a65e4ab
--- /dev/null
+++ b/queue-5.15/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
@@ -0,0 +1,84 @@
+From 05ed39f24d86601b23073a84cf952ac5d29cb675 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 09:01:11 +0800
+Subject: net: hns3: fix kernel crash when 1588 is received on HIP08 devices
+
+From: Yonglong Liu <liuyonglong@huawei.com>
+
+[ Upstream commit 0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3 ]
+
+The HIP08 devices does not register the ptp devices, so the
+hdev->ptp is NULL, but the hardware can receive 1588 messages,
+and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the
+access of hdev->ptp->flags will cause a kernel crash:
+
+[ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
+[ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
+...
+[ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]
+[ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge]
+[ 5889.279101] sp : ffff800012c3bc50
+[ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040
+[ 5889.289927] x27: ffff800009116484 x26: 0000000080007500
+[ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000
+[ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000
+[ 5889.309134] x21: 0000000000000000 x20: ffff204004220080
+[ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000
+[ 5889.321897] x17: 0000000000000000 x16: 0000000000000000
+[ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000
+[ 5889.334617] x13: 0000000000000000 x12: 00000000010011df
+[ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000
+[ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d
+[ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480
+[ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000
+[ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000
+[ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080
+[ 5889.378857] Call trace:
+[ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]
+[ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3]
+[ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3]
+[ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3]
+[ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3]
+[ 5889.411084] napi_poll+0xcc/0x264
+[ 5889.415329] net_rx_action+0xd4/0x21c
+[ 5889.419911] __do_softirq+0x130/0x358
+[ 5889.424484] irq_exit+0x134/0x154
+[ 5889.428700] __handle_domain_irq+0x88/0xf0
+[ 5889.433684] gic_handle_irq+0x78/0x2c0
+[ 5889.438319] el1_irq+0xb8/0x140
+[ 5889.442354] arch_cpu_idle+0x18/0x40
+[ 5889.446816] default_idle_call+0x5c/0x1c0
+[ 5889.451714] cpuidle_idle_call+0x174/0x1b0
+[ 5889.456692] do_idle+0xc8/0x160
+[ 5889.460717] cpu_startup_entry+0x30/0xfc
+[ 5889.465523] secondary_start_kernel+0x158/0x1ec
+[ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80)
+[ 5889.477950] SMP: stopping secondary CPUs
+[ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95
+[ 5890.522951] Starting crashdump kernel...
+
+Fixes: 0bf5eb788512 ("net: hns3: add support for PTP")
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
+index befa9bcc2f2f2..dd0750f6daa6c 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
+@@ -120,7 +120,7 @@ void hclge_ptp_get_rx_hwts(struct hnae3_handle *handle, struct sk_buff *skb,
+ 	u64 ns = nsec;
+ 	u32 sec_h;
+ 
+-	if (!test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags))
++	if (!hdev->ptp || !test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags))
+ 		return;
+ 
+ 	/* Since the BD does not have enough space for the higher 16 bits of
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch b/queue-5.15/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
new file mode 100644
index 00000000000..859b11f7fc8
--- /dev/null
+++ b/queue-5.15/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
@@ -0,0 +1,44 @@
+From 529ba247ef0e2c75088d2bdf4c19d420dbceace0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 09:01:14 +0800
+Subject: net: hns3: fix port duplex configure error in IMP reset
+
+From: Jie Wang <wangjie125@huawei.com>
+
+[ Upstream commit 11d80f79dd9f871a52feba4bf24b5ac39f448eb7 ]
+
+Currently, the mac port is fixed to configured as full dplex mode in
+hclge_mac_init() when driver initialization or reset restore. Users may
+change the mode to half duplex with ethtool,  so it may cause the user
+configuration dropped after reset.
+
+To fix it, don't change the duplex mode when resetting.
+
+Fixes: 2d03eacc0b7e ("net: hns3: Only update mac configuation when necessary")
+Signed-off-by: Jie Wang <wangjie125@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 12274c2b9feab..598da1be22ebe 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2803,7 +2803,10 @@ static int hclge_mac_init(struct hclge_dev *hdev)
+ 	int ret;
+ 
+ 	hdev->support_sfp_query = true;
+-	hdev->hw.mac.duplex = HCLGE_MAC_FULL;
++
++	if (!test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
++		hdev->hw.mac.duplex = HCLGE_MAC_FULL;
++
+ 	ret = hclge_cfg_mac_speed_dup_hw(hdev, hdev->hw.mac.speed,
+ 					 hdev->hw.mac.duplex);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch b/queue-5.15/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
new file mode 100644
index 00000000000..b5f3d887b18
--- /dev/null
+++ b/queue-5.15/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
@@ -0,0 +1,125 @@
+From 9459b2ba9522fceb0dcc7bf4460a683386a18685 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 10:07:16 +0000
+Subject: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b0ec2abf98267f14d032102551581c833b0659d3 ]
+
+Apply the same fix than ones found in :
+
+8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()")
+1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()")
+
+We have to save skb->network_header in a temporary variable
+in order to be able to recompute the network_header pointer
+after a pskb_inet_may_pull() call.
+
+pskb_inet_may_pull() makes sure the needed headers are in skb->head.
+
+syzbot reported:
+BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
+ BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
+ BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]
+ BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409
+  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
+  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
+  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]
+  ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409
+  __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389
+  ipgre_rcv net/ipv4/ip_gre.c:411 [inline]
+  gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447
+  gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163
+  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205
+  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233
+  NF_HOOK include/linux/netfilter.h:314 [inline]
+  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254
+  dst_input include/net/dst.h:461 [inline]
+  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]
+  NF_HOOK include/linux/netfilter.h:314 [inline]
+  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569
+  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]
+  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648
+  netif_receive_skb_internal net/core/dev.c:5734 [inline]
+  netif_receive_skb+0x58/0x660 net/core/dev.c:5793
+  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556
+  tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009
+  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055
+  call_write_iter include/linux/fs.h:2087 [inline]
+  new_sync_write fs/read_write.c:497 [inline]
+  vfs_write+0xb6b/0x1520 fs/read_write.c:590
+  ksys_write+0x20f/0x4c0 fs/read_write.c:643
+  __do_sys_write fs/read_write.c:655 [inline]
+  __se_sys_write fs/read_write.c:652 [inline]
+  __x64_sys_write+0x93/0xd0 fs/read_write.c:652
+  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+Uninit was created at:
+  __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590
+  alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133
+  alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204
+  skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909
+  tun_build_skb drivers/net/tun.c:1686 [inline]
+  tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826
+  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055
+  call_write_iter include/linux/fs.h:2087 [inline]
+  new_sync_write fs/read_write.c:497 [inline]
+  vfs_write+0xb6b/0x1520 fs/read_write.c:590
+  ksys_write+0x20f/0x4c0 fs/read_write.c:643
+  __do_sys_write fs/read_write.c:655 [inline]
+  __se_sys_write fs/read_write.c:652 [inline]
+  __x64_sys_write+0x93/0xd0 fs/read_write.c:652
+  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 96b7cd3049a33..db6d3d5c474c6 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -364,7 +364,7 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+ 		  bool log_ecn_error)
+ {
+ 	const struct iphdr *iph = ip_hdr(skb);
+-	int err;
++	int nh, err;
+ 
+ #ifdef CONFIG_NET_IPGRE_BROADCAST
+ 	if (ipv4_is_multicast(iph->daddr)) {
+@@ -390,8 +390,21 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+ 		tunnel->i_seqno = ntohl(tpi->seq) + 1;
+ 	}
+ 
++	/* Save offset of outer header relative to skb->head,
++	 * because we are going to reset the network header to the inner header
++	 * and might change skb->head.
++	 */
++	nh = skb_network_header(skb) - skb->head;
++
+ 	skb_set_network_header(skb, (tunnel->dev->type == ARPHRD_ETHER) ? ETH_HLEN : 0);
+ 
++	if (!pskb_inet_may_pull(skb)) {
++		DEV_STATS_INC(tunnel->dev, rx_length_errors);
++		DEV_STATS_INC(tunnel->dev, rx_errors);
++		goto drop;
++	}
++	iph = (struct iphdr *)(skb->head + nh);
++
+ 	err = IP_ECN_decapsulate(iph, skb);
+ 	if (unlikely(err)) {
+ 		if (log_ecn_error)
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch b/queue-5.15/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
new file mode 100644
index 00000000000..6404e504dbf
--- /dev/null
+++ b/queue-5.15/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
@@ -0,0 +1,45 @@
+From a490e52c72ee20712e17fa2e68b53ddaf65c1e68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: net: kcm: fix incorrect parameter validation in the kcm_getsockopt)
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 3ed5f415133f9b7518fbe55ba9ae9a3f5e700929 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/kcm/kcmsock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index 0d1ab4149553c..5457ca1909801 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -1275,10 +1275,11 @@ static int kcm_getsockopt(struct socket *sock, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	switch (optname) {
+ 	case KCM_RECV_DISABLE:
+ 		val = kcm->rx_disabled;
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-phy-dp83822-enable-rgmii-mode-if-phy_interface_i.patch b/queue-5.15/net-phy-dp83822-enable-rgmii-mode-if-phy_interface_i.patch
new file mode 100644
index 00000000000..6c791c10fa8
--- /dev/null
+++ b/queue-5.15/net-phy-dp83822-enable-rgmii-mode-if-phy_interface_i.patch
@@ -0,0 +1,59 @@
+From ef1aa16e91cc8fd47206b7b755e5c5330461c404 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 May 2022 01:58:46 +0200
+Subject: net: phy: DP83822: enable rgmii mode if phy_interface_is_rgmii
+
+From: Tommaso Merciai <tommaso.merciai@amarulasolutions.com>
+
+[ Upstream commit 621427fbdada788f18f77238e1c36f463c2cb9d1 ]
+
+RGMII mode can be enable from dp83822 straps, and also writing bit 9
+of register 0x17 - RMII and Status Register (RCSR).
+When phy_interface_is_rgmii rgmii mode must be enabled, same for
+contrary, this prevents malconfigurations of hw straps
+
+References:
+ - https://www.ti.com/lit/gpn/dp83822i p66
+
+Signed-off-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com>
+Co-developed-by: Michael Trimarchi <michael@amarulasolutions.com>
+Suggested-by: Alberto Bianchi <alberto.bianchi@amarulasolutions.com>
+Tested-by: Tommaso Merciai <tommaso.merciai@amarulasolutions.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Stable-dep-of: c8a5c731fd12 ("net: phy: dp83822: Fix RGMII TX delay configuration")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83822.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index f070aa97c77b4..267e6fd3d4448 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -94,7 +94,8 @@
+ #define DP83822_WOL_INDICATION_SEL BIT(8)
+ #define DP83822_WOL_CLR_INDICATION BIT(11)
+ 
+-/* RSCR bits */
++/* RCSR bits */
++#define DP83822_RGMII_MODE_EN	BIT(9)
+ #define DP83822_RX_CLK_SHIFT	BIT(12)
+ #define DP83822_TX_CLK_SHIFT	BIT(11)
+ 
+@@ -407,6 +408,12 @@ static int dp83822_config_init(struct phy_device *phydev)
+ 			if (err)
+ 				return err;
+ 		}
++
++		phy_set_bits_mmd(phydev, DP83822_DEVADDR,
++					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
++	} else {
++		phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
++					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
+ 	}
+ 
+ 	if (dp83822->fx_enabled) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch b/queue-5.15/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
new file mode 100644
index 00000000000..fae50746b78
--- /dev/null
+++ b/queue-5.15/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
@@ -0,0 +1,91 @@
+From a4ff9b8f1b0f8acc8135f8234604f74d6c0699dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 12:06:08 +0100
+Subject: net: phy: dp83822: Fix RGMII TX delay configuration
+
+From: Tim Pambor <tp@osasysteme.de>
+
+[ Upstream commit c8a5c731fd1223090af57da33838c671a7fc6a78 ]
+
+The logic for enabling the TX clock shift is inverse of enabling the RX
+clock shift. The TX clock shift is disabled when DP83822_TX_CLK_SHIFT is
+set. Correct the current behavior and always write the delay configuration
+to ensure consistent delay settings regardless of bootloader configuration.
+
+Reference: https://www.ti.com/lit/ds/symlink/dp83822i.pdf p. 69
+
+Fixes: 8095295292b5 ("net: phy: DP83822: Add setting the fixed internal delay")
+Signed-off-by: Tim Pambor <tp@osasysteme.de>
+Link: https://lore.kernel.org/r/20240305110608.104072-1-tp@osasysteme.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83822.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index 267e6fd3d4448..57411ee1d8374 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -380,7 +380,7 @@ static int dp83822_config_init(struct phy_device *phydev)
+ {
+ 	struct dp83822_private *dp83822 = phydev->priv;
+ 	struct device *dev = &phydev->mdio.dev;
+-	int rgmii_delay;
++	int rgmii_delay = 0;
+ 	s32 rx_int_delay;
+ 	s32 tx_int_delay;
+ 	int err = 0;
+@@ -390,30 +390,33 @@ static int dp83822_config_init(struct phy_device *phydev)
+ 		rx_int_delay = phy_get_internal_delay(phydev, dev, NULL, 0,
+ 						      true);
+ 
+-		if (rx_int_delay <= 0)
+-			rgmii_delay = 0;
+-		else
+-			rgmii_delay = DP83822_RX_CLK_SHIFT;
++		/* Set DP83822_RX_CLK_SHIFT to enable rx clk internal delay */
++		if (rx_int_delay > 0)
++			rgmii_delay |= DP83822_RX_CLK_SHIFT;
+ 
+ 		tx_int_delay = phy_get_internal_delay(phydev, dev, NULL, 0,
+ 						      false);
++
++		/* Set DP83822_TX_CLK_SHIFT to disable tx clk internal delay */
+ 		if (tx_int_delay <= 0)
+-			rgmii_delay &= ~DP83822_TX_CLK_SHIFT;
+-		else
+ 			rgmii_delay |= DP83822_TX_CLK_SHIFT;
+ 
+-		if (rgmii_delay) {
+-			err = phy_set_bits_mmd(phydev, DP83822_DEVADDR,
+-					       MII_DP83822_RCSR, rgmii_delay);
+-			if (err)
+-				return err;
+-		}
++		err = phy_modify_mmd(phydev, DP83822_DEVADDR, MII_DP83822_RCSR,
++				     DP83822_RX_CLK_SHIFT | DP83822_TX_CLK_SHIFT, rgmii_delay);
++		if (err)
++			return err;
++
++		err = phy_set_bits_mmd(phydev, DP83822_DEVADDR,
++				       MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
+ 
+-		phy_set_bits_mmd(phydev, DP83822_DEVADDR,
+-					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
++		if (err)
++			return err;
+ 	} else {
+-		phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
+-					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
++		err = phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
++					 MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
++
++		if (err)
++			return err;
+ 	}
+ 
+ 	if (dp83822->fx_enabled) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch b/queue-5.15/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
new file mode 100644
index 00000000000..2cf753a09d6
--- /dev/null
+++ b/queue-5.15/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
@@ -0,0 +1,48 @@
+From defa651d26be0fae8e8b660b0407ca1e881a6f4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 12:19:06 +0100
+Subject: net: phy: fix phy_get_internal_delay accessing an empty array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kévin L'hôpital <kevin.lhopital@savoirfairelinux.com>
+
+[ Upstream commit 4469c0c5b14a0919f5965c7ceac96b523eb57b79 ]
+
+The phy_get_internal_delay function could try to access to an empty
+array in the case that the driver is calling phy_get_internal_delay
+without defining delay_values and rx-internal-delay-ps or
+tx-internal-delay-ps is defined to 0 in the device-tree.
+This will lead to "unable to handle kernel NULL pointer dereference at
+virtual address 0". To avoid this kernel oops, the test should be delay
+>= 0. As there is already delay < 0 test just before, the test could
+only be size == 0.
+
+Fixes: 92252eec913b ("net: phy: Add a helper to return the index for of the internal delay")
+Co-developed-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Signed-off-by: Kévin L'hôpital <kevin.lhopital@savoirfairelinux.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 0429825a7179d..c1d6ebf12ec74 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -2904,7 +2904,7 @@ s32 phy_get_internal_delay(struct phy_device *phydev, struct device *dev,
+ 	if (delay < 0)
+ 		return delay;
+ 
+-	if (delay && size == 0)
++	if (size == 0)
+ 		return delay;
+ 
+ 	if (delay < delay_values[0] || delay > delay_values[size - 1]) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch b/queue-5.15/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
new file mode 100644
index 00000000000..c0dddc427e6
--- /dev/null
+++ b/queue-5.15/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
@@ -0,0 +1,42 @@
+From 06829ae9f4bb84a7fa755d3614d237572c93f061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 23:58:20 +0200
+Subject: net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d6f4de70f73a106986ee315d7d512539f2f3303a ]
+
+The intent is to check if the strings' are truncated or not. So, >= should
+be used instead of >, because strlcat() and snprintf() return the length of
+the output, excluding the trailing NULL.
+
+Fixes: a02d69261134 ("SUNRPC: Provide functions for managing universal addresses")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/addr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
+index d435bffc61999..97ff11973c493 100644
+--- a/net/sunrpc/addr.c
++++ b/net/sunrpc/addr.c
+@@ -284,10 +284,10 @@ char *rpc_sockaddr2uaddr(const struct sockaddr *sap, gfp_t gfp_flags)
+ 	}
+ 
+ 	if (snprintf(portbuf, sizeof(portbuf),
+-		     ".%u.%u", port >> 8, port & 0xff) > (int)sizeof(portbuf))
++		     ".%u.%u", port >> 8, port & 0xff) >= (int)sizeof(portbuf))
+ 		return NULL;
+ 
+-	if (strlcat(addrbuf, portbuf, sizeof(addrbuf)) > sizeof(addrbuf))
++	if (strlcat(addrbuf, portbuf, sizeof(addrbuf)) >= sizeof(addrbuf))
+ 		return NULL;
+ 
+ 	return kstrdup(addrbuf, gfp_flags);
+-- 
+2.43.0
+
diff --git a/queue-5.15/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch b/queue-5.15/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
new file mode 100644
index 00000000000..49d4c68b514
--- /dev/null
+++ b/queue-5.15/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
@@ -0,0 +1,47 @@
+From 3b43f35c2030eaf326d6174850326cf805618e5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: net/x25: fix incorrect parameter validation in the x25_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit d6eb8de2015f0c24822e47356f839167ebde2945 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 07f6206e7cb47..1e5152fdee589 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -460,12 +460,12 @@ static int x25_getsockopt(struct socket *sock, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		goto out;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	rc = -EINVAL;
+ 	if (len < 0)
+ 		goto out;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	rc = -EFAULT;
+ 	if (put_user(len, optlen))
+ 		goto out;
+-- 
+2.43.0
+
diff --git a/queue-5.15/nfp-flower-handle-acti_netdevs-allocation-failure.patch b/queue-5.15/nfp-flower-handle-acti_netdevs-allocation-failure.patch
new file mode 100644
index 00000000000..28a36890dfb
--- /dev/null
+++ b/queue-5.15/nfp-flower-handle-acti_netdevs-allocation-failure.patch
@@ -0,0 +1,45 @@
+From ed28a319a9cc7c4355111acaf725c5665050b621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 22:25:40 +0800
+Subject: nfp: flower: handle acti_netdevs allocation failure
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 84e95149bd341705f0eca6a7fcb955c548805002 ]
+
+The kmalloc_array() in nfp_fl_lag_do_work() will return null, if
+the physical memory has run out. As a result, if we dereference
+the acti_netdevs, the null pointer dereference bugs will happen.
+
+This patch adds a check to judge whether allocation failure occurs.
+If it happens, the delayed work will be rescheduled and try again.
+
+Fixes: bb9a8d031140 ("nfp: flower: monitor and offload LAG groups")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reviewed-by: Louis Peens <louis.peens@corigine.com>
+Link: https://lore.kernel.org/r/20240308142540.9674-1-duoming@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/lag_conf.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
+index 63907aeb3884e..3167f9675ae0f 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
+@@ -308,6 +308,11 @@ static void nfp_fl_lag_do_work(struct work_struct *work)
+ 
+ 		acti_netdevs = kmalloc_array(entry->slave_cnt,
+ 					     sizeof(*acti_netdevs), GFP_KERNEL);
++		if (!acti_netdevs) {
++			schedule_delayed_work(&lag->work,
++					      NFP_FL_LAG_DELAY);
++			continue;
++		}
+ 
+ 		/* Include sanity check in the loop. It may be that a bond has
+ 		 * changed between processing the last notification and the
+-- 
+2.43.0
+
diff --git a/queue-5.15/nfs-fix-an-off-by-one-in-root_nfs_cat.patch b/queue-5.15/nfs-fix-an-off-by-one-in-root_nfs_cat.patch
new file mode 100644
index 00000000000..fa598e9c2dc
--- /dev/null
+++ b/queue-5.15/nfs-fix-an-off-by-one-in-root_nfs_cat.patch
@@ -0,0 +1,42 @@
+From f8cb8e310d6936cf7300b62e7df135060d3036b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Feb 2024 22:16:53 +0100
+Subject: NFS: Fix an off by one in root_nfs_cat()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 698ad1a538da0b6bf969cfee630b4e3a026afb87 ]
+
+The intent is to check if 'dest' is truncated or not. So, >= should be
+used instead of >, because strlcat() returns the length of 'dest' and 'src'
+excluding the trailing NULL.
+
+Fixes: 56463e50d1fc ("NFS: Use super.c for NFSROOT mount option parsing")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfsroot.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
+index fa148308822cc..c2cf4ff628811 100644
+--- a/fs/nfs/nfsroot.c
++++ b/fs/nfs/nfsroot.c
+@@ -175,10 +175,10 @@ static int __init root_nfs_cat(char *dest, const char *src,
+ 	size_t len = strlen(dest);
+ 
+ 	if (len && dest[len - 1] != ',')
+-		if (strlcat(dest, ",", destlen) > destlen)
++		if (strlcat(dest, ",", destlen) >= destlen)
+ 			return -1;
+ 
+-	if (strlcat(dest, src, destlen) > destlen)
++	if (strlcat(dest, src, destlen) >= destlen)
+ 		return -1;
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch b/queue-5.15/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
new file mode 100644
index 00000000000..16c74cdf177
--- /dev/null
+++ b/queue-5.15/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
@@ -0,0 +1,60 @@
+From eb50234a452c57b90ed960771805069c4dd72cde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 07:51:28 -0700
+Subject: NFSv4.2: fix listxattr maximum XDR buffer size
+
+From: Jorge Mora <jmora1300@gmail.com>
+
+[ Upstream commit bcac8bff90a6ee1629f90669cdb9d28fb86049b0 ]
+
+Switch order of operations to avoid creating a short XDR buffer:
+e.g., buflen = 12, old xdrlen = 12, new xdrlen = 20.
+
+Having a short XDR buffer leads to lxa_maxcount be a few bytes
+less than what is needed to retrieve the whole list when using
+a buflen as returned by a call with size = 0:
+    buflen = listxattr(path, NULL, 0);
+    buf = malloc(buflen);
+    buflen = listxattr(path, buf, buflen);
+
+For a file with one attribute (name = '123456'), the first call
+with size = 0 will return buflen = 12 ('user.123456\x00').
+The second call with size = 12, sends LISTXATTRS with
+lxa_maxcount = 12 + 8 (cookie) + 4 (array count) = 24. The
+XDR buffer needs 8 (cookie) + 4 (array count) + 4 (name count)
++ 6 (name len) + 2 (padding) + 4 (eof) = 28 which is 4 bytes
+shorter than the lxa_maxcount provided in the call.
+
+Fixes: 04a5da690e8f ("NFSv4.2: define limits and sizes for user xattr handling")
+Signed-off-by: Jorge Mora <mora@netapp.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs42.h b/fs/nfs/nfs42.h
+index 0fe5aacbcfdf1..e7192d0eea3de 100644
+--- a/fs/nfs/nfs42.h
++++ b/fs/nfs/nfs42.h
+@@ -54,11 +54,14 @@ int nfs42_proc_removexattr(struct inode *inode, const char *name);
+  * They would be 7 bytes long in the eventual buffer ("user.x\0"), and
+  * 8 bytes long XDR-encoded.
+  *
+- * Include the trailing eof word as well.
++ * Include the trailing eof word as well and make the result a multiple
++ * of 4 bytes.
+  */
+ static inline u32 nfs42_listxattr_xdrsize(u32 buflen)
+ {
+-	return ((buflen / (XATTR_USER_PREFIX_LEN + 2)) * 8) + 4;
++	u32 size = 8 * buflen / (XATTR_USER_PREFIX_LEN + 2) + 4;
++
++	return (size + 3) & ~3;
+ }
+ #endif /* CONFIG_NFS_V4_2 */
+ #endif /* __LINUX_FS_NFS_NFS4_2_H */
+-- 
+2.43.0
+
diff --git a/queue-5.15/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch b/queue-5.15/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
new file mode 100644
index 00000000000..65988dab470
--- /dev/null
+++ b/queue-5.15/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
@@ -0,0 +1,99 @@
+From 530992cc4e3f6ca00d2205e799fd6ca928e72020 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 07:56:12 -0700
+Subject: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
+
+From: Jorge Mora <jmora1300@gmail.com>
+
+[ Upstream commit 251a658bbfceafb4d58c76b77682c8bf7bcfad65 ]
+
+A call to listxattr() with a buffer size = 0 returns the actual
+size of the buffer needed for a subsequent call. When size > 0,
+nfs4_listxattr() does not return an error because either
+generic_listxattr() or nfs4_listxattr_nfs4_label() consumes
+exactly all the bytes then size is 0 when calling
+nfs4_listxattr_nfs4_user() which then triggers the following
+kernel BUG:
+
+  [   99.403778] kernel BUG at mm/usercopy.c:102!
+  [   99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
+  [   99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1
+  [   99.415827] Call trace:
+  [   99.415985]  usercopy_abort+0x70/0xa0
+  [   99.416227]  __check_heap_object+0x134/0x158
+  [   99.416505]  check_heap_object+0x150/0x188
+  [   99.416696]  __check_object_size.part.0+0x78/0x168
+  [   99.416886]  __check_object_size+0x28/0x40
+  [   99.417078]  listxattr+0x8c/0x120
+  [   99.417252]  path_listxattr+0x78/0xe0
+  [   99.417476]  __arm64_sys_listxattr+0x28/0x40
+  [   99.417723]  invoke_syscall+0x78/0x100
+  [   99.417929]  el0_svc_common.constprop.0+0x48/0xf0
+  [   99.418186]  do_el0_svc+0x24/0x38
+  [   99.418376]  el0_svc+0x3c/0x110
+  [   99.418554]  el0t_64_sync_handler+0x120/0x130
+  [   99.418788]  el0t_64_sync+0x194/0x198
+  [   99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)
+
+Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl',
+thus calling lisxattr() with size = 16 will trigger the bug.
+
+Add check on nfs4_listxattr() to return ERANGE error when it is
+called with size > 0 and the return value is greater than size.
+
+Fixes: 012a211abd5d ("NFSv4.2: hook in the user extended attribute handlers")
+Signed-off-by: Jorge Mora <mora@netapp.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index a865b384f0fc0..925ad7dbe6a0d 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -10517,29 +10517,33 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = {
+ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
+ {
+ 	ssize_t error, error2, error3;
++	size_t left = size;
+ 
+-	error = generic_listxattr(dentry, list, size);
++	error = generic_listxattr(dentry, list, left);
+ 	if (error < 0)
+ 		return error;
+ 	if (list) {
+ 		list += error;
+-		size -= error;
++		left -= error;
+ 	}
+ 
+-	error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, size);
++	error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, left);
+ 	if (error2 < 0)
+ 		return error2;
+ 
+ 	if (list) {
+ 		list += error2;
+-		size -= error2;
++		left -= error2;
+ 	}
+ 
+-	error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, size);
++	error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left);
+ 	if (error3 < 0)
+ 		return error3;
+ 
+-	return error + error2 + error3;
++	error += error2 + error3;
++	if (size && error > size)
++		return -ERANGE;
++	return error;
+ }
+ 
+ static void nfs4_enable_swap(struct inode *inode)
+-- 
+2.43.0
+
diff --git a/queue-5.15/ntb-epf-fix-possible-memory-leak-in-pci_vntb_probe.patch b/queue-5.15/ntb-epf-fix-possible-memory-leak-in-pci_vntb_probe.patch
new file mode 100644
index 00000000000..436ccf84704
--- /dev/null
+++ b/queue-5.15/ntb-epf-fix-possible-memory-leak-in-pci_vntb_probe.patch
@@ -0,0 +1,40 @@
+From 070ca1277279ba4a14d5874e2a231becefe0c5be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Nov 2022 17:28:52 +0800
+Subject: NTB: EPF: fix possible memory leak in pci_vntb_probe()
+
+From: ruanjinjie <ruanjinjie@huawei.com>
+
+[ Upstream commit 956578e3d397e00d6254dc7b5194d28587f98518 ]
+
+As ntb_register_device() don't handle error of device_register(),
+if ntb_register_device() returns error in pci_vntb_probe(), name of kobject
+which is allocated in dev_set_name() called in device_add() is leaked.
+
+As comment of device_add() says, it should call put_device() to drop the
+reference count that was set in device_initialize()
+when it fails, so the name can be freed in kobject_cleanup().
+
+Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Stable-dep-of: aebfdfe39b93 ("NTB: fix possible name leak in ntb_register_device()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-vntb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+index 1466dd1904175..138742af51707 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+@@ -1249,6 +1249,7 @@ static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	return 0;
+ 
+ err_register_dev:
++	put_device(&ndev->ntb.dev);
+ 	return -EINVAL;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/ntb-fix-possible-name-leak-in-ntb_register_device.patch b/queue-5.15/ntb-fix-possible-name-leak-in-ntb_register_device.patch
new file mode 100644
index 00000000000..3007b777a24
--- /dev/null
+++ b/queue-5.15/ntb-fix-possible-name-leak-in-ntb_register_device.patch
@@ -0,0 +1,85 @@
+From c070f93cc6f7b0fae87a4306d84b11e3cbfa1146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 11:30:56 +0800
+Subject: NTB: fix possible name leak in ntb_register_device()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 ]
+
+If device_register() fails in ntb_register_device(), the device name
+allocated by dev_set_name() should be freed. As per the comment in
+device_register(), callers should use put_device() to give up the
+reference in the error path. So fix this by calling put_device() in the
+error path so that the name can be freed in kobject_cleanup().
+
+As a result of this, put_device() in the error path of
+ntb_register_device() is removed and the actual error is returned.
+
+Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweicloud.com
+[mani: reworded commit message]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/core.c                            | 8 +++++++-
+ drivers/pci/endpoint/functions/pci-epf-vntb.c | 6 +-----
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/ntb/core.c b/drivers/ntb/core.c
+index 27dd93deff6e5..d702bee780826 100644
+--- a/drivers/ntb/core.c
++++ b/drivers/ntb/core.c
+@@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client);
+ 
+ int ntb_register_device(struct ntb_dev *ntb)
+ {
++	int ret;
++
+ 	if (!ntb)
+ 		return -EINVAL;
+ 	if (!ntb->pdev)
+@@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb)
+ 	ntb->ctx_ops = NULL;
+ 	spin_lock_init(&ntb->ctx_lock);
+ 
+-	return device_register(&ntb->dev);
++	ret = device_register(&ntb->dev);
++	if (ret)
++		put_device(&ntb->dev);
++
++	return ret;
+ }
+ EXPORT_SYMBOL(ntb_register_device);
+ 
+diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+index 138742af51707..d4cd4bd4a0881 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+@@ -1242,15 +1242,11 @@ static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	ret = ntb_register_device(&ndev->ntb);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to register NTB device\n");
+-		goto err_register_dev;
++		return ret;
+ 	}
+ 
+ 	dev_dbg(dev, "PCI Virtual NTB driver loaded\n");
+ 	return 0;
+-
+-err_register_dev:
+-	put_device(&ndev->ntb.dev);
+-	return -EINVAL;
+ }
+ 
+ static struct pci_device_id pci_vntb_table[] = {
+-- 
+2.43.0
+
diff --git a/queue-5.15/opp-debugfs-fix-warning-around-icc_get_name.patch b/queue-5.15/opp-debugfs-fix-warning-around-icc_get_name.patch
new file mode 100644
index 00000000000..ae0a8b3fa69
--- /dev/null
+++ b/queue-5.15/opp-debugfs-fix-warning-around-icc_get_name.patch
@@ -0,0 +1,50 @@
+From 833e36d87e4ce0ef5a2a356e95a9b8f8da3bf5c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 16:48:28 +0530
+Subject: OPP: debugfs: Fix warning around icc_get_name()
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 28330ceb953e39880ea77da4895bb902a1244860 ]
+
+If the kernel isn't built with interconnect support, icc_get_name()
+returns NULL and we get following warning:
+
+drivers/opp/debugfs.c: In function 'bw_name_read':
+drivers/opp/debugfs.c:43:42: error: '%.62s' directive argument is null [-Werror=format-overflow=]
+         i = scnprintf(buf, sizeof(buf), "%.62s\n", icc_get_name(path));
+
+Fix it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402141313.81ltVF5g-lkp@intel.com/
+Fixes: 0430b1d5704b0 ("opp: Expose bandwidth information via debugfs")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/debugfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c
+index 9eb71f47487b2..1c9d039edb26b 100644
+--- a/drivers/opp/debugfs.c
++++ b/drivers/opp/debugfs.c
+@@ -37,10 +37,12 @@ static ssize_t bw_name_read(struct file *fp, char __user *userbuf,
+ 			    size_t count, loff_t *ppos)
+ {
+ 	struct icc_path *path = fp->private_data;
++	const char *name = icc_get_name(path);
+ 	char buf[64];
+-	int i;
++	int i = 0;
+ 
+-	i = scnprintf(buf, sizeof(buf), "%.62s\n", icc_get_name(path));
++	if (name)
++		i = scnprintf(buf, sizeof(buf), "%.62s\n", name);
+ 
+ 	return simple_read_from_buffer(userbuf, count, ppos, buf, i);
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch b/queue-5.15/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
new file mode 100644
index 00000000000..4abc38575d9
--- /dev/null
+++ b/queue-5.15/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
@@ -0,0 +1,52 @@
+From 1e5a27c6999cf6f388fc43b3bb47b624915d458b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 14:16:34 +0100
+Subject: PCI/AER: Fix rootport attribute paths in ABI docs
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 0e7d29a39a546161ea3a49e8e282a43212d7ff68 ]
+
+The 'aer_stats' directory never made it into the sixth and final revision
+of the series adding the sysfs AER attributes.
+
+Link: https://lore.kernel.org/r/20240202131635.11405-2-johan+linaro@kernel.org
+Link: https://lore.kernel.org/lkml/20180621184822.GB14136@bhelgaas-glaptop.roam.corp.google.com/
+Fixes: 12833017e581 ("PCI/AER: Add sysfs attributes for rootport cumulative stats")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats b/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats
+index 860db53037a58..24087d5fd417a 100644
+--- a/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats
++++ b/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats
+@@ -100,19 +100,19 @@ collectors) that are AER capable. These indicate the number of error messages as
+ device, so these counters include them and are thus cumulative of all the error
+ messages on the PCI hierarchy originating at that root port.
+ 
+-What:		/sys/bus/pci/devices/<dev>/aer_stats/aer_rootport_total_err_cor
++What:		/sys/bus/pci/devices/<dev>/aer_rootport_total_err_cor
+ Date:		July 2018
+ KernelVersion: 4.19.0
+ Contact:	linux-pci@vger.kernel.org, rajatja@google.com
+ Description:	Total number of ERR_COR messages reported to rootport.
+ 
+-What:	    /sys/bus/pci/devices/<dev>/aer_stats/aer_rootport_total_err_fatal
++What:		/sys/bus/pci/devices/<dev>/aer_rootport_total_err_fatal
+ Date:		July 2018
+ KernelVersion: 4.19.0
+ Contact:	linux-pci@vger.kernel.org, rajatja@google.com
+ Description:	Total number of ERR_FATAL messages reported to rootport.
+ 
+-What:	    /sys/bus/pci/devices/<dev>/aer_stats/aer_rootport_total_err_nonfatal
++What:		/sys/bus/pci/devices/<dev>/aer_rootport_total_err_nonfatal
+ Date:		July 2018
+ KernelVersion: 4.19.0
+ Contact:	linux-pci@vger.kernel.org, rajatja@google.com
+-- 
+2.43.0
+
diff --git a/queue-5.15/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch b/queue-5.15/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
new file mode 100644
index 00000000000..e8a842b7cea
--- /dev/null
+++ b/queue-5.15/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
@@ -0,0 +1,45 @@
+From f7abf4caa30d8b752dac4e35efc27091989cce85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 13:08:15 +0200
+Subject: PCI/DPC: Print all TLP Prefixes, not just the first
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 6568d82512b0a64809acff3d7a747362fa4288c8 ]
+
+The TLP Prefix Log Register consists of multiple DWORDs (PCIe r6.1 sec
+7.9.14.13) but the loop in dpc_process_rp_pio_error() keeps reading from
+the first DWORD, so we print only the first PIO TLP Prefix (duplicated
+several times), and we never print the second, third, etc., Prefixes.
+
+Add the iteration count based offset calculation into the config read.
+
+Fixes: f20c4ea49ec4 ("PCI/DPC: Add eDPC support")
+Link: https://lore.kernel.org/r/20240118110815.3867-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+[bhelgaas: add user-visible details to commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/dpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c
+index f21d64ae4ffcc..cf0d4ba2e157a 100644
+--- a/drivers/pci/pcie/dpc.c
++++ b/drivers/pci/pcie/dpc.c
+@@ -231,7 +231,7 @@ static void dpc_process_rp_pio_error(struct pci_dev *pdev)
+ 
+ 	for (i = 0; i < pdev->dpc_rp_log_size - 5; i++) {
+ 		pci_read_config_dword(pdev,
+-			cap + PCI_EXP_DPC_RP_PIO_TLPPREFIX_LOG, &prefix);
++			cap + PCI_EXP_DPC_RP_PIO_TLPPREFIX_LOG + i * 4, &prefix);
+ 		pci_err(pdev, "TLP Prefix Header: dw%d, %#010x\n", i, prefix);
+ 	}
+  clear_status:
+-- 
+2.43.0
+
diff --git a/queue-5.15/pci-endpoint-support-ntb-transfer-between-rc-and-ep.patch b/queue-5.15/pci-endpoint-support-ntb-transfer-between-rc-and-ep.patch
new file mode 100644
index 00000000000..56809355ac9
--- /dev/null
+++ b/queue-5.15/pci-endpoint-support-ntb-transfer-between-rc-and-ep.patch
@@ -0,0 +1,1515 @@
+From f8f2869d35db08fd9f56af92093473b585cada7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Feb 2022 10:23:54 -0600
+Subject: PCI: endpoint: Support NTB transfer between RC and EP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit e35f56bb03304abc92c928b641af41ca372966bb ]
+
+Add NTB function driver and virtual PCI Bus and Virtual NTB driver
+to implement communication between PCIe Root Port and PCIe EP devices
+
+┌────────────┐         ┌─────────────────────────────────────┐
+│            │         │                                     │
+├────────────┤         │                      ┌──────────────┤
+│ NTB        │         │                      │ NTB          │
+│ NetDev     │         │                      │ NetDev       │
+├────────────┤         │                      ├──────────────┤
+│ NTB        │         │                      │ NTB          │
+│ Transfer   │         │                      │ Transfer     │
+├────────────┤         │                      ├──────────────┤
+│            │         │                      │              │
+│  PCI NTB   │         │                      │              │
+│    EPF     │         │                      │              │
+│   Driver   │         │                      │ PCI Virtual  │
+│            │         ├───────────────┐      │ NTB Driver   │
+│            │         │ PCI EP NTB    │◄────►│              │
+│            │         │  FN Driver    │      │              │
+├────────────┤         ├───────────────┤      ├──────────────┤
+│            │         │               │      │              │
+│  PCI Bus   │ ◄─────► │  PCI EP Bus   │      │  Virtual PCI │
+│            │  PCI    │               │      │     Bus      │
+└────────────┘         └───────────────┴──────┴──────────────┘
+PCIe Root Port                        PCI EP
+
+This driver includes 3 parts:
+ 1 PCI EP NTB function driver
+ 2 Virtual PCI bus
+ 3 PCI virtual NTB driver, which is loaded only by above virtual PCI bus
+
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Stable-dep-of: aebfdfe39b93 ("NTB: fix possible name leak in ntb_register_device()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/Kconfig        |   11 +
+ drivers/pci/endpoint/functions/Makefile       |    1 +
+ drivers/pci/endpoint/functions/pci-epf-vntb.c | 1424 +++++++++++++++++
+ 3 files changed, 1436 insertions(+)
+ create mode 100644 drivers/pci/endpoint/functions/pci-epf-vntb.c
+
+diff --git a/drivers/pci/endpoint/functions/Kconfig b/drivers/pci/endpoint/functions/Kconfig
+index 5f1242ca2f4e4..65217428d17b9 100644
+--- a/drivers/pci/endpoint/functions/Kconfig
++++ b/drivers/pci/endpoint/functions/Kconfig
+@@ -25,3 +25,14 @@ config PCI_EPF_NTB
+ 	  device tree.
+ 
+ 	  If in doubt, say "N" to disable Endpoint NTB driver.
++
++config PCI_EPF_VNTB
++        tristate "PCI Endpoint NTB driver"
++        depends on PCI_ENDPOINT
++        select CONFIGFS_FS
++        help
++          Select this configuration option to enable the Non-Transparent
++          Bridge (NTB) driver for PCIe Endpoint. NTB driver implements NTB
++          between PCI Root Port and PCIe Endpoint.
++
++          If in doubt, say "N" to disable Endpoint NTB driver.
+diff --git a/drivers/pci/endpoint/functions/Makefile b/drivers/pci/endpoint/functions/Makefile
+index 96ab932a537a2..5c13001deaba1 100644
+--- a/drivers/pci/endpoint/functions/Makefile
++++ b/drivers/pci/endpoint/functions/Makefile
+@@ -5,3 +5,4 @@
+ 
+ obj-$(CONFIG_PCI_EPF_TEST)		+= pci-epf-test.o
+ obj-$(CONFIG_PCI_EPF_NTB)		+= pci-epf-ntb.o
++obj-$(CONFIG_PCI_EPF_VNTB) 		+= pci-epf-vntb.o
+diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+new file mode 100644
+index 0000000000000..1466dd1904175
+--- /dev/null
++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+@@ -0,0 +1,1424 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Endpoint Function Driver to implement Non-Transparent Bridge functionality
++ * Between PCI RC and EP
++ *
++ * Copyright (C) 2020 Texas Instruments
++ * Copyright (C) 2022 NXP
++ *
++ * Based on pci-epf-ntb.c
++ * Author: Frank Li <Frank.Li@nxp.com>
++ * Author: Kishon Vijay Abraham I <kishon@ti.com>
++ */
++
++/**
++ * +------------+         +---------------------------------------+
++ * |            |         |                                       |
++ * +------------+         |                        +--------------+
++ * | NTB        |         |                        | NTB          |
++ * | NetDev     |         |                        | NetDev       |
++ * +------------+         |                        +--------------+
++ * | NTB        |         |                        | NTB          |
++ * | Transfer   |         |                        | Transfer     |
++ * +------------+         |                        +--------------+
++ * |            |         |                        |              |
++ * |  PCI NTB   |         |                        |              |
++ * |    EPF     |         |                        |              |
++ * |   Driver   |         |                        | PCI Virtual  |
++ * |            |         +---------------+        | NTB Driver   |
++ * |            |         | PCI EP NTB    |<------>|              |
++ * |            |         |  FN Driver    |        |              |
++ * +------------+         +---------------+        +--------------+
++ * |            |         |               |        |              |
++ * |  PCI Bus   | <-----> |  PCI EP Bus   |        |  Virtual PCI |
++ * |            |  PCI    |               |        |     Bus      |
++ * +------------+         +---------------+--------+--------------+
++ * PCIe Root Port                        PCI EP
++ */
++
++#include <linux/delay.h>
++#include <linux/io.h>
++#include <linux/module.h>
++#include <linux/slab.h>
++
++#include <linux/pci-epc.h>
++#include <linux/pci-epf.h>
++#include <linux/ntb.h>
++
++static struct workqueue_struct *kpcintb_workqueue;
++
++#define COMMAND_CONFIGURE_DOORBELL	1
++#define COMMAND_TEARDOWN_DOORBELL	2
++#define COMMAND_CONFIGURE_MW		3
++#define COMMAND_TEARDOWN_MW		4
++#define COMMAND_LINK_UP			5
++#define COMMAND_LINK_DOWN		6
++
++#define COMMAND_STATUS_OK		1
++#define COMMAND_STATUS_ERROR		2
++
++#define LINK_STATUS_UP			BIT(0)
++
++#define SPAD_COUNT			64
++#define DB_COUNT			4
++#define NTB_MW_OFFSET			2
++#define DB_COUNT_MASK			GENMASK(15, 0)
++#define MSIX_ENABLE			BIT(16)
++#define MAX_DB_COUNT			32
++#define MAX_MW				4
++
++enum epf_ntb_bar {
++	BAR_CONFIG,
++	BAR_DB,
++	BAR_MW0,
++	BAR_MW1,
++	BAR_MW2,
++};
++
++/*
++ * +--------------------------------------------------+ Base
++ * |                                                  |
++ * |                                                  |
++ * |                                                  |
++ * |          Common Control Register                 |
++ * |                                                  |
++ * |                                                  |
++ * |                                                  |
++ * +-----------------------+--------------------------+ Base+span_offset
++ * |                       |                          |
++ * |    Peer Span Space    |    Span Space            |
++ * |                       |                          |
++ * |                       |                          |
++ * +-----------------------+--------------------------+ Base+span_offset
++ * |                       |                          |     +span_count * 4
++ * |                       |                          |
++ * |     Span Space        |   Peer Span Space        |
++ * |                       |                          |
++ * +-----------------------+--------------------------+
++ *       Virtual PCI             PCIe Endpoint
++ *       NTB Driver               NTB Driver
++ */
++struct epf_ntb_ctrl {
++	u32     command;
++	u32     argument;
++	u16     command_status;
++	u16     link_status;
++	u32     topology;
++	u64     addr;
++	u64     size;
++	u32     num_mws;
++	u32	reserved;
++	u32     spad_offset;
++	u32     spad_count;
++	u32	db_entry_size;
++	u32     db_data[MAX_DB_COUNT];
++	u32     db_offset[MAX_DB_COUNT];
++} __packed;
++
++struct epf_ntb {
++	struct ntb_dev ntb;
++	struct pci_epf *epf;
++	struct config_group group;
++
++	u32 num_mws;
++	u32 db_count;
++	u32 spad_count;
++	u64 mws_size[MAX_MW];
++	u64 db;
++	u32 vbus_number;
++	u16 vntb_pid;
++	u16 vntb_vid;
++
++	bool linkup;
++	u32 spad_size;
++
++	enum pci_barno epf_ntb_bar[6];
++
++	struct epf_ntb_ctrl *reg;
++
++	phys_addr_t epf_db_phy;
++	void __iomem *epf_db;
++
++	phys_addr_t vpci_mw_phy[MAX_MW];
++	void __iomem *vpci_mw_addr[MAX_MW];
++
++	struct delayed_work cmd_handler;
++};
++
++#define to_epf_ntb(epf_group) container_of((epf_group), struct epf_ntb, group)
++#define ntb_ndev(__ntb) container_of(__ntb, struct epf_ntb, ntb)
++
++static struct pci_epf_header epf_ntb_header = {
++	.vendorid	= PCI_ANY_ID,
++	.deviceid	= PCI_ANY_ID,
++	.baseclass_code	= PCI_BASE_CLASS_MEMORY,
++	.interrupt_pin	= PCI_INTERRUPT_INTA,
++};
++
++/**
++ * epf_ntb_link_up() - Raise link_up interrupt to Virtual Host
++ * @ntb: NTB device that facilitates communication between HOST and VHOST
++ * @link_up: true or false indicating Link is UP or Down
++ *
++ * Once NTB function in HOST invoke ntb_link_enable(),
++ * this NTB function driver will trigger a link event to vhost.
++ */
++static int epf_ntb_link_up(struct epf_ntb *ntb, bool link_up)
++{
++	if (link_up)
++		ntb->reg->link_status |= LINK_STATUS_UP;
++	else
++		ntb->reg->link_status &= ~LINK_STATUS_UP;
++
++	ntb_link_event(&ntb->ntb);
++	return 0;
++}
++
++/**
++ * epf_ntb_configure_mw() - Configure the Outbound Address Space for vhost
++ *   to access the memory window of host
++ * @ntb: NTB device that facilitates communication between host and vhost
++ * @mw: Index of the memory window (either 0, 1, 2 or 3)
++ *
++ *                          EP Outbound Window
++ * +--------+              +-----------+
++ * |        |              |           |
++ * |        |              |           |
++ * |        |              |           |
++ * |        |              |           |
++ * |        |              +-----------+
++ * | Virtual|              | Memory Win|
++ * | NTB    | -----------> |           |
++ * | Driver |              |           |
++ * |        |              +-----------+
++ * |        |              |           |
++ * |        |              |           |
++ * +--------+              +-----------+
++ *  VHost                   PCI EP
++ */
++static int epf_ntb_configure_mw(struct epf_ntb *ntb, u32 mw)
++{
++	phys_addr_t phys_addr;
++	u8 func_no, vfunc_no;
++	u64 addr, size;
++	int ret = 0;
++
++	phys_addr = ntb->vpci_mw_phy[mw];
++	addr = ntb->reg->addr;
++	size = ntb->reg->size;
++
++	func_no = ntb->epf->func_no;
++	vfunc_no = ntb->epf->vfunc_no;
++
++	ret = pci_epc_map_addr(ntb->epf->epc, func_no, vfunc_no, phys_addr, addr, size);
++	if (ret)
++		dev_err(&ntb->epf->epc->dev,
++			"Failed to map memory window %d address\n", mw);
++	return ret;
++}
++
++/**
++ * epf_ntb_teardown_mw() - Teardown the configured OB ATU
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ * @mw: Index of the memory window (either 0, 1, 2 or 3)
++ *
++ * Teardown the configured OB ATU configured in epf_ntb_configure_mw() using
++ * pci_epc_unmap_addr()
++ */
++static void epf_ntb_teardown_mw(struct epf_ntb *ntb, u32 mw)
++{
++	pci_epc_unmap_addr(ntb->epf->epc,
++			   ntb->epf->func_no,
++			   ntb->epf->vfunc_no,
++			   ntb->vpci_mw_phy[mw]);
++}
++
++/**
++ * epf_ntb_cmd_handler() - Handle commands provided by the NTB Host
++ * @work: work_struct for the epf_ntb_epc
++ *
++ * Workqueue function that gets invoked for the two epf_ntb_epc
++ * periodically (once every 5ms) to see if it has received any commands
++ * from NTB host. The host can send commands to configure doorbell or
++ * configure memory window or to update link status.
++ */
++static void epf_ntb_cmd_handler(struct work_struct *work)
++{
++	struct epf_ntb_ctrl *ctrl;
++	u32 command, argument;
++	struct epf_ntb *ntb;
++	struct device *dev;
++	int ret;
++	int i;
++
++	ntb = container_of(work, struct epf_ntb, cmd_handler.work);
++
++	for (i = 1; i < ntb->db_count; i++) {
++		if (readl(ntb->epf_db + i * 4)) {
++			if (readl(ntb->epf_db + i * 4))
++				ntb->db |= 1 << (i - 1);
++
++			ntb_db_event(&ntb->ntb, i);
++			writel(0, ntb->epf_db + i * 4);
++		}
++	}
++
++	ctrl = ntb->reg;
++	command = ctrl->command;
++	if (!command)
++		goto reset_handler;
++	argument = ctrl->argument;
++
++	ctrl->command = 0;
++	ctrl->argument = 0;
++
++	ctrl = ntb->reg;
++	dev = &ntb->epf->dev;
++
++	switch (command) {
++	case COMMAND_CONFIGURE_DOORBELL:
++		ctrl->command_status = COMMAND_STATUS_OK;
++		break;
++	case COMMAND_TEARDOWN_DOORBELL:
++		ctrl->command_status = COMMAND_STATUS_OK;
++		break;
++	case COMMAND_CONFIGURE_MW:
++		ret = epf_ntb_configure_mw(ntb, argument);
++		if (ret < 0)
++			ctrl->command_status = COMMAND_STATUS_ERROR;
++		else
++			ctrl->command_status = COMMAND_STATUS_OK;
++		break;
++	case COMMAND_TEARDOWN_MW:
++		epf_ntb_teardown_mw(ntb, argument);
++		ctrl->command_status = COMMAND_STATUS_OK;
++		break;
++	case COMMAND_LINK_UP:
++		ntb->linkup = true;
++		ret = epf_ntb_link_up(ntb, true);
++		if (ret < 0)
++			ctrl->command_status = COMMAND_STATUS_ERROR;
++		else
++			ctrl->command_status = COMMAND_STATUS_OK;
++		goto reset_handler;
++	case COMMAND_LINK_DOWN:
++		ntb->linkup = false;
++		ret = epf_ntb_link_up(ntb, false);
++		if (ret < 0)
++			ctrl->command_status = COMMAND_STATUS_ERROR;
++		else
++			ctrl->command_status = COMMAND_STATUS_OK;
++		break;
++	default:
++		dev_err(dev, "UNKNOWN command: %d\n", command);
++		break;
++	}
++
++reset_handler:
++	queue_delayed_work(kpcintb_workqueue, &ntb->cmd_handler,
++			   msecs_to_jiffies(5));
++}
++
++/**
++ * epf_ntb_config_sspad_bar_clear() - Clear Config + Self scratchpad BAR
++ * @ntb_epc: EPC associated with one of the HOST which holds peer's outbound
++ *	     address.
++ *
++ * Clear BAR0 of EP CONTROLLER 1 which contains the HOST1's config and
++ * self scratchpad region (removes inbound ATU configuration). While BAR0 is
++ * the default self scratchpad BAR, an NTB could have other BARs for self
++ * scratchpad (because of reserved BARs). This function can get the exact BAR
++ * used for self scratchpad from epf_ntb_bar[BAR_CONFIG].
++ *
++ * Please note the self scratchpad region and config region is combined to
++ * a single region and mapped using the same BAR. Also note HOST2's peer
++ * scratchpad is HOST1's self scratchpad.
++ */
++static void epf_ntb_config_sspad_bar_clear(struct epf_ntb *ntb)
++{
++	struct pci_epf_bar *epf_bar;
++	enum pci_barno barno;
++
++	barno = ntb->epf_ntb_bar[BAR_CONFIG];
++	epf_bar = &ntb->epf->bar[barno];
++
++	pci_epc_clear_bar(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no, epf_bar);
++}
++
++/**
++ * epf_ntb_config_sspad_bar_set() - Set Config + Self scratchpad BAR
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ *
++ * Map BAR0 of EP CONTROLLER 1 which contains the HOST1's config and
++ * self scratchpad region.
++ *
++ * Please note the self scratchpad region and config region is combined to
++ * a single region and mapped using the same BAR.
++ */
++static int epf_ntb_config_sspad_bar_set(struct epf_ntb *ntb)
++{
++	struct pci_epf_bar *epf_bar;
++	enum pci_barno barno;
++	u8 func_no, vfunc_no;
++	struct device *dev;
++	int ret;
++
++	dev = &ntb->epf->dev;
++	func_no = ntb->epf->func_no;
++	vfunc_no = ntb->epf->vfunc_no;
++	barno = ntb->epf_ntb_bar[BAR_CONFIG];
++	epf_bar = &ntb->epf->bar[barno];
++
++	ret = pci_epc_set_bar(ntb->epf->epc, func_no, vfunc_no, epf_bar);
++	if (ret) {
++		dev_err(dev, "inft: Config/Status/SPAD BAR set failed\n");
++		return ret;
++	}
++	return 0;
++}
++
++/**
++ * epf_ntb_config_spad_bar_free() - Free the physical memory associated with
++ *   config + scratchpad region
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ */
++static void epf_ntb_config_spad_bar_free(struct epf_ntb *ntb)
++{
++	enum pci_barno barno;
++
++	barno = ntb->epf_ntb_bar[BAR_CONFIG];
++	pci_epf_free_space(ntb->epf, ntb->reg, barno, 0);
++}
++
++/**
++ * epf_ntb_config_spad_bar_alloc() - Allocate memory for config + scratchpad
++ *   region
++ * @ntb: NTB device that facilitates communication between HOST1 and HOST2
++ *
++ * Allocate the Local Memory mentioned in the above diagram. The size of
++ * CONFIG REGION is sizeof(struct epf_ntb_ctrl) and size of SCRATCHPAD REGION
++ * is obtained from "spad-count" configfs entry.
++ */
++static int epf_ntb_config_spad_bar_alloc(struct epf_ntb *ntb)
++{
++	size_t align;
++	enum pci_barno barno;
++	struct epf_ntb_ctrl *ctrl;
++	u32 spad_size, ctrl_size;
++	u64 size;
++	struct pci_epf *epf = ntb->epf;
++	struct device *dev = &epf->dev;
++	u32 spad_count;
++	void *base;
++	int i;
++	const struct pci_epc_features *epc_features = pci_epc_get_features(epf->epc,
++								epf->func_no,
++								epf->vfunc_no);
++	barno = ntb->epf_ntb_bar[BAR_CONFIG];
++	size = epc_features->bar_fixed_size[barno];
++	align = epc_features->align;
++
++	if ((!IS_ALIGNED(size, align)))
++		return -EINVAL;
++
++	spad_count = ntb->spad_count;
++
++	ctrl_size = sizeof(struct epf_ntb_ctrl);
++	spad_size = 2 * spad_count * 4;
++
++	if (!align) {
++		ctrl_size = roundup_pow_of_two(ctrl_size);
++		spad_size = roundup_pow_of_two(spad_size);
++	} else {
++		ctrl_size = ALIGN(ctrl_size, align);
++		spad_size = ALIGN(spad_size, align);
++	}
++
++	if (!size)
++		size = ctrl_size + spad_size;
++	else if (size < ctrl_size + spad_size)
++		return -EINVAL;
++
++	base = pci_epf_alloc_space(epf, size, barno, align, 0);
++	if (!base) {
++		dev_err(dev, "Config/Status/SPAD alloc region fail\n");
++		return -ENOMEM;
++	}
++
++	ntb->reg = base;
++
++	ctrl = ntb->reg;
++	ctrl->spad_offset = ctrl_size;
++
++	ctrl->spad_count = spad_count;
++	ctrl->num_mws = ntb->num_mws;
++	ntb->spad_size = spad_size;
++
++	ctrl->db_entry_size = 4;
++
++	for (i = 0; i < ntb->db_count; i++) {
++		ntb->reg->db_data[i] = 1 + i;
++		ntb->reg->db_offset[i] = 0;
++	}
++
++	return 0;
++}
++
++/**
++ * epf_ntb_configure_interrupt() - Configure MSI/MSI-X capaiblity
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ *
++ * Configure MSI/MSI-X capability for each interface with number of
++ * interrupts equal to "db_count" configfs entry.
++ */
++static int epf_ntb_configure_interrupt(struct epf_ntb *ntb)
++{
++	const struct pci_epc_features *epc_features;
++	struct device *dev;
++	u32 db_count;
++	int ret;
++
++	dev = &ntb->epf->dev;
++
++	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
++
++	if (!(epc_features->msix_capable || epc_features->msi_capable)) {
++		dev_err(dev, "MSI or MSI-X is required for doorbell\n");
++		return -EINVAL;
++	}
++
++	db_count = ntb->db_count;
++	if (db_count > MAX_DB_COUNT) {
++		dev_err(dev, "DB count cannot be more than %d\n", MAX_DB_COUNT);
++		return -EINVAL;
++	}
++
++	ntb->db_count = db_count;
++
++	if (epc_features->msi_capable) {
++		ret = pci_epc_set_msi(ntb->epf->epc,
++				      ntb->epf->func_no,
++				      ntb->epf->vfunc_no,
++				      16);
++		if (ret) {
++			dev_err(dev, "MSI configuration failed\n");
++			return ret;
++		}
++	}
++
++	return 0;
++}
++
++/**
++ * epf_ntb_db_bar_init() - Configure Doorbell window BARs
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ */
++static int epf_ntb_db_bar_init(struct epf_ntb *ntb)
++{
++	const struct pci_epc_features *epc_features;
++	u32 align;
++	struct device *dev = &ntb->epf->dev;
++	int ret;
++	struct pci_epf_bar *epf_bar;
++	void __iomem *mw_addr;
++	enum pci_barno barno;
++	size_t size = 4 * ntb->db_count;
++
++	epc_features = pci_epc_get_features(ntb->epf->epc,
++					    ntb->epf->func_no,
++					    ntb->epf->vfunc_no);
++	align = epc_features->align;
++
++	if (size < 128)
++		size = 128;
++
++	if (align)
++		size = ALIGN(size, align);
++	else
++		size = roundup_pow_of_two(size);
++
++	barno = ntb->epf_ntb_bar[BAR_DB];
++
++	mw_addr = pci_epf_alloc_space(ntb->epf, size, barno, align, 0);
++	if (!mw_addr) {
++		dev_err(dev, "Failed to allocate OB address\n");
++		return -ENOMEM;
++	}
++
++	ntb->epf_db = mw_addr;
++
++	epf_bar = &ntb->epf->bar[barno];
++
++	ret = pci_epc_set_bar(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no, epf_bar);
++	if (ret) {
++		dev_err(dev, "Doorbell BAR set failed\n");
++			goto err_alloc_peer_mem;
++	}
++	return ret;
++
++err_alloc_peer_mem:
++	pci_epc_mem_free_addr(ntb->epf->epc, epf_bar->phys_addr, mw_addr, epf_bar->size);
++	return -1;
++}
++
++/**
++ * epf_ntb_db_bar_clear() - Clear doorbell BAR and free memory
++ *   allocated in peer's outbound address space
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ */
++static void epf_ntb_db_bar_clear(struct epf_ntb *ntb)
++{
++	enum pci_barno barno;
++
++	barno = ntb->epf_ntb_bar[BAR_DB];
++	pci_epf_free_space(ntb->epf, ntb->epf_db, barno, 0);
++	pci_epc_clear_bar(ntb->epf->epc,
++			  ntb->epf->func_no,
++			  ntb->epf->vfunc_no,
++			  &ntb->epf->bar[barno]);
++}
++
++/**
++ * epf_ntb_mw_bar_init() - Configure Memory window BARs
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ *
++ */
++static int epf_ntb_mw_bar_init(struct epf_ntb *ntb)
++{
++	int ret = 0;
++	int i;
++	u64 size;
++	enum pci_barno barno;
++	struct device *dev = &ntb->epf->dev;
++
++	for (i = 0; i < ntb->num_mws; i++) {
++		size = ntb->mws_size[i];
++		barno = ntb->epf_ntb_bar[BAR_MW0 + i];
++
++		ntb->epf->bar[barno].barno = barno;
++		ntb->epf->bar[barno].size = size;
++		ntb->epf->bar[barno].addr = 0;
++		ntb->epf->bar[barno].phys_addr = 0;
++		ntb->epf->bar[barno].flags |= upper_32_bits(size) ?
++				PCI_BASE_ADDRESS_MEM_TYPE_64 :
++				PCI_BASE_ADDRESS_MEM_TYPE_32;
++
++		ret = pci_epc_set_bar(ntb->epf->epc,
++				      ntb->epf->func_no,
++				      ntb->epf->vfunc_no,
++				      &ntb->epf->bar[barno]);
++		if (ret) {
++			dev_err(dev, "MW set failed\n");
++			goto err_alloc_mem;
++		}
++
++		/* Allocate EPC outbound memory windows to vpci vntb device */
++		ntb->vpci_mw_addr[i] = pci_epc_mem_alloc_addr(ntb->epf->epc,
++							      &ntb->vpci_mw_phy[i],
++							      size);
++		if (!ntb->vpci_mw_addr[i]) {
++			dev_err(dev, "Failed to allocate source address\n");
++			goto err_alloc_mem;
++		}
++	}
++
++	return ret;
++err_alloc_mem:
++	return ret;
++}
++
++/**
++ * epf_ntb_mw_bar_clear() - Clear Memory window BARs
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ */
++static void epf_ntb_mw_bar_clear(struct epf_ntb *ntb)
++{
++	enum pci_barno barno;
++	int i;
++
++	for (i = 0; i < ntb->num_mws; i++) {
++		barno = ntb->epf_ntb_bar[BAR_MW0 + i];
++		pci_epc_clear_bar(ntb->epf->epc,
++				  ntb->epf->func_no,
++				  ntb->epf->vfunc_no,
++				  &ntb->epf->bar[barno]);
++
++		pci_epc_mem_free_addr(ntb->epf->epc,
++				      ntb->vpci_mw_phy[i],
++				      ntb->vpci_mw_addr[i],
++				      ntb->mws_size[i]);
++	}
++}
++
++/**
++ * epf_ntb_epc_destroy() - Cleanup NTB EPC interface
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ *
++ * Wrapper for epf_ntb_epc_destroy_interface() to cleanup all the NTB interfaces
++ */
++static void epf_ntb_epc_destroy(struct epf_ntb *ntb)
++{
++	pci_epc_remove_epf(ntb->epf->epc, ntb->epf, 0);
++	pci_epc_put(ntb->epf->epc);
++}
++
++/**
++ * epf_ntb_init_epc_bar() - Identify BARs to be used for each of the NTB
++ * constructs (scratchpad region, doorbell, memorywindow)
++ * @ntb: NTB device that facilitates communication between HOST and vHOST
++ */
++static int epf_ntb_init_epc_bar(struct epf_ntb *ntb)
++{
++	const struct pci_epc_features *epc_features;
++	enum pci_barno barno;
++	enum epf_ntb_bar bar;
++	struct device *dev;
++	u32 num_mws;
++	int i;
++
++	barno = BAR_0;
++	num_mws = ntb->num_mws;
++	dev = &ntb->epf->dev;
++	epc_features = pci_epc_get_features(ntb->epf->epc, ntb->epf->func_no, ntb->epf->vfunc_no);
++
++	/* These are required BARs which are mandatory for NTB functionality */
++	for (bar = BAR_CONFIG; bar <= BAR_MW0; bar++, barno++) {
++		barno = pci_epc_get_next_free_bar(epc_features, barno);
++		if (barno < 0) {
++			dev_err(dev, "Fail to get NTB function BAR\n");
++			return barno;
++		}
++		ntb->epf_ntb_bar[bar] = barno;
++	}
++
++	/* These are optional BARs which don't impact NTB functionality */
++	for (bar = BAR_MW1, i = 1; i < num_mws; bar++, barno++, i++) {
++		barno = pci_epc_get_next_free_bar(epc_features, barno);
++		if (barno < 0) {
++			ntb->num_mws = i;
++			dev_dbg(dev, "BAR not available for > MW%d\n", i + 1);
++		}
++		ntb->epf_ntb_bar[bar] = barno;
++	}
++
++	return 0;
++}
++
++/**
++ * epf_ntb_epc_init() - Initialize NTB interface
++ * @ntb: NTB device that facilitates communication between HOST and vHOST2
++ *
++ * Wrapper to initialize a particular EPC interface and start the workqueue
++ * to check for commands from host. This function will write to the
++ * EP controller HW for configuring it.
++ */
++static int epf_ntb_epc_init(struct epf_ntb *ntb)
++{
++	u8 func_no, vfunc_no;
++	struct pci_epc *epc;
++	struct pci_epf *epf;
++	struct device *dev;
++	int ret;
++
++	epf = ntb->epf;
++	dev = &epf->dev;
++	epc = epf->epc;
++	func_no = ntb->epf->func_no;
++	vfunc_no = ntb->epf->vfunc_no;
++
++	ret = epf_ntb_config_sspad_bar_set(ntb);
++	if (ret) {
++		dev_err(dev, "Config/self SPAD BAR init failed");
++		return ret;
++	}
++
++	ret = epf_ntb_configure_interrupt(ntb);
++	if (ret) {
++		dev_err(dev, "Interrupt configuration failed\n");
++		goto err_config_interrupt;
++	}
++
++	ret = epf_ntb_db_bar_init(ntb);
++	if (ret) {
++		dev_err(dev, "DB BAR init failed\n");
++		goto err_db_bar_init;
++	}
++
++	ret = epf_ntb_mw_bar_init(ntb);
++	if (ret) {
++		dev_err(dev, "MW BAR init failed\n");
++		goto err_mw_bar_init;
++	}
++
++	if (vfunc_no <= 1) {
++		ret = pci_epc_write_header(epc, func_no, vfunc_no, epf->header);
++		if (ret) {
++			dev_err(dev, "Configuration header write failed\n");
++			goto err_write_header;
++		}
++	}
++
++	INIT_DELAYED_WORK(&ntb->cmd_handler, epf_ntb_cmd_handler);
++	queue_work(kpcintb_workqueue, &ntb->cmd_handler.work);
++
++	return 0;
++
++err_write_header:
++	epf_ntb_mw_bar_clear(ntb);
++err_mw_bar_init:
++	epf_ntb_db_bar_clear(ntb);
++err_db_bar_init:
++err_config_interrupt:
++	epf_ntb_config_sspad_bar_clear(ntb);
++
++	return ret;
++}
++
++
++/**
++ * epf_ntb_epc_cleanup() - Cleanup all NTB interfaces
++ * @ntb: NTB device that facilitates communication between HOST1 and HOST2
++ *
++ * Wrapper to cleanup all NTB interfaces.
++ */
++static void epf_ntb_epc_cleanup(struct epf_ntb *ntb)
++{
++	epf_ntb_db_bar_clear(ntb);
++	epf_ntb_mw_bar_clear(ntb);
++}
++
++#define EPF_NTB_R(_name)						\
++static ssize_t epf_ntb_##_name##_show(struct config_item *item,		\
++				      char *page)			\
++{									\
++	struct config_group *group = to_config_group(item);		\
++	struct epf_ntb *ntb = to_epf_ntb(group);			\
++									\
++	return sprintf(page, "%d\n", ntb->_name);			\
++}
++
++#define EPF_NTB_W(_name)						\
++static ssize_t epf_ntb_##_name##_store(struct config_item *item,	\
++				       const char *page, size_t len)	\
++{									\
++	struct config_group *group = to_config_group(item);		\
++	struct epf_ntb *ntb = to_epf_ntb(group);			\
++	u32 val;							\
++	int ret;							\
++									\
++	ret = kstrtou32(page, 0, &val);					\
++	if (ret)							\
++		return ret;						\
++									\
++	ntb->_name = val;						\
++									\
++	return len;							\
++}
++
++#define EPF_NTB_MW_R(_name)						\
++static ssize_t epf_ntb_##_name##_show(struct config_item *item,		\
++				      char *page)			\
++{									\
++	struct config_group *group = to_config_group(item);		\
++	struct epf_ntb *ntb = to_epf_ntb(group);			\
++	int win_no;							\
++									\
++	sscanf(#_name, "mw%d", &win_no);				\
++									\
++	return sprintf(page, "%lld\n", ntb->mws_size[win_no - 1]);	\
++}
++
++#define EPF_NTB_MW_W(_name)						\
++static ssize_t epf_ntb_##_name##_store(struct config_item *item,	\
++				       const char *page, size_t len)	\
++{									\
++	struct config_group *group = to_config_group(item);		\
++	struct epf_ntb *ntb = to_epf_ntb(group);			\
++	struct device *dev = &ntb->epf->dev;				\
++	int win_no;							\
++	u64 val;							\
++	int ret;							\
++									\
++	ret = kstrtou64(page, 0, &val);					\
++	if (ret)							\
++		return ret;						\
++									\
++	if (sscanf(#_name, "mw%d", &win_no) != 1)			\
++		return -EINVAL;						\
++									\
++	if (ntb->num_mws < win_no) {					\
++		dev_err(dev, "Invalid num_nws: %d value\n", ntb->num_mws); \
++		return -EINVAL;						\
++	}								\
++									\
++	ntb->mws_size[win_no - 1] = val;				\
++									\
++	return len;							\
++}
++
++static ssize_t epf_ntb_num_mws_store(struct config_item *item,
++				     const char *page, size_t len)
++{
++	struct config_group *group = to_config_group(item);
++	struct epf_ntb *ntb = to_epf_ntb(group);
++	u32 val;
++	int ret;
++
++	ret = kstrtou32(page, 0, &val);
++	if (ret)
++		return ret;
++
++	if (val > MAX_MW)
++		return -EINVAL;
++
++	ntb->num_mws = val;
++
++	return len;
++}
++
++EPF_NTB_R(spad_count)
++EPF_NTB_W(spad_count)
++EPF_NTB_R(db_count)
++EPF_NTB_W(db_count)
++EPF_NTB_R(num_mws)
++EPF_NTB_R(vbus_number)
++EPF_NTB_W(vbus_number)
++EPF_NTB_R(vntb_pid)
++EPF_NTB_W(vntb_pid)
++EPF_NTB_R(vntb_vid)
++EPF_NTB_W(vntb_vid)
++EPF_NTB_MW_R(mw1)
++EPF_NTB_MW_W(mw1)
++EPF_NTB_MW_R(mw2)
++EPF_NTB_MW_W(mw2)
++EPF_NTB_MW_R(mw3)
++EPF_NTB_MW_W(mw3)
++EPF_NTB_MW_R(mw4)
++EPF_NTB_MW_W(mw4)
++
++CONFIGFS_ATTR(epf_ntb_, spad_count);
++CONFIGFS_ATTR(epf_ntb_, db_count);
++CONFIGFS_ATTR(epf_ntb_, num_mws);
++CONFIGFS_ATTR(epf_ntb_, mw1);
++CONFIGFS_ATTR(epf_ntb_, mw2);
++CONFIGFS_ATTR(epf_ntb_, mw3);
++CONFIGFS_ATTR(epf_ntb_, mw4);
++CONFIGFS_ATTR(epf_ntb_, vbus_number);
++CONFIGFS_ATTR(epf_ntb_, vntb_pid);
++CONFIGFS_ATTR(epf_ntb_, vntb_vid);
++
++static struct configfs_attribute *epf_ntb_attrs[] = {
++	&epf_ntb_attr_spad_count,
++	&epf_ntb_attr_db_count,
++	&epf_ntb_attr_num_mws,
++	&epf_ntb_attr_mw1,
++	&epf_ntb_attr_mw2,
++	&epf_ntb_attr_mw3,
++	&epf_ntb_attr_mw4,
++	&epf_ntb_attr_vbus_number,
++	&epf_ntb_attr_vntb_pid,
++	&epf_ntb_attr_vntb_vid,
++	NULL,
++};
++
++static const struct config_item_type ntb_group_type = {
++	.ct_attrs	= epf_ntb_attrs,
++	.ct_owner	= THIS_MODULE,
++};
++
++/**
++ * epf_ntb_add_cfs() - Add configfs directory specific to NTB
++ * @epf: NTB endpoint function device
++ * @group: A pointer to the config_group structure referencing a group of
++ *	   config_items of a specific type that belong to a specific sub-system.
++ *
++ * Add configfs directory specific to NTB. This directory will hold
++ * NTB specific properties like db_count, spad_count, num_mws etc.,
++ */
++static struct config_group *epf_ntb_add_cfs(struct pci_epf *epf,
++					    struct config_group *group)
++{
++	struct epf_ntb *ntb = epf_get_drvdata(epf);
++	struct config_group *ntb_group = &ntb->group;
++	struct device *dev = &epf->dev;
++
++	config_group_init_type_name(ntb_group, dev_name(dev), &ntb_group_type);
++
++	return ntb_group;
++}
++
++/*==== virtual PCI bus driver, which only load virtual NTB PCI driver ====*/
++
++static u32 pci_space[] = {
++	0xffffffff,	/*DeviceID, Vendor ID*/
++	0,		/*Status, Command*/
++	0xffffffff,	/*Class code, subclass, prog if, revision id*/
++	0x40,		/*bist, header type, latency Timer, cache line size*/
++	0,		/*BAR 0*/
++	0,		/*BAR 1*/
++	0,		/*BAR 2*/
++	0,		/*BAR 3*/
++	0,		/*BAR 4*/
++	0,		/*BAR 5*/
++	0,		/*Cardbus cis point*/
++	0,		/*Subsystem ID Subystem vendor id*/
++	0,		/*ROM Base Address*/
++	0,		/*Reserved, Cap. Point*/
++	0,		/*Reserved,*/
++	0,		/*Max Lat, Min Gnt, interrupt pin, interrupt line*/
++};
++
++int pci_read(struct pci_bus *bus, unsigned int devfn, int where, int size, u32 *val)
++{
++	if (devfn == 0) {
++		memcpy(val, ((u8 *)pci_space) + where, size);
++		return PCIBIOS_SUCCESSFUL;
++	}
++	return PCIBIOS_DEVICE_NOT_FOUND;
++}
++
++int pci_write(struct pci_bus *bus, unsigned int devfn, int where, int size, u32 val)
++{
++	return 0;
++}
++
++struct pci_ops vpci_ops = {
++	.read = pci_read,
++	.write = pci_write,
++};
++
++static int vpci_scan_bus(void *sysdata)
++{
++	struct pci_bus *vpci_bus;
++	struct epf_ntb *ndev = sysdata;
++
++	vpci_bus = pci_scan_bus(ndev->vbus_number, &vpci_ops, sysdata);
++	if (vpci_bus)
++		pr_err("create pci bus\n");
++
++	pci_bus_add_devices(vpci_bus);
++
++	return 0;
++}
++
++/*==================== Virtual PCIe NTB driver ==========================*/
++
++static int vntb_epf_mw_count(struct ntb_dev *ntb, int pidx)
++{
++	struct epf_ntb *ndev = ntb_ndev(ntb);
++
++	return ndev->num_mws;
++}
++
++static int vntb_epf_spad_count(struct ntb_dev *ntb)
++{
++	return ntb_ndev(ntb)->spad_count;
++}
++
++static int vntb_epf_peer_mw_count(struct ntb_dev *ntb)
++{
++	return ntb_ndev(ntb)->num_mws;
++}
++
++static u64 vntb_epf_db_valid_mask(struct ntb_dev *ntb)
++{
++	return BIT_ULL(ntb_ndev(ntb)->db_count) - 1;
++}
++
++static int vntb_epf_db_set_mask(struct ntb_dev *ntb, u64 db_bits)
++{
++	return 0;
++}
++
++static int vntb_epf_mw_set_trans(struct ntb_dev *ndev, int pidx, int idx,
++		dma_addr_t addr, resource_size_t size)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++	struct pci_epf_bar *epf_bar;
++	enum pci_barno barno;
++	int ret;
++	struct device *dev;
++
++	dev = &ntb->ntb.dev;
++	barno = ntb->epf_ntb_bar[BAR_MW0 + idx];
++	epf_bar = &ntb->epf->bar[barno];
++	epf_bar->phys_addr = addr;
++	epf_bar->barno = barno;
++	epf_bar->size = size;
++
++	ret = pci_epc_set_bar(ntb->epf->epc, 0, 0, epf_bar);
++	if (ret) {
++		dev_err(dev, "failure set mw trans\n");
++		return ret;
++	}
++	return 0;
++}
++
++static int vntb_epf_mw_clear_trans(struct ntb_dev *ntb, int pidx, int idx)
++{
++	return 0;
++}
++
++static int vntb_epf_peer_mw_get_addr(struct ntb_dev *ndev, int idx,
++				phys_addr_t *base, resource_size_t *size)
++{
++
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++
++	if (base)
++		*base = ntb->vpci_mw_phy[idx];
++
++	if (size)
++		*size = ntb->mws_size[idx];
++
++	return 0;
++}
++
++static int vntb_epf_link_enable(struct ntb_dev *ntb,
++			enum ntb_speed max_speed,
++			enum ntb_width max_width)
++{
++	return 0;
++}
++
++static u32 vntb_epf_spad_read(struct ntb_dev *ndev, int idx)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++	int off = ntb->reg->spad_offset, ct = ntb->reg->spad_count * 4;
++	u32 val;
++	void __iomem *base = ntb->reg;
++
++	val = readl(base + off + ct + idx * 4);
++	return val;
++}
++
++static int vntb_epf_spad_write(struct ntb_dev *ndev, int idx, u32 val)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++	struct epf_ntb_ctrl *ctrl = ntb->reg;
++	int off = ctrl->spad_offset, ct = ctrl->spad_count * 4;
++	void __iomem *base = ntb->reg;
++
++	writel(val, base + off + ct + idx * 4);
++	return 0;
++}
++
++static u32 vntb_epf_peer_spad_read(struct ntb_dev *ndev, int pidx, int idx)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++	struct epf_ntb_ctrl *ctrl = ntb->reg;
++	int off = ctrl->spad_offset;
++	void __iomem *base = ntb->reg;
++	u32 val;
++
++	val = readl(base + off + idx * 4);
++	return val;
++}
++
++static int vntb_epf_peer_spad_write(struct ntb_dev *ndev, int pidx, int idx, u32 val)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++	struct epf_ntb_ctrl *ctrl = ntb->reg;
++	int off = ctrl->spad_offset;
++	void __iomem *base = ntb->reg;
++
++	writel(val, base + off + idx * 4);
++	return 0;
++}
++
++static int vntb_epf_peer_db_set(struct ntb_dev *ndev, u64 db_bits)
++{
++	u32 interrupt_num = ffs(db_bits) + 1;
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++	u8 func_no, vfunc_no;
++	int ret;
++
++	func_no = ntb->epf->func_no;
++	vfunc_no = ntb->epf->vfunc_no;
++
++	ret = pci_epc_raise_irq(ntb->epf->epc,
++				func_no,
++				vfunc_no,
++				PCI_EPC_IRQ_MSI,
++				interrupt_num + 1);
++	if (ret)
++		dev_err(&ntb->ntb.dev, "Failed to raise IRQ\n");
++
++	return ret;
++}
++
++static u64 vntb_epf_db_read(struct ntb_dev *ndev)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++
++	return ntb->db;
++}
++
++static int vntb_epf_mw_get_align(struct ntb_dev *ndev, int pidx, int idx,
++			resource_size_t *addr_align,
++			resource_size_t *size_align,
++			resource_size_t *size_max)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++
++	if (addr_align)
++		*addr_align = SZ_4K;
++
++	if (size_align)
++		*size_align = 1;
++
++	if (size_max)
++		*size_max = ntb->mws_size[idx];
++
++	return 0;
++}
++
++static u64 vntb_epf_link_is_up(struct ntb_dev *ndev,
++			enum ntb_speed *speed,
++			enum ntb_width *width)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++
++	return ntb->reg->link_status;
++}
++
++static int vntb_epf_db_clear_mask(struct ntb_dev *ndev, u64 db_bits)
++{
++	return 0;
++}
++
++static int vntb_epf_db_clear(struct ntb_dev *ndev, u64 db_bits)
++{
++	struct epf_ntb *ntb = ntb_ndev(ndev);
++
++	ntb->db &= ~db_bits;
++	return 0;
++}
++
++static int vntb_epf_link_disable(struct ntb_dev *ntb)
++{
++	return 0;
++}
++
++static const struct ntb_dev_ops vntb_epf_ops = {
++	.mw_count		= vntb_epf_mw_count,
++	.spad_count		= vntb_epf_spad_count,
++	.peer_mw_count		= vntb_epf_peer_mw_count,
++	.db_valid_mask		= vntb_epf_db_valid_mask,
++	.db_set_mask		= vntb_epf_db_set_mask,
++	.mw_set_trans		= vntb_epf_mw_set_trans,
++	.mw_clear_trans		= vntb_epf_mw_clear_trans,
++	.peer_mw_get_addr	= vntb_epf_peer_mw_get_addr,
++	.link_enable		= vntb_epf_link_enable,
++	.spad_read		= vntb_epf_spad_read,
++	.spad_write		= vntb_epf_spad_write,
++	.peer_spad_read		= vntb_epf_peer_spad_read,
++	.peer_spad_write	= vntb_epf_peer_spad_write,
++	.peer_db_set		= vntb_epf_peer_db_set,
++	.db_read		= vntb_epf_db_read,
++	.mw_get_align		= vntb_epf_mw_get_align,
++	.link_is_up		= vntb_epf_link_is_up,
++	.db_clear_mask		= vntb_epf_db_clear_mask,
++	.db_clear		= vntb_epf_db_clear,
++	.link_disable		= vntb_epf_link_disable,
++};
++
++static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
++{
++	int ret;
++	struct epf_ntb *ndev = (struct epf_ntb *)pdev->sysdata;
++	struct device *dev = &pdev->dev;
++
++	ndev->ntb.pdev = pdev;
++	ndev->ntb.topo = NTB_TOPO_NONE;
++	ndev->ntb.ops =  &vntb_epf_ops;
++
++	ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(32));
++	if (ret) {
++		dev_err(dev, "Cannot set DMA mask\n");
++		return -EINVAL;
++	}
++
++	ret = ntb_register_device(&ndev->ntb);
++	if (ret) {
++		dev_err(dev, "Failed to register NTB device\n");
++		goto err_register_dev;
++	}
++
++	dev_dbg(dev, "PCI Virtual NTB driver loaded\n");
++	return 0;
++
++err_register_dev:
++	return -EINVAL;
++}
++
++static struct pci_device_id pci_vntb_table[] = {
++	{
++		PCI_DEVICE(0xffff, 0xffff),
++	},
++	{},
++};
++
++static struct pci_driver vntb_pci_driver = {
++	.name           = "pci-vntb",
++	.id_table       = pci_vntb_table,
++	.probe          = pci_vntb_probe,
++};
++
++/* ============ PCIe EPF Driver Bind ====================*/
++
++/**
++ * epf_ntb_bind() - Initialize endpoint controller to provide NTB functionality
++ * @epf: NTB endpoint function device
++ *
++ * Initialize both the endpoint controllers associated with NTB function device.
++ * Invoked when a primary interface or secondary interface is bound to EPC
++ * device. This function will succeed only when EPC is bound to both the
++ * interfaces.
++ */
++static int epf_ntb_bind(struct pci_epf *epf)
++{
++	struct epf_ntb *ntb = epf_get_drvdata(epf);
++	struct device *dev = &epf->dev;
++	int ret;
++
++	if (!epf->epc) {
++		dev_dbg(dev, "PRIMARY EPC interface not yet bound\n");
++		return 0;
++	}
++
++	ret = epf_ntb_init_epc_bar(ntb);
++	if (ret) {
++		dev_err(dev, "Failed to create NTB EPC\n");
++		goto err_bar_init;
++	}
++
++	ret = epf_ntb_config_spad_bar_alloc(ntb);
++	if (ret) {
++		dev_err(dev, "Failed to allocate BAR memory\n");
++		goto err_bar_alloc;
++	}
++
++	ret = epf_ntb_epc_init(ntb);
++	if (ret) {
++		dev_err(dev, "Failed to initialize EPC\n");
++		goto err_bar_alloc;
++	}
++
++	epf_set_drvdata(epf, ntb);
++
++	pci_space[0] = (ntb->vntb_pid << 16) | ntb->vntb_vid;
++	pci_vntb_table[0].vendor = ntb->vntb_vid;
++	pci_vntb_table[0].device = ntb->vntb_pid;
++
++	if (pci_register_driver(&vntb_pci_driver)) {
++		dev_err(dev, "failure register vntb pci driver\n");
++		goto err_bar_alloc;
++	}
++
++	vpci_scan_bus(ntb);
++
++	return 0;
++
++err_bar_alloc:
++	epf_ntb_config_spad_bar_free(ntb);
++
++err_bar_init:
++	epf_ntb_epc_destroy(ntb);
++
++	return ret;
++}
++
++/**
++ * epf_ntb_unbind() - Cleanup the initialization from epf_ntb_bind()
++ * @epf: NTB endpoint function device
++ *
++ * Cleanup the initialization from epf_ntb_bind()
++ */
++static void epf_ntb_unbind(struct pci_epf *epf)
++{
++	struct epf_ntb *ntb = epf_get_drvdata(epf);
++
++	epf_ntb_epc_cleanup(ntb);
++	epf_ntb_config_spad_bar_free(ntb);
++	epf_ntb_epc_destroy(ntb);
++
++	pci_unregister_driver(&vntb_pci_driver);
++}
++
++// EPF driver probe
++static struct pci_epf_ops epf_ntb_ops = {
++	.bind   = epf_ntb_bind,
++	.unbind = epf_ntb_unbind,
++	.add_cfs = epf_ntb_add_cfs,
++};
++
++/**
++ * epf_ntb_probe() - Probe NTB function driver
++ * @epf: NTB endpoint function device
++ *
++ * Probe NTB function driver when endpoint function bus detects a NTB
++ * endpoint function.
++ */
++static int epf_ntb_probe(struct pci_epf *epf)
++{
++	struct epf_ntb *ntb;
++	struct device *dev;
++
++	dev = &epf->dev;
++
++	ntb = devm_kzalloc(dev, sizeof(*ntb), GFP_KERNEL);
++	if (!ntb)
++		return -ENOMEM;
++
++	epf->header = &epf_ntb_header;
++	ntb->epf = epf;
++	ntb->vbus_number = 0xff;
++	epf_set_drvdata(epf, ntb);
++
++	dev_info(dev, "pci-ep epf driver loaded\n");
++	return 0;
++}
++
++static const struct pci_epf_device_id epf_ntb_ids[] = {
++	{
++		.name = "pci_epf_vntb",
++	},
++	{},
++};
++
++static struct pci_epf_driver epf_ntb_driver = {
++	.driver.name    = "pci_epf_vntb",
++	.probe          = epf_ntb_probe,
++	.id_table       = epf_ntb_ids,
++	.ops            = &epf_ntb_ops,
++	.owner          = THIS_MODULE,
++};
++
++static int __init epf_ntb_init(void)
++{
++	int ret;
++
++	kpcintb_workqueue = alloc_workqueue("kpcintb", WQ_MEM_RECLAIM |
++					    WQ_HIGHPRI, 0);
++	ret = pci_epf_register_driver(&epf_ntb_driver);
++	if (ret) {
++		destroy_workqueue(kpcintb_workqueue);
++		pr_err("Failed to register pci epf ntb driver --> %d\n", ret);
++		return ret;
++	}
++
++	return 0;
++}
++module_init(epf_ntb_init);
++
++static void __exit epf_ntb_exit(void)
++{
++	pci_epf_unregister_driver(&epf_ntb_driver);
++	destroy_workqueue(kpcintb_workqueue);
++}
++module_exit(epf_ntb_exit);
++
++MODULE_DESCRIPTION("PCI EPF NTB DRIVER");
++MODULE_AUTHOR("Frank Li <Frank.li@nxp.com>");
++MODULE_LICENSE("GPL v2");
+-- 
+2.43.0
+
diff --git a/queue-5.15/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch b/queue-5.15/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
new file mode 100644
index 00000000000..707235cdc95
--- /dev/null
+++ b/queue-5.15/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
@@ -0,0 +1,67 @@
+From 087d70f206971345503c7acc8193501a97852f2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 20:21:14 +0800
+Subject: PCI: Make pci_dev_is_disconnected() helper public for other drivers
+
+From: Ethan Zhao <haifeng.zhao@linux.intel.com>
+
+[ Upstream commit 39714fd73c6b60a8d27bcc5b431afb0828bf4434 ]
+
+Make pci_dev_is_disconnected() public so that it can be called from
+Intel VT-d driver to quickly fix/workaround the surprise removal
+unplug hang issue for those ATS capable devices on PCIe switch downstream
+hotplug capable ports.
+
+Beside pci_device_is_present() function, this one has no config space
+space access, so is light enough to optimize the normal pure surprise
+removal and safe removal flow.
+
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Tested-by: Haorong Ye <yehaorong@bytedance.com>
+Signed-off-by: Ethan Zhao <haifeng.zhao@linux.intel.com>
+Link: https://lore.kernel.org/r/20240301080727.3529832-2-haifeng.zhao@linux.intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.h   | 5 -----
+ include/linux/pci.h | 5 +++++
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 2b5337980da7d..ec968b14aa2a2 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -395,11 +395,6 @@ static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused)
+ 	return 0;
+ }
+ 
+-static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
+-{
+-	return dev->error_state == pci_channel_io_perm_failure;
+-}
+-
+ /* pci_dev priv_flags */
+ #define PCI_DEV_ADDED 0
+ #define PCI_DPC_RECOVERED 1
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 99dfb8c1993a6..08d26b58f95ca 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2284,6 +2284,11 @@ static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
+ 	return NULL;
+ }
+ 
++static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
++{
++	return dev->error_state == pci_channel_io_perm_failure;
++}
++
+ void pci_request_acs(void);
+ bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags);
+ bool pci_acs_path_enabled(struct pci_dev *start,
+-- 
+2.43.0
+
diff --git a/queue-5.15/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch b/queue-5.15/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
new file mode 100644
index 00000000000..d94b8f152e9
--- /dev/null
+++ b/queue-5.15/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
@@ -0,0 +1,56 @@
+From 25d1853c3bd9b89b13e742683993c62d24c8c6f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 14:28:11 +0100
+Subject: PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jörg Wedekind <joerg@wedekind.de>
+
+[ Upstream commit baf67aefbe7d7deafa59ca49612d163f8889934c ]
+
+Per PCIe r6.1, sec 2.2.6.2 and 7.5.3.4, a Requester may not use 8-bit Tags
+unless its Extended Tag Field Enable is set, but all Receivers/Completers
+must handle 8-bit Tags correctly regardless of their Extended Tag Field
+Enable.
+
+Some devices do not handle 8-bit Tags as Completers, so add a quirk for
+them.  If we find such a device, we disable Extended Tags for the entire
+hierarchy to make peer-to-peer DMA possible.
+
+The 3ware 9650SE seems to have issues with handling 8-bit tags. Mark it as
+broken.
+
+This fixes PCI Parity Errors like :
+
+  3w-9xxx: scsi0: ERROR: (0x06:0x000C): PCI Parity Error: clearing.
+  3w-9xxx: scsi0: ERROR: (0x06:0x000D): PCI Abort: clearing.
+  3w-9xxx: scsi0: ERROR: (0x06:0x000E): Controller Queue Error: clearing.
+  3w-9xxx: scsi0: ERROR: (0x06:0x0010): Microcontroller Error: clearing.
+
+Link: https://lore.kernel.org/r/20240219132811.8351-1-joerg@wedekind.de
+Fixes: 60db3a4d8cc9 ("PCI: Enable PCIe Extended Tags if supported")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=202425
+Signed-off-by: Jörg Wedekind <joerg@wedekind.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index fcdc17bbcc8ee..1b6484c906094 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5390,6 +5390,7 @@ static void quirk_no_ext_tags(struct pci_dev *pdev)
+ 
+ 	pci_walk_bus(bridge->bus, pci_configure_extended_tags, NULL);
+ }
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_3WARE, 0x1004, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0132, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0140, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0141, quirk_no_ext_tags);
+-- 
+2.43.0
+
diff --git a/queue-5.15/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch b/queue-5.15/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
new file mode 100644
index 00000000000..e250560cde8
--- /dev/null
+++ b/queue-5.15/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
@@ -0,0 +1,38 @@
+From 2fcef39cdf01286c73bb797e934e1e374f15c97c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 20:52:35 +0100
+Subject: PCI/P2PDMA: Fix a sleeping issue in a RCU read section
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 1e5c66afd4a40bb7be17cb33cbb1a1085f727730 ]
+
+It is not allowed to sleep within a RCU read section, so use GFP_ATOMIC
+instead of GFP_KERNEL here.
+
+Link: https://lore.kernel.org/r/02d9ec4a10235def0e764ff1f5be881ba12e16e8.1704397858.git.christophe.jaillet@wanadoo.fr
+Fixes: ae21f835a5bd ("PCI/P2PDMA: Finish RCU conversion of pdev->p2pdma")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index 316fd2f44df45..57654c82b08e8 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -536,7 +536,7 @@ calc_map_type_and_dist(struct pci_dev *provider, struct pci_dev *client,
+ 	p2pdma = rcu_dereference(provider->p2pdma);
+ 	if (p2pdma)
+ 		xa_store(&p2pdma->map_types, map_types_idx(client),
+-			 xa_mk_value(map_type), GFP_KERNEL);
++			 xa_mk_value(map_type), GFP_ATOMIC);
+ 	rcu_read_unlock();
+ 	return map_type;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/pci-switchtec-fix-an-error-handling-path-in-switchte.patch b/queue-5.15/pci-switchtec-fix-an-error-handling-path-in-switchte.patch
new file mode 100644
index 00000000000..a29d68fa10a
--- /dev/null
+++ b/queue-5.15/pci-switchtec-fix-an-error-handling-path-in-switchte.patch
@@ -0,0 +1,51 @@
+From 4fbf3642e5b43084220425e1ac0cb89e0aca6e28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 15:30:01 +0100
+Subject: PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit dec529b0b0572b32f9eb91c882dd1f08ca657efb ]
+
+The commit in Fixes changed the logic on how resources are released and
+introduced a new switchtec_exit_pci() that need to be called explicitly in
+order to undo a corresponding switchtec_init_pci().
+
+This was done in the remove function, but not in the probe.
+
+Fix the probe now.
+
+Fixes: df25461119d9 ("PCI: switchtec: Fix stdev_release() crash after surprise hot remove")
+Link: https://lore.kernel.org/r/01446d2ccb91a578239915812f2b7dfbeb2882af.1703428183.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/switch/switchtec.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 2a026183f06b3..bc14386ba440c 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -1614,7 +1614,7 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
+ 	rc = switchtec_init_isr(stdev);
+ 	if (rc) {
+ 		dev_err(&stdev->dev, "failed to init isr.\n");
+-		goto err_put;
++		goto err_exit_pci;
+ 	}
+ 
+ 	iowrite32(SWITCHTEC_EVENT_CLEAR |
+@@ -1635,6 +1635,8 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
+ 
+ err_devadd:
+ 	stdev_kill(stdev);
++err_exit_pci:
++	switchtec_exit_pci(stdev);
+ err_put:
+ 	ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
+ 	put_device(&stdev->dev);
+-- 
+2.43.0
+
diff --git a/queue-5.15/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch b/queue-5.15/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
new file mode 100644
index 00000000000..bceb8aab4bd
--- /dev/null
+++ b/queue-5.15/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
@@ -0,0 +1,38 @@
+From f27abad7ee49311af17f139ecfd7d435543de2ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Jan 2024 02:57:56 +0000
+Subject: perf evsel: Fix duplicate initialization of data->id in
+ evsel__parse_sample()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 4962aec0d684c8edb14574ccd0da53e4926ff834 ]
+
+data->id has been initialized at line 2362, remove duplicate initialization.
+
+Fixes: 3ad31d8a0df2 ("perf evsel: Centralize perf_sample initialization")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Reviewed-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240127025756.4041808-1-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index c87f9974c0c10..c19a583ca9f66 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -2252,7 +2252,6 @@ int evsel__parse_sample(struct evsel *evsel, union perf_event *event,
+ 	data->period = evsel->core.attr.sample_period;
+ 	data->cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
+ 	data->misc    = event->header.misc;
+-	data->id = -1ULL;
+ 	data->data_src = PERF_MEM_DATA_SRC_NONE;
+ 
+ 	if (event->header.type != PERF_RECORD_SAMPLE) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/perf-record-fix-possible-incorrect-free-in-record__s.patch b/queue-5.15/perf-record-fix-possible-incorrect-free-in-record__s.patch
new file mode 100644
index 00000000000..35feb4cac9a
--- /dev/null
+++ b/queue-5.15/perf-record-fix-possible-incorrect-free-in-record__s.patch
@@ -0,0 +1,40 @@
+From 1f6c95f28370f44bcd1eb4c91524039c63abadd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 04:03:02 +0000
+Subject: perf record: Fix possible incorrect free in record__switch_output()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit aff10a165201f6f60cff225083ce301ad3f5d8f1 ]
+
+perf_data__switch() may not assign a legal value to 'new_filename'.
+In this case, 'new_filename' uses the on-stack value, which may cause a
+incorrect free and unexpected result.
+
+Fixes: 03724b2e9c45 ("perf record: Allow to limit number of reported perf.data files")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240119040304.3708522-2-yangjihong1@huawei.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-record.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index b3509d9d20cc2..b92c26f6aa1d7 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -1277,8 +1277,8 @@ static int
+ record__switch_output(struct record *rec, bool at_exit)
+ {
+ 	struct perf_data *data = &rec->data;
++	char *new_filename = NULL;
+ 	int fd, err;
+-	char *new_filename;
+ 
+ 	/* Same Size:      "2015122520103046"*/
+ 	char timestamp[] = "InvalidTimestamp";
+-- 
+2.43.0
+
diff --git a/queue-5.15/perf-stat-avoid-metric-only-segv.patch b/queue-5.15/perf-stat-avoid-metric-only-segv.patch
new file mode 100644
index 00000000000..5bcea71fd79
--- /dev/null
+++ b/queue-5.15/perf-stat-avoid-metric-only-segv.patch
@@ -0,0 +1,43 @@
+From 514815aa25c9686fc7d9c95769cff2d98525fd8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 12:49:46 -0800
+Subject: perf stat: Avoid metric-only segv
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2543947c77e0e224bda86b4e7220c2f6714da463 ]
+
+Cycles is recognized as part of a hard coded metric in stat-shadow.c,
+it may call print_metric_only with a NULL fmt string leading to a
+segfault. Handle the NULL fmt explicitly.
+
+Fixes: 088519f318be ("perf stat: Move the display functions to stat-display.c")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: K Prateek Nayak <kprateek.nayak@amd.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Kaige Ye <ye@kaige.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240209204947.3873294-4-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
+index 24e50fabb6c33..5ed20e1e09aef 100644
+--- a/tools/perf/util/stat-display.c
++++ b/tools/perf/util/stat-display.c
+@@ -275,7 +275,7 @@ static void print_metric_only(struct perf_stat_config *config,
+ 	if (color)
+ 		mlen += strlen(color) + sizeof(PERF_COLOR_RESET) - 1;
+ 
+-	color_snprintf(str, sizeof(str), color ?: "", fmt, val);
++	color_snprintf(str, sizeof(str), color ?: "", fmt ?: "", val);
+ 	fprintf(out, "%*s ", mlen, str);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/perf-thread_map-free-strlist-on-normal-path-in-threa.patch b/queue-5.15/perf-thread_map-free-strlist-on-normal-path-in-threa.patch
new file mode 100644
index 00000000000..17e6a7242cd
--- /dev/null
+++ b/queue-5.15/perf-thread_map-free-strlist-on-normal-path-in-threa.patch
@@ -0,0 +1,45 @@
+From d0d5617b2c201b33b89c25ed50f7ed59dcde91f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:32:28 +0000
+Subject: perf thread_map: Free strlist on normal path in
+ thread_map__new_by_tid_str()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 1eb3d924e3c0b8c27388b0583a989d757866efb6 ]
+
+slist needs to be freed in both error path and normal path in
+thread_map__new_by_tid_str().
+
+Fixes: b52956c961be3a04 ("perf tools: Allow multiple threads or processes in record, stat, top")
+Reviewed-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240206083228.172607-6-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/thread_map.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c
+index c9bfe4696943b..cee7fc3b5bb0c 100644
+--- a/tools/perf/util/thread_map.c
++++ b/tools/perf/util/thread_map.c
+@@ -279,13 +279,13 @@ struct perf_thread_map *thread_map__new_by_tid_str(const char *tid_str)
+ 		threads->nr = ntasks;
+ 	}
+ out:
++	strlist__delete(slist);
+ 	if (threads)
+ 		refcount_set(&threads->refcnt, 1);
+ 	return threads;
+ 
+ out_free_threads:
+ 	zfree(&threads);
+-	strlist__delete(slist);
+ 	goto out;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch b/queue-5.15/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
new file mode 100644
index 00000000000..40814c50e7b
--- /dev/null
+++ b/queue-5.15/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
@@ -0,0 +1,40 @@
+From 1e2506c0eee56781e65469f283d074486668889d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 15:19:08 +0800
+Subject: pinctrl: mediatek: Drop bogus slew rate register range for MT8192
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit e15ab05a6b3ed42f2f43f8bd1a1abdbde64afecd ]
+
+The MT8192 does not support configuring pin slew rate. This is evident
+from both the datasheet, and the fact that the driver points the slew
+rate register range at the GPIO direction register range.
+
+Drop the bogus setting.
+
+Fixes: d32f38f2a8fc ("pinctrl: mediatek: Add pinctrl driver for mt8192")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240131071910.3950450-2-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mt8192.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8192.c b/drivers/pinctrl/mediatek/pinctrl-mt8192.c
+index 0c16b2c756bf3..f3020e3c8533b 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8192.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8192.c
+@@ -1346,7 +1346,6 @@ static const struct mtk_pin_reg_calc mt8192_reg_cals[PINCTRL_PIN_REG_MAX] = {
+ 	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt8192_pin_dir_range),
+ 	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt8192_pin_di_range),
+ 	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt8192_pin_do_range),
+-	[PINCTRL_PIN_REG_SR] = MTK_RANGE(mt8192_pin_dir_range),
+ 	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt8192_pin_smt_range),
+ 	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt8192_pin_ies_range),
+ 	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt8192_pin_pu_range),
+-- 
+2.43.0
+
diff --git a/queue-5.15/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch b/queue-5.15/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
new file mode 100644
index 00000000000..369fba2ec94
--- /dev/null
+++ b/queue-5.15/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
@@ -0,0 +1,53 @@
+From 0f58457c2edfaf4aedb13c8cce9f362a0192f677 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 23:34:08 +1100
+Subject: powerpc/embedded6xx: Fix no previous prototype for avr_uart_send()
+ etc.
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 20933531be0577cdd782216858c26150dbc7936f ]
+
+Move the prototypes into mpc10x.h which is included by all the relevant
+C files, fixes:
+
+  arch/powerpc/platforms/embedded6xx/ls_uart.c:59:6: error: no previous prototype for 'avr_uart_configure'
+  arch/powerpc/platforms/embedded6xx/ls_uart.c:82:6: error: no previous prototype for 'avr_uart_send'
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240305123410.3306253-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/embedded6xx/linkstation.c | 3 ---
+ arch/powerpc/platforms/embedded6xx/mpc10x.h      | 3 +++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/embedded6xx/linkstation.c b/arch/powerpc/platforms/embedded6xx/linkstation.c
+index eb8342e7f84e9..ac3bd4a3216ce 100644
+--- a/arch/powerpc/platforms/embedded6xx/linkstation.c
++++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
+@@ -100,9 +100,6 @@ static void __init linkstation_init_IRQ(void)
+ 	mpic_init(mpic);
+ }
+ 
+-extern void avr_uart_configure(void);
+-extern void avr_uart_send(const char);
+-
+ static void __noreturn linkstation_restart(char *cmd)
+ {
+ 	local_irq_disable();
+diff --git a/arch/powerpc/platforms/embedded6xx/mpc10x.h b/arch/powerpc/platforms/embedded6xx/mpc10x.h
+index 5ad12023e5628..ebc258fa4858d 100644
+--- a/arch/powerpc/platforms/embedded6xx/mpc10x.h
++++ b/arch/powerpc/platforms/embedded6xx/mpc10x.h
+@@ -156,4 +156,7 @@ int mpc10x_disable_store_gathering(struct pci_controller *hose);
+ /* For MPC107 boards that use the built-in openpic */
+ void mpc10x_set_openpic(void);
+ 
++void avr_uart_configure(void);
++void avr_uart_send(const char c);
++
+ #endif	/* __PPC_KERNEL_MPC10X_H */
+-- 
+2.43.0
+
diff --git a/queue-5.15/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch b/queue-5.15/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
new file mode 100644
index 00000000000..af30cd3ceaa
--- /dev/null
+++ b/queue-5.15/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
@@ -0,0 +1,65 @@
+From d3e6a7869cf59570ec995093d7ecc3239b89064c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 14:58:37 +0100
+Subject: powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c5aebb53b32460bc52680dd4e2a2f6b84d5ea521 ]
+
+arch_vmap_pud_supported() and arch_vmap_pmd_supported() are
+expected to constant-fold to false when RADIX is not enabled.
+
+Force inlining in order to avoid following failure which
+leads to unexpected call of non-existing pud_set_huge() and
+pmd_set_huge() on powerpc 8xx.
+
+In function 'pud_huge_tests',
+    inlined from 'debug_vm_pgtable' at mm/debug_vm_pgtable.c:1399:2:
+./arch/powerpc/include/asm/vmalloc.h:9:33: warning: inlining failed in call to 'arch_vmap_pud_supported.isra': call is unlikely and code size would grow [-Winline]
+    9 | #define arch_vmap_pud_supported arch_vmap_pud_supported
+      |                                 ^~~~~~~~~~~~~~~~~~~~~~~
+./arch/powerpc/include/asm/vmalloc.h:10:20: note: in expansion of macro 'arch_vmap_pud_supported'
+   10 | static inline bool arch_vmap_pud_supported(pgprot_t prot)
+      |                    ^~~~~~~~~~~~~~~~~~~~~~~
+./arch/powerpc/include/asm/vmalloc.h:9:33: note: called from here
+    9 | #define arch_vmap_pud_supported arch_vmap_pud_supported
+mm/debug_vm_pgtable.c:458:14: note: in expansion of macro 'arch_vmap_pud_supported'
+  458 |         if (!arch_vmap_pud_supported(args->page_prot) ||
+      |              ^~~~~~~~~~~~~~~~~~~~~~~
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402131836.OU1TDuoi-lkp@intel.com/
+Fixes: 8309c9d71702 ("powerpc: inline huge vmap supported functions")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/bbd84ad52bf377e8d3b5865a906f2dc5d99964ba.1707832677.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/vmalloc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/vmalloc.h b/arch/powerpc/include/asm/vmalloc.h
+index 4c69ece52a31e..59ed89890c902 100644
+--- a/arch/powerpc/include/asm/vmalloc.h
++++ b/arch/powerpc/include/asm/vmalloc.h
+@@ -7,14 +7,14 @@
+ #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
+ 
+ #define arch_vmap_pud_supported arch_vmap_pud_supported
+-static inline bool arch_vmap_pud_supported(pgprot_t prot)
++static __always_inline bool arch_vmap_pud_supported(pgprot_t prot)
+ {
+ 	/* HPT does not cope with large pages in the vmalloc area */
+ 	return radix_enabled();
+ }
+ 
+ #define arch_vmap_pmd_supported arch_vmap_pmd_supported
+-static inline bool arch_vmap_pmd_supported(pgprot_t prot)
++static __always_inline bool arch_vmap_pmd_supported(pgprot_t prot)
+ {
+ 	return radix_enabled();
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch b/queue-5.15/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
new file mode 100644
index 00000000000..ef9be65df1b
--- /dev/null
+++ b/queue-5.15/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
@@ -0,0 +1,118 @@
+From a4e7838f9c6a75adab23becb8d2100b964ab4b2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 17:58:47 +0530
+Subject: powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value
+ checks
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit ad86d7ee43b22aa2ed60fb982ae94b285c1be671 ]
+
+Running event hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/
+in one of the system throws below error:
+
+ ---Logs---
+ # perf list | grep hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles
+  hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=?/[Kernel PMU event]
+
+ # perf stat -v -e hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ sleep 2
+Using CPUID 00800200
+Control descriptor is not initialized
+Warning:
+hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ event is not supported by the kernel.
+failed to read counter hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/
+
+ Performance counter stats for 'system wide':
+
+   <not supported>      hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/
+
+       2.000700771 seconds time elapsed
+
+The above error is because of the hcall failure as required
+permission "Enable Performance Information Collection" is not set.
+Based on current code, single_gpci_request function did not check the
+error type incase hcall fails and by default returns EINVAL. But we can
+have other reasons for hcall failures like H_AUTHORITY/H_PARAMETER with
+detail_rc as GEN_BUF_TOO_SMALL, for which we need to act accordingly.
+
+Fix this issue by adding new checks in the single_gpci_request and
+h_gpci_event_init functions.
+
+Result after fix patch changes:
+
+ # perf stat -e hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ sleep 2
+Error:
+No permission to enable hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ event.
+
+Fixes: 220a0c609ad1 ("powerpc/perf: Add support for the hv gpci (get performance counter info) interface")
+Reported-by: Akanksha J N <akanksha@linux.ibm.com>
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240229122847.101162-1-kjain@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/hv-gpci.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
+index 28b770bbc10b4..2a054de80e50b 100644
+--- a/arch/powerpc/perf/hv-gpci.c
++++ b/arch/powerpc/perf/hv-gpci.c
+@@ -164,6 +164,20 @@ static unsigned long single_gpci_request(u32 req, u32 starting_index,
+ 
+ 	ret = plpar_hcall_norets(H_GET_PERF_COUNTER_INFO,
+ 			virt_to_phys(arg), HGPCI_REQ_BUFFER_SIZE);
++
++	/*
++	 * ret value as 'H_PARAMETER' with detail_rc as 'GEN_BUF_TOO_SMALL',
++	 * specifies that the current buffer size cannot accommodate
++	 * all the information and a partial buffer returned.
++	 * Since in this function we are only accessing data for a given starting index,
++	 * we don't need to accommodate whole data and can get required count by
++	 * accessing first entry data.
++	 * Hence hcall fails only incase the ret value is other than H_SUCCESS or
++	 * H_PARAMETER with detail_rc value as GEN_BUF_TOO_SMALL(0x1B).
++	 */
++	if (ret == H_PARAMETER && be32_to_cpu(arg->params.detail_rc) == 0x1B)
++		ret = 0;
++
+ 	if (ret) {
+ 		pr_devel("hcall failed: 0x%lx\n", ret);
+ 		goto out;
+@@ -228,6 +242,7 @@ static int h_gpci_event_init(struct perf_event *event)
+ {
+ 	u64 count;
+ 	u8 length;
++	unsigned long ret;
+ 
+ 	/* Not our event */
+ 	if (event->attr.type != event->pmu->type)
+@@ -258,13 +273,23 @@ static int h_gpci_event_init(struct perf_event *event)
+ 	}
+ 
+ 	/* check if the request works... */
+-	if (single_gpci_request(event_get_request(event),
++	ret = single_gpci_request(event_get_request(event),
+ 				event_get_starting_index(event),
+ 				event_get_secondary_index(event),
+ 				event_get_counter_info_version(event),
+ 				event_get_offset(event),
+ 				length,
+-				&count)) {
++				&count);
++
++	/*
++	 * ret value as H_AUTHORITY implies that partition is not permitted to retrieve
++	 * performance information, and required to set
++	 * "Enable Performance Information Collection" option.
++	 */
++	if (ret == H_AUTHORITY)
++		return -EPERM;
++
++	if (ret) {
+ 		pr_devel("gpci hcall failed\n");
+ 		return -EINVAL;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-5.15/printk-add-panic_in_progress-helper.patch b/queue-5.15/printk-add-panic_in_progress-helper.patch
new file mode 100644
index 00000000000..a8ce95161cd
--- /dev/null
+++ b/queue-5.15/printk-add-panic_in_progress-helper.patch
@@ -0,0 +1,46 @@
+From 638bff97b02854768b03c7de106b677613c51560 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Feb 2022 09:18:18 -0800
+Subject: printk: Add panic_in_progress helper
+
+From: Stephen Brennan <stephen.s.brennan@oracle.com>
+
+[ Upstream commit 77498617857f68496b360081dde1a492d40c28b2 ]
+
+This will be used help avoid deadlocks during panics. Although it would
+be better to include this in linux/panic.h, it would require that header
+to include linux/atomic.h as well. On some architectures, this results
+in a circular dependency as well. So instead add the helper directly to
+printk.c.
+
+Suggested-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Stephen Brennan <stephen.s.brennan@oracle.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20220202171821.179394-2-stephen.s.brennan@oracle.com
+Stable-dep-of: d04d5882cd67 ("printk: Disable passing console lock owner completely during panic()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 8b110b245d92c..de44ccf9743c1 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -258,6 +258,11 @@ static void __up_console_sem(unsigned long ip)
+ }
+ #define up_console_sem() __up_console_sem(_RET_IP_)
+ 
++static bool panic_in_progress(void)
++{
++	return unlikely(atomic_read(&panic_cpu) != PANIC_CPU_INVALID);
++}
++
+ /*
+  * This is used for debugging the mess that is the VT code by
+  * keeping track if we have the console semaphore held. It's
+-- 
+2.43.0
+
diff --git a/queue-5.15/printk-disable-passing-console-lock-owner-completely.patch b/queue-5.15/printk-disable-passing-console-lock-owner-completely.patch
new file mode 100644
index 00000000000..4defae7c2ce
--- /dev/null
+++ b/queue-5.15/printk-disable-passing-console-lock-owner-completely.patch
@@ -0,0 +1,116 @@
+From edf4e1e6001bf8bc53c4ed01fc18f8ea53e06e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:47:00 +0106
+Subject: printk: Disable passing console lock owner completely during panic()
+
+From: Petr Mladek <pmladek@suse.com>
+
+[ Upstream commit d04d5882cd678b898a9d7c5aee6afbe9e6e77fcd ]
+
+The commit d51507098ff91 ("printk: disable optimistic spin
+during panic") added checks to avoid becoming a console waiter
+if a panic is in progress.
+
+However, the transition to panic can occur while there is
+already a waiter. The current owner should not pass the lock to
+the waiter because it might get stopped or blocked anytime.
+
+Also the panic context might pass the console lock owner to an
+already stopped waiter by mistake. It might happen when
+console_flush_on_panic() ignores the current lock owner, for
+example:
+
+CPU0                                CPU1
+----                                ----
+console_lock_spinning_enable()
+                                    console_trylock_spinning()
+                                      [CPU1 now console waiter]
+NMI: panic()
+  panic_other_cpus_shutdown()
+                                    [stopped as console waiter]
+  console_flush_on_panic()
+    console_lock_spinning_enable()
+    [print 1 record]
+    console_lock_spinning_disable_and_check()
+      [handover to stopped CPU1]
+
+This results in panic() not flushing the panic messages.
+
+Fix these problems by disabling all spinning operations
+completely during panic().
+
+Another advantage is that it prevents possible deadlocks caused
+by "console_owner_lock". The panic() context does not need to
+take it any longer. The lockless checks are safe because the
+functions become NOPs when they see the panic in progress. All
+operations manipulating the state are still synchronized by the
+lock even when non-panic CPUs would notice the panic
+synchronously.
+
+The current owner might stay spinning. But non-panic() CPUs
+would get stopped anyway and the panic context will never start
+spinning.
+
+Fixes: dbdda842fe96 ("printk: Add console owner and waiter logic to load balance console writes")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Link: https://lore.kernel.org/r/20240207134103.1357162-12-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index de44ccf9743c1..5ad824b080e27 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1802,10 +1802,23 @@ static bool console_waiter;
+  */
+ static void console_lock_spinning_enable(void)
+ {
++	/*
++	 * Do not use spinning in panic(). The panic CPU wants to keep the lock.
++	 * Non-panic CPUs abandon the flush anyway.
++	 *
++	 * Just keep the lockdep annotation. The panic-CPU should avoid
++	 * taking console_owner_lock because it might cause a deadlock.
++	 * This looks like the easiest way how to prevent false lockdep
++	 * reports without handling races a lockless way.
++	 */
++	if (panic_in_progress())
++		goto lockdep;
++
+ 	raw_spin_lock(&console_owner_lock);
+ 	console_owner = current;
+ 	raw_spin_unlock(&console_owner_lock);
+ 
++lockdep:
+ 	/* The waiter may spin on us after setting console_owner */
+ 	spin_acquire(&console_owner_dep_map, 0, 0, _THIS_IP_);
+ }
+@@ -1829,6 +1842,22 @@ static int console_lock_spinning_disable_and_check(void)
+ {
+ 	int waiter;
+ 
++	/*
++	 * Ignore spinning waiters during panic() because they might get stopped
++	 * or blocked at any time,
++	 *
++	 * It is safe because nobody is allowed to start spinning during panic
++	 * in the first place. If there has been a waiter then non panic CPUs
++	 * might stay spinning. They would get stopped anyway. The panic context
++	 * will never start spinning and an interrupted spin on panic CPU will
++	 * never continue.
++	 */
++	if (panic_in_progress()) {
++		/* Keep lockdep happy. */
++		spin_release(&console_owner_dep_map, _THIS_IP_);
++		return 0;
++	}
++
+ 	raw_spin_lock(&console_owner_lock);
+ 	waiter = READ_ONCE(console_waiter);
+ 	console_owner = NULL;
+-- 
+2.43.0
+
diff --git a/queue-5.15/pwm-atmel-hlcdc-convert-to-platform-remove-callback-.patch b/queue-5.15/pwm-atmel-hlcdc-convert-to-platform-remove-callback-.patch
new file mode 100644
index 00000000000..27a94aa13b8
--- /dev/null
+++ b/queue-5.15/pwm-atmel-hlcdc-convert-to-platform-remove-callback-.patch
@@ -0,0 +1,65 @@
+From 3de7ab3e24b245102563a1743516dff091fa7ae4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 19:54:16 +0100
+Subject: pwm: atmel-hlcdc: Convert to platform remove callback returning void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 5fce94170ad8a67b839f3dd8e8e8a87039ba0251 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is (mostly) ignored
+and this typically results in resource leaks. To improve here there is a
+quest to make the remove callback return void. In the first step of this
+quest all drivers are converted to .remove_new() which already returns
+void.
+
+Trivially convert this driver from always returning zero in the remove
+callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: e25ac87d3f83 ("pwm: atmel-hlcdc: Fix clock imbalance related to suspend support")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-atmel-hlcdc.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pwm/pwm-atmel-hlcdc.c b/drivers/pwm/pwm-atmel-hlcdc.c
+index a43b2babc8093..96a709a9d49a8 100644
+--- a/drivers/pwm/pwm-atmel-hlcdc.c
++++ b/drivers/pwm/pwm-atmel-hlcdc.c
+@@ -278,15 +278,13 @@ static int atmel_hlcdc_pwm_probe(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-static int atmel_hlcdc_pwm_remove(struct platform_device *pdev)
++static void atmel_hlcdc_pwm_remove(struct platform_device *pdev)
+ {
+ 	struct atmel_hlcdc_pwm *chip = platform_get_drvdata(pdev);
+ 
+ 	pwmchip_remove(&chip->chip);
+ 
+ 	clk_disable_unprepare(chip->hlcdc->periph_clk);
+-
+-	return 0;
+ }
+ 
+ static const struct of_device_id atmel_hlcdc_pwm_dt_ids[] = {
+@@ -301,7 +299,7 @@ static struct platform_driver atmel_hlcdc_pwm_driver = {
+ 		.pm = &atmel_hlcdc_pwm_pm_ops,
+ 	},
+ 	.probe = atmel_hlcdc_pwm_probe,
+-	.remove = atmel_hlcdc_pwm_remove,
++	.remove_new = atmel_hlcdc_pwm_remove,
+ };
+ module_platform_driver(atmel_hlcdc_pwm_driver);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch b/queue-5.15/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
new file mode 100644
index 00000000000..4d8a4119b0b
--- /dev/null
+++ b/queue-5.15/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
@@ -0,0 +1,41 @@
+From d4915f71dbac004bd37898463d081b25bb9a966d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 13:04:33 +0100
+Subject: pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit e25ac87d3f831fed002c34aadddaf4ebb4ea45ec ]
+
+The suspend callback disables the periph clock when the PWM is enabled
+and resume reenables this clock if the PWM was disabled before. Judging
+from the code comment it's suspend that is wrong here. Fix accordingly.
+
+Fixes: f9bb9da7c09d ("pwm: atmel-hlcdc: Implement the suspend/resume hooks")
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/b51ea92b0a45eff3dc83b08adefd43d930df996c.1706269232.git.u.kleine-koenig@pengutronix.de
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-atmel-hlcdc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-atmel-hlcdc.c b/drivers/pwm/pwm-atmel-hlcdc.c
+index 4d0b859d0ac13..3e9c94a8d7f72 100644
+--- a/drivers/pwm/pwm-atmel-hlcdc.c
++++ b/drivers/pwm/pwm-atmel-hlcdc.c
+@@ -186,7 +186,7 @@ static int atmel_hlcdc_pwm_suspend(struct device *dev)
+ 	struct atmel_hlcdc_pwm *atmel = dev_get_drvdata(dev);
+ 
+ 	/* Keep the periph clock enabled if the PWM is still running. */
+-	if (pwm_is_enabled(&atmel->chip.pwms[0]))
++	if (!pwm_is_enabled(&atmel->chip.pwms[0]))
+ 		clk_disable_unprepare(atmel->hlcdc->periph_clk);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-5.15/pwm-atmel-hlcdc-use-consistent-variable-naming.patch b/queue-5.15/pwm-atmel-hlcdc-use-consistent-variable-naming.patch
new file mode 100644
index 00000000000..84198a3e4d3
--- /dev/null
+++ b/queue-5.15/pwm-atmel-hlcdc-use-consistent-variable-naming.patch
@@ -0,0 +1,210 @@
+From cf2b1a562e77543b1f4c90ec686744ae0ba1e7de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Jul 2023 22:56:15 +0200
+Subject: pwm: atmel-hlcdc: Use consistent variable naming
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit aecab554b6ffa9a94ba796031eb39ea20eb60fb3 ]
+
+In PWM drivers the variable name "chip" is usually only used for struct
+pwm_chip pointers. This driver however used "chip" for its driver data
+and pwm_chip pointers are named "chip", too, when there is no driver
+data around and "c" otherwise. Instead use "atmel" for driver data and
+always "chip" for pwm_chips.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+[thierry.reding@gmail.com: replace ddata by atmel]
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: e25ac87d3f83 ("pwm: atmel-hlcdc: Fix clock imbalance related to suspend support")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-atmel-hlcdc.c | 65 ++++++++++++++++++-----------------
+ 1 file changed, 33 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/pwm/pwm-atmel-hlcdc.c b/drivers/pwm/pwm-atmel-hlcdc.c
+index 96a709a9d49a8..4d0b859d0ac13 100644
+--- a/drivers/pwm/pwm-atmel-hlcdc.c
++++ b/drivers/pwm/pwm-atmel-hlcdc.c
+@@ -38,11 +38,11 @@ static inline struct atmel_hlcdc_pwm *to_atmel_hlcdc_pwm(struct pwm_chip *chip)
+ 	return container_of(chip, struct atmel_hlcdc_pwm, chip);
+ }
+ 
+-static int atmel_hlcdc_pwm_apply(struct pwm_chip *c, struct pwm_device *pwm,
++static int atmel_hlcdc_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 				 const struct pwm_state *state)
+ {
+-	struct atmel_hlcdc_pwm *chip = to_atmel_hlcdc_pwm(c);
+-	struct atmel_hlcdc *hlcdc = chip->hlcdc;
++	struct atmel_hlcdc_pwm *atmel = to_atmel_hlcdc_pwm(chip);
++	struct atmel_hlcdc *hlcdc = atmel->hlcdc;
+ 	unsigned int status;
+ 	int ret;
+ 
+@@ -54,7 +54,7 @@ static int atmel_hlcdc_pwm_apply(struct pwm_chip *c, struct pwm_device *pwm,
+ 		u32 pwmcfg;
+ 		int pres;
+ 
+-		if (!chip->errata || !chip->errata->slow_clk_erratum) {
++		if (!atmel->errata || !atmel->errata->slow_clk_erratum) {
+ 			clk_freq = clk_get_rate(new_clk);
+ 			if (!clk_freq)
+ 				return -EINVAL;
+@@ -64,7 +64,7 @@ static int atmel_hlcdc_pwm_apply(struct pwm_chip *c, struct pwm_device *pwm,
+ 		}
+ 
+ 		/* Errata: cannot use slow clk on some IP revisions */
+-		if ((chip->errata && chip->errata->slow_clk_erratum) ||
++		if ((atmel->errata && atmel->errata->slow_clk_erratum) ||
+ 		    clk_period_ns > state->period) {
+ 			new_clk = hlcdc->sys_clk;
+ 			clk_freq = clk_get_rate(new_clk);
+@@ -77,8 +77,8 @@ static int atmel_hlcdc_pwm_apply(struct pwm_chip *c, struct pwm_device *pwm,
+ 
+ 		for (pres = 0; pres <= ATMEL_HLCDC_PWMPS_MAX; pres++) {
+ 		/* Errata: cannot divide by 1 on some IP revisions */
+-			if (!pres && chip->errata &&
+-			    chip->errata->div1_clk_erratum)
++			if (!pres && atmel->errata &&
++			    atmel->errata->div1_clk_erratum)
+ 				continue;
+ 
+ 			if ((clk_period_ns << pres) >= state->period)
+@@ -90,7 +90,7 @@ static int atmel_hlcdc_pwm_apply(struct pwm_chip *c, struct pwm_device *pwm,
+ 
+ 		pwmcfg = ATMEL_HLCDC_PWMPS(pres);
+ 
+-		if (new_clk != chip->cur_clk) {
++		if (new_clk != atmel->cur_clk) {
+ 			u32 gencfg = 0;
+ 			int ret;
+ 
+@@ -98,8 +98,8 @@ static int atmel_hlcdc_pwm_apply(struct pwm_chip *c, struct pwm_device *pwm,
+ 			if (ret)
+ 				return ret;
+ 
+-			clk_disable_unprepare(chip->cur_clk);
+-			chip->cur_clk = new_clk;
++			clk_disable_unprepare(atmel->cur_clk);
++			atmel->cur_clk = new_clk;
+ 
+ 			if (new_clk == hlcdc->sys_clk)
+ 				gencfg = ATMEL_HLCDC_CLKPWMSEL;
+@@ -160,8 +160,8 @@ static int atmel_hlcdc_pwm_apply(struct pwm_chip *c, struct pwm_device *pwm,
+ 		if (ret)
+ 			return ret;
+ 
+-		clk_disable_unprepare(chip->cur_clk);
+-		chip->cur_clk = NULL;
++		clk_disable_unprepare(atmel->cur_clk);
++		atmel->cur_clk = NULL;
+ 	}
+ 
+ 	return 0;
+@@ -183,31 +183,32 @@ static const struct atmel_hlcdc_pwm_errata atmel_hlcdc_pwm_sama5d3_errata = {
+ #ifdef CONFIG_PM_SLEEP
+ static int atmel_hlcdc_pwm_suspend(struct device *dev)
+ {
+-	struct atmel_hlcdc_pwm *chip = dev_get_drvdata(dev);
++	struct atmel_hlcdc_pwm *atmel = dev_get_drvdata(dev);
+ 
+ 	/* Keep the periph clock enabled if the PWM is still running. */
+-	if (pwm_is_enabled(&chip->chip.pwms[0]))
+-		clk_disable_unprepare(chip->hlcdc->periph_clk);
++	if (pwm_is_enabled(&atmel->chip.pwms[0]))
++		clk_disable_unprepare(atmel->hlcdc->periph_clk);
+ 
+ 	return 0;
+ }
+ 
+ static int atmel_hlcdc_pwm_resume(struct device *dev)
+ {
+-	struct atmel_hlcdc_pwm *chip = dev_get_drvdata(dev);
++	struct atmel_hlcdc_pwm *atmel = dev_get_drvdata(dev);
+ 	struct pwm_state state;
+ 	int ret;
+ 
+-	pwm_get_state(&chip->chip.pwms[0], &state);
++	pwm_get_state(&atmel->chip.pwms[0], &state);
+ 
+ 	/* Re-enable the periph clock it was stopped during suspend. */
+ 	if (!state.enabled) {
+-		ret = clk_prepare_enable(chip->hlcdc->periph_clk);
++		ret = clk_prepare_enable(atmel->hlcdc->periph_clk);
+ 		if (ret)
+ 			return ret;
+ 	}
+ 
+-	return atmel_hlcdc_pwm_apply(&chip->chip, &chip->chip.pwms[0], &state);
++	return atmel_hlcdc_pwm_apply(&atmel->chip, &atmel->chip.pwms[0],
++				     &state);
+ }
+ #endif
+ 
+@@ -244,14 +245,14 @@ static int atmel_hlcdc_pwm_probe(struct platform_device *pdev)
+ {
+ 	const struct of_device_id *match;
+ 	struct device *dev = &pdev->dev;
+-	struct atmel_hlcdc_pwm *chip;
++	struct atmel_hlcdc_pwm *atmel;
+ 	struct atmel_hlcdc *hlcdc;
+ 	int ret;
+ 
+ 	hlcdc = dev_get_drvdata(dev->parent);
+ 
+-	chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL);
+-	if (!chip)
++	atmel = devm_kzalloc(dev, sizeof(*atmel), GFP_KERNEL);
++	if (!atmel)
+ 		return -ENOMEM;
+ 
+ 	ret = clk_prepare_enable(hlcdc->periph_clk);
+@@ -260,31 +261,31 @@ static int atmel_hlcdc_pwm_probe(struct platform_device *pdev)
+ 
+ 	match = of_match_node(atmel_hlcdc_dt_ids, dev->parent->of_node);
+ 	if (match)
+-		chip->errata = match->data;
++		atmel->errata = match->data;
+ 
+-	chip->hlcdc = hlcdc;
+-	chip->chip.ops = &atmel_hlcdc_pwm_ops;
+-	chip->chip.dev = dev;
+-	chip->chip.npwm = 1;
++	atmel->hlcdc = hlcdc;
++	atmel->chip.ops = &atmel_hlcdc_pwm_ops;
++	atmel->chip.dev = dev;
++	atmel->chip.npwm = 1;
+ 
+-	ret = pwmchip_add(&chip->chip);
++	ret = pwmchip_add(&atmel->chip);
+ 	if (ret) {
+ 		clk_disable_unprepare(hlcdc->periph_clk);
+ 		return ret;
+ 	}
+ 
+-	platform_set_drvdata(pdev, chip);
++	platform_set_drvdata(pdev, atmel);
+ 
+ 	return 0;
+ }
+ 
+ static void atmel_hlcdc_pwm_remove(struct platform_device *pdev)
+ {
+-	struct atmel_hlcdc_pwm *chip = platform_get_drvdata(pdev);
++	struct atmel_hlcdc_pwm *atmel = platform_get_drvdata(pdev);
+ 
+-	pwmchip_remove(&chip->chip);
++	pwmchip_remove(&atmel->chip);
+ 
+-	clk_disable_unprepare(chip->hlcdc->periph_clk);
++	clk_disable_unprepare(atmel->hlcdc->periph_clk);
+ }
+ 
+ static const struct of_device_id atmel_hlcdc_pwm_dt_ids[] = {
+-- 
+2.43.0
+
diff --git a/queue-5.15/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch b/queue-5.15/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
new file mode 100644
index 00000000000..239afff379b
--- /dev/null
+++ b/queue-5.15/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
@@ -0,0 +1,62 @@
+From 956fb499a3c10cbc55fda9150f2e37228ad4c90c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Feb 2024 22:20:43 +0100
+Subject: pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 5f623835584f1c8d1030666796f40c47a448ce0b ]
+
+The driver only used the number of pwm channels to set the pwm_chip's
+npwm member. The result is that if there are more capture channels than
+PWM channels specified in the device tree, only a part of the capture
+channel is usable. Fix that by passing the bigger channel count to the
+pwm framework. This makes it possible that the .apply() callback is
+called with .hwpwm >= pwm_num_devs, catch that case and return an error
+code.
+
+Fixes: c97267ae831d ("pwm: sti: Add PWM capture callback")
+Link: https://lore.kernel.org/r/20240204212043.2951852-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-sti.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c
+index 652fdb8dc7bfa..0a7920cbd4949 100644
+--- a/drivers/pwm/pwm-sti.c
++++ b/drivers/pwm/pwm-sti.c
+@@ -395,8 +395,17 @@ static int sti_pwm_capture(struct pwm_chip *chip, struct pwm_device *pwm,
+ static int sti_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 			 const struct pwm_state *state)
+ {
++	struct sti_pwm_chip *pc = to_sti_pwmchip(chip);
++	struct sti_pwm_compat_data *cdata = pc->cdata;
++	struct device *dev = pc->dev;
+ 	int err;
+ 
++	if (pwm->hwpwm >= cdata->pwm_num_devs) {
++		dev_err(dev, "device %u is not valid for pwm mode\n",
++			pwm->hwpwm);
++		return -EINVAL;
++	}
++
+ 	if (state->polarity != PWM_POLARITY_NORMAL)
+ 		return -EINVAL;
+ 
+@@ -647,7 +656,7 @@ static int sti_pwm_probe(struct platform_device *pdev)
+ 
+ 	pc->chip.dev = dev;
+ 	pc->chip.ops = &sti_pwm_ops;
+-	pc->chip.npwm = pc->cdata->pwm_num_devs;
++	pc->chip.npwm = max(cdata->pwm_num_devs, cdata->cpt_num_devs);
+ 
+ 	for (i = 0; i < cdata->cpt_num_devs; i++) {
+ 		struct sti_cpt_ddata *ddata = &cdata->ddata[i];
+-- 
+2.43.0
+
diff --git a/queue-5.15/pwm-sti-implement-.apply-callback.patch b/queue-5.15/pwm-sti-implement-.apply-callback.patch
new file mode 100644
index 00000000000..ef089d56518
--- /dev/null
+++ b/queue-5.15/pwm-sti-implement-.apply-callback.patch
@@ -0,0 +1,71 @@
+From 6e4629e277009480ff98aed2ceef0c3e29662169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 May 2022 16:09:52 +0200
+Subject: pwm: sti: Implement .apply() callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit b2e60b32b4fe5da4cf7fedd976416b5f47f62332 ]
+
+To eventually get rid of all legacy drivers convert this driver to the
+modern world implementing .apply().
+This just pushed a variant of pwm_apply_legacy() into the driver that was
+slightly simplified because the driver doesn't provide a .set_polarity()
+callback.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 5f623835584f ("pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-sti.c | 29 ++++++++++++++++++++++++++---
+ 1 file changed, 26 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c
+index f8a3f30e54dd5..652fdb8dc7bfa 100644
+--- a/drivers/pwm/pwm-sti.c
++++ b/drivers/pwm/pwm-sti.c
+@@ -392,11 +392,34 @@ static int sti_pwm_capture(struct pwm_chip *chip, struct pwm_device *pwm,
+ 	return ret;
+ }
+ 
++static int sti_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
++			 const struct pwm_state *state)
++{
++	int err;
++
++	if (state->polarity != PWM_POLARITY_NORMAL)
++		return -EINVAL;
++
++	if (!state->enabled) {
++		if (pwm->state.enabled)
++			sti_pwm_disable(chip, pwm);
++
++		return 0;
++	}
++
++	err = sti_pwm_config(pwm->chip, pwm, state->duty_cycle, state->period);
++	if (err)
++		return err;
++
++	if (!pwm->state.enabled)
++		err = sti_pwm_enable(chip, pwm);
++
++	return err;
++}
++
+ static const struct pwm_ops sti_pwm_ops = {
+ 	.capture = sti_pwm_capture,
+-	.config = sti_pwm_config,
+-	.enable = sti_pwm_enable,
+-	.disable = sti_pwm_disable,
++	.apply = sti_pwm_apply,
+ 	.free = sti_pwm_free,
+ 	.owner = THIS_MODULE,
+ };
+-- 
+2.43.0
+
diff --git a/queue-5.15/quota-fix-potential-null-pointer-dereference.patch b/queue-5.15/quota-fix-potential-null-pointer-dereference.patch
new file mode 100644
index 00000000000..4aeb434aaf5
--- /dev/null
+++ b/queue-5.15/quota-fix-potential-null-pointer-dereference.patch
@@ -0,0 +1,278 @@
+From 923720cbb91cc832e5c33106ed01502ba2fb626d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 16:18:52 +0800
+Subject: quota: Fix potential NULL pointer dereference
+
+From: Wang Jianjian <wangjianjian3@huawei.com>
+
+[ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ]
+
+Below race may cause NULL pointer dereference
+
+P1					P2
+dquot_free_inode			quota_off
+					  drop_dquot_ref
+					   remove_dquot_ref
+					   dquots = i_dquot(inode)
+  dquots = i_dquot(inode)
+  srcu_read_lock
+  dquots[cnt]) != NULL (1)
+					     dquots[type] = NULL (2)
+  spin_lock(&dquots[cnt]->dq_dqb_lock) (3)
+   ....
+
+If dquot_free_inode(or other routines) checks inode's quota pointers (1)
+before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer
+dereference will be triggered.
+
+So let's fix it by using a temporary pointer to avoid this issue.
+
+Signed-off-by: Wang Jianjian <wangjianjian3@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20240202081852.2514092-1-wangjianjian3@huawei.com>
+Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 57 insertions(+), 41 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index b7d8cd84df576..041459526abcf 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot)
+ EXPORT_SYMBOL(dquot_mark_dquot_dirty);
+ 
+ /* Dirtify all the dquots - this can block when journalling */
+-static inline int mark_all_dquot_dirty(struct dquot * const *dquot)
++static inline int mark_all_dquot_dirty(struct dquot * const *dquots)
+ {
+ 	int ret, err, cnt;
++	struct dquot *dquot;
+ 
+ 	ret = err = 0;
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (dquot[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (dquot)
+ 			/* Even in case of error we have to continue */
+-			ret = mark_dquot_dirty(dquot[cnt]);
++			ret = mark_dquot_dirty(dquot);
+ 		if (!err)
+ 			err = ret;
+ 	}
+@@ -1684,6 +1686,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	int reserve = flags & DQUOT_SPACE_RESERVE;
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode)) {
+ 		if (reserve) {
+@@ -1703,27 +1706,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ 	index = srcu_read_lock(&dquot_srcu);
+ 	spin_lock(&inode->i_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+ 		if (reserve) {
+-			ret = dquot_add_space(dquots[cnt], 0, number, flags,
+-					      &warn[cnt]);
++			ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]);
+ 		} else {
+-			ret = dquot_add_space(dquots[cnt], number, 0, flags,
+-					      &warn[cnt]);
++			ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]);
+ 		}
+ 		if (ret) {
+ 			/* Back out changes we already did */
+ 			for (cnt--; cnt >= 0; cnt--) {
+-				if (!dquots[cnt])
++				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++				if (!dquot)
+ 					continue;
+-				spin_lock(&dquots[cnt]->dq_dqb_lock);
++				spin_lock(&dquot->dq_dqb_lock);
+ 				if (reserve)
+-					dquot_free_reserved_space(dquots[cnt],
+-								  number);
++					dquot_free_reserved_space(dquot, number);
+ 				else
+-					dquot_decr_space(dquots[cnt], number);
+-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
++					dquot_decr_space(dquot, number);
++				spin_unlock(&dquot->dq_dqb_lock);
+ 			}
+ 			spin_unlock(&inode->i_lock);
+ 			goto out_flush_warn;
+@@ -1754,6 +1756,7 @@ int dquot_alloc_inode(struct inode *inode)
+ 	int cnt, ret = 0, index;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	struct dquot * const *dquots;
++	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode))
+ 		return 0;
+@@ -1764,17 +1767,19 @@ int dquot_alloc_inode(struct inode *inode)
+ 	index = srcu_read_lock(&dquot_srcu);
+ 	spin_lock(&inode->i_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+-		ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]);
++		ret = dquot_add_inodes(dquot, 1, &warn[cnt]);
+ 		if (ret) {
+ 			for (cnt--; cnt >= 0; cnt--) {
+-				if (!dquots[cnt])
++				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++				if (!dquot)
+ 					continue;
+ 				/* Back out changes we already did */
+-				spin_lock(&dquots[cnt]->dq_dqb_lock);
+-				dquot_decr_inodes(dquots[cnt], 1);
+-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
++				spin_lock(&dquot->dq_dqb_lock);
++				dquot_decr_inodes(dquot, 1);
++				spin_unlock(&dquot->dq_dqb_lock);
+ 			}
+ 			goto warn_put_all;
+ 		}
+@@ -1796,6 +1801,7 @@ EXPORT_SYMBOL(dquot_alloc_inode);
+ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 	int cnt, index;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1811,9 +1817,8 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ 	spin_lock(&inode->i_lock);
+ 	/* Claim reserved quotas to allocated quotas */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (dquots[cnt]) {
+-			struct dquot *dquot = dquots[cnt];
+-
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (dquot) {
+ 			spin_lock(&dquot->dq_dqb_lock);
+ 			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number))
+ 				number = dquot->dq_dqb.dqb_rsvspace;
+@@ -1838,6 +1843,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty);
+ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 	int cnt, index;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1853,9 +1859,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ 	spin_lock(&inode->i_lock);
+ 	/* Claim reserved quotas to allocated quotas */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (dquots[cnt]) {
+-			struct dquot *dquot = dquots[cnt];
+-
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (dquot) {
+ 			spin_lock(&dquot->dq_dqb_lock);
+ 			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number))
+ 				number = dquot->dq_dqb.dqb_curspace;
+@@ -1882,6 +1887,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 	int reserve = flags & DQUOT_SPACE_RESERVE, index;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1902,17 +1908,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ 		int wtype;
+ 
+ 		warn[cnt].w_type = QUOTA_NL_NOWARN;
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+-		spin_lock(&dquots[cnt]->dq_dqb_lock);
+-		wtype = info_bdq_free(dquots[cnt], number);
++		spin_lock(&dquot->dq_dqb_lock);
++		wtype = info_bdq_free(dquot, number);
+ 		if (wtype != QUOTA_NL_NOWARN)
+-			prepare_warning(&warn[cnt], dquots[cnt], wtype);
++			prepare_warning(&warn[cnt], dquot, wtype);
+ 		if (reserve)
+-			dquot_free_reserved_space(dquots[cnt], number);
++			dquot_free_reserved_space(dquot, number);
+ 		else
+-			dquot_decr_space(dquots[cnt], number);
+-		spin_unlock(&dquots[cnt]->dq_dqb_lock);
++			dquot_decr_space(dquot, number);
++		spin_unlock(&dquot->dq_dqb_lock);
+ 	}
+ 	if (reserve)
+ 		*inode_reserved_space(inode) -= number;
+@@ -1937,6 +1944,7 @@ void dquot_free_inode(struct inode *inode)
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	struct dquot * const *dquots;
++	struct dquot *dquot;
+ 	int index;
+ 
+ 	if (!inode_quota_active(inode))
+@@ -1947,16 +1955,16 @@ void dquot_free_inode(struct inode *inode)
+ 	spin_lock(&inode->i_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+ 		int wtype;
+-
+ 		warn[cnt].w_type = QUOTA_NL_NOWARN;
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+-		spin_lock(&dquots[cnt]->dq_dqb_lock);
+-		wtype = info_idq_free(dquots[cnt], 1);
++		spin_lock(&dquot->dq_dqb_lock);
++		wtype = info_idq_free(dquot, 1);
+ 		if (wtype != QUOTA_NL_NOWARN)
+-			prepare_warning(&warn[cnt], dquots[cnt], wtype);
+-		dquot_decr_inodes(dquots[cnt], 1);
+-		spin_unlock(&dquots[cnt]->dq_dqb_lock);
++			prepare_warning(&warn[cnt], dquot, wtype);
++		dquot_decr_inodes(dquot, 1);
++		spin_unlock(&dquot->dq_dqb_lock);
+ 	}
+ 	spin_unlock(&inode->i_lock);
+ 	mark_all_dquot_dirty(dquots);
+@@ -1983,7 +1991,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	qsize_t rsv_space = 0;
+ 	qsize_t inode_usage = 1;
+ 	struct dquot *transfer_from[MAXQUOTAS] = {};
+-	int cnt, ret = 0;
++	int cnt, index, ret = 0;
+ 	char is_valid[MAXQUOTAS] = {};
+ 	struct dquot_warn warn_to[MAXQUOTAS];
+ 	struct dquot_warn warn_from_inodes[MAXQUOTAS];
+@@ -2072,8 +2080,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	spin_unlock(&inode->i_lock);
+ 	spin_unlock(&dq_data_lock);
+ 
++	/*
++	 * These arrays are local and we hold dquot references so we don't need
++	 * the srcu protection but still take dquot_srcu to avoid warning in
++	 * mark_all_dquot_dirty().
++	 */
++	index = srcu_read_lock(&dquot_srcu);
+ 	mark_all_dquot_dirty(transfer_from);
+ 	mark_all_dquot_dirty(transfer_to);
++	srcu_read_unlock(&dquot_srcu, index);
++
+ 	flush_warnings(warn_to);
+ 	flush_warnings(warn_from_inodes);
+ 	flush_warnings(warn_from_space);
+-- 
+2.43.0
+
diff --git a/queue-5.15/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch b/queue-5.15/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
new file mode 100644
index 00000000000..f4477c696f3
--- /dev/null
+++ b/queue-5.15/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
@@ -0,0 +1,253 @@
+From d03c6063f60f9b6cf336a14d401344d55e9b28e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 15:32:09 +0100
+Subject: quota: Fix rcu annotations of inode dquot pointers
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 179b8c97ebf63429589f5afeba59a181fe70603e ]
+
+Dquot pointers in i_dquot array in the inode are protected by
+dquot_srcu. Annotate the array pointers with __rcu, perform the locked
+dereferences with srcu_dereference_check() instead of plain reads, and
+set the array elements with rcu_assign_pointer().
+
+Fixes: b9ba6f94b238 ("quota: remove dqptr_sem")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402061900.rTuYDlo6-lkp@intel.com/
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 66 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 39 insertions(+), 27 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 041459526abcf..edb414d3fd164 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -399,7 +399,7 @@ int dquot_mark_dquot_dirty(struct dquot *dquot)
+ EXPORT_SYMBOL(dquot_mark_dquot_dirty);
+ 
+ /* Dirtify all the dquots - this can block when journalling */
+-static inline int mark_all_dquot_dirty(struct dquot * const *dquots)
++static inline int mark_all_dquot_dirty(struct dquot __rcu * const *dquots)
+ {
+ 	int ret, err, cnt;
+ 	struct dquot *dquot;
+@@ -1006,14 +1006,15 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)
+ }
+ EXPORT_SYMBOL(dqget);
+ 
+-static inline struct dquot **i_dquot(struct inode *inode)
++static inline struct dquot __rcu **i_dquot(struct inode *inode)
+ {
+-	return inode->i_sb->s_op->get_dquots(inode);
++	/* Force __rcu for now until filesystems are fixed */
++	return (struct dquot __rcu **)inode->i_sb->s_op->get_dquots(inode);
+ }
+ 
+ static int dqinit_needed(struct inode *inode, int type)
+ {
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	int cnt;
+ 
+ 	if (IS_NOQUOTA(inode))
+@@ -1103,14 +1104,16 @@ static void remove_dquot_ref(struct super_block *sb, int type)
+ 		 */
+ 		spin_lock(&dq_data_lock);
+ 		if (!IS_NOQUOTA(inode)) {
+-			struct dquot **dquots = i_dquot(inode);
+-			struct dquot *dquot = dquots[type];
++			struct dquot __rcu **dquots = i_dquot(inode);
++			struct dquot *dquot = srcu_dereference_check(
++				dquots[type], &dquot_srcu,
++				lockdep_is_held(&dq_data_lock));
+ 
+ #ifdef CONFIG_QUOTA_DEBUG
+ 			if (unlikely(inode_get_rsv_space(inode) > 0))
+ 				reserved = 1;
+ #endif
+-			dquots[type] = NULL;
++			rcu_assign_pointer(dquots[type], NULL);
+ 			if (dquot)
+ 				dqput(dquot);
+ 		}
+@@ -1463,7 +1466,8 @@ static int inode_quota_active(const struct inode *inode)
+ static int __dquot_initialize(struct inode *inode, int type)
+ {
+ 	int cnt, init_needed = 0;
+-	struct dquot **dquots, *got[MAXQUOTAS] = {};
++	struct dquot __rcu **dquots;
++	struct dquot *got[MAXQUOTAS] = {};
+ 	struct super_block *sb = inode->i_sb;
+ 	qsize_t rsv;
+ 	int ret = 0;
+@@ -1538,7 +1542,7 @@ static int __dquot_initialize(struct inode *inode, int type)
+ 		if (!got[cnt])
+ 			continue;
+ 		if (!dquots[cnt]) {
+-			dquots[cnt] = got[cnt];
++			rcu_assign_pointer(dquots[cnt], got[cnt]);
+ 			got[cnt] = NULL;
+ 			/*
+ 			 * Make quota reservation system happy if someone
+@@ -1546,12 +1550,16 @@ static int __dquot_initialize(struct inode *inode, int type)
+ 			 */
+ 			rsv = inode_get_rsv_space(inode);
+ 			if (unlikely(rsv)) {
++				struct dquot *dquot = srcu_dereference_check(
++					dquots[cnt], &dquot_srcu,
++					lockdep_is_held(&dq_data_lock));
++
+ 				spin_lock(&inode->i_lock);
+ 				/* Get reservation again under proper lock */
+ 				rsv = __inode_get_rsv_space(inode);
+-				spin_lock(&dquots[cnt]->dq_dqb_lock);
+-				dquots[cnt]->dq_dqb.dqb_rsvspace += rsv;
+-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
++				spin_lock(&dquot->dq_dqb_lock);
++				dquot->dq_dqb.dqb_rsvspace += rsv;
++				spin_unlock(&dquot->dq_dqb_lock);
+ 				spin_unlock(&inode->i_lock);
+ 			}
+ 		}
+@@ -1573,7 +1581,7 @@ EXPORT_SYMBOL(dquot_initialize);
+ 
+ bool dquot_initialize_needed(struct inode *inode)
+ {
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	int i;
+ 
+ 	if (!inode_quota_active(inode))
+@@ -1598,13 +1606,14 @@ EXPORT_SYMBOL(dquot_initialize_needed);
+ static void __dquot_drop(struct inode *inode)
+ {
+ 	int cnt;
+-	struct dquot **dquots = i_dquot(inode);
++	struct dquot __rcu **dquots = i_dquot(inode);
+ 	struct dquot *put[MAXQUOTAS];
+ 
+ 	spin_lock(&dq_data_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		put[cnt] = dquots[cnt];
+-		dquots[cnt] = NULL;
++		put[cnt] = srcu_dereference_check(dquots[cnt], &dquot_srcu,
++					lockdep_is_held(&dq_data_lock));
++		rcu_assign_pointer(dquots[cnt], NULL);
+ 	}
+ 	spin_unlock(&dq_data_lock);
+ 	dqput_all(put);
+@@ -1612,7 +1621,7 @@ static void __dquot_drop(struct inode *inode)
+ 
+ void dquot_drop(struct inode *inode)
+ {
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	int cnt;
+ 
+ 	if (IS_NOQUOTA(inode))
+@@ -1685,7 +1694,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ 	int cnt, ret = 0, index;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	int reserve = flags & DQUOT_SPACE_RESERVE;
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1755,7 +1764,7 @@ int dquot_alloc_inode(struct inode *inode)
+ {
+ 	int cnt, ret = 0, index;
+ 	struct dquot_warn warn[MAXQUOTAS];
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode))
+@@ -1800,7 +1809,7 @@ EXPORT_SYMBOL(dquot_alloc_inode);
+  */
+ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 	int cnt, index;
+ 
+@@ -1842,7 +1851,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty);
+  */
+ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 	int cnt, index;
+ 
+@@ -1886,7 +1895,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ {
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 	int reserve = flags & DQUOT_SPACE_RESERVE, index;
+ 
+@@ -1943,7 +1952,7 @@ void dquot_free_inode(struct inode *inode)
+ {
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	struct dquot *dquot;
+ 	int index;
+ 
+@@ -1990,6 +1999,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	qsize_t cur_space;
+ 	qsize_t rsv_space = 0;
+ 	qsize_t inode_usage = 1;
++	struct dquot __rcu **dquots;
+ 	struct dquot *transfer_from[MAXQUOTAS] = {};
+ 	int cnt, index, ret = 0;
+ 	char is_valid[MAXQUOTAS] = {};
+@@ -2022,6 +2032,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	}
+ 	cur_space = __inode_get_bytes(inode);
+ 	rsv_space = __inode_get_rsv_space(inode);
++	dquots = i_dquot(inode);
+ 	/*
+ 	 * Build the transfer_from list, check limits, and update usage in
+ 	 * the target structures.
+@@ -2036,7 +2047,8 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 		if (!sb_has_quota_active(inode->i_sb, cnt))
+ 			continue;
+ 		is_valid[cnt] = 1;
+-		transfer_from[cnt] = i_dquot(inode)[cnt];
++		transfer_from[cnt] = srcu_dereference_check(dquots[cnt],
++				&dquot_srcu, lockdep_is_held(&dq_data_lock));
+ 		ret = dquot_add_inodes(transfer_to[cnt], inode_usage,
+ 				       &warn_to[cnt]);
+ 		if (ret)
+@@ -2075,7 +2087,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 						  rsv_space);
+ 			spin_unlock(&transfer_from[cnt]->dq_dqb_lock);
+ 		}
+-		i_dquot(inode)[cnt] = transfer_to[cnt];
++		rcu_assign_pointer(dquots[cnt], transfer_to[cnt]);
+ 	}
+ 	spin_unlock(&inode->i_lock);
+ 	spin_unlock(&dq_data_lock);
+@@ -2086,8 +2098,8 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	 * mark_all_dquot_dirty().
+ 	 */
+ 	index = srcu_read_lock(&dquot_srcu);
+-	mark_all_dquot_dirty(transfer_from);
+-	mark_all_dquot_dirty(transfer_to);
++	mark_all_dquot_dirty((struct dquot __rcu **)transfer_from);
++	mark_all_dquot_dirty((struct dquot __rcu **)transfer_to);
+ 	srcu_read_unlock(&dquot_srcu, index);
+ 
+ 	flush_warnings(warn_to);
+-- 
+2.43.0
+
diff --git a/queue-5.15/quota-simplify-drop_dquot_ref.patch b/queue-5.15/quota-simplify-drop_dquot_ref.patch
new file mode 100644
index 00000000000..3824e1efa86
--- /dev/null
+++ b/queue-5.15/quota-simplify-drop_dquot_ref.patch
@@ -0,0 +1,132 @@
+From a6eb30b3484ae8b18a8f9e290faa89d7b29ce744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Jun 2023 19:08:22 +0800
+Subject: quota: simplify drop_dquot_ref()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 7bce48f0fec602b3b6c335963b26d9eefa417788 ]
+
+As Honza said, remove_inode_dquot_ref() currently does not release the
+last dquot reference but instead adds the dquot to tofree_head list. This
+is because dqput() can sleep while dropping of the last dquot reference
+(writing back the dquot and calling ->release_dquot()) and that must not
+happen under dq_list_lock. Now that dqput() queues the final dquot cleanup
+into a workqueue, remove_inode_dquot_ref() can call dqput() unconditionally
+and we can significantly simplify it.
+
+Here we open code the simplified code of remove_inode_dquot_ref() into
+remove_dquot_ref() and remove the function put_dquot_list() which is no
+longer used.
+
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20230630110822.3881712-6-libaokun1@huawei.com>
+Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 70 +++++++-----------------------------------------
+ 1 file changed, 9 insertions(+), 61 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 75e593b1c03e8..b7d8cd84df576 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1084,59 +1084,7 @@ static int add_dquot_ref(struct super_block *sb, int type)
+ 	return err;
+ }
+ 
+-/*
+- * Remove references to dquots from inode and add dquot to list for freeing
+- * if we have the last reference to dquot
+- */
+-static void remove_inode_dquot_ref(struct inode *inode, int type,
+-				   struct list_head *tofree_head)
+-{
+-	struct dquot **dquots = i_dquot(inode);
+-	struct dquot *dquot = dquots[type];
+-
+-	if (!dquot)
+-		return;
+-
+-	dquots[type] = NULL;
+-	if (list_empty(&dquot->dq_free)) {
+-		/*
+-		 * The inode still has reference to dquot so it can't be in the
+-		 * free list
+-		 */
+-		spin_lock(&dq_list_lock);
+-		list_add(&dquot->dq_free, tofree_head);
+-		spin_unlock(&dq_list_lock);
+-	} else {
+-		/*
+-		 * Dquot is already in a list to put so we won't drop the last
+-		 * reference here.
+-		 */
+-		dqput(dquot);
+-	}
+-}
+-
+-/*
+- * Free list of dquots
+- * Dquots are removed from inodes and no new references can be got so we are
+- * the only ones holding reference
+- */
+-static void put_dquot_list(struct list_head *tofree_head)
+-{
+-	struct list_head *act_head;
+-	struct dquot *dquot;
+-
+-	act_head = tofree_head->next;
+-	while (act_head != tofree_head) {
+-		dquot = list_entry(act_head, struct dquot, dq_free);
+-		act_head = act_head->next;
+-		/* Remove dquot from the list so we won't have problems... */
+-		list_del_init(&dquot->dq_free);
+-		dqput(dquot);
+-	}
+-}
+-
+-static void remove_dquot_ref(struct super_block *sb, int type,
+-		struct list_head *tofree_head)
++static void remove_dquot_ref(struct super_block *sb, int type)
+ {
+ 	struct inode *inode;
+ #ifdef CONFIG_QUOTA_DEBUG
+@@ -1153,11 +1101,16 @@ static void remove_dquot_ref(struct super_block *sb, int type,
+ 		 */
+ 		spin_lock(&dq_data_lock);
+ 		if (!IS_NOQUOTA(inode)) {
++			struct dquot **dquots = i_dquot(inode);
++			struct dquot *dquot = dquots[type];
++
+ #ifdef CONFIG_QUOTA_DEBUG
+ 			if (unlikely(inode_get_rsv_space(inode) > 0))
+ 				reserved = 1;
+ #endif
+-			remove_inode_dquot_ref(inode, type, tofree_head);
++			dquots[type] = NULL;
++			if (dquot)
++				dqput(dquot);
+ 		}
+ 		spin_unlock(&dq_data_lock);
+ 	}
+@@ -1174,13 +1127,8 @@ static void remove_dquot_ref(struct super_block *sb, int type,
+ /* Gather all references from inodes and drop them */
+ static void drop_dquot_ref(struct super_block *sb, int type)
+ {
+-	LIST_HEAD(tofree_head);
+-
+-	if (sb->dq_op) {
+-		remove_dquot_ref(sb, type, &tofree_head);
+-		synchronize_srcu(&dquot_srcu);
+-		put_dquot_list(&tofree_head);
+-	}
++	if (sb->dq_op)
++		remove_dquot_ref(sb, type);
+ }
+ 
+ static inline
+-- 
+2.43.0
+
diff --git a/queue-5.15/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch b/queue-5.15/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
new file mode 100644
index 00000000000..cce74a15de1
--- /dev/null
+++ b/queue-5.15/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
@@ -0,0 +1,133 @@
+From e211bce6a3486d45bf3c59ae0c7b575a589ca311 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 19:53:13 -0800
+Subject: RDMA/device: Fix a race between mad_client and cm_client init
+
+From: Shifeng Li <lishifeng@sangfor.com.cn>
+
+[ Upstream commit 7a8bccd8b29c321ac181369b42b04fecf05f98e2 ]
+
+The mad_client will be initialized in enable_device_and_get(), while the
+devices_rwsem will be downgraded to a read semaphore. There is a window
+that leads to the failed initialization for cm_client, since it can not
+get matched mad port from ib_mad_port_list, and the matched mad port will
+be added to the list after that.
+
+    mad_client    |                       cm_client
+------------------|--------------------------------------------------------
+ib_register_device|
+enable_device_and_get
+down_write(&devices_rwsem)
+xa_set_mark(&devices, DEVICE_REGISTERED)
+downgrade_write(&devices_rwsem)
+                  |
+                  |ib_cm_init
+                  |ib_register_client(&cm_client)
+                  |down_read(&devices_rwsem)
+                  |xa_for_each_marked (&devices, DEVICE_REGISTERED)
+                  |add_client_context
+                  |cm_add_one
+                  |ib_register_mad_agent
+                  |ib_get_mad_port
+                  |__ib_get_mad_port
+                  |list_for_each_entry(entry, &ib_mad_port_list, port_list)
+                  |return NULL
+                  |up_read(&devices_rwsem)
+                  |
+add_client_context|
+ib_mad_init_device|
+ib_mad_port_open  |
+list_add_tail(&port_priv->port_list, &ib_mad_port_list)
+up_read(&devices_rwsem)
+                  |
+
+Fix it by using down_write(&devices_rwsem) in ib_register_client().
+
+Fixes: d0899892edd0 ("RDMA/device: Provide APIs from the core code to help unregistration")
+Link: https://lore.kernel.org/r/20240203035313.98991-1-lishifeng@sangfor.com.cn
+Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
+Signed-off-by: Shifeng Li <lishifeng@sangfor.com.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 37 +++++++++++++++++++-------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 2c2ac63b39c42..725f2719132fb 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1729,7 +1729,7 @@ static int assign_client_id(struct ib_client *client)
+ {
+ 	int ret;
+ 
+-	down_write(&clients_rwsem);
++	lockdep_assert_held(&clients_rwsem);
+ 	/*
+ 	 * The add/remove callbacks must be called in FIFO/LIFO order. To
+ 	 * achieve this we assign client_ids so they are sorted in
+@@ -1738,14 +1738,11 @@ static int assign_client_id(struct ib_client *client)
+ 	client->client_id = highest_client_id;
+ 	ret = xa_insert(&clients, client->client_id, client, GFP_KERNEL);
+ 	if (ret)
+-		goto out;
++		return ret;
+ 
+ 	highest_client_id++;
+ 	xa_set_mark(&clients, client->client_id, CLIENT_REGISTERED);
+-
+-out:
+-	up_write(&clients_rwsem);
+-	return ret;
++	return 0;
+ }
+ 
+ static void remove_client_id(struct ib_client *client)
+@@ -1775,25 +1772,35 @@ int ib_register_client(struct ib_client *client)
+ {
+ 	struct ib_device *device;
+ 	unsigned long index;
++	bool need_unreg = false;
+ 	int ret;
+ 
+ 	refcount_set(&client->uses, 1);
+ 	init_completion(&client->uses_zero);
++
++	/*
++	 * The devices_rwsem is held in write mode to ensure that a racing
++	 * ib_register_device() sees a consisent view of clients and devices.
++	 */
++	down_write(&devices_rwsem);
++	down_write(&clients_rwsem);
+ 	ret = assign_client_id(client);
+ 	if (ret)
+-		return ret;
++		goto out;
+ 
+-	down_read(&devices_rwsem);
++	need_unreg = true;
+ 	xa_for_each_marked (&devices, index, device, DEVICE_REGISTERED) {
+ 		ret = add_client_context(device, client);
+-		if (ret) {
+-			up_read(&devices_rwsem);
+-			ib_unregister_client(client);
+-			return ret;
+-		}
++		if (ret)
++			goto out;
+ 	}
+-	up_read(&devices_rwsem);
+-	return 0;
++	ret = 0;
++out:
++	up_write(&clients_rwsem);
++	up_write(&devices_rwsem);
++	if (need_unreg && ret)
++		ib_unregister_client(client);
++	return ret;
+ }
+ EXPORT_SYMBOL(ib_register_client);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch b/queue-5.15/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
new file mode 100644
index 00000000000..bbb5be9a65f
--- /dev/null
+++ b/queue-5.15/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
@@ -0,0 +1,41 @@
+From 7d005cd158f89cf71d1675565184c36e9e8255cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 11:32:04 +0000
+Subject: RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
+
+From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+
+[ Upstream commit 7a7b7f575a25aa68ee934ee8107294487efcb3fe ]
+
+strnlen() may return 0 (e.g. for "\0\n" string), it's better to
+check the result of strnlen() before using 'len - 1' expression
+for the 'buf' array index.
+
+Detected using the static analysis tool - Svace.
+
+Fixes: dc3b66a0ce70 ("RDMA/rtrs-clt: Add a minimum latency multipath policy")
+Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+Link: https://lore.kernel.org/r/20240221113204.147478-1-aleksei.kodanev@bell-sw.com
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+index dbf9a778c3bd7..583c38eb04326 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+@@ -131,7 +131,7 @@ static ssize_t mpath_policy_store(struct device *dev,
+ 
+ 	/* distinguish "mi" and "min-latency" with length */
+ 	len = strnlen(buf, NAME_MAX);
+-	if (buf[len - 1] == '\n')
++	if (len && buf[len - 1] == '\n')
+ 		len--;
+ 
+ 	if (!strncasecmp(buf, "round-robin", 11) ||
+-- 
+2.43.0
+
diff --git a/queue-5.15/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch b/queue-5.15/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
new file mode 100644
index 00000000000..0d1e8d1e157
--- /dev/null
+++ b/queue-5.15/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
@@ -0,0 +1,61 @@
+From 4941c3c5c0e59dc1759a030857559b734fdea10d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 02:15:49 -0700
+Subject: RDMA/srpt: Do not register event handler until srpt device is fully
+ setup
+
+From: William Kucharski <william.kucharski@oracle.com>
+
+[ Upstream commit c21a8870c98611e8f892511825c9607f1e2cd456 ]
+
+Upon rare occasions, KASAN reports a use-after-free Write
+in srpt_refresh_port().
+
+This seems to be because an event handler is registered before the
+srpt device is fully setup and a race condition upon error may leave a
+partially setup event handler in place.
+
+Instead, only register the event handler after srpt device initialization
+is complete.
+
+Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
+Signed-off-by: William Kucharski <william.kucharski@oracle.com>
+Link: https://lore.kernel.org/r/20240202091549.991784-2-william.kucharski@oracle.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 60f9c612eb3c3..1b44ce0ac991c 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -3209,7 +3209,6 @@ static int srpt_add_one(struct ib_device *device)
+ 
+ 	INIT_IB_EVENT_HANDLER(&sdev->event_handler, sdev->device,
+ 			      srpt_event_handler);
+-	ib_register_event_handler(&sdev->event_handler);
+ 
+ 	for (i = 1; i <= sdev->device->phys_port_cnt; i++) {
+ 		sport = &sdev->port[i - 1];
+@@ -3232,6 +3231,7 @@ static int srpt_add_one(struct ib_device *device)
+ 		}
+ 	}
+ 
++	ib_register_event_handler(&sdev->event_handler);
+ 	spin_lock(&srpt_dev_lock);
+ 	list_add_tail(&sdev->list, &srpt_dev_list);
+ 	spin_unlock(&srpt_dev_lock);
+@@ -3242,7 +3242,6 @@ static int srpt_add_one(struct ib_device *device)
+ 
+ err_port:
+ 	srpt_unregister_mad_agent(sdev, i);
+-	ib_unregister_event_handler(&sdev->event_handler);
+ err_cm:
+ 	if (sdev->cm_id)
+ 		ib_destroy_cm_id(sdev->cm_id);
+-- 
+2.43.0
+
diff --git a/queue-5.15/rtc-test-fix-invalid-format-specifier.patch b/queue-5.15/rtc-test-fix-invalid-format-specifier.patch
new file mode 100644
index 00000000000..cf2392473c2
--- /dev/null
+++ b/queue-5.15/rtc-test-fix-invalid-format-specifier.patch
@@ -0,0 +1,41 @@
+From 83e402fe10a6da0d73816184cba785968e04cc5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:18 +0800
+Subject: rtc: test: Fix invalid format specifier.
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 8a904a3caa88118744062e872ae90f37748a8fd8 ]
+
+'days' is a s64 (from div_s64), and so should use a %lld specifier.
+
+This was found by extending KUnit's assertion macros to use gcc's
+__printf attribute.
+
+Fixes: 1d1bb12a8b18 ("rtc: Improve performance of rtc_time64_to_tm(). Add tests.")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/lib_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/lib_test.c b/drivers/rtc/lib_test.c
+index d5caf36c56cdc..225c859d6da55 100644
+--- a/drivers/rtc/lib_test.c
++++ b/drivers/rtc/lib_test.c
+@@ -54,7 +54,7 @@ static void rtc_time64_to_tm_test_date_range(struct kunit *test)
+ 
+ 		days = div_s64(secs, 86400);
+ 
+-		#define FAIL_MSG "%d/%02d/%02d (%2d) : %ld", \
++		#define FAIL_MSG "%d/%02d/%02d (%2d) : %lld", \
+ 			year, month, mday, yday, days
+ 
+ 		KUNIT_ASSERT_EQ_MSG(test, year - 1900, result.tm_year, FAIL_MSG);
+-- 
+2.43.0
+
diff --git a/queue-5.15/s390-dasd-add-autoquiesce-feature.patch b/queue-5.15/s390-dasd-add-autoquiesce-feature.patch
new file mode 100644
index 00000000000..78321fcde37
--- /dev/null
+++ b/queue-5.15/s390-dasd-add-autoquiesce-feature.patch
@@ -0,0 +1,216 @@
+From 40cad1f73a869e656e202bf108c6e1a36112536e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 16:20:12 +0200
+Subject: s390/dasd: add autoquiesce feature
+
+From: Stefan Haberland <sth@linux.ibm.com>
+
+[ Upstream commit 1cee2975bbabd89df1097c354867192106b058ea ]
+
+Add the internal logic to check for autoquiesce triggers and handle
+them.
+
+Quiesce and resume are functions that tell Linux to stop/resume
+issuing I/Os to a specific DASD.
+The DASD driver allows a manual quiesce/resume via ioctl.
+
+Autoquiesce will define an amount of triggers that will lead to
+an automatic quiesce if a certain event occurs.
+There is no automatic resume.
+
+All events will be reported via DASD Extended Error Reporting (EER)
+if configured.
+
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
+Link: https://lore.kernel.org/r/20230405142017.2446986-3-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: c3116e62ddef ("s390/dasd: fix double module refcount decrement")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/uapi/asm/dasd.h |  2 ++
+ drivers/s390/block/dasd.c         | 60 ++++++++++++++++++++++---------
+ drivers/s390/block/dasd_eer.c     |  1 +
+ drivers/s390/block/dasd_int.h     |  2 ++
+ 4 files changed, 48 insertions(+), 17 deletions(-)
+
+diff --git a/arch/s390/include/uapi/asm/dasd.h b/arch/s390/include/uapi/asm/dasd.h
+index 9ec86fae99805..188d17fc5f0c1 100644
+--- a/arch/s390/include/uapi/asm/dasd.h
++++ b/arch/s390/include/uapi/asm/dasd.h
+@@ -78,6 +78,7 @@ typedef struct dasd_information2_t {
+  * 0x040: give access to raw eckd data
+  * 0x080: enable discard support
+  * 0x100: enable autodisable for IFCC errors (default)
++ * 0x200: enable requeue of all requests on autoquiesce
+  */
+ #define DASD_FEATURE_READONLY	      0x001
+ #define DASD_FEATURE_USEDIAG	      0x002
+@@ -88,6 +89,7 @@ typedef struct dasd_information2_t {
+ #define DASD_FEATURE_USERAW	      0x040
+ #define DASD_FEATURE_DISCARD	      0x080
+ #define DASD_FEATURE_PATH_AUTODISABLE 0x100
++#define DASD_FEATURE_REQUEUEQUIESCE   0x200
+ #define DASD_FEATURE_DEFAULT	      DASD_FEATURE_PATH_AUTODISABLE
+ 
+ #define DASD_PARTN_BITS 2
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index dc73b20e7424f..c45b6f3780ebd 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -84,7 +84,8 @@ static void dasd_profile_init(struct dasd_profile *, struct dentry *);
+ static void dasd_profile_exit(struct dasd_profile *);
+ static void dasd_hosts_init(struct dentry *, struct dasd_device *);
+ static void dasd_hosts_exit(struct dasd_device *);
+-
++static int dasd_handle_autoquiesce(struct dasd_device *, struct dasd_ccw_req *,
++				   unsigned int);
+ /*
+  * SECTION: Operations on the device structure.
+  */
+@@ -2349,7 +2350,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
+ 		/* Non-temporary stop condition will trigger fail fast */
+ 		if (device->stopped & ~DASD_STOPPED_PENDING &&
+ 		    test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
+-		    (!dasd_eer_enabled(device))) {
++		    !dasd_eer_enabled(device) && device->aq_mask == 0) {
+ 			cqr->status = DASD_CQR_FAILED;
+ 			cqr->intrc = -ENOLINK;
+ 			continue;
+@@ -2825,20 +2826,18 @@ static void __dasd_process_block_ccw_queue(struct dasd_block *block,
+ 			dasd_log_sense(cqr, &cqr->irb);
+ 		}
+ 
+-		/* First of all call extended error reporting. */
+-		if (dasd_eer_enabled(base) &&
+-		    cqr->status == DASD_CQR_FAILED) {
+-			dasd_eer_write(base, cqr, DASD_EER_FATALERROR);
+-
+-			/* restart request  */
++		/*
++		 * First call extended error reporting and check for autoquiesce
++		 */
++		spin_lock_irqsave(get_ccwdev_lock(base->cdev), flags);
++		if (cqr->status == DASD_CQR_FAILED &&
++		    dasd_handle_autoquiesce(base, cqr, DASD_EER_FATALERROR)) {
+ 			cqr->status = DASD_CQR_FILLED;
+ 			cqr->retries = 255;
+-			spin_lock_irqsave(get_ccwdev_lock(base->cdev), flags);
+-			dasd_device_set_stop_bits(base, DASD_STOPPED_QUIESCE);
+-			spin_unlock_irqrestore(get_ccwdev_lock(base->cdev),
+-					       flags);
++			spin_unlock_irqrestore(get_ccwdev_lock(base->cdev), flags);
+ 			goto restart;
+ 		}
++		spin_unlock_irqrestore(get_ccwdev_lock(base->cdev), flags);
+ 
+ 		/* Process finished ERP request. */
+ 		if (cqr->refers) {
+@@ -2880,7 +2879,7 @@ static void __dasd_block_start_head(struct dasd_block *block)
+ 		/* Non-temporary stop condition will trigger fail fast */
+ 		if (block->base->stopped & ~DASD_STOPPED_PENDING &&
+ 		    test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
+-		    (!dasd_eer_enabled(block->base))) {
++		    !dasd_eer_enabled(block->base) && block->base->aq_mask == 0) {
+ 			cqr->status = DASD_CQR_FAILED;
+ 			cqr->intrc = -ENOLINK;
+ 			dasd_schedule_block_bh(block);
+@@ -3743,8 +3742,8 @@ int dasd_generic_last_path_gone(struct dasd_device *device)
+ 	dev_warn(&device->cdev->dev, "No operational channel path is left "
+ 		 "for the device\n");
+ 	DBF_DEV_EVENT(DBF_WARNING, device, "%s", "last path gone");
+-	/* First of all call extended error reporting. */
+-	dasd_eer_write(device, NULL, DASD_EER_NOPATH);
++	/* First call extended error reporting and check for autoquiesce. */
++	dasd_handle_autoquiesce(device, NULL, DASD_EER_NOPATH);
+ 
+ 	if (device->state < DASD_STATE_BASIC)
+ 		return 0;
+@@ -3877,7 +3876,8 @@ void dasd_generic_path_event(struct ccw_device *cdev, int *path_event)
+ 			 "No verified channel paths remain for the device\n");
+ 		DBF_DEV_EVENT(DBF_WARNING, device,
+ 			      "%s", "last verified path gone");
+-		dasd_eer_write(device, NULL, DASD_EER_NOPATH);
++		/* First call extended error reporting and check for autoquiesce. */
++		dasd_handle_autoquiesce(device, NULL, DASD_EER_NOPATH);
+ 		dasd_device_set_stop_bits(device,
+ 					  DASD_STOPPED_DC_WAIT);
+ 	}
+@@ -3899,7 +3899,8 @@ EXPORT_SYMBOL_GPL(dasd_generic_verify_path);
+ void dasd_generic_space_exhaust(struct dasd_device *device,
+ 				struct dasd_ccw_req *cqr)
+ {
+-	dasd_eer_write(device, NULL, DASD_EER_NOSPC);
++	/* First call extended error reporting and check for autoquiesce. */
++	dasd_handle_autoquiesce(device, NULL, DASD_EER_NOSPC);
+ 
+ 	if (device->state < DASD_STATE_BASIC)
+ 		return;
+@@ -3992,6 +3993,31 @@ void dasd_schedule_requeue(struct dasd_device *device)
+ }
+ EXPORT_SYMBOL(dasd_schedule_requeue);
+ 
++static int dasd_handle_autoquiesce(struct dasd_device *device,
++				   struct dasd_ccw_req *cqr,
++				   unsigned int reason)
++{
++	/* in any case write eer message with reason */
++	if (dasd_eer_enabled(device))
++		dasd_eer_write(device, cqr, reason);
++
++	if (!test_bit(reason, &device->aq_mask))
++		return 0;
++
++	/* notify eer about autoquiesce */
++	if (dasd_eer_enabled(device))
++		dasd_eer_write(device, NULL, DASD_EER_AUTOQUIESCE);
++
++	pr_info("%s: The DASD has been put in the quiesce state\n",
++		dev_name(&device->cdev->dev));
++	dasd_device_set_stop_bits(device, DASD_STOPPED_QUIESCE);
++
++	if (device->features & DASD_FEATURE_REQUEUEQUIESCE)
++		dasd_schedule_requeue(device);
++
++	return 1;
++}
++
+ static struct dasd_ccw_req *dasd_generic_build_rdc(struct dasd_device *device,
+ 						   int rdc_buffer_size,
+ 						   int magic)
+diff --git a/drivers/s390/block/dasd_eer.c b/drivers/s390/block/dasd_eer.c
+index 5ae64af9ccea3..22338033e6bfb 100644
+--- a/drivers/s390/block/dasd_eer.c
++++ b/drivers/s390/block/dasd_eer.c
+@@ -387,6 +387,7 @@ void dasd_eer_write(struct dasd_device *device, struct dasd_ccw_req *cqr,
+ 		break;
+ 	case DASD_EER_NOPATH:
+ 	case DASD_EER_NOSPC:
++	case DASD_EER_AUTOQUIESCE:
+ 		dasd_eer_write_standard_trigger(device, NULL, id);
+ 		break;
+ 	case DASD_EER_STATECHANGE:
+diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
+index d743d1d2b38e9..744e14a81cc48 100644
+--- a/drivers/s390/block/dasd_int.h
++++ b/drivers/s390/block/dasd_int.h
+@@ -459,6 +459,7 @@ extern struct dasd_discipline *dasd_diag_discipline_pointer;
+ #define DASD_EER_STATECHANGE 3
+ #define DASD_EER_PPRCSUSPEND 4
+ #define DASD_EER_NOSPC	     5
++#define DASD_EER_AUTOQUIESCE 31
+ 
+ /* DASD path handling */
+ 
+@@ -636,6 +637,7 @@ struct dasd_device {
+ 	struct dasd_format_entry format_entry;
+ 	struct kset *paths_info;
+ 	struct dasd_copy_relation *copy;
++	unsigned long aq_mask;
+ };
+ 
+ struct dasd_block {
+-- 
+2.43.0
+
diff --git a/queue-5.15/s390-dasd-add-copy-pair-setup.patch b/queue-5.15/s390-dasd-add-copy-pair-setup.patch
new file mode 100644
index 00000000000..300eb9566fa
--- /dev/null
+++ b/queue-5.15/s390-dasd-add-copy-pair-setup.patch
@@ -0,0 +1,858 @@
+From 12057b646658020aa9a227fb38f89b4721636e6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 21:26:12 +0200
+Subject: s390/dasd: add copy pair setup
+
+From: Stefan Haberland <sth@linux.ibm.com>
+
+[ Upstream commit a91ff09d39f9b6545254839ac91f1ff7bd21d39e ]
+
+A copy relation that is configured on the storage server side needs to be
+enabled separately in the device driver. A sysfs interface is created
+that allows userspace tooling to control such setup.
+
+The following sysfs entries are added to store and read copy relation
+information:
+
+copy_pair
+    - Add/Delete a copy pair relation to the DASD device driver
+    - Query all previously added copy pair relations
+copy_role
+    - Query the copy pair role of the device
+
+To add a copy pair to the DASD device driver it has to be specified
+through the sysfs attribute copy_pair. Only one secondary device can be
+specified at a time together with the primary device. Both, secondary
+and primary can be used equally to define the copy pair.
+The secondary devices have to be offline when adding the copy relation.
+The primary device needs to be specified first followed by the comma
+separated secondary device.
+Read from the copy_pair attribute to get the current setup and write
+"clear" to the attribute to delete any existing setup.
+
+Example:
+$ echo 0.0.9700,0.0.9740 > /sys/bus/ccw/devices/0.0.9700/copy_pair
+$ cat /sys/bus/ccw/devices/0.0.9700/copy_pair
+0.0.9700,0.0.9740
+
+During device online processing the required data will be read from the
+storage server and the information will be compared to the setup
+requested through the copy_pair attribute. The registration of the
+primary and secondary device will be handled accordingly.
+A blockdevice is only allocated for copy relation primary devices.
+
+To query the copy role of a device read from the copy_role sysfs
+attribute. Possible values are primary, secondary, and none.
+
+Example:
+$ cat /sys/bus/ccw/devices/0.0.9700/copy_role
+primary
+
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220920192616.808070-4-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: c3116e62ddef ("s390/dasd: fix double module refcount decrement")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd_devmap.c | 566 ++++++++++++++++++++++++++++++-
+ drivers/s390/block/dasd_eckd.c   |  52 ++-
+ drivers/s390/block/dasd_eckd.h   |   2 +-
+ drivers/s390/block/dasd_int.h    |  20 ++
+ 4 files changed, 623 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
+index 2c40fe15da552..6f9f7a0723128 100644
+--- a/drivers/s390/block/dasd_devmap.c
++++ b/drivers/s390/block/dasd_devmap.c
+@@ -26,7 +26,6 @@
+ 
+ /* This is ugly... */
+ #define PRINTK_HEADER "dasd_devmap:"
+-#define DASD_BUS_ID_SIZE 20
+ #define DASD_MAX_PARAMS 256
+ 
+ #include "dasd_int.h"
+@@ -50,6 +49,7 @@ struct dasd_devmap {
+         unsigned int devindex;
+         unsigned short features;
+ 	struct dasd_device *device;
++	struct dasd_copy_relation *copy;
+ };
+ 
+ /*
+@@ -130,7 +130,7 @@ __setup ("dasd=", dasd_call_setup);
+ /*
+  * Read a device busid/devno from a string.
+  */
+-static int __init dasd_busid(char *str, int *id0, int *id1, int *devno)
++static int dasd_busid(char *str, int *id0, int *id1, int *devno)
+ {
+ 	unsigned int val;
+ 	char *tok;
+@@ -438,16 +438,12 @@ dasd_add_busid(const char *bus_id, int features)
+ 	return devmap;
+ }
+ 
+-/*
+- * Find devmap for device with given bus_id.
+- */
+ static struct dasd_devmap *
+-dasd_find_busid(const char *bus_id)
++dasd_find_busid_locked(const char *bus_id)
+ {
+ 	struct dasd_devmap *devmap, *tmp;
+ 	int hash;
+ 
+-	spin_lock(&dasd_devmap_lock);
+ 	devmap = ERR_PTR(-ENODEV);
+ 	hash = dasd_hash_busid(bus_id);
+ 	list_for_each_entry(tmp, &dasd_hashlists[hash], list) {
+@@ -456,6 +452,19 @@ dasd_find_busid(const char *bus_id)
+ 			break;
+ 		}
+ 	}
++	return devmap;
++}
++
++/*
++ * Find devmap for device with given bus_id.
++ */
++static struct dasd_devmap *
++dasd_find_busid(const char *bus_id)
++{
++	struct dasd_devmap *devmap;
++
++	spin_lock(&dasd_devmap_lock);
++	devmap = dasd_find_busid_locked(bus_id);
+ 	spin_unlock(&dasd_devmap_lock);
+ 	return devmap;
+ }
+@@ -584,6 +593,238 @@ dasd_create_device(struct ccw_device *cdev)
+ 	return device;
+ }
+ 
++/*
++ * allocate a PPRC data structure and call the discipline function to fill
++ */
++static int dasd_devmap_get_pprc_status(struct dasd_device *device,
++				       struct dasd_pprc_data_sc4 **data)
++{
++	struct dasd_pprc_data_sc4 *temp;
++
++	if (!device->discipline || !device->discipline->pprc_status) {
++		dev_warn(&device->cdev->dev, "Unable to query copy relation status\n");
++		return -EOPNOTSUPP;
++	}
++	temp = kzalloc(sizeof(*temp), GFP_KERNEL);
++	if (!temp)
++		return -ENOMEM;
++
++	/* get PPRC information from storage */
++	if (device->discipline->pprc_status(device, temp)) {
++		dev_warn(&device->cdev->dev, "Error during copy relation status query\n");
++		kfree(temp);
++		return -EINVAL;
++	}
++	*data = temp;
++
++	return 0;
++}
++
++/*
++ * find an entry in a PPRC device_info array by a given UID
++ * depending on the primary/secondary state of the device it has to be
++ * matched with the respective fields
++ */
++static int dasd_devmap_entry_from_pprc_data(struct dasd_pprc_data_sc4 *data,
++					    struct dasd_uid uid,
++					    bool primary)
++{
++	int i;
++
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (primary) {
++			if (data->dev_info[i].prim_cu_ssid == uid.ssid &&
++			    data->dev_info[i].primary == uid.real_unit_addr)
++				return i;
++		} else {
++			if (data->dev_info[i].sec_cu_ssid == uid.ssid &&
++			    data->dev_info[i].secondary == uid.real_unit_addr)
++				return i;
++		}
++	}
++	return -1;
++}
++
++/*
++ * check the consistency of a specified copy relation by checking
++ * the following things:
++ *
++ *   - is the given device part of a copy pair setup
++ *   - does the state of the device match the state in the PPRC status data
++ *   - does the device UID match with the UID in the PPRC status data
++ *   - to prevent misrouted IO check if the given device is present in all
++ *     related PPRC status data
++ */
++static int dasd_devmap_check_copy_relation(struct dasd_device *device,
++					   struct dasd_copy_entry *entry,
++					   struct dasd_pprc_data_sc4 *data,
++					   struct dasd_copy_relation *copy)
++{
++	struct dasd_pprc_data_sc4 *tmp_dat;
++	struct dasd_device *tmp_dev;
++	struct dasd_uid uid;
++	int i, j;
++
++	if (!device->discipline || !device->discipline->get_uid ||
++	    device->discipline->get_uid(device, &uid))
++		return 1;
++
++	i = dasd_devmap_entry_from_pprc_data(data, uid, entry->primary);
++	if (i < 0) {
++		dev_warn(&device->cdev->dev, "Device not part of a copy relation\n");
++		return 1;
++	}
++
++	/* double check which role the current device has */
++	if (entry->primary) {
++		if (data->dev_info[i].flags & 0x80) {
++			dev_warn(&device->cdev->dev, "Copy pair secondary is setup as primary\n");
++			return 1;
++		}
++		if (data->dev_info[i].prim_cu_ssid != uid.ssid ||
++		    data->dev_info[i].primary != uid.real_unit_addr) {
++			dev_warn(&device->cdev->dev,
++				 "Primary device %s does not match copy pair status primary device %04x\n",
++				 dev_name(&device->cdev->dev),
++				 data->dev_info[i].prim_cu_ssid |
++				 data->dev_info[i].primary);
++			return 1;
++		}
++	} else {
++		if (!(data->dev_info[i].flags & 0x80)) {
++			dev_warn(&device->cdev->dev, "Copy pair primary is setup as secondary\n");
++			return 1;
++		}
++		if (data->dev_info[i].sec_cu_ssid != uid.ssid ||
++		    data->dev_info[i].secondary != uid.real_unit_addr) {
++			dev_warn(&device->cdev->dev,
++				 "Secondary device %s does not match copy pair status secondary device %04x\n",
++				 dev_name(&device->cdev->dev),
++				 data->dev_info[i].sec_cu_ssid |
++				 data->dev_info[i].secondary);
++			return 1;
++		}
++	}
++
++	/*
++	 * the current device has to be part of the copy relation of all
++	 * entries to prevent misrouted IO to another copy pair
++	 */
++	for (j = 0; j < DASD_CP_ENTRIES; j++) {
++		if (entry == &copy->entry[j])
++			tmp_dev = device;
++		else
++			tmp_dev = copy->entry[j].device;
++
++		if (!tmp_dev)
++			continue;
++
++		if (dasd_devmap_get_pprc_status(tmp_dev, &tmp_dat))
++			return 1;
++
++		if (dasd_devmap_entry_from_pprc_data(tmp_dat, uid, entry->primary) < 0) {
++			dev_warn(&tmp_dev->cdev->dev,
++				 "Copy pair relation does not contain device: %s\n",
++				 dev_name(&device->cdev->dev));
++			kfree(tmp_dat);
++			return 1;
++		}
++		kfree(tmp_dat);
++	}
++	return 0;
++}
++
++/* delete device from copy relation entry */
++static void dasd_devmap_delete_copy_relation_device(struct dasd_device *device)
++{
++	struct dasd_copy_relation *copy;
++	int i;
++
++	if (!device->copy)
++		return;
++
++	copy = device->copy;
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (copy->entry[i].device == device)
++			copy->entry[i].device = NULL;
++	}
++	dasd_put_device(device);
++	device->copy = NULL;
++}
++
++/*
++ * read all required information for a copy relation setup and setup the device
++ * accordingly
++ */
++int dasd_devmap_set_device_copy_relation(struct ccw_device *cdev,
++					 bool pprc_enabled)
++{
++	struct dasd_pprc_data_sc4 *data = NULL;
++	struct dasd_copy_entry *entry = NULL;
++	struct dasd_copy_relation *copy;
++	struct dasd_devmap *devmap;
++	struct dasd_device *device;
++	int i, rc = 0;
++
++	devmap = dasd_devmap_from_cdev(cdev);
++	if (IS_ERR(devmap))
++		return PTR_ERR(devmap);
++
++	device = devmap->device;
++	if (!device)
++		return -ENODEV;
++
++	copy = devmap->copy;
++	/* no copy pair setup for this device */
++	if (!copy)
++		goto out;
++
++	rc = dasd_devmap_get_pprc_status(device, &data);
++	if (rc)
++		return rc;
++
++	/* print error if PPRC is requested but not enabled on storage server */
++	if (!pprc_enabled) {
++		dev_err(&cdev->dev, "Copy relation not enabled on storage server\n");
++		rc = -EINVAL;
++		goto out;
++	}
++
++	if (!data->dev_info[0].state) {
++		dev_warn(&device->cdev->dev, "Copy pair setup requested for device not in copy relation\n");
++		rc = -EINVAL;
++		goto out;
++	}
++	/* find entry */
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (copy->entry[i].configured &&
++		    strncmp(dev_name(&cdev->dev),
++			    copy->entry[i].busid, DASD_BUS_ID_SIZE) == 0) {
++			entry = &copy->entry[i];
++			break;
++		}
++	}
++	if (!entry) {
++		dev_warn(&device->cdev->dev, "Copy relation entry not found\n");
++		rc = -EINVAL;
++		goto out;
++	}
++	/* check if the copy relation is valid */
++	if (dasd_devmap_check_copy_relation(device, entry, data, copy)) {
++		dev_warn(&device->cdev->dev, "Copy relation faulty\n");
++		rc = -EINVAL;
++		goto out;
++	}
++
++	dasd_get_device(device);
++	copy->entry[i].device = device;
++	device->copy = copy;
++out:
++	kfree(data);
++	return rc;
++}
++EXPORT_SYMBOL_GPL(dasd_devmap_set_device_copy_relation);
++
+ /*
+  * Wait queue for dasd_delete_device waits.
+  */
+@@ -617,6 +858,8 @@ dasd_delete_device(struct dasd_device *device)
+ 	dev_set_drvdata(&device->cdev->dev, NULL);
+ 	spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
+ 
++	/* Removve copy relation */
++	dasd_devmap_delete_copy_relation_device(device);
+ 	/*
+ 	 * Drop ref_count by 3, one for the devmap reference, one for
+ 	 * the cdev reference and one for the passed reference.
+@@ -1683,6 +1926,313 @@ dasd_path_fcs_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
+ static struct kobj_attribute path_fcs_attribute =
+ 	__ATTR(fc_security, 0444, dasd_path_fcs_show, NULL);
+ 
++/*
++ * print copy relation in the form
++ * primary,secondary[1] primary,secondary[2], ...
++ */
++static ssize_t
++dasd_copy_pair_show(struct device *dev,
++		    struct device_attribute *attr, char *buf)
++{
++	char prim_busid[DASD_BUS_ID_SIZE];
++	struct dasd_copy_relation *copy;
++	struct dasd_devmap *devmap;
++	int len = 0;
++	int i;
++
++	devmap = dasd_find_busid(dev_name(dev));
++	if (IS_ERR(devmap))
++		return -ENODEV;
++
++	if (!devmap->copy)
++		return -ENODEV;
++
++	copy = devmap->copy;
++	/* find primary */
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (copy->entry[i].configured && copy->entry[i].primary) {
++			strscpy(prim_busid, copy->entry[i].busid,
++				DASD_BUS_ID_SIZE);
++			break;
++		}
++	}
++	if (!copy->entry[i].primary)
++		goto out;
++
++	/* print all secondary */
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (copy->entry[i].configured && !copy->entry[i].primary)
++			len += sysfs_emit_at(buf, len, "%s,%s ", prim_busid,
++					     copy->entry[i].busid);
++	}
++
++	len += sysfs_emit_at(buf, len, "\n");
++out:
++	return len;
++}
++
++static int dasd_devmap_set_copy_relation(struct dasd_devmap *devmap,
++					 struct dasd_copy_relation *copy,
++					 char *busid, bool primary)
++{
++	int i;
++
++	/* find free entry */
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		/* current bus_id already included, nothing to do */
++		if (copy->entry[i].configured &&
++		    strncmp(copy->entry[i].busid, busid, DASD_BUS_ID_SIZE) == 0)
++			return 0;
++
++		if (!copy->entry[i].configured)
++			break;
++	}
++	if (i == DASD_CP_ENTRIES)
++		return -EINVAL;
++
++	copy->entry[i].configured = true;
++	strscpy(copy->entry[i].busid, busid, DASD_BUS_ID_SIZE);
++	if (primary) {
++		copy->active = &copy->entry[i];
++		copy->entry[i].primary = true;
++	}
++	if (!devmap->copy)
++		devmap->copy = copy;
++
++	return 0;
++}
++
++static void dasd_devmap_del_copy_relation(struct dasd_copy_relation *copy,
++					  char *busid)
++{
++	int i;
++
++	spin_lock(&dasd_devmap_lock);
++	/* find entry */
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (copy->entry[i].configured &&
++		    strncmp(copy->entry[i].busid, busid, DASD_BUS_ID_SIZE) == 0)
++			break;
++	}
++	if (i == DASD_CP_ENTRIES || !copy->entry[i].configured) {
++		spin_unlock(&dasd_devmap_lock);
++		return;
++	}
++
++	copy->entry[i].configured = false;
++	memset(copy->entry[i].busid, 0, DASD_BUS_ID_SIZE);
++	if (copy->active == &copy->entry[i]) {
++		copy->active = NULL;
++		copy->entry[i].primary = false;
++	}
++	spin_unlock(&dasd_devmap_lock);
++}
++
++static int dasd_devmap_clear_copy_relation(struct device *dev)
++{
++	struct dasd_copy_relation *copy;
++	struct dasd_devmap *devmap;
++	int i, rc = 1;
++
++	devmap = dasd_devmap_from_cdev(to_ccwdev(dev));
++	if (IS_ERR(devmap))
++		return 1;
++
++	spin_lock(&dasd_devmap_lock);
++	if (!devmap->copy)
++		goto out;
++
++	copy = devmap->copy;
++	/* first check if all secondary devices are offline*/
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (!copy->entry[i].configured)
++			continue;
++
++		if (copy->entry[i].device == copy->active->device)
++			continue;
++
++		if (copy->entry[i].device)
++			goto out;
++	}
++	/* clear all devmap entries */
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (strlen(copy->entry[i].busid) == 0)
++			continue;
++		if (copy->entry[i].device) {
++			dasd_put_device(copy->entry[i].device);
++			copy->entry[i].device->copy = NULL;
++			copy->entry[i].device = NULL;
++		}
++		devmap = dasd_find_busid_locked(copy->entry[i].busid);
++		devmap->copy = NULL;
++		memset(copy->entry[i].busid, 0, DASD_BUS_ID_SIZE);
++	}
++	kfree(copy);
++	rc = 0;
++out:
++	spin_unlock(&dasd_devmap_lock);
++	return rc;
++}
++
++/*
++ * parse BUSIDs from a copy pair
++ */
++static int dasd_devmap_parse_busid(const char *buf, char *prim_busid,
++				   char *sec_busid)
++{
++	char *primary, *secondary, *tmp, *pt;
++	int id0, id1, id2;
++
++	pt =  kstrdup(buf, GFP_KERNEL);
++	tmp = pt;
++	if (!tmp)
++		return -ENOMEM;
++
++	primary = strsep(&tmp, ",");
++	if (!primary) {
++		kfree(pt);
++		return -EINVAL;
++	}
++	secondary = strsep(&tmp, ",");
++	if (!secondary) {
++		kfree(pt);
++		return -EINVAL;
++	}
++	if (dasd_busid(primary, &id0, &id1, &id2)) {
++		kfree(pt);
++		return -EINVAL;
++	}
++	sprintf(prim_busid, "%01x.%01x.%04x", id0, id1, id2);
++	if (dasd_busid(secondary, &id0, &id1, &id2)) {
++		kfree(pt);
++		return -EINVAL;
++	}
++	sprintf(sec_busid, "%01x.%01x.%04x", id0, id1, id2);
++	kfree(pt);
++
++	return 0;
++}
++
++static ssize_t dasd_copy_pair_store(struct device *dev,
++				    struct device_attribute *attr,
++				    const char *buf, size_t count)
++{
++	struct dasd_devmap *prim_devmap, *sec_devmap;
++	char prim_busid[DASD_BUS_ID_SIZE];
++	char sec_busid[DASD_BUS_ID_SIZE];
++	struct dasd_copy_relation *copy;
++	struct dasd_device *device;
++	bool pprc_enabled;
++	int rc;
++
++	if (strncmp(buf, "clear", strlen("clear")) == 0) {
++		if (dasd_devmap_clear_copy_relation(dev))
++			return -EINVAL;
++		return count;
++	}
++
++	rc = dasd_devmap_parse_busid(buf, prim_busid, sec_busid);
++	if (rc)
++		return rc;
++
++	if (strncmp(dev_name(dev), prim_busid, DASD_BUS_ID_SIZE) != 0 &&
++	    strncmp(dev_name(dev), sec_busid, DASD_BUS_ID_SIZE) != 0)
++		return -EINVAL;
++
++	/* allocate primary devmap if needed */
++	prim_devmap = dasd_find_busid(prim_busid);
++	if (IS_ERR(prim_devmap))
++		prim_devmap = dasd_add_busid(prim_busid, DASD_FEATURE_DEFAULT);
++
++	/* allocate secondary devmap if needed */
++	sec_devmap = dasd_find_busid(sec_busid);
++	if (IS_ERR(sec_devmap))
++		sec_devmap = dasd_add_busid(sec_busid, DASD_FEATURE_DEFAULT);
++
++	/* setting copy relation is only allowed for offline secondary */
++	if (sec_devmap->device)
++		return -EINVAL;
++
++	if (prim_devmap->copy) {
++		copy = prim_devmap->copy;
++	} else if (sec_devmap->copy) {
++		copy = sec_devmap->copy;
++	} else {
++		copy = kzalloc(sizeof(*copy), GFP_KERNEL);
++		if (!copy)
++			return -ENOMEM;
++	}
++	spin_lock(&dasd_devmap_lock);
++	rc = dasd_devmap_set_copy_relation(prim_devmap, copy, prim_busid, true);
++	if (rc) {
++		spin_unlock(&dasd_devmap_lock);
++		return rc;
++	}
++	rc = dasd_devmap_set_copy_relation(sec_devmap, copy, sec_busid, false);
++	if (rc) {
++		spin_unlock(&dasd_devmap_lock);
++		return rc;
++	}
++	spin_unlock(&dasd_devmap_lock);
++
++	/* if primary device is already online call device setup directly */
++	if (prim_devmap->device && !prim_devmap->device->copy) {
++		device = prim_devmap->device;
++		if (device->discipline->pprc_enabled) {
++			pprc_enabled = device->discipline->pprc_enabled(device);
++			rc = dasd_devmap_set_device_copy_relation(device->cdev,
++								  pprc_enabled);
++		} else {
++			rc = -EOPNOTSUPP;
++		}
++	}
++	if (rc) {
++		dasd_devmap_del_copy_relation(copy, prim_busid);
++		dasd_devmap_del_copy_relation(copy, sec_busid);
++		count = rc;
++	}
++
++	return count;
++}
++static DEVICE_ATTR(copy_pair, 0644, dasd_copy_pair_show,
++		   dasd_copy_pair_store);
++
++static ssize_t
++dasd_copy_role_show(struct device *dev,
++		    struct device_attribute *attr, char *buf)
++{
++	struct dasd_copy_relation *copy;
++	struct dasd_device *device;
++	int len, i;
++
++	device = dasd_device_from_cdev(to_ccwdev(dev));
++	if (IS_ERR(device))
++		return -ENODEV;
++
++	if (!device->copy) {
++		len = sysfs_emit(buf, "none\n");
++		goto out;
++	}
++	copy = device->copy;
++	/* only the active device is primary */
++	if (copy->active->device == device) {
++		len = sysfs_emit(buf, "primary\n");
++		goto out;
++	}
++	for (i = 0; i < DASD_CP_ENTRIES; i++) {
++		if (copy->entry[i].device == device) {
++			len = sysfs_emit(buf, "secondary\n");
++			goto out;
++		}
++	}
++	/* not in the list, no COPY role */
++	len = sysfs_emit(buf, "none\n");
++out:
++	dasd_put_device(device);
++	return len;
++}
++static DEVICE_ATTR(copy_role, 0444, dasd_copy_role_show, NULL);
++
+ #define DASD_DEFINE_ATTR(_name, _func)					\
+ static ssize_t dasd_##_name##_show(struct device *dev,			\
+ 				   struct device_attribute *attr,	\
+@@ -1739,6 +2289,8 @@ static struct attribute * dasd_attrs[] = {
+ 	&dev_attr_hpf.attr,
+ 	&dev_attr_ese.attr,
+ 	&dev_attr_fc_security.attr,
++	&dev_attr_copy_pair.attr,
++	&dev_attr_copy_role.attr,
+ 	NULL,
+ };
+ 
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 76f861c2ce614..59b11950fb60c 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -2028,11 +2028,28 @@ static void dasd_eckd_kick_validate_server(struct dasd_device *device)
+ 		dasd_put_device(device);
+ }
+ 
++/*
++ * return if the device is the copy relation primary if a copy relation is active
++ */
++static int dasd_device_is_primary(struct dasd_device *device)
++{
++	if (!device->copy)
++		return 1;
++
++	if (device->copy->active->device == device)
++		return 1;
++
++	return 0;
++}
++
+ static int dasd_eckd_alloc_block(struct dasd_device *device)
+ {
+ 	struct dasd_block *block;
+ 	struct dasd_uid temp_uid;
+ 
++	if (!dasd_device_is_primary(device))
++		return 0;
++
+ 	dasd_eckd_get_uid(device, &temp_uid);
+ 	if (temp_uid.type == UA_BASE_DEVICE) {
+ 		block = dasd_alloc_block();
+@@ -2047,6 +2064,13 @@ static int dasd_eckd_alloc_block(struct dasd_device *device)
+ 	return 0;
+ }
+ 
++static bool dasd_eckd_pprc_enabled(struct dasd_device *device)
++{
++	struct dasd_eckd_private *private = device->private;
++
++	return private->rdc_data.facilities.PPRC_enabled;
++}
++
+ /*
+  * Check device characteristics.
+  * If the device is accessible using ECKD discipline, the device is enabled.
+@@ -2112,6 +2136,24 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
+ 			device->default_expires = value;
+ 	}
+ 
++	/* Read Device Characteristics */
++	rc = dasd_generic_read_dev_chars(device, DASD_ECKD_MAGIC,
++					 &private->rdc_data, 64);
++	if (rc) {
++		DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
++				"Read device characteristic failed, rc=%d", rc);
++		goto out_err1;
++	}
++
++	/* setup PPRC for device from devmap */
++	rc = dasd_devmap_set_device_copy_relation(device->cdev,
++						  dasd_eckd_pprc_enabled(device));
++	if (rc) {
++		DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
++				"copy relation setup failed, rc=%d", rc);
++		goto out_err1;
++	}
++
+ 	/* check if block device is needed and allocate in case */
+ 	rc = dasd_eckd_alloc_block(device);
+ 	if (rc)
+@@ -2140,15 +2182,6 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
+ 	/* Read Extent Pool Information */
+ 	dasd_eckd_read_ext_pool_info(device);
+ 
+-	/* Read Device Characteristics */
+-	rc = dasd_generic_read_dev_chars(device, DASD_ECKD_MAGIC,
+-					 &private->rdc_data, 64);
+-	if (rc) {
+-		DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
+-				"Read device characteristic failed, rc=%d", rc);
+-		goto out_err3;
+-	}
+-
+ 	if ((device->features & DASD_FEATURE_USERAW) &&
+ 	    !(private->rdc_data.facilities.RT_in_LR)) {
+ 		dev_err(&device->cdev->dev, "The storage server does not "
+@@ -6789,6 +6822,7 @@ static struct dasd_discipline dasd_eckd_discipline = {
+ 	.ese_format = dasd_eckd_ese_format,
+ 	.ese_read = dasd_eckd_ese_read,
+ 	.pprc_status = dasd_eckd_query_pprc_status,
++	.pprc_enabled = dasd_eckd_pprc_enabled,
+ };
+ 
+ static int __init
+diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
+index ed83a9a55191b..4b869c2bd5195 100644
+--- a/drivers/s390/block/dasd_eckd.h
++++ b/drivers/s390/block/dasd_eckd.h
+@@ -267,7 +267,7 @@ struct dasd_eckd_characteristics {
+ 		unsigned char reserved3:8;
+ 		unsigned char defect_wr:1;
+ 		unsigned char XRC_supported:1;
+-		unsigned char reserved4:1;
++		unsigned char PPRC_enabled:1;
+ 		unsigned char striping:1;
+ 		unsigned char reserved5:4;
+ 		unsigned char cfw:1;
+diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
+index 2ee8bc035b34a..d743d1d2b38e9 100644
+--- a/drivers/s390/block/dasd_int.h
++++ b/drivers/s390/block/dasd_int.h
+@@ -291,6 +291,24 @@ struct dasd_pprc_data_sc4 {
+ 	struct dasd_pprc_dev_info dev_info[5];
+ } __packed;
+ 
++#define DASD_BUS_ID_SIZE 20
++#define DASD_CP_ENTRIES 5
++
++struct dasd_copy_entry {
++	char busid[DASD_BUS_ID_SIZE];
++	struct dasd_device *device;
++	bool primary;
++	bool configured;
++};
++
++struct dasd_copy_relation {
++	struct dasd_copy_entry entry[DASD_CP_ENTRIES];
++	struct dasd_copy_entry *active;
++};
++
++int dasd_devmap_set_device_copy_relation(struct ccw_device *,
++					 bool pprc_enabled);
++
+ /*
+  * the struct dasd_discipline is
+  * sth like a table of virtual functions, if you think of dasd_eckd
+@@ -420,6 +438,7 @@ struct dasd_discipline {
+ 					   struct dasd_ccw_req *, struct irb *);
+ 	int (*ese_read)(struct dasd_ccw_req *, struct irb *);
+ 	int (*pprc_status)(struct dasd_device *, struct	dasd_pprc_data_sc4 *);
++	bool (*pprc_enabled)(struct dasd_device *);
+ };
+ 
+ extern struct dasd_discipline *dasd_diag_discipline_pointer;
+@@ -616,6 +635,7 @@ struct dasd_device {
+ 	struct dasd_profile profile;
+ 	struct dasd_format_entry format_entry;
+ 	struct kset *paths_info;
++	struct dasd_copy_relation *copy;
+ };
+ 
+ struct dasd_block {
+-- 
+2.43.0
+
diff --git a/queue-5.15/s390-dasd-add-query-pprc-function.patch b/queue-5.15/s390-dasd-add-query-pprc-function.patch
new file mode 100644
index 00000000000..e52b02c826d
--- /dev/null
+++ b/queue-5.15/s390-dasd-add-query-pprc-function.patch
@@ -0,0 +1,181 @@
+From 1d0b85e211ffd6716dc9e0cb2ffd06aaf2ebe2da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 21:26:11 +0200
+Subject: s390/dasd: add query PPRC function
+
+From: Stefan Haberland <sth@linux.ibm.com>
+
+[ Upstream commit 3f217cceb6846e7533511fc69bc774cdba37ff7d ]
+
+Add function to query the Peer-to-Peer-Remote-Copy (PPRC) state of a
+device by reading the related structure through a read subsystem data call.
+
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220920192616.808070-3-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: c3116e62ddef ("s390/dasd: fix double module refcount decrement")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd_eckd.c | 66 ++++++++++++++++++++++++++++++++++
+ drivers/s390/block/dasd_eckd.h |  6 ++++
+ drivers/s390/block/dasd_int.h  | 32 +++++++++++++++++
+ 3 files changed, 104 insertions(+)
+
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index cf80db7a74a3d..76f861c2ce614 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -6105,6 +6105,71 @@ static int dasd_hosts_print(struct dasd_device *device, struct seq_file *m)
+ 	return 0;
+ }
+ 
++/*
++ * Perform Subsystem Function - Peer-to-Peer Remote Copy Extended Query
++ */
++static int dasd_eckd_query_pprc_status(struct dasd_device *device,
++				       struct dasd_pprc_data_sc4 *data)
++{
++	struct dasd_pprc_data_sc4 *pprc_data;
++	struct dasd_psf_prssd_data *prssdp;
++	struct dasd_ccw_req *cqr;
++	struct ccw1 *ccw;
++	int rc;
++
++	cqr = dasd_smalloc_request(DASD_ECKD_MAGIC, 1 /* PSF */	+ 1 /* RSSD */,
++				   sizeof(*prssdp) + sizeof(*pprc_data) + 1,
++				   device, NULL);
++	if (IS_ERR(cqr)) {
++		DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
++				"Could not allocate query PPRC status request");
++		return PTR_ERR(cqr);
++	}
++	cqr->startdev = device;
++	cqr->memdev = device;
++	cqr->block = NULL;
++	cqr->retries = 256;
++	cqr->expires = 10 * HZ;
++
++	/* Prepare for Read Subsystem Data */
++	prssdp = (struct dasd_psf_prssd_data *)cqr->data;
++	memset(prssdp, 0, sizeof(struct dasd_psf_prssd_data));
++	prssdp->order = PSF_ORDER_PRSSD;
++	prssdp->suborder = PSF_SUBORDER_PPRCEQ;
++	prssdp->varies[0] = PPRCEQ_SCOPE_4;
++	pprc_data = (struct dasd_pprc_data_sc4 *)(prssdp + 1);
++
++	ccw = cqr->cpaddr;
++	ccw->cmd_code = DASD_ECKD_CCW_PSF;
++	ccw->count = sizeof(struct dasd_psf_prssd_data);
++	ccw->flags |= CCW_FLAG_CC;
++	ccw->flags |= CCW_FLAG_SLI;
++	ccw->cda = (__u32)(addr_t)prssdp;
++
++	/* Read Subsystem Data - query host access */
++	ccw++;
++	ccw->cmd_code = DASD_ECKD_CCW_RSSD;
++	ccw->count = sizeof(*pprc_data);
++	ccw->flags |= CCW_FLAG_SLI;
++	ccw->cda = (__u32)(addr_t)pprc_data;
++
++	cqr->buildclk = get_tod_clock();
++	cqr->status = DASD_CQR_FILLED;
++
++	rc = dasd_sleep_on_interruptible(cqr);
++	if (rc == 0) {
++		*data = *pprc_data;
++	} else {
++		DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
++				"PPRC Extended Query failed with rc=%d\n",
++				rc);
++		rc = -EOPNOTSUPP;
++	}
++
++	dasd_sfree_request(cqr, cqr->memdev);
++	return rc;
++}
++
+ /*
+  * Perform Subsystem Function - CUIR response
+  */
+@@ -6723,6 +6788,7 @@ static struct dasd_discipline dasd_eckd_discipline = {
+ 	.ext_pool_exhaust = dasd_eckd_ext_pool_exhaust,
+ 	.ese_format = dasd_eckd_ese_format,
+ 	.ese_read = dasd_eckd_ese_read,
++	.pprc_status = dasd_eckd_query_pprc_status,
+ };
+ 
+ static int __init
+diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
+index 65e4630ad2aea..ed83a9a55191b 100644
+--- a/drivers/s390/block/dasd_eckd.h
++++ b/drivers/s390/block/dasd_eckd.h
+@@ -66,9 +66,15 @@
+  * Perform Subsystem Function / Sub-Orders
+  */
+ #define PSF_SUBORDER_QHA		 0x1C /* Query Host Access */
++#define PSF_SUBORDER_PPRCEQ		 0x50 /* PPRC Extended Query */
+ #define PSF_SUBORDER_VSQ		 0x52 /* Volume Storage Query */
+ #define PSF_SUBORDER_LCQ		 0x53 /* Logical Configuration Query */
+ 
++/*
++ * PPRC Extended Query Scopes
++ */
++#define PPRCEQ_SCOPE_4			 0x04 /* Scope 4 for PPRC Extended Query */
++
+ /*
+  * CUIR response condition codes
+  */
+diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
+index d94ae067f085e..2ee8bc035b34a 100644
+--- a/drivers/s390/block/dasd_int.h
++++ b/drivers/s390/block/dasd_int.h
+@@ -260,6 +260,37 @@ struct dasd_uid {
+ 	char vduit[33];
+ };
+ 
++/*
++ * PPRC Status data
++ */
++struct dasd_pprc_header {
++	__u8 entries;		/* 0     Number of device entries */
++	__u8 unused;		/* 1     unused */
++	__u16 entry_length;	/* 2-3   Length of device entry */
++	__u32 unused2;		/* 4-7   unused */
++} __packed;
++
++struct dasd_pprc_dev_info {
++	__u8 state;		/* 0       Copy State */
++	__u8 flags;		/* 1       Flags */
++	__u8 reserved1[2];	/* 2-3     reserved */
++	__u8 prim_lss;		/* 4       Primary device LSS */
++	__u8 primary;		/* 5       Primary device address */
++	__u8 sec_lss;		/* 6       Secondary device LSS */
++	__u8 secondary;		/* 7       Secondary device address */
++	__u16 pprc_id;		/* 8-9     Peer-to-Peer Remote Copy ID */
++	__u8 reserved2[12];	/* 10-21   reserved */
++	__u16 prim_cu_ssid;	/* 22-23   Pimary Control Unit SSID */
++	__u8 reserved3[12];	/* 24-35   reserved */
++	__u16 sec_cu_ssid;	/* 36-37   Secondary Control Unit SSID */
++	__u8 reserved4[90];	/* 38-127  reserved */
++} __packed;
++
++struct dasd_pprc_data_sc4 {
++	struct dasd_pprc_header header;
++	struct dasd_pprc_dev_info dev_info[5];
++} __packed;
++
+ /*
+  * the struct dasd_discipline is
+  * sth like a table of virtual functions, if you think of dasd_eckd
+@@ -388,6 +419,7 @@ struct dasd_discipline {
+ 	struct dasd_ccw_req *(*ese_format)(struct dasd_device *,
+ 					   struct dasd_ccw_req *, struct irb *);
+ 	int (*ese_read)(struct dasd_ccw_req *, struct irb *);
++	int (*pprc_status)(struct dasd_device *, struct	dasd_pprc_data_sc4 *);
+ };
+ 
+ extern struct dasd_discipline *dasd_diag_discipline_pointer;
+-- 
+2.43.0
+
diff --git a/queue-5.15/s390-dasd-fix-double-module-refcount-decrement.patch b/queue-5.15/s390-dasd-fix-double-module-refcount-decrement.patch
new file mode 100644
index 00000000000..d72a054fa5c
--- /dev/null
+++ b/queue-5.15/s390-dasd-fix-double-module-refcount-decrement.patch
@@ -0,0 +1,58 @@
+From 0c773277cf693e3f79456943ac76d72d811bef51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 13:45:22 +0100
+Subject: s390/dasd: fix double module refcount decrement
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miroslav Franc <mfranc@suse.cz>
+
+[ Upstream commit c3116e62ddeff79cae342147753ce596f01fcf06 ]
+
+Once the discipline is associated with the device, deleting the device
+takes care of decrementing the module's refcount.  Doing it manually on
+this error path causes refcount to artificially decrease on each error
+while it should just stay the same.
+
+Fixes: c020d722b110 ("s390/dasd: fix panic during offline processing")
+Signed-off-by: Miroslav Franc <mfranc@suse.cz>
+Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240209124522.3697827-3-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index f13f76fe3f2e2..fc33474271115 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -3573,12 +3573,11 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 		dasd_delete_device(device);
+ 		return -EINVAL;
+ 	}
++	device->base_discipline = base_discipline;
+ 	if (!try_module_get(discipline->owner)) {
+-		module_put(base_discipline->owner);
+ 		dasd_delete_device(device);
+ 		return -EINVAL;
+ 	}
+-	device->base_discipline = base_discipline;
+ 	device->discipline = discipline;
+ 
+ 	/* check_device will allocate block device if necessary */
+@@ -3586,8 +3585,6 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 	if (rc) {
+ 		dev_warn(dev, "Setting the DASD online with discipline %s failed with rc=%i\n",
+ 			 discipline->name, rc);
+-		module_put(discipline->owner);
+-		module_put(base_discipline->owner);
+ 		dasd_delete_device(device);
+ 		return rc;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-5.15/s390-dasd-put-block-allocation-in-separate-function.patch b/queue-5.15/s390-dasd-put-block-allocation-in-separate-function.patch
new file mode 100644
index 00000000000..f5b44731b31
--- /dev/null
+++ b/queue-5.15/s390-dasd-put-block-allocation-in-separate-function.patch
@@ -0,0 +1,88 @@
+From 6dca41f5bf941263d40b5b8f7c988860c39bbba8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 21:26:10 +0200
+Subject: s390/dasd: put block allocation in separate function
+
+From: Stefan Haberland <sth@linux.ibm.com>
+
+[ Upstream commit 2b43bf061b2e1b67561cbb1f6f305421f5fc86af ]
+
+Put block allocation into a separate function to put some copy pair logic
+in it in a later patch.
+
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220920192616.808070-2-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: c3116e62ddef ("s390/dasd: fix double module refcount decrement")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd_eckd.c | 38 ++++++++++++++++++++--------------
+ 1 file changed, 23 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 56ab74aa07f42..cf80db7a74a3d 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -2028,6 +2028,25 @@ static void dasd_eckd_kick_validate_server(struct dasd_device *device)
+ 		dasd_put_device(device);
+ }
+ 
++static int dasd_eckd_alloc_block(struct dasd_device *device)
++{
++	struct dasd_block *block;
++	struct dasd_uid temp_uid;
++
++	dasd_eckd_get_uid(device, &temp_uid);
++	if (temp_uid.type == UA_BASE_DEVICE) {
++		block = dasd_alloc_block();
++		if (IS_ERR(block)) {
++			DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
++					"could not allocate dasd block structure");
++			return PTR_ERR(block);
++		}
++		device->block = block;
++		block->base = device;
++	}
++	return 0;
++}
++
+ /*
+  * Check device characteristics.
+  * If the device is accessible using ECKD discipline, the device is enabled.
+@@ -2036,8 +2055,6 @@ static int
+ dasd_eckd_check_characteristics(struct dasd_device *device)
+ {
+ 	struct dasd_eckd_private *private = device->private;
+-	struct dasd_block *block;
+-	struct dasd_uid temp_uid;
+ 	int rc, i;
+ 	int readonly;
+ 	unsigned long value;
+@@ -2095,19 +2112,10 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
+ 			device->default_expires = value;
+ 	}
+ 
+-	dasd_eckd_get_uid(device, &temp_uid);
+-	if (temp_uid.type == UA_BASE_DEVICE) {
+-		block = dasd_alloc_block();
+-		if (IS_ERR(block)) {
+-			DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "%s",
+-					"could not allocate dasd "
+-					"block structure");
+-			rc = PTR_ERR(block);
+-			goto out_err1;
+-		}
+-		device->block = block;
+-		block->base = device;
+-	}
++	/* check if block device is needed and allocate in case */
++	rc = dasd_eckd_alloc_block(device);
++	if (rc)
++		goto out_err1;
+ 
+ 	/* register lcu with alias handling, enable PAV */
+ 	rc = dasd_alias_make_device_known_to_lcu(device);
+-- 
+2.43.0
+
diff --git a/queue-5.15/s390-dasd-use-dev_-for-device-log-messages.patch b/queue-5.15/s390-dasd-use-dev_-for-device-log-messages.patch
new file mode 100644
index 00000000000..212899d5b63
--- /dev/null
+++ b/queue-5.15/s390-dasd-use-dev_-for-device-log-messages.patch
@@ -0,0 +1,172 @@
+From aafbd146f7d2e13d835fb3a719d2e23e7c10c308 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 17:42:48 +0100
+Subject: s390/dasd: Use dev_*() for device log messages
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Höppner <hoeppner@linux.ibm.com>
+
+[ Upstream commit 79ae56fc475869d636071f66d9e4ef2a3819eee6 ]
+
+All log messages in dasd.c use the printk variants of pr_*(). They all
+add the name of the affected device manually to the log message.
+This can be simplified by using the dev_*() variants of printk, which
+include the device information and make a separate call to dev_name()
+unnecessary.
+
+The KMSG_COMPONENT and the pr_fmt() definition can be dropped. Note that
+this removes the "dasd: " prefix from the one pr_info() call in
+dasd_init(). However, the log message already provides all relevant
+information.
+
+Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240208164248.540985-10-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: c3116e62ddef ("s390/dasd: fix double module refcount decrement")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd.c | 50 +++++++++++++++++++--------------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index c45b6f3780ebd..f13f76fe3f2e2 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -8,9 +8,6 @@
+  * Copyright IBM Corp. 1999, 2009
+  */
+ 
+-#define KMSG_COMPONENT "dasd"
+-#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+-
+ #include <linux/kmod.h>
+ #include <linux/init.h>
+ #include <linux/interrupt.h>
+@@ -3451,8 +3448,7 @@ static void dasd_generic_auto_online(void *data, async_cookie_t cookie)
+ 
+ 	ret = ccw_device_set_online(cdev);
+ 	if (ret)
+-		pr_warn("%s: Setting the DASD online failed with rc=%d\n",
+-			dev_name(&cdev->dev), ret);
++		dev_warn(&cdev->dev, "Setting the DASD online failed with rc=%d\n", ret);
+ }
+ 
+ /*
+@@ -3539,8 +3535,11 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ {
+ 	struct dasd_discipline *discipline;
+ 	struct dasd_device *device;
++	struct device *dev;
+ 	int rc;
+ 
++	dev = &cdev->dev;
++
+ 	/* first online clears initial online feature flag */
+ 	dasd_set_feature(cdev, DASD_FEATURE_INITIAL_ONLINE, 0);
+ 	device = dasd_create_device(cdev);
+@@ -3553,11 +3552,10 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 			/* Try to load the required module. */
+ 			rc = request_module(DASD_DIAG_MOD);
+ 			if (rc) {
+-				pr_warn("%s Setting the DASD online failed "
+-					"because the required module %s "
+-					"could not be loaded (rc=%d)\n",
+-					dev_name(&cdev->dev), DASD_DIAG_MOD,
+-					rc);
++				dev_warn(dev, "Setting the DASD online failed "
++					 "because the required module %s "
++					 "could not be loaded (rc=%d)\n",
++					 DASD_DIAG_MOD, rc);
+ 				dasd_delete_device(device);
+ 				return -ENODEV;
+ 			}
+@@ -3565,8 +3563,7 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 		/* Module init could have failed, so check again here after
+ 		 * request_module(). */
+ 		if (!dasd_diag_discipline_pointer) {
+-			pr_warn("%s Setting the DASD online failed because of missing DIAG discipline\n",
+-				dev_name(&cdev->dev));
++			dev_warn(dev, "Setting the DASD online failed because of missing DIAG discipline\n");
+ 			dasd_delete_device(device);
+ 			return -ENODEV;
+ 		}
+@@ -3587,8 +3584,8 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 	/* check_device will allocate block device if necessary */
+ 	rc = discipline->check_device(device);
+ 	if (rc) {
+-		pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n",
+-			dev_name(&cdev->dev), discipline->name, rc);
++		dev_warn(dev, "Setting the DASD online with discipline %s failed with rc=%i\n",
++			 discipline->name, rc);
+ 		module_put(discipline->owner);
+ 		module_put(base_discipline->owner);
+ 		dasd_delete_device(device);
+@@ -3597,16 +3594,15 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 
+ 	dasd_set_target_state(device, DASD_STATE_ONLINE);
+ 	if (device->state <= DASD_STATE_KNOWN) {
+-		pr_warn("%s Setting the DASD online failed because of a missing discipline\n",
+-			dev_name(&cdev->dev));
++		dev_warn(dev, "Setting the DASD online failed because of a missing discipline\n");
+ 		rc = -ENODEV;
+ 		dasd_set_target_state(device, DASD_STATE_NEW);
+ 		if (device->block)
+ 			dasd_free_block(device->block);
+ 		dasd_delete_device(device);
+-	} else
+-		pr_debug("dasd_generic device %s found\n",
+-				dev_name(&cdev->dev));
++	} else {
++		dev_dbg(dev, "dasd_generic device found\n");
++	}
+ 
+ 	wait_event(dasd_init_waitq, _wait_for_device(device));
+ 
+@@ -3617,10 +3613,13 @@ EXPORT_SYMBOL_GPL(dasd_generic_set_online);
+ 
+ int dasd_generic_set_offline(struct ccw_device *cdev)
+ {
++	int max_count, open_count, rc;
+ 	struct dasd_device *device;
+ 	struct dasd_block *block;
+-	int max_count, open_count, rc;
+ 	unsigned long flags;
++	struct device *dev;
++
++	dev = &cdev->dev;
+ 
+ 	rc = 0;
+ 	spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+@@ -3641,11 +3640,10 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
+ 		open_count = atomic_read(&device->block->open_count);
+ 		if (open_count > max_count) {
+ 			if (open_count > 0)
+-				pr_warn("%s: The DASD cannot be set offline with open count %i\n",
+-					dev_name(&cdev->dev), open_count);
++				dev_warn(dev, "The DASD cannot be set offline with open count %i\n",
++					 open_count);
+ 			else
+-				pr_warn("%s: The DASD cannot be set offline while it is in use\n",
+-					dev_name(&cdev->dev));
++				dev_warn(dev, "The DASD cannot be set offline while it is in use\n");
+ 			rc = -EBUSY;
+ 			goto out_err;
+ 		}
+@@ -4008,8 +4006,8 @@ static int dasd_handle_autoquiesce(struct dasd_device *device,
+ 	if (dasd_eer_enabled(device))
+ 		dasd_eer_write(device, NULL, DASD_EER_AUTOQUIESCE);
+ 
+-	pr_info("%s: The DASD has been put in the quiesce state\n",
+-		dev_name(&device->cdev->dev));
++	dev_info(&device->cdev->dev,
++		 "The DASD has been put in the quiesce state\n");
+ 	dasd_device_set_stop_bits(device, DASD_STOPPED_QUIESCE);
+ 
+ 	if (device->features & DASD_FEATURE_REQUEUEQUIESCE)
+-- 
+2.43.0
+
diff --git a/queue-5.15/s390-vdso-drop-fpic-from-ldflags.patch b/queue-5.15/s390-vdso-drop-fpic-from-ldflags.patch
new file mode 100644
index 00000000000..df99d470dff
--- /dev/null
+++ b/queue-5.15/s390-vdso-drop-fpic-from-ldflags.patch
@@ -0,0 +1,66 @@
+From a75bbac540a48b2c93bca418580ac4b38959fbf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 20:14:28 -0700
+Subject: s390/vdso: drop '-fPIC' from LDFLAGS
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 0628c03934187be33942580e10bb9afcc61adeed ]
+
+'-fPIC' as an option to the linker does not do what it seems like it
+should. With ld.bfd, it is treated as '-f PIC', which does not make
+sense based on the meaning of '-f':
+
+  -f SHLIB, --auxiliary SHLIB Auxiliary filter for shared object symbol table
+
+When building with ld.lld (currently under review in a GitHub pull
+request), it just errors out because '-f' means nothing and neither does
+'-fPIC':
+
+  ld.lld: error: unknown argument '-fPIC'
+
+'-fPIC' was blindly copied from CFLAGS when the vDSO stopped being
+linked with '$(CC)', it should not be needed. Remove it to clear up the
+build failure with ld.lld.
+
+Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO")
+Link: https://github.com/llvm/llvm-project/pull/75643
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Fangrui Song <maskray@google.com>
+Link: https://lore.kernel.org/r/20240130-s390-vdso-drop-fpic-from-ldflags-v1-1-094ad104fc55@kernel.org
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vdso32/Makefile | 2 +-
+ arch/s390/kernel/vdso64/Makefile | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
+index 245bddfe9bc0e..cc513add48eb5 100644
+--- a/arch/s390/kernel/vdso32/Makefile
++++ b/arch/s390/kernel/vdso32/Makefile
+@@ -22,7 +22,7 @@ KBUILD_AFLAGS_32 += -m31 -s
+ KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS))
+ KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin
+ 
+-LDFLAGS_vdso32.so.dbg += -fPIC -shared -soname=linux-vdso32.so.1 \
++LDFLAGS_vdso32.so.dbg += -shared -soname=linux-vdso32.so.1 \
+ 	--hash-style=both --build-id=sha1 -melf_s390 -T
+ 
+ $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index 1605ba45ac4c0..42d918d50a1ff 100644
+--- a/arch/s390/kernel/vdso64/Makefile
++++ b/arch/s390/kernel/vdso64/Makefile
+@@ -26,7 +26,7 @@ KBUILD_AFLAGS_64 += -m64 -s
+ 
+ KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS))
+ KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin
+-ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \
++ldflags-y := -shared -soname=linux-vdso64.so.1 \
+ 	     --hash-style=both --build-id=sha1 -T
+ 
+ $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_64)
+-- 
+2.43.0
+
diff --git a/queue-5.15/sched-fair-take-the-scheduling-domain-into-account-i.patch b/queue-5.15/sched-fair-take-the-scheduling-domain-into-account-i.patch
new file mode 100644
index 00000000000..5c550f6381b
--- /dev/null
+++ b/queue-5.15/sched-fair-take-the-scheduling-domain-into-account-i.patch
@@ -0,0 +1,55 @@
+From cf5205d39f068db047a326b865cacc805d887722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 14:17:07 +0100
+Subject: sched/fair: Take the scheduling domain into account in
+ select_idle_core()
+
+From: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+
+[ Upstream commit 23d04d8c6b8ec339057264659b7834027f3e6a63 ]
+
+When picking a CPU on task wakeup, select_idle_core() has to take
+into account the scheduling domain where the function looks for the CPU.
+
+This is because the "isolcpus" kernel command line option can remove CPUs
+from the domain to isolate them from other SMT siblings.
+
+This change replaces the set of CPUs allowed to run the task from
+p->cpus_ptr by the intersection of p->cpus_ptr and sched_domain_span(sd)
+which is stored in the 'cpus' argument provided by select_idle_cpu().
+
+Fixes: 9fe1f127b913 ("sched/fair: Merge select_idle_core/cpu()")
+Signed-off-by: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20240110131707.437301-2-keisuke.nishimura@inria.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index b55d51b4105cd..4a1393405a6fe 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -6394,7 +6394,7 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu
+ 		if (!available_idle_cpu(cpu)) {
+ 			idle = false;
+ 			if (*idle_cpu == -1) {
+-				if (sched_idle_cpu(cpu) && cpumask_test_cpu(cpu, p->cpus_ptr)) {
++				if (sched_idle_cpu(cpu) && cpumask_test_cpu(cpu, cpus)) {
+ 					*idle_cpu = cpu;
+ 					break;
+ 				}
+@@ -6402,7 +6402,7 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu
+ 			}
+ 			break;
+ 		}
+-		if (*idle_cpu == -1 && cpumask_test_cpu(cpu, p->cpus_ptr))
++		if (*idle_cpu == -1 && cpumask_test_cpu(cpu, cpus))
+ 			*idle_cpu = cpu;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch b/queue-5.15/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
new file mode 100644
index 00000000000..466cbfc3ebe
--- /dev/null
+++ b/queue-5.15/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
@@ -0,0 +1,152 @@
+From 8dd4d26e34b72c9ccf16798c47e9dbf993e00358 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 13:44:06 +0100
+Subject: scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b69600231f751304db914c63b937f7098ed2895c ]
+
+Some callback functions used here take a boolean argument, others take a
+status argument. This breaks KCFI type checking, so clang now warns about
+the function pointer cast:
+
+drivers/scsi/bfa/bfad_bsg.c:2138:29: error: cast from 'void (*)(void *, enum bfa_status)' to 'bfa_cb_cbfn_t' (aka 'void (*)(void *, enum bfa_boolean)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+
+Assuming the code is actually correct here and the callers always match the
+argument types of the callee, rework this to replace the explicit cast with
+a union of the two pointer types. This does not change the behavior of the
+code, so if something is actually broken here, a larger rework may be
+necessary.
+
+Fixes: 37ea0558b87a ("[SCSI] bfa: Added support to collect and reset fcport stats")
+Fixes: 3ec4f2c8bff2 ("[SCSI] bfa: Added support to configure QOS and collect stats.")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240222124433.2046570-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bfa/bfa.h      |  9 ++++++++-
+ drivers/scsi/bfa/bfa_core.c |  4 +---
+ drivers/scsi/bfa/bfa_ioc.h  |  8 ++++++--
+ drivers/scsi/bfa/bfad_bsg.c | 11 ++++-------
+ 4 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
+index 7bd2ba1ad4d11..f30fe324e6ecc 100644
+--- a/drivers/scsi/bfa/bfa.h
++++ b/drivers/scsi/bfa/bfa.h
+@@ -20,7 +20,6 @@
+ struct bfa_s;
+ 
+ typedef void (*bfa_isr_func_t) (struct bfa_s *bfa, struct bfi_msg_s *m);
+-typedef void (*bfa_cb_cbfn_status_t) (void *cbarg, bfa_status_t status);
+ 
+ /*
+  * Interrupt message handlers
+@@ -437,4 +436,12 @@ struct bfa_cb_pending_q_s {
+ 	(__qe)->data = (__data);				\
+ } while (0)
+ 
++#define bfa_pending_q_init_status(__qe, __cbfn, __cbarg, __data) do {	\
++	bfa_q_qe_init(&((__qe)->hcb_qe.qe));			\
++	(__qe)->hcb_qe.cbfn_status = (__cbfn);			\
++	(__qe)->hcb_qe.cbarg = (__cbarg);			\
++	(__qe)->hcb_qe.pre_rmv = BFA_TRUE;			\
++	(__qe)->data = (__data);				\
++} while (0)
++
+ #endif /* __BFA_H__ */
+diff --git a/drivers/scsi/bfa/bfa_core.c b/drivers/scsi/bfa/bfa_core.c
+index 6846ca8f7313c..3438d0b8ba062 100644
+--- a/drivers/scsi/bfa/bfa_core.c
++++ b/drivers/scsi/bfa/bfa_core.c
+@@ -1907,15 +1907,13 @@ bfa_comp_process(struct bfa_s *bfa, struct list_head *comp_q)
+ 	struct list_head		*qe;
+ 	struct list_head		*qen;
+ 	struct bfa_cb_qe_s	*hcb_qe;
+-	bfa_cb_cbfn_status_t	cbfn;
+ 
+ 	list_for_each_safe(qe, qen, comp_q) {
+ 		hcb_qe = (struct bfa_cb_qe_s *) qe;
+ 		if (hcb_qe->pre_rmv) {
+ 			/* qe is invalid after return, dequeue before cbfn() */
+ 			list_del(qe);
+-			cbfn = (bfa_cb_cbfn_status_t)(hcb_qe->cbfn);
+-			cbfn(hcb_qe->cbarg, hcb_qe->fw_status);
++			hcb_qe->cbfn_status(hcb_qe->cbarg, hcb_qe->fw_status);
+ 		} else
+ 			hcb_qe->cbfn(hcb_qe->cbarg, BFA_TRUE);
+ 	}
+diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
+index 933a1c3890ff5..5e568d6d7b261 100644
+--- a/drivers/scsi/bfa/bfa_ioc.h
++++ b/drivers/scsi/bfa/bfa_ioc.h
+@@ -361,14 +361,18 @@ struct bfa_reqq_wait_s {
+ 	void	*cbarg;
+ };
+ 
+-typedef void	(*bfa_cb_cbfn_t) (void *cbarg, bfa_boolean_t complete);
++typedef void (*bfa_cb_cbfn_t) (void *cbarg, bfa_boolean_t complete);
++typedef void (*bfa_cb_cbfn_status_t) (void *cbarg, bfa_status_t status);
+ 
+ /*
+  * Generic BFA callback element.
+  */
+ struct bfa_cb_qe_s {
+ 	struct list_head	qe;
+-	bfa_cb_cbfn_t	cbfn;
++	union {
++		bfa_cb_cbfn_status_t	cbfn_status;
++		bfa_cb_cbfn_t		cbfn;
++	};
+ 	bfa_boolean_t	once;
+ 	bfa_boolean_t	pre_rmv;	/* set for stack based qe(s) */
+ 	bfa_status_t	fw_status;	/* to access fw status in comp proc */
+diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
+index be8dfbe13e904..524e4e6979c9f 100644
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -2135,8 +2135,7 @@ bfad_iocmd_fcport_get_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_cb_pending_q_s cb_qe;
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
+-			   &fcomp, &iocmd->stats);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, &iocmd->stats);
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	iocmd->status = bfa_fcport_get_stats(&bfad->bfa, &cb_qe);
+ 	spin_unlock_irqrestore(&bfad->bfad_lock, flags);
+@@ -2159,7 +2158,7 @@ bfad_iocmd_fcport_reset_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_cb_pending_q_s cb_qe;
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp, &fcomp, NULL);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, NULL);
+ 
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	iocmd->status = bfa_fcport_clear_stats(&bfad->bfa, &cb_qe);
+@@ -2443,8 +2442,7 @@ bfad_iocmd_qos_get_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_fcport_s *fcport = BFA_FCPORT_MOD(&bfad->bfa);
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
+-			   &fcomp, &iocmd->stats);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, &iocmd->stats);
+ 
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	WARN_ON(!bfa_ioc_get_fcmode(&bfad->bfa.ioc));
+@@ -2474,8 +2472,7 @@ bfad_iocmd_qos_reset_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_fcport_s *fcport = BFA_FCPORT_MOD(&bfad->bfa);
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
+-			   &fcomp, NULL);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, NULL);
+ 
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	WARN_ON(!bfa_ioc_get_fcmode(&bfad->bfa.ioc));
+-- 
+2.43.0
+
diff --git a/queue-5.15/scsi-csiostor-avoid-function-pointer-casts.patch b/queue-5.15/scsi-csiostor-avoid-function-pointer-casts.patch
new file mode 100644
index 00000000000..0cdffcc5fdf
--- /dev/null
+++ b/queue-5.15/scsi-csiostor-avoid-function-pointer-casts.patch
@@ -0,0 +1,135 @@
+From a1adb4df267f7d778623de0a87f02001bc21ba44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:05:00 +0100
+Subject: scsi: csiostor: Avoid function pointer casts
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9f3dbcb5632d6876226031d552ef6163bb3ad215 ]
+
+csiostor uses function pointer casts to keep the csio_ln_ev state machine
+hidden, but this causes warnings about control flow integrity (KCFI)
+violations in clang-16 and higher:
+
+drivers/scsi/csiostor/csio_lnode.c:1098:33: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1098 |         return (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready));
+      |                                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/csiostor/csio_lnode.c:1369:29: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1369 |         if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_uninit)) {
+      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/csiostor/csio_lnode.c:1373:29: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1373 |         if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready)) {
+      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/csiostor/csio_lnode.c:1377:29: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1377 |         if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_offline)) {
+      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Move the enum into a shared header so the correct types can be used without
+the need for casts.
+
+Fixes: a3667aaed569 ("[SCSI] csiostor: Chelsio FCoE offload driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240213100518.457623-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_defs.h  | 18 ++++++++++++++++--
+ drivers/scsi/csiostor/csio_lnode.c |  8 ++++----
+ drivers/scsi/csiostor/csio_lnode.h | 13 -------------
+ 3 files changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/scsi/csiostor/csio_defs.h b/drivers/scsi/csiostor/csio_defs.h
+index c38017b4af982..e50e93e7fe5a1 100644
+--- a/drivers/scsi/csiostor/csio_defs.h
++++ b/drivers/scsi/csiostor/csio_defs.h
+@@ -73,7 +73,21 @@ csio_list_deleted(struct list_head *list)
+ #define csio_list_prev(elem)	(((struct list_head *)(elem))->prev)
+ 
+ /* State machine */
+-typedef void (*csio_sm_state_t)(void *, uint32_t);
++struct csio_lnode;
++
++/* State machine evets */
++enum csio_ln_ev {
++	CSIO_LNE_NONE = (uint32_t)0,
++	CSIO_LNE_LINKUP,
++	CSIO_LNE_FAB_INIT_DONE,
++	CSIO_LNE_LINK_DOWN,
++	CSIO_LNE_DOWN_LINK,
++	CSIO_LNE_LOGO,
++	CSIO_LNE_CLOSE,
++	CSIO_LNE_MAX_EVENT,
++};
++
++typedef void (*csio_sm_state_t)(struct csio_lnode *ln, enum csio_ln_ev evt);
+ 
+ struct csio_sm {
+ 	struct list_head	sm_list;
+@@ -83,7 +97,7 @@ struct csio_sm {
+ static inline void
+ csio_set_state(void *smp, void *state)
+ {
+-	((struct csio_sm *)smp)->sm_state = (csio_sm_state_t)state;
++	((struct csio_sm *)smp)->sm_state = state;
+ }
+ 
+ static inline void
+diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
+index d5ac938970232..5b3ffefae476d 100644
+--- a/drivers/scsi/csiostor/csio_lnode.c
++++ b/drivers/scsi/csiostor/csio_lnode.c
+@@ -1095,7 +1095,7 @@ csio_handle_link_down(struct csio_hw *hw, uint8_t portid, uint32_t fcfi,
+ int
+ csio_is_lnode_ready(struct csio_lnode *ln)
+ {
+-	return (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready));
++	return (csio_get_state(ln) == csio_lns_ready);
+ }
+ 
+ /*****************************************************************************/
+@@ -1366,15 +1366,15 @@ csio_free_fcfinfo(struct kref *kref)
+ void
+ csio_lnode_state_to_str(struct csio_lnode *ln, int8_t *str)
+ {
+-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_uninit)) {
++	if (csio_get_state(ln) == csio_lns_uninit) {
+ 		strcpy(str, "UNINIT");
+ 		return;
+ 	}
+-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready)) {
++	if (csio_get_state(ln) == csio_lns_ready) {
+ 		strcpy(str, "READY");
+ 		return;
+ 	}
+-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_offline)) {
++	if (csio_get_state(ln) == csio_lns_offline) {
+ 		strcpy(str, "OFFLINE");
+ 		return;
+ 	}
+diff --git a/drivers/scsi/csiostor/csio_lnode.h b/drivers/scsi/csiostor/csio_lnode.h
+index 372a67d122d38..607698a0f0631 100644
+--- a/drivers/scsi/csiostor/csio_lnode.h
++++ b/drivers/scsi/csiostor/csio_lnode.h
+@@ -53,19 +53,6 @@
+ extern int csio_fcoe_rnodes;
+ extern int csio_fdmi_enable;
+ 
+-/* State machine evets */
+-enum csio_ln_ev {
+-	CSIO_LNE_NONE = (uint32_t)0,
+-	CSIO_LNE_LINKUP,
+-	CSIO_LNE_FAB_INIT_DONE,
+-	CSIO_LNE_LINK_DOWN,
+-	CSIO_LNE_DOWN_LINK,
+-	CSIO_LNE_LOGO,
+-	CSIO_LNE_CLOSE,
+-	CSIO_LNE_MAX_EVENT,
+-};
+-
+-
+ struct csio_fcf_info {
+ 	struct list_head	list;
+ 	uint8_t			priority;
+-- 
+2.43.0
+
diff --git a/queue-5.15/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch b/queue-5.15/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
new file mode 100644
index 00000000000..30ef31e2d5d
--- /dev/null
+++ b/queue-5.15/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
@@ -0,0 +1,98 @@
+From 9c0e0735a5921867c3ed3857d4304d501ce50722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:06:19 +0300
+Subject: selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY
+ values
+
+From: Andrey Grafin <conquistador@yandex-team.ru>
+
+[ Upstream commit 40628f9fff73adecac77a9aa390f8016724cad99 ]
+
+Check that bpf_object__load() successfully creates map_in_maps
+with BPF_MAP_TYPE_PERF_EVENT_ARRAY values.
+These changes cover fix in the previous patch
+"libbpf: Apply map_set_def_max_entries() for inner_maps on creation".
+
+A command line output is:
+- w/o fix
+$ sudo ./test_maps
+libbpf: map 'mim_array_pe': failed to create inner map: -22
+libbpf: map 'mim_array_pe': failed to create: Invalid argument(-22)
+libbpf: failed to load object './test_map_in_map.bpf.o'
+Failed to load test prog
+
+- with fix
+$ sudo ./test_maps
+...
+test_maps: OK, 0 SKIPPED
+
+Fixes: 646f02ffdd49 ("libbpf: Add BTF-defined map-in-map support")
+Signed-off-by: Andrey Grafin <conquistador@yandex-team.ru>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/bpf/20240117130619.9403-2-conquistador@yandex-team.ru
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_map_in_map.c     | 26 +++++++++++++++++++
+ tools/testing/selftests/bpf/test_maps.c       |  6 ++++-
+ 2 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_map_in_map.c b/tools/testing/selftests/bpf/progs/test_map_in_map.c
+index 5f0e0bfc151e5..8a52bc56568d6 100644
+--- a/tools/testing/selftests/bpf/progs/test_map_in_map.c
++++ b/tools/testing/selftests/bpf/progs/test_map_in_map.c
+@@ -23,6 +23,32 @@ struct {
+ 	__uint(value_size, sizeof(__u32));
+ } mim_hash SEC(".maps");
+ 
++/* The following three maps are used to test
++ * perf_event_array map can be an inner
++ * map of hash/array_of_maps.
++ */
++struct perf_event_array {
++	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
++	__type(key, __u32);
++	__type(value, __u32);
++} inner_map0 SEC(".maps");
++
++struct {
++	__uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
++	__uint(max_entries, 1);
++	__type(key, __u32);
++	__array(values, struct perf_event_array);
++} mim_array_pe SEC(".maps") = {
++	.values = {&inner_map0}};
++
++struct {
++	__uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
++	__uint(max_entries, 1);
++	__type(key, __u32);
++	__array(values, struct perf_event_array);
++} mim_hash_pe SEC(".maps") = {
++	.values = {&inner_map0}};
++
+ SEC("xdp")
+ int xdp_mimtest0(struct xdp_md *ctx)
+ {
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index c7a36a9378f8c..a72cc78706eaf 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -1196,7 +1196,11 @@ static void test_map_in_map(void)
+ 		goto out_map_in_map;
+ 	}
+ 
+-	bpf_object__load(obj);
++	err = bpf_object__load(obj);
++	if (err) {
++		printf("Failed to load test prog\n");
++		goto out_map_in_map;
++	}
+ 
+ 	map = bpf_object__find_map_by_name(obj, "mim_array");
+ 	if (!map) {
+-- 
+2.43.0
+
diff --git a/queue-5.15/series b/queue-5.15/series
index 1802cdfff91..930cbdd7569 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -28,3 +28,257 @@ input-gpio_keys_polled-suppress-deferred-probe-error.patch
 asoc-wm8962-enable-oscillator-if-selecting-wm8962_fl.patch
 asoc-wm8962-enable-both-spkoutr_ena-and-spkoutl_ena-.patch
 asoc-wm8962-fix-up-incorrect-error-message-in-wm8962.patch
+do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
+f2fs-implement-iomap-operations.patch
+s390-dasd-put-block-allocation-in-separate-function.patch
+s390-dasd-add-query-pprc-function.patch
+s390-dasd-add-copy-pair-setup.patch
+s390-dasd-add-autoquiesce-feature.patch
+s390-dasd-use-dev_-for-device-log-messages.patch
+s390-dasd-fix-double-module-refcount-decrement.patch
+nbd-null-check-for-nla_nest_start.patch
+fs-select-rework-stack-allocation-hack-for-clang.patch
+md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
+lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
+time-test-fix-incorrect-format-specifier.patch
+rtc-test-fix-invalid-format-specifier.patch
+aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
+timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
+timekeeping-fix-cross-timestamp-interpolation-corner.patch
+timekeeping-fix-cross-timestamp-interpolation-for-no.patch
+sched-fair-take-the-scheduling-domain-into-account-i.patch
+wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
+wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
+wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
+wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
+wifi-b43-disable-qos-for-bcm4331.patch
+wifi-wilc1000-fix-declarations-ordering.patch
+wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
+wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
+wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
+wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
+arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
+cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
+cpufreq-explicitly-include-correct-dt-includes.patch
+cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
+sock_diag-annotate-data-races-around-sock_diag_handl.patch
+inet_diag-annotate-data-races-around-inet_diag_table.patch
+bpftool-silence-build-warning-about-calloc.patch
+libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
+selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
+af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
+cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
+arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
+arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
+arm64-dts-imx8mm-kontron-add-support-for-ultra-high-.patch
+arm64-dts-imx8mm-kontron-use-the-vselect-signal-to-s.patch
+arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
+wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
+wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
+wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
+wifi-iwlwifi-fix-ewrd-table-validity-check.patch
+arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
+pwm-atmel-hlcdc-convert-to-platform-remove-callback-.patch
+pwm-atmel-hlcdc-use-consistent-variable-naming.patch
+pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
+net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
+wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
+arm64-dts-qcom-msm8996-move-clock-cells-to-qmp-phy-c.patch
+arm64-dts-qcom-msm8998-drop-usb-phy-clock-index.patch
+arm64-dts-qcom-msm8998-switch-usb-qmp-phy-to-new-sty.patch
+arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
+arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sdm845-switch-ufs-qmp-phy-to-new-styl.patch
+arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm8150-switch-ufs-qmp-phy-to-new-styl.patch
+arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm8250-switch-ufs-qmp-phy-to-new-styl.patch
+arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
+printk-add-panic_in_progress-helper.patch
+printk-disable-passing-console-lock-owner-completely.patch
+pwm-sti-implement-.apply-callback.patch
+pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
+wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
+s390-vdso-drop-fpic-from-ldflags.patch
+ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
+arm64-dts-mt8183-kukui-add-type-c-node.patch
+arm64-dts-mt8183-kukui-split-out-keyboard-node-and-d.patch
+arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
+arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
+bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
+arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
+wireless-remove-redundant-flush_workqueue-calls.patch
+wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
+acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
+bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
+iommu-amd-mark-interrupt-as-managed.patch
+wifi-brcmsmac-avoid-function-pointer-casts.patch
+net-ena-remove-ena_select_queue.patch
+arm-dts-arm-realview-fix-development-chip-rom-compat.patch
+arm64-dts-renesas-r8a779a0-update-to-r-car-gen4-comp.patch
+arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
+arm-dts-imx6dl-yapp4-move-phy-reset-into-switch-node.patch
+arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
+arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
+arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
+acpi-resource-add-infinity-laptops-to-irq1_edge_low_.patch
+acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
+acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
+acpi-scan-fix-device-check-notification-handling.patch
+x86-relocs-ignore-relocations-in-.notes-section.patch
+sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
+mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
+wifi-rtw88-8821c-fix-false-alarm-count.patch
+pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
+iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
+igb-move-perout-and-extts-isr-logic-to-separate-func.patch
+igb-fix-missing-time-sync-events.patch
+bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
+bluetooth-hci_qca-add-support-for-qti-bluetooth-chip.patch
+bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
+bluetooth-hci_core-fix-possible-buffer-overflow.patch
+sr9800-add-check-for-usbnet_get_endpoints.patch
+bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
+bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
+bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
+ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
+net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
+net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
+net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
+net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
+net-phy-dp83822-enable-rgmii-mode-if-phy_interface_i.patch
+net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
+opp-debugfs-fix-warning-around-icc_get_name.patch
+tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
+net-change-sock_getsockopt-to-take-the-sk-ptr-instea.patch
+bpf-net-change-sk_getsockopt-to-take-the-sockptr_t-a.patch
+bpf-net-change-do_ip_getsockopt-to-take-the-sockptr_.patch
+ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
+l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
+udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
+net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
+net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
+nfp-flower-handle-acti_netdevs-allocation-failure.patch
+dm-raid-fix-false-positive-for-requeue-needed-during.patch
+dm-call-the-resume-method-on-internal-suspend.patch
+drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
+drm-tegra-dpaux-populate-aux-bus.patch
+drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
+drm-tegra-dsi-make-use-of-the-helper-function-dev_er.patch
+drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
+drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
+drm-tegra-dc-rgb-allow-changing-plld-rate-on-tegra30.patch
+drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
+drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
+drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
+drm-rockchip-inno_hdmi-fix-video-timing.patch
+drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
+drm-ttm-add-ttm_resource_fini-v2.patch
+drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
+drm-rockchip-lvds-do-not-overwrite-error-code.patch
+drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
+drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
+dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
+media-tc358743-register-v4l2-async-device-only-after.patch
+pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
+perf-record-fix-possible-incorrect-free-in-record__s.patch
+hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
+drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
+drm-amd-display-fix-potential-null-pointer-dereferen.patch
+perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
+pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
+clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
+media-em28xx-annotate-unchecked-call-to-media_device.patch
+media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
+media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
+media-edia-dvbdev-fix-a-use-after-free.patch
+pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
+clk-qcom-reset-commonize-the-de-assert-functions.patch
+clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
+dt-bindings-clock-qcom-add-missing-ufs-qref-clocks.patch
+clk-qcom-gcc-sc8180x-add-missing-ufs-qref-clocks.patch
+quota-simplify-drop_dquot_ref.patch
+quota-fix-potential-null-pointer-dereference.patch
+quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
+pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
+pci-switchtec-fix-an-error-handling-path-in-switchte.patch
+crypto-xilinx-call-finalize-with-bh-disabled.patch
+perf-thread_map-free-strlist-on-normal-path-in-threa.patch
+drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
+alsa-seq-fix-function-cast-warnings.patch
+perf-stat-avoid-metric-only-segv.patch
+asoc-meson-use-dev_err_probe-helper.patch
+asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
+asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
+powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
+pci-endpoint-support-ntb-transfer-between-rc-and-ep.patch
+ntb-epf-fix-possible-memory-leak-in-pci_vntb_probe.patch
+ntb-fix-possible-name-leak-in-ntb_register_device.patch
+media-sun8i-di-fix-coefficient-writes.patch
+media-sun8i-di-fix-power-on-off-sequences.patch
+media-sun8i-di-fix-chroma-difference-threshold.patch
+media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
+media-go7007-add-check-of-return-value-of-go7007_rea.patch
+media-pvrusb2-remove-redundant-null-check.patch
+media-pvrusb2-fix-pvr2_stream_callback-casts.patch
+clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
+drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
+pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
+clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
+clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
+drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
+mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
+mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
+crypto-arm-sha-fix-function-cast-warnings.patch
+drm-tidss-fix-initial-plane-zpos-values.patch
+mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
+mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
+asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
+asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
+hid-amd_sfh-update-hpd-sensor-structure-elements.patch
+drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
+media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
+media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
+media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
+media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
+media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
+drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
+powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
+drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
+module-add-support-for-default-value-for-module-asyn.patch
+modules-wait-do_free_init-correctly.patch
+powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
+leds-aw2013-unlock-mutex-before-destroying-it.patch
+leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
+backlight-lm3630a-initialize-backlight_properties-on.patch
+backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
+backlight-da9052-fully-initialize-backlight_properti.patch
+backlight-lm3639-fully-initialize-backlight_properti.patch
+backlight-lp8788-fully-initialize-backlight_properti.patch
+arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
+sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
+clk-fix-clk_core_get-null-dereference.patch
+clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
+alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
+alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
+rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
+f2fs-multidevice-support-direct-io.patch
+f2fs-invalidate-meta_mapping-before-ipu-dio-write.patch
+f2fs-replace-congestion_wait-calls-with-io_schedule_.patch
+f2fs-fix-to-invalidate-meta_mapping-before-dio-write.patch
+f2fs-invalidate-meta-pages-only-for-post_read-requir.patch
+f2fs-reduce-stack-memory-cost-by-using-bitfield-in-s.patch
+f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
+f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
+scsi-csiostor-avoid-function-pointer-casts.patch
+rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
+rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
+scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
+net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
+nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
+nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
+watchdog-stm32_iwdg-initialize-default-timeout.patch
+nfs-fix-an-off-by-one-in-root_nfs_cat.patch
+f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
+afs-revert-afs-hide-silly-rename-files-from-userspac.patch
diff --git a/queue-5.15/sock_diag-annotate-data-races-around-sock_diag_handl.patch b/queue-5.15/sock_diag-annotate-data-races-around-sock_diag_handl.patch
new file mode 100644
index 00000000000..ae3ac78bb46
--- /dev/null
+++ b/queue-5.15/sock_diag-annotate-data-races-around-sock_diag_handl.patch
@@ -0,0 +1,74 @@
+From afaca66ef30eb6955eb31db288ffe66ea56741a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 11:25:55 +0000
+Subject: sock_diag: annotate data-races around sock_diag_handlers[family]
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit efd402537673f9951992aea4ef0f5ff51d858f4b ]
+
+__sock_diag_cmd() and sock_diag_bind() read sock_diag_handlers[family]
+without a lock held.
+
+Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.
+
+Fixes: 8ef874bfc729 ("sock_diag: Move the sock_ code to net/core/")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_diag.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index c9c45b935f990..bce65b519ee80 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -189,7 +189,7 @@ int sock_diag_register(const struct sock_diag_handler *hndl)
+ 	if (sock_diag_handlers[hndl->family])
+ 		err = -EBUSY;
+ 	else
+-		sock_diag_handlers[hndl->family] = hndl;
++		WRITE_ONCE(sock_diag_handlers[hndl->family], hndl);
+ 	mutex_unlock(&sock_diag_table_mutex);
+ 
+ 	return err;
+@@ -205,7 +205,7 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld)
+ 
+ 	mutex_lock(&sock_diag_table_mutex);
+ 	BUG_ON(sock_diag_handlers[family] != hnld);
+-	sock_diag_handlers[family] = NULL;
++	WRITE_ONCE(sock_diag_handlers[family], NULL);
+ 	mutex_unlock(&sock_diag_table_mutex);
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_unregister);
+@@ -223,7 +223,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 		return -EINVAL;
+ 	req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX);
+ 
+-	if (sock_diag_handlers[req->sdiag_family] == NULL)
++	if (READ_ONCE(sock_diag_handlers[req->sdiag_family]) == NULL)
+ 		sock_load_diag_module(req->sdiag_family, 0);
+ 
+ 	mutex_lock(&sock_diag_table_mutex);
+@@ -282,12 +282,12 @@ static int sock_diag_bind(struct net *net, int group)
+ 	switch (group) {
+ 	case SKNLGRP_INET_TCP_DESTROY:
+ 	case SKNLGRP_INET_UDP_DESTROY:
+-		if (!sock_diag_handlers[AF_INET])
++		if (!READ_ONCE(sock_diag_handlers[AF_INET]))
+ 			sock_load_diag_module(AF_INET, 0);
+ 		break;
+ 	case SKNLGRP_INET6_TCP_DESTROY:
+ 	case SKNLGRP_INET6_UDP_DESTROY:
+-		if (!sock_diag_handlers[AF_INET6])
++		if (!READ_ONCE(sock_diag_handlers[AF_INET6]))
+ 			sock_load_diag_module(AF_INET6, 0);
+ 		break;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-5.15/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch b/queue-5.15/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
new file mode 100644
index 00000000000..2fef944bd62
--- /dev/null
+++ b/queue-5.15/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
@@ -0,0 +1,62 @@
+From 4c82dfd93291c10ce7928fa2d9e5422ac2204c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 18:42:28 +0100
+Subject: sparc32: Fix section mismatch in leon_pci_grpci
+
+From: Sam Ravnborg <sam@ravnborg.org>
+
+[ Upstream commit 24338a6ae13cb743ced77da1b3a12c83f08a0c96 ]
+
+Passing a datastructre marked _initconst to platform_driver_register()
+is wrong. Drop the __initconst notation.
+
+This fixes the following warnings:
+
+WARNING: modpost: vmlinux: section mismatch in reference: grpci1_of_driver+0x30 (section: .data) -> grpci1_of_match (section: .init.rodata)
+WARNING: modpost: vmlinux: section mismatch in reference: grpci2_of_driver+0x30 (section: .data) -> grpci2_of_match (section: .init.rodata)
+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Andreas Larsson <andreas@gaisler.com>
+Fixes: 4154bb821f0b ("sparc: leon: grpci1: constify of_device_id")
+Fixes: 03949b1cb9f1 ("sparc: leon: grpci2: constify of_device_id")
+Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Tested-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20240224-sam-fix-sparc32-all-builds-v2-7-1f186603c5c4@ravnborg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/leon_pci_grpci1.c | 2 +-
+ arch/sparc/kernel/leon_pci_grpci2.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/sparc/kernel/leon_pci_grpci1.c b/arch/sparc/kernel/leon_pci_grpci1.c
+index e6935d0ac1ec9..c32590bdd3120 100644
+--- a/arch/sparc/kernel/leon_pci_grpci1.c
++++ b/arch/sparc/kernel/leon_pci_grpci1.c
+@@ -696,7 +696,7 @@ static int grpci1_of_probe(struct platform_device *ofdev)
+ 	return err;
+ }
+ 
+-static const struct of_device_id grpci1_of_match[] __initconst = {
++static const struct of_device_id grpci1_of_match[] = {
+ 	{
+ 	 .name = "GAISLER_PCIFBRG",
+ 	 },
+diff --git a/arch/sparc/kernel/leon_pci_grpci2.c b/arch/sparc/kernel/leon_pci_grpci2.c
+index ca22f93d90454..dd06abc61657f 100644
+--- a/arch/sparc/kernel/leon_pci_grpci2.c
++++ b/arch/sparc/kernel/leon_pci_grpci2.c
+@@ -887,7 +887,7 @@ static int grpci2_of_probe(struct platform_device *ofdev)
+ 	return err;
+ }
+ 
+-static const struct of_device_id grpci2_of_match[] __initconst = {
++static const struct of_device_id grpci2_of_match[] = {
+ 	{
+ 	 .name = "GAISLER_GRPCI2",
+ 	 },
+-- 
+2.43.0
+
diff --git a/queue-5.15/sr9800-add-check-for-usbnet_get_endpoints.patch b/queue-5.15/sr9800-add-check-for-usbnet_get_endpoints.patch
new file mode 100644
index 00000000000..3055bb06852
--- /dev/null
+++ b/queue-5.15/sr9800-add-check-for-usbnet_get_endpoints.patch
@@ -0,0 +1,40 @@
+From a16376fc50379e6661cd82159ce75a8eeba8f5f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 07:59:27 +0000
+Subject: sr9800: Add check for usbnet_get_endpoints
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ]
+
+Add check for usbnet_get_endpoints() and return the error if it fails
+in order to transfer the error.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support")
+Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/sr9800.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
+index 576401c8b1bee..79358369c4565 100644
+--- a/drivers/net/usb/sr9800.c
++++ b/drivers/net/usb/sr9800.c
+@@ -736,7 +736,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf)
+ 
+ 	data->eeprom_len = SR9800_EEPROM_LEN;
+ 
+-	usbnet_get_endpoints(dev, intf);
++	ret = usbnet_get_endpoints(dev, intf);
++	if (ret)
++		goto out;
+ 
+ 	/* LED Setting Rule :
+ 	 * AABB:CCDD
+-- 
+2.43.0
+
diff --git a/queue-5.15/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch b/queue-5.15/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
new file mode 100644
index 00000000000..bad52e5a187
--- /dev/null
+++ b/queue-5.15/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
@@ -0,0 +1,86 @@
+From 4e9eb20ccb13676cd693e4e6edb65e546282acbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 13:38:13 +0800
+Subject: SUNRPC: fix some memleaks in gssx_dec_option_array
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 3cfcfc102a5e57b021b786a755a38935e357797d ]
+
+The creds and oa->data need to be freed in the error-handling paths after
+their allocation. So this patch add these deallocations in the
+corresponding paths.
+
+Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/gss_rpc_xdr.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+index d79f12c2550ac..cb32ab9a83952 100644
+--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
++++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+@@ -250,8 +250,8 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
+ 
+ 	creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
+ 	if (!creds) {
+-		kfree(oa->data);
+-		return -ENOMEM;
++		err = -ENOMEM;
++		goto free_oa;
+ 	}
+ 
+ 	oa->data[0].option.data = CREDS_VALUE;
+@@ -265,29 +265,40 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
+ 
+ 		/* option buffer */
+ 		p = xdr_inline_decode(xdr, 4);
+-		if (unlikely(p == NULL))
+-			return -ENOSPC;
++		if (unlikely(p == NULL)) {
++			err = -ENOSPC;
++			goto free_creds;
++		}
+ 
+ 		length = be32_to_cpup(p);
+ 		p = xdr_inline_decode(xdr, length);
+-		if (unlikely(p == NULL))
+-			return -ENOSPC;
++		if (unlikely(p == NULL)) {
++			err = -ENOSPC;
++			goto free_creds;
++		}
+ 
+ 		if (length == sizeof(CREDS_VALUE) &&
+ 		    memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
+ 			/* We have creds here. parse them */
+ 			err = gssx_dec_linux_creds(xdr, creds);
+ 			if (err)
+-				return err;
++				goto free_creds;
+ 			oa->data[0].value.len = 1; /* presence */
+ 		} else {
+ 			/* consume uninteresting buffer */
+ 			err = gssx_dec_buffer(xdr, &dummy);
+ 			if (err)
+-				return err;
++				goto free_creds;
+ 		}
+ 	}
+ 	return 0;
++
++free_creds:
++	kfree(creds);
++free_oa:
++	kfree(oa->data);
++	oa->data = NULL;
++	return err;
+ }
+ 
+ static int gssx_dec_status(struct xdr_stream *xdr,
+-- 
+2.43.0
+
diff --git a/queue-5.15/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch b/queue-5.15/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
new file mode 100644
index 00000000000..2569124b78c
--- /dev/null
+++ b/queue-5.15/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
@@ -0,0 +1,47 @@
+From b124a2821c05d08a920c283ef327fa863be0aa1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:49 +0000
+Subject: tcp: fix incorrect parameter validation in the do_tcp_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 716edc9706deb3bb2ff56e2eeb83559cea8f22db ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 626cef75afe7a..521c15962c719 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3965,11 +3965,11 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	switch (optname) {
+ 	case TCP_MAXSEG:
+ 		val = tp->mss_cache;
+-- 
+2.43.0
+
diff --git a/queue-5.15/time-test-fix-incorrect-format-specifier.patch b/queue-5.15/time-test-fix-incorrect-format-specifier.patch
new file mode 100644
index 00000000000..915cee975e7
--- /dev/null
+++ b/queue-5.15/time-test-fix-incorrect-format-specifier.patch
@@ -0,0 +1,40 @@
+From 5499f1a4cec0985d3dc394356f214040b20d764b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:17 +0800
+Subject: time: test: Fix incorrect format specifier
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 133e267ef4a26d19c93996a874714e9f3f8c70aa ]
+
+'days' is a s64 (from div_s64), and so should use a %lld specifier.
+
+This was found by extending KUnit's assertion macros to use gcc's
+__printf attribute.
+
+Fixes: 276010551664 ("time: Improve performance of time64_to_tm()")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/time_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/time_test.c b/kernel/time/time_test.c
+index 831e8e779acef..f7c3de01197c9 100644
+--- a/kernel/time/time_test.c
++++ b/kernel/time/time_test.c
+@@ -73,7 +73,7 @@ static void time64_to_tm_test_date_range(struct kunit *test)
+ 
+ 		days = div_s64(secs, 86400);
+ 
+-		#define FAIL_MSG "%05ld/%02d/%02d (%2d) : %ld", \
++		#define FAIL_MSG "%05ld/%02d/%02d (%2d) : %lld", \
+ 			year, month, mdday, yday, days
+ 
+ 		KUNIT_ASSERT_EQ_MSG(test, year - 1900, result.tm_year, FAIL_MSG);
+-- 
+2.43.0
+
diff --git a/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-corner.patch b/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-corner.patch
new file mode 100644
index 00000000000..aedd27c8e57
--- /dev/null
+++ b/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-corner.patch
@@ -0,0 +1,114 @@
+From dc8eed3d4a3b0ce4f1855690fe740b394449b82d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 08:38:40 +0100
+Subject: timekeeping: Fix cross-timestamp interpolation corner case decision
+
+From: Peter Hilber <peter.hilber@opensynergy.com>
+
+[ Upstream commit 87a41130881995f82f7adbafbfeddaebfb35f0ef ]
+
+The cycle_between() helper checks if parameter test is in the open interval
+(before, after). Colloquially speaking, this also applies to the counter
+wrap-around special case before > after. get_device_system_crosststamp()
+currently uses cycle_between() at the first call site to decide whether to
+interpolate for older counter readings.
+
+get_device_system_crosststamp() has the following problem with
+cycle_between() testing against an open interval: Assume that, by chance,
+cycles == tk->tkr_mono.cycle_last (in the following, "cycle_last" for
+brevity). Then, cycle_between() at the first call site, with effective
+argument values cycle_between(cycle_last, cycles, now), returns false,
+enabling interpolation. During interpolation,
+get_device_system_crosststamp() will then call cycle_between() at the
+second call site (if a history_begin was supplied). The effective argument
+values are cycle_between(history_begin->cycles, cycles, cycles), since
+system_counterval.cycles == interval_start == cycles, per the assumption.
+Due to the test against the open interval, cycle_between() returns false
+again. This causes get_device_system_crosststamp() to return -EINVAL.
+
+This failure should be avoided, since get_device_system_crosststamp() works
+both when cycles follows cycle_last (no interpolation), and when cycles
+precedes cycle_last (interpolation). For the case cycles == cycle_last,
+interpolation is actually unneeded.
+
+Fix this by changing cycle_between() into timestamp_in_interval(), which
+now checks against the closed interval, rather than the open interval.
+
+This changes the get_device_system_crosststamp() behavior for three corner
+cases:
+
+1. Bypass interpolation in the case cycles == tk->tkr_mono.cycle_last,
+   fixing the problem described above.
+
+2. At the first timestamp_in_interval() call site, cycles == now no longer
+   causes failure.
+
+3. At the second timestamp_in_interval() call site, history_begin->cycles
+   == system_counterval.cycles no longer causes failure.
+   adjust_historical_crosststamp() also works for this corner case,
+   where partial_history_cycles == total_history_cycles.
+
+These behavioral changes should not cause any problems.
+
+Fixes: 2c756feb18d9 ("time: Add history to cross timestamp interface supporting slower devices")
+Signed-off-by: Peter Hilber <peter.hilber@opensynergy.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20231218073849.35294-3-peter.hilber@opensynergy.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 985aa75eedb24..d21280b3b2ea7 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1163,13 +1163,15 @@ static int adjust_historical_crosststamp(struct system_time_snapshot *history,
+ }
+ 
+ /*
+- * cycle_between - true if test occurs chronologically between before and after
++ * timestamp_in_interval - true if ts is chronologically in [start, end]
++ *
++ * True if ts occurs chronologically at or after start, and before or at end.
+  */
+-static bool cycle_between(u64 before, u64 test, u64 after)
++static bool timestamp_in_interval(u64 start, u64 end, u64 ts)
+ {
+-	if (test > before && test < after)
++	if (ts >= start && ts <= end)
+ 		return true;
+-	if (before > after && (test > before || test < after))
++	if (start > end && (ts >= start || ts <= end))
+ 		return true;
+ 	return false;
+ }
+@@ -1229,7 +1231,7 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ 		 */
+ 		now = tk_clock_read(&tk->tkr_mono);
+ 		interval_start = tk->tkr_mono.cycle_last;
+-		if (!cycle_between(interval_start, cycles, now)) {
++		if (!timestamp_in_interval(interval_start, now, cycles)) {
+ 			clock_was_set_seq = tk->clock_was_set_seq;
+ 			cs_was_changed_seq = tk->cs_was_changed_seq;
+ 			cycles = interval_start;
+@@ -1260,13 +1262,13 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ 		bool discontinuity;
+ 
+ 		/*
+-		 * Check that the counter value occurs after the provided
++		 * Check that the counter value is not before the provided
+ 		 * history reference and that the history doesn't cross a
+ 		 * clocksource change
+ 		 */
+ 		if (!history_begin ||
+-		    !cycle_between(history_begin->cycles,
+-				   system_counterval.cycles, cycles) ||
++		    !timestamp_in_interval(history_begin->cycles,
++					   cycles, system_counterval.cycles) ||
+ 		    history_begin->cs_was_changed_seq != cs_was_changed_seq)
+ 			return -EINVAL;
+ 		partial_history_cycles = cycles - system_counterval.cycles;
+-- 
+2.43.0
+
diff --git a/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-for-no.patch b/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-for-no.patch
new file mode 100644
index 00000000000..8bc9d8831bb
--- /dev/null
+++ b/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-for-no.patch
@@ -0,0 +1,58 @@
+From 67fcb0b09ba9225a452a8a68de6873528bd65830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 08:38:41 +0100
+Subject: timekeeping: Fix cross-timestamp interpolation for non-x86
+
+From: Peter Hilber <peter.hilber@opensynergy.com>
+
+[ Upstream commit 14274d0bd31b4debf28284604589f596ad2e99f2 ]
+
+So far, get_device_system_crosststamp() unconditionally passes
+system_counterval.cycles to timekeeping_cycles_to_ns(). But when
+interpolating system time (do_interp == true), system_counterval.cycles is
+before tkr_mono.cycle_last, contrary to the timekeeping_cycles_to_ns()
+expectations.
+
+On x86, CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE will mitigate on
+interpolating, setting delta to 0. With delta == 0, xtstamp->sys_monoraw
+and xtstamp->sys_realtime are then set to the last update time, as
+implicitly expected by adjust_historical_crosststamp(). On other
+architectures, the resulting nonsense xtstamp->sys_monoraw and
+xtstamp->sys_realtime corrupt the xtstamp (ts) adjustment in
+adjust_historical_crosststamp().
+
+Fix this by deriving xtstamp->sys_monoraw and xtstamp->sys_realtime from
+the last update time when interpolating, by using the local variable
+"cycles". The local variable already has the right value when
+interpolating, unlike system_counterval.cycles.
+
+Fixes: 2c756feb18d9 ("time: Add history to cross timestamp interface supporting slower devices")
+Signed-off-by: Peter Hilber <peter.hilber@opensynergy.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: John Stultz <jstultz@google.com>
+Link: https://lore.kernel.org/r/20231218073849.35294-4-peter.hilber@opensynergy.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index d21280b3b2ea7..dfa6649c490de 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1244,10 +1244,8 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ 				      tk_core.timekeeper.offs_real);
+ 		base_raw = tk->tkr_raw.base;
+ 
+-		nsec_real = timekeeping_cycles_to_ns(&tk->tkr_mono,
+-						     system_counterval.cycles);
+-		nsec_raw = timekeeping_cycles_to_ns(&tk->tkr_raw,
+-						    system_counterval.cycles);
++		nsec_real = timekeeping_cycles_to_ns(&tk->tkr_mono, cycles);
++		nsec_raw = timekeeping_cycles_to_ns(&tk->tkr_raw, cycles);
+ 	} while (read_seqcount_retry(&tk_core.seq, seq));
+ 
+ 	xtstamp->sys_realtime = ktime_add_ns(base_real, nsec_real);
+-- 
+2.43.0
+
diff --git a/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch b/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
new file mode 100644
index 00000000000..efb7c5a2e16
--- /dev/null
+++ b/queue-5.15/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
@@ -0,0 +1,43 @@
+From 810b340e3948befbdf5d6fa3577b57fcb5a50fa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 08:38:39 +0100
+Subject: timekeeping: Fix cross-timestamp interpolation on counter wrap
+
+From: Peter Hilber <peter.hilber@opensynergy.com>
+
+[ Upstream commit 84dccadd3e2a3f1a373826ad71e5ced5e76b0c00 ]
+
+cycle_between() decides whether get_device_system_crosststamp() will
+interpolate for older counter readings.
+
+cycle_between() yields wrong results for a counter wrap-around where after
+< before < test, and for the case after < test < before.
+
+Fix the comparison logic.
+
+Fixes: 2c756feb18d9 ("time: Add history to cross timestamp interface supporting slower devices")
+Signed-off-by: Peter Hilber <peter.hilber@opensynergy.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: John Stultz <jstultz@google.com>
+Link: https://lore.kernel.org/r/20231218073849.35294-2-peter.hilber@opensynergy.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index d921c1b256cf5..985aa75eedb24 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1169,7 +1169,7 @@ static bool cycle_between(u64 before, u64 test, u64 after)
+ {
+ 	if (test > before && test < after)
+ 		return true;
+-	if (test < before && before > after)
++	if (before > after && (test > before || test < after))
+ 		return true;
+ 	return false;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch b/queue-5.15/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
new file mode 100644
index 00000000000..f1edfbc6bbb
--- /dev/null
+++ b/queue-5.15/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
@@ -0,0 +1,47 @@
+From 03edcbc80be661d218072c52bd87cf100aceed27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: udp: fix incorrect parameter validation in the udp_lib_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 4bb3ba7b74fceec6f558745b25a43c6521cf5506 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index c454daa78a2f8..2caf54c241037 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2814,11 +2814,11 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	switch (optname) {
+ 	case UDP_CORK:
+ 		val = READ_ONCE(up->corkflag);
+-- 
+2.43.0
+
diff --git a/queue-5.15/watchdog-stm32_iwdg-initialize-default-timeout.patch b/queue-5.15/watchdog-stm32_iwdg-initialize-default-timeout.patch
new file mode 100644
index 00000000000..247b719bb01
--- /dev/null
+++ b/queue-5.15/watchdog-stm32_iwdg-initialize-default-timeout.patch
@@ -0,0 +1,59 @@
+From aa5259ff56d1debfa29a9e81501bcc758239a692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 13:27:23 -0500
+Subject: watchdog: stm32_iwdg: initialize default timeout
+
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+
+[ Upstream commit dbd7c0088b7f44aa0b9276ed3449df075a7b5b54 ]
+
+The driver never sets a default timeout value, therefore it is
+initialized to zero. When CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED is
+enabled, the watchdog is started during probe. The kernel is supposed to
+automatically ping the watchdog from this point until userspace takes
+over, but this does not happen if the configured timeout is zero. A zero
+timeout causes watchdog_need_worker() to return false, so the heartbeat
+worker does not run and the system therefore resets soon after the
+driver is probed.
+
+This patch fixes this by setting an arbitrary non-zero default timeout.
+The default could be read from the hardware instead, but I didn't see
+any reason to add this complexity.
+
+This has been tested on an STM32F746.
+
+Fixes: 85fdc63fe256 ("drivers: watchdog: stm32_iwdg: set WDOG_HW_RUNNING at probe")
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20240228182723.12855-1-ben.wolsieffer@hefring.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/stm32_iwdg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/watchdog/stm32_iwdg.c b/drivers/watchdog/stm32_iwdg.c
+index a3436c296c97b..8a7b1279a3130 100644
+--- a/drivers/watchdog/stm32_iwdg.c
++++ b/drivers/watchdog/stm32_iwdg.c
+@@ -21,6 +21,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/watchdog.h>
+ 
++#define DEFAULT_TIMEOUT 10
++
+ /* IWDG registers */
+ #define IWDG_KR		0x00 /* Key register */
+ #define IWDG_PR		0x04 /* Prescaler Register */
+@@ -251,6 +253,7 @@ static int stm32_iwdg_probe(struct platform_device *pdev)
+ 	wdd->parent = dev;
+ 	wdd->info = &stm32_iwdg_info;
+ 	wdd->ops = &stm32_iwdg_ops;
++	wdd->timeout = DEFAULT_TIMEOUT;
+ 	wdd->min_timeout = DIV_ROUND_UP((RLR_MIN + 1) * PR_MIN, wdt->rate);
+ 	wdd->max_hw_heartbeat_ms = ((RLR_MAX + 1) * wdt->data->max_prescaler *
+ 				    1000) / wdt->rate;
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch b/queue-5.15/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
new file mode 100644
index 00000000000..df58ff1d985
--- /dev/null
+++ b/queue-5.15/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
@@ -0,0 +1,42 @@
+From 256f810f1a2380315da9604bdd9f24fdc1181233 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Dec 2023 13:29:01 +0200
+Subject: wifi: ath10k: fix NULL pointer dereference in
+ ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
+
+From: Xingyuan Mo <hdthky0@gmail.com>
+
+[ Upstream commit ad25ee36f00172f7d53242dc77c69fff7ced0755 ]
+
+We should check whether the WMI_TLV_TAG_STRUCT_MGMT_TX_COMPL_EVENT tlv is
+present before accessing it, otherwise a null pointer deference error will
+occur.
+
+Fixes: dc405152bb64 ("ath10k: handle mgmt tx completion event")
+Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20231208043433.271449-1-hdthky0@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 7efbe03fbca82..d5dafbecc1845 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -844,6 +844,10 @@ ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev(struct ath10k *ar, struct sk_buff *skb,
+ 	}
+ 
+ 	ev = tb[WMI_TLV_TAG_STRUCT_MGMT_TX_COMPL_EVENT];
++	if (!ev) {
++		kfree(tb);
++		return -EPROTO;
++	}
+ 
+ 	arg->desc_id = ev->desc_id;
+ 	arg->status = ev->status;
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch b/queue-5.15/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
new file mode 100644
index 00000000000..bb1a538eff3
--- /dev/null
+++ b/queue-5.15/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
@@ -0,0 +1,124 @@
+From d1c40940cd5e2dbf131047b9ee82fa63e7b3685e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 15:02:17 +0100
+Subject: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is
+ complete
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 24355fcb0d4cbcb6ddda262596558e8cfba70f11 ]
+
+The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data
+structures have been fully initialised by the time it runs. However, because of
+the order in which things are initialised, this is not guaranteed to be the
+case, because the device is exposed to the USB subsystem before the ath9k driver
+initialisation is completed.
+
+We already committed a partial fix for this in commit:
+8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()")
+
+However, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event
+tasklet, pairing it with an "initialisation complete" bit in the TX struct. It
+seems syzbot managed to trigger the race for one of the other commands as well,
+so let's just move the existing synchronisation bit to cover the whole
+tasklet (setting it at the end of ath9k_htc_probe_device() instead of inside
+ath9k_tx_init()).
+
+Link: https://lore.kernel.org/r/ed1d2c66-1193-4c81-9542-d514c29ba8b8.bugreport@ubisectech.com
+Fixes: 8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()")
+Reported-by: Ubisectech Sirius <bugreport@ubisectech.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20240126140218.1033443-1-toke@toke.dk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc.h          |  2 +-
+ drivers/net/wireless/ath/ath9k/htc_drv_init.c |  4 ++++
+ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c |  4 ----
+ drivers/net/wireless/ath/ath9k/wmi.c          | 10 ++++++----
+ 4 files changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
+index 237f4ec2cffd7..6c33e898b3000 100644
+--- a/drivers/net/wireless/ath/ath9k/htc.h
++++ b/drivers/net/wireless/ath/ath9k/htc.h
+@@ -306,7 +306,6 @@ struct ath9k_htc_tx {
+ 	DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM);
+ 	struct timer_list cleanup_timer;
+ 	spinlock_t tx_lock;
+-	bool initialized;
+ };
+ 
+ struct ath9k_htc_tx_ctl {
+@@ -515,6 +514,7 @@ struct ath9k_htc_priv {
+ 	unsigned long ps_usecount;
+ 	bool ps_enabled;
+ 	bool ps_idle;
++	bool initialized;
+ 
+ #ifdef CONFIG_MAC80211_LEDS
+ 	enum led_brightness brightness;
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 96a3185a96d75..b014185373f34 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -966,6 +966,10 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+ 
+ 	htc_handle->drv_priv = priv;
+ 
++	/* Allow ath9k_wmi_event_tasklet() to operate. */
++	smp_wmb();
++	priv->initialized = true;
++
+ 	return 0;
+ 
+ err_init:
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index d6a3f001dacb9..2fdd27885f543 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -815,10 +815,6 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv)
+ 	skb_queue_head_init(&priv->tx.data_vo_queue);
+ 	skb_queue_head_init(&priv->tx.tx_failed);
+ 
+-	/* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */
+-	smp_wmb();
+-	priv->tx.initialized = true;
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index 1476b42b52a91..805ad31edba2b 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -155,6 +155,12 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
+ 		}
+ 		spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+ 
++		/* Check if ath9k_htc_probe_device() completed. */
++		if (!data_race(priv->initialized)) {
++			kfree_skb(skb);
++			continue;
++		}
++
+ 		hdr = (struct wmi_cmd_hdr *) skb->data;
+ 		cmd_id = be16_to_cpu(hdr->command_id);
+ 		wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+@@ -169,10 +175,6 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
+ 					     &wmi->drv_priv->fatal_work);
+ 			break;
+ 		case WMI_TXSTATUS_EVENTID:
+-			/* Check if ath9k_tx_init() completed. */
+-			if (!data_race(priv->tx.initialized))
+-				break;
+-
+ 			spin_lock_bh(&priv->tx.tx_lock);
+ 			if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
+ 				spin_unlock_bh(&priv->tx.tx_lock);
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-b43-disable-qos-for-bcm4331.patch b/queue-5.15/wifi-b43-disable-qos-for-bcm4331.patch
new file mode 100644
index 00000000000..861e4fbf481
--- /dev/null
+++ b/queue-5.15/wifi-b43-disable-qos-for-bcm4331.patch
@@ -0,0 +1,68 @@
+From 0cc85a7cbf5451a1397e704ffb0d0847fd77157d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:58 +0000
+Subject: wifi: b43: Disable QoS for bcm4331
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 09795bded2e725443fe4a4803cae2079cdaf7b26 ]
+
+bcm4331 seems to not function correctly with QoS support. This may be due
+to issues with currently available firmware or potentially a device
+specific issue.
+
+When queues that are not of the default "best effort" priority are
+selected, traffic appears to not transmit out of the hardware while no
+errors are returned. This behavior is present among all the other priority
+queues: video, voice, and background. While this can be worked around by
+setting a kernel parameter, the default behavior is problematic for most
+users and may be difficult to debug. This patch offers a working out-of-box
+experience for bcm4331 users.
+
+Log of the issue (using ssh low-priority traffic as an example):
+    ssh -T -vvvv git@github.com
+    OpenSSH_9.6p1, OpenSSL 3.0.12 24 Oct 2023
+    debug1: Reading configuration data /etc/ssh/ssh_config
+    debug2: checking match for 'host * exec "/nix/store/q1c2flcykgr4wwg5a6h450hxbk4ch589-bash-5.2-p15/bin/bash -c '/nix/store/c015armnkhr6v18za0rypm7sh1i8js8w-gnupg-2.4.1/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1'"' host github.com originally github.com
+    debug3: /etc/ssh/ssh_config line 5: matched 'host "github.com"'
+    debug1: Executing command: '/nix/store/q1c2flcykgr4wwg5a6h450hxbk4ch589-bash-5.2-p15/bin/bash -c '/nix/store/c015armnkhr6v18za0rypm7sh1i8js8w-gnupg-2.4.1/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1''
+    debug3: command returned status 0
+    debug3: /etc/ssh/ssh_config line 5: matched 'exec "/nix/store/q1c2flcykgr4wwg5a6h450hxbk4ch589-bash-5.2-p15/bin/bash -c '/nix/store/c015armnkhr6v18za0r"'
+    debug2: match found
+    debug1: /etc/ssh/ssh_config line 9: Applying options for *
+    debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/binary-eater/.ssh/known_hosts'
+    debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/binary-eater/.ssh/known_hosts2'
+    debug2: resolving "github.com" port 22
+    debug3: resolve_host: lookup github.com:22
+    debug3: channel_clear_timeouts: clearing
+    debug3: ssh_connect_direct: entering
+    debug1: Connecting to github.com [192.30.255.113] port 22.
+    debug3: set_sock_tos: set socket 3 IP_TOS 0x48
+
+Fixes: e6f5b934fba8 ("b43: Add QOS support")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-5-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
+index ad38aabfd5972..e6e4a18d817a0 100644
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -2587,7 +2587,8 @@ static void b43_request_firmware(struct work_struct *work)
+ 
+ start_ieee80211:
+ 	wl->hw->queues = B43_QOS_QUEUE_NUM;
+-	if (!modparam_qos || dev->fw.opensource)
++	if (!modparam_qos || dev->fw.opensource ||
++	    dev->dev->chip_id == BCMA_CHIP_ID_BCM4331)
+ 		wl->hw->queues = 1;
+ 
+ 	err = ieee80211_register_hw(wl->hw);
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch b/queue-5.15/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
new file mode 100644
index 00000000000..8096a2da551
--- /dev/null
+++ b/queue-5.15/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
@@ -0,0 +1,66 @@
+From 40d7489047a519f7ebf020a0cb91fd4402d1b153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:51 +0000
+Subject: wifi: b43: Stop correct queue in DMA worker when QoS is disabled
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 581c8967d66c4961076dbbee356834e9c6777184 ]
+
+When QoS is disabled, the queue priority value will not map to the correct
+ieee80211 queue since there is only one queue. Stop queue 0 when QoS is
+disabled to prevent trying to stop a non-existent queue and failing to stop
+the actual queue instantiated.
+
+Fixes: bad691946966 ("b43: avoid packet losses in the dma worker code.")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-4-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/main.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
+index 17bcec5f3ff75..ad38aabfd5972 100644
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -3603,7 +3603,7 @@ static void b43_tx_work(struct work_struct *work)
+ 				err = b43_dma_tx(dev, skb);
+ 			if (err == -ENOSPC) {
+ 				wl->tx_queue_stopped[queue_num] = true;
+-				ieee80211_stop_queue(wl->hw, queue_num);
++				b43_stop_queue(dev, queue_num);
+ 				skb_queue_head(&wl->tx_queue[queue_num], skb);
+ 				break;
+ 			}
+@@ -3627,6 +3627,7 @@ static void b43_op_tx(struct ieee80211_hw *hw,
+ 		      struct sk_buff *skb)
+ {
+ 	struct b43_wl *wl = hw_to_b43_wl(hw);
++	u16 skb_queue_mapping;
+ 
+ 	if (unlikely(skb->len < 2 + 2 + 6)) {
+ 		/* Too short, this can't be a valid frame. */
+@@ -3635,12 +3636,12 @@ static void b43_op_tx(struct ieee80211_hw *hw,
+ 	}
+ 	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
+ 
+-	skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
+-	if (!wl->tx_queue_stopped[skb->queue_mapping]) {
++	skb_queue_mapping = skb_get_queue_mapping(skb);
++	skb_queue_tail(&wl->tx_queue[skb_queue_mapping], skb);
++	if (!wl->tx_queue_stopped[skb_queue_mapping])
+ 		ieee80211_queue_work(wl->hw, &wl->tx_work);
+-	} else {
+-		ieee80211_stop_queue(wl->hw, skb->queue_mapping);
+-	}
++	else
++		b43_stop_queue(wl->current_dev, skb_queue_mapping);
+ }
+ 
+ static void b43_qos_params_upload(struct b43_wldev *dev,
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch b/queue-5.15/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
new file mode 100644
index 00000000000..4b56abc4a38
--- /dev/null
+++ b/queue-5.15/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
@@ -0,0 +1,167 @@
+From 15bf1a315d8d871ad0a338e53ec40ee1ab3c83c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:33 +0000
+Subject: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is
+ disabled
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 9636951e4468f02c72cc75a82dc65d003077edbc ]
+
+When QoS is disabled, the queue priority value will not map to the correct
+ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS
+is disabled to prevent trying to stop/wake a non-existent queue and failing
+to stop/wake the actual queue instantiated.
+
+Log of issue before change (with kernel parameter qos=0):
+    [  +5.112651] ------------[ cut here ]------------
+    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3
+    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common
+    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]
+    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS
+    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019
+    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 <0f> 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00
+    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097
+    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000
+    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900
+    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0
+    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000
+    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40
+    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000
+    [  +0.000001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    [  +0.000001] CR2: 00007fafda7ae008 CR3: 000000046d220005 CR4: 00000000000606e0
+    [  +0.000002] Call Trace:
+    [  +0.000003]  <TASK>
+    [  +0.000001]  ? __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000044]  ? __warn+0x81/0x130
+    [  +0.000005]  ? __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000045]  ? report_bug+0x171/0x1a0
+    [  +0.000004]  ? handle_bug+0x41/0x70
+    [  +0.000004]  ? exc_invalid_op+0x17/0x70
+    [  +0.000003]  ? asm_exc_invalid_op+0x1a/0x20
+    [  +0.000005]  ? __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000043]  ieee80211_wake_queue+0x4a/0x80 [mac80211]
+    [  +0.000044]  b43_dma_handle_txstatus+0x29c/0x3a0 [b43]
+    [  +0.000016]  ? __pfx_irq_thread_fn+0x10/0x10
+    [  +0.000002]  b43_handle_txstatus+0x61/0x80 [b43]
+    [  +0.000012]  b43_interrupt_thread_handler+0x3f9/0x6b0 [b43]
+    [  +0.000011]  irq_thread_fn+0x23/0x60
+    [  +0.000002]  irq_thread+0xfe/0x1c0
+    [  +0.000002]  ? __pfx_irq_thread_dtor+0x10/0x10
+    [  +0.000001]  ? __pfx_irq_thread+0x10/0x10
+    [  +0.000001]  kthread+0xe8/0x120
+    [  +0.000003]  ? __pfx_kthread+0x10/0x10
+    [  +0.000003]  ret_from_fork+0x34/0x50
+    [  +0.000002]  ? __pfx_kthread+0x10/0x10
+    [  +0.000002]  ret_from_fork_asm+0x1b/0x30
+    [  +0.000004]  </TASK>
+    [  +0.000001] ---[ end trace 0000000000000000 ]---
+
+    [  +0.000065] ------------[ cut here ]------------
+    [  +0.000001] WARNING: CPU: 0 PID: 56077 at net/mac80211/util.c:514 __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000077] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3
+    [  +0.000073]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common
+    [  +0.000084]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43]
+    [  +0.000012] CPU: 0 PID: 56077 Comm: kworker/u16:17 Tainted: G        W  O       6.6.7 #1-NixOS
+    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019
+    [  +0.000001] Workqueue: phy7 b43_tx_work [b43]
+    [  +0.000019] RIP: 0010:__ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000076] Code: 74 11 48 8b 78 08 0f b7 d6 89 e9 4c 89 e6 e8 ab f4 00 00 65 ff 0d 9c b7 34 3f 0f 85 55 ff ff ff 0f 1f 44 00 00 e9 4b ff ff ff <0f> 0b 5b 5d 41 5c 41 5d c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90
+    [  +0.000002] RSP: 0000:ffffc90004157d50 EFLAGS: 00010097
+    [  +0.000002] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000
+    [  +0.000002] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8882d65d0900
+    [  +0.000002] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
+    [  +0.000001] R10: 00000000000000ff R11: ffff88814d0155a0 R12: ffff8882d65d0900
+    [  +0.000002] R13: 0000000000000000 R14: ffff8881002d2800 R15: 00000000000000d0
+    [  +0.000002] FS:  0000000000000000(0000) GS:ffff88846f800000(0000) knlGS:0000000000000000
+    [  +0.000003] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    [  +0.000002] CR2: 00007f2e8c10c880 CR3: 0000000385b66005 CR4: 00000000000606f0
+    [  +0.000002] Call Trace:
+    [  +0.000001]  <TASK>
+    [  +0.000001]  ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000075]  ? __warn+0x81/0x130
+    [  +0.000004]  ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000075]  ? report_bug+0x171/0x1a0
+    [  +0.000005]  ? handle_bug+0x41/0x70
+    [  +0.000003]  ? exc_invalid_op+0x17/0x70
+    [  +0.000004]  ? asm_exc_invalid_op+0x1a/0x20
+    [  +0.000004]  ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000076]  ieee80211_stop_queue+0x36/0x50 [mac80211]
+    [  +0.000077]  b43_dma_tx+0x550/0x780 [b43]
+    [  +0.000023]  b43_tx_work+0x90/0x130 [b43]
+    [  +0.000018]  process_one_work+0x174/0x340
+    [  +0.000003]  worker_thread+0x27b/0x3a0
+    [  +0.000004]  ? __pfx_worker_thread+0x10/0x10
+    [  +0.000002]  kthread+0xe8/0x120
+    [  +0.000003]  ? __pfx_kthread+0x10/0x10
+    [  +0.000004]  ret_from_fork+0x34/0x50
+    [  +0.000002]  ? __pfx_kthread+0x10/0x10
+    [  +0.000003]  ret_from_fork_asm+0x1b/0x30
+    [  +0.000006]  </TASK>
+    [  +0.000001] ---[ end trace 0000000000000000 ]---
+
+Fixes: e6f5b934fba8 ("b43: Add QOS support")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-2-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/b43.h | 16 ++++++++++++++++
+ drivers/net/wireless/broadcom/b43/dma.c |  4 ++--
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/b43.h b/drivers/net/wireless/broadcom/b43/b43.h
+index 67b4bac048e58..c0d8fc0b22fb2 100644
+--- a/drivers/net/wireless/broadcom/b43/b43.h
++++ b/drivers/net/wireless/broadcom/b43/b43.h
+@@ -1082,6 +1082,22 @@ static inline bool b43_using_pio_transfers(struct b43_wldev *dev)
+ 	return dev->__using_pio_transfers;
+ }
+ 
++static inline void b43_wake_queue(struct b43_wldev *dev, int queue_prio)
++{
++	if (dev->qos_enabled)
++		ieee80211_wake_queue(dev->wl->hw, queue_prio);
++	else
++		ieee80211_wake_queue(dev->wl->hw, 0);
++}
++
++static inline void b43_stop_queue(struct b43_wldev *dev, int queue_prio)
++{
++	if (dev->qos_enabled)
++		ieee80211_stop_queue(dev->wl->hw, queue_prio);
++	else
++		ieee80211_stop_queue(dev->wl->hw, 0);
++}
++
+ /* Message printing */
+ __printf(2, 3) void b43info(struct b43_wl *wl, const char *fmt, ...);
+ __printf(2, 3) void b43err(struct b43_wl *wl, const char *fmt, ...);
+diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c
+index 9a7c62bd5e431..cfaf2f9d67b22 100644
+--- a/drivers/net/wireless/broadcom/b43/dma.c
++++ b/drivers/net/wireless/broadcom/b43/dma.c
+@@ -1399,7 +1399,7 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
+ 	    should_inject_overflow(ring)) {
+ 		/* This TX ring is full. */
+ 		unsigned int skb_mapping = skb_get_queue_mapping(skb);
+-		ieee80211_stop_queue(dev->wl->hw, skb_mapping);
++		b43_stop_queue(dev, skb_mapping);
+ 		dev->wl->tx_queue_stopped[skb_mapping] = true;
+ 		ring->stopped = true;
+ 		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
+@@ -1570,7 +1570,7 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ 	} else {
+ 		/* If the driver queue is running wake the corresponding
+ 		 * mac80211 queue. */
+-		ieee80211_wake_queue(dev->wl->hw, ring->queue_prio);
++		b43_wake_queue(dev, ring->queue_prio);
+ 		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
+ 			b43dbg(dev->wl, "Woke up TX ring %d\n", ring->index);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch b/queue-5.15/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
new file mode 100644
index 00000000000..a5d15fb0083
--- /dev/null
+++ b/queue-5.15/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
@@ -0,0 +1,59 @@
+From ac77348ef8dad480e7cc280603485ffeeb0dff9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:45 +0000
+Subject: wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is
+ disabled
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 77135a38f6c2f950d2306ac3d37cbb407e6243f2 ]
+
+When QoS is disabled, the queue priority value will not map to the correct
+ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS
+is disabled to prevent trying to stop/wake a non-existent queue and failing
+to stop/wake the actual queue instantiated.
+
+Fixes: 5100d5ac81b9 ("b43: Add PIO support for PCMCIA devices")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-3-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/pio.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/pio.c b/drivers/net/wireless/broadcom/b43/pio.c
+index 8c28a9250cd19..cc19b589fa70d 100644
+--- a/drivers/net/wireless/broadcom/b43/pio.c
++++ b/drivers/net/wireless/broadcom/b43/pio.c
+@@ -525,7 +525,7 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
+ 	if (total_len > (q->buffer_size - q->buffer_used)) {
+ 		/* Not enough memory on the queue. */
+ 		err = -EBUSY;
+-		ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
++		b43_stop_queue(dev, skb_get_queue_mapping(skb));
+ 		q->stopped = true;
+ 		goto out;
+ 	}
+@@ -552,7 +552,7 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
+ 	if (((q->buffer_size - q->buffer_used) < roundup(2 + 2 + 6, 4)) ||
+ 	    (q->free_packet_slots == 0)) {
+ 		/* The queue is full. */
+-		ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
++		b43_stop_queue(dev, skb_get_queue_mapping(skb));
+ 		q->stopped = true;
+ 	}
+ 
+@@ -587,7 +587,7 @@ void b43_pio_handle_txstatus(struct b43_wldev *dev,
+ 	list_add(&pack->list, &q->packets_list);
+ 
+ 	if (q->stopped) {
+-		ieee80211_wake_queue(dev->wl->hw, q->queue_prio);
++		b43_wake_queue(dev, q->queue_prio);
+ 		q->stopped = false;
+ 	}
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-brcmsmac-avoid-function-pointer-casts.patch b/queue-5.15/wifi-brcmsmac-avoid-function-pointer-casts.patch
new file mode 100644
index 00000000000..ab6a6ab1637
--- /dev/null
+++ b/queue-5.15/wifi-brcmsmac-avoid-function-pointer-casts.patch
@@ -0,0 +1,81 @@
+From 3700e9f834d8804e0ac6942295d6f89020388e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:05:37 +0100
+Subject: wifi: brcmsmac: avoid function pointer casts
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e1ea6db35fc3ba5ff063f097385e9f7a88c25356 ]
+
+An old cleanup went a little too far and causes a warning with clang-16
+and higher as it breaks control flow integrity (KCFI) rules:
+
+drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c:64:34: error: cast from 'void (*)(struct brcms_phy *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   64 |                         brcms_init_timer(physhim->wl, (void (*)(void *))fn,
+      |                                                       ^~~~~~~~~~~~~~~~~~~~
+
+Change this one instance back to passing a void pointer so it can be
+used with the timer callback interface.
+
+Fixes: d89a4c80601d ("staging: brcm80211: removed void * from softmac phy")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240213100548.457854-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c   | 3 ++-
+ drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c  | 5 ++---
+ drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h  | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
+index ccc621b8ed9f2..4a1fe982a948e 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
+@@ -383,8 +383,9 @@ struct shared_phy *wlc_phy_shared_attach(struct shared_phy_params *shp)
+ 	return sh;
+ }
+ 
+-static void wlc_phy_timercb_phycal(struct brcms_phy *pi)
++static void wlc_phy_timercb_phycal(void *ptr)
+ {
++	struct brcms_phy *pi = ptr;
+ 	uint delay = 5;
+ 
+ 	if (PHY_PERICAL_MPHASE_PENDING(pi)) {
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
+index a0de5db0cd646..b723817915365 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
+@@ -57,12 +57,11 @@ void wlc_phy_shim_detach(struct phy_shim_info *physhim)
+ }
+ 
+ struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
+-				     void (*fn)(struct brcms_phy *pi),
++				     void (*fn)(void *pi),
+ 				     void *arg, const char *name)
+ {
+ 	return (struct wlapi_timer *)
+-			brcms_init_timer(physhim->wl, (void (*)(void *))fn,
+-					 arg, name);
++			brcms_init_timer(physhim->wl, fn, arg, name);
+ }
+ 
+ void wlapi_free_timer(struct wlapi_timer *t)
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
+index dd8774717adee..27d0934e600ed 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
+@@ -131,7 +131,7 @@ void wlc_phy_shim_detach(struct phy_shim_info *physhim);
+ 
+ /* PHY to WL utility functions */
+ struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
+-				     void (*fn)(struct brcms_phy *pi),
++				     void (*fn)(void *pi),
+ 				     void *arg, const char *name);
+ void wlapi_free_timer(struct wlapi_timer *t);
+ void wlapi_add_timer(struct wlapi_timer *t, uint ms, int periodic);
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch b/queue-5.15/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
new file mode 100644
index 00000000000..b7166058c72
--- /dev/null
+++ b/queue-5.15/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
@@ -0,0 +1,43 @@
+From 3f393c21c5d4a0134db02e122825e083f7fd61a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 08:53:53 +0200
+Subject: wifi: iwlwifi: dbg-tlv: ensure NUL termination
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ]
+
+The iwl_fw_ini_debug_info_tlv is used as a string, so we must
+ensure the string is terminated correctly before using it.
+
+Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4c055dc84984a0@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+index 8a610c518082a..fe3239c4607e3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+@@ -99,6 +99,12 @@ static int iwl_dbg_tlv_alloc_debug_info(struct iwl_trans *trans,
+ 	if (le32_to_cpu(tlv->length) != sizeof(*debug_info))
+ 		return -EINVAL;
+ 
++	/* we use this as a string, ensure input was NUL terminated */
++	if (strnlen(debug_info->debug_cfg_name,
++		    sizeof(debug_info->debug_cfg_name)) ==
++			sizeof(debug_info->debug_cfg_name))
++		return -EINVAL;
++
+ 	IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n",
+ 		     debug_info->debug_cfg_name);
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-iwlwifi-fix-ewrd-table-validity-check.patch b/queue-5.15/wifi-iwlwifi-fix-ewrd-table-validity-check.patch
new file mode 100644
index 00000000000..f7325ab8324
--- /dev/null
+++ b/queue-5.15/wifi-iwlwifi-fix-ewrd-table-validity-check.patch
@@ -0,0 +1,44 @@
+From ffb822ba4c1a237d3cb7ea8adc6e484058750e48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 21:21:49 +0200
+Subject: wifi: iwlwifi: fix EWRD table validity check
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit c8d8f3911135921ace8e939ea0956b55f74bf8a0 ]
+
+EWRD ACPI table contains up to 3 additional sar profiles.
+According to the BIOS spec, the table contains a n_profile
+variable indicating how many additional profiles exist in the
+table.
+Currently we check that n_profiles is not <= 0.
+But according to the BIOS spec, 0 is a valid value,
+and it can't be < 0 anyway because we receive that from ACPI as
+an unsigned integer.
+
+Fixes: 39c1a9728f93 ("iwlwifi: refactor the SAR tables from mvm to acpi")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://msgid.link/20240129211905.448ea2f40814.Iffd2aadf8e8693e6cb599bee0406a800a0c1e081@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+index f0e0d4ccbc091..0b1c6bf729c3e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+@@ -674,7 +674,7 @@ int iwl_sar_get_ewrd_table(struct iwl_fw_runtime *fwrt)
+ 	 * from index 1, so the maximum value allowed here is
+ 	 * ACPI_SAR_PROFILES_NUM - 1.
+ 	 */
+-	if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) {
++	if (n_profiles >= ACPI_SAR_PROFILE_NUM) {
+ 		ret = -EINVAL;
+ 		goto out_free;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch b/queue-5.15/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
new file mode 100644
index 00000000000..752035ba1f7
--- /dev/null
+++ b/queue-5.15/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
@@ -0,0 +1,52 @@
+From 31606da23ed9e669a32f1ef75914bb04f79379e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 18:02:09 +0200
+Subject: wifi: iwlwifi: mvm: don't set replay counters to 0xff
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit d5bd4041cd70faf26fc9a54bd6f172537bbe77f3 ]
+
+The firmware (later) actually uses the values even for keys
+that are invalid as far as the host is concerned, later in
+rekeying, and then only sets the low 48 bits since the PNs
+are only 48 bits over the air. It does, however, compare the
+full 64 bits later, obviously causing problems.
+
+Remove the memset and use kzalloc instead to avoid any old
+heap data leaking to the firmware. We already init all the
+other fields in the struct anyway. This leaves the data set
+to zero for any unused fields, so the firmware can look at
+them safely even if they're not used right now.
+
+Fixes: 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240206175739.462101146fef.I10f3855b99417af4247cff04af78dcbc6cb75c9c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index 27756e47f7caf..c4c62bcbe67de 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -462,12 +462,10 @@ static int iwl_mvm_wowlan_config_rsc_tsc(struct iwl_mvm *mvm,
+ 		struct wowlan_key_rsc_v5_data data = {};
+ 		int i;
+ 
+-		data.rsc = kmalloc(sizeof(*data.rsc), GFP_KERNEL);
++		data.rsc = kzalloc(sizeof(*data.rsc), GFP_KERNEL);
+ 		if (!data.rsc)
+ 			return -ENOMEM;
+ 
+-		memset(data.rsc, 0xff, sizeof(*data.rsc));
+-
+ 		for (i = 0; i < ARRAY_SIZE(data.rsc->mcast_key_id_map); i++)
+ 			data.rsc->mcast_key_id_map[i] =
+ 				IWL_MCAST_KEY_MAP_INVALID;
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch b/queue-5.15/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
new file mode 100644
index 00000000000..1898dda47d6
--- /dev/null
+++ b/queue-5.15/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
@@ -0,0 +1,105 @@
+From 670b5440420f9718913c2efc90a98c411ad019f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 08:53:48 +0200
+Subject: wifi: iwlwifi: mvm: report beacon protection failures
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 91380f768d7f6e3d003755defa792e9a00a1444a ]
+
+Andrei reports that we just silently drop beacons after we
+report the key counters, but never report to userspace, so
+wpa_supplicant cannot send the WNM action frame. Fix that.
+
+Fixes: b1fdc2505abc ("iwlwifi: mvm: advertise BIGTK client support if available")
+Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240128084842.7d855442cdce.Iba90b26f893dc8c49bfb8be65373cd0a138af12c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 26 +++++++++++--------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 2e3eb7402197f..e1d0c79212311 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -305,6 +305,7 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 				u32 status,
+ 				struct ieee80211_rx_status *stats)
+ {
++	struct wireless_dev *wdev;
+ 	struct iwl_mvm_sta *mvmsta;
+ 	struct iwl_mvm_vif *mvmvif;
+ 	u8 keyid;
+@@ -326,9 +327,15 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 	if (!ieee80211_is_beacon(hdr->frame_control))
+ 		return 0;
+ 
++	if (!sta)
++		return -1;
++
++	mvmsta = iwl_mvm_sta_from_mac80211(sta);
++	mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
++
+ 	/* key mismatch - will also report !MIC_OK but we shouldn't count it */
+ 	if (!(status & IWL_RX_MPDU_STATUS_KEY_VALID))
+-		return -1;
++		goto report;
+ 
+ 	/* good cases */
+ 	if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK &&
+@@ -337,13 +344,6 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 		return 0;
+ 	}
+ 
+-	if (!sta)
+-		return -1;
+-
+-	mvmsta = iwl_mvm_sta_from_mac80211(sta);
+-
+-	mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
+-
+ 	/*
+ 	 * both keys will have the same cipher and MIC length, use
+ 	 * whichever one is available
+@@ -352,11 +352,11 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 	if (!key) {
+ 		key = rcu_dereference(mvmvif->bcn_prot.keys[1]);
+ 		if (!key)
+-			return -1;
++			goto report;
+ 	}
+ 
+ 	if (len < key->icv_len + IEEE80211_GMAC_PN_LEN + 2)
+-		return -1;
++		goto report;
+ 
+ 	/* get the real key ID */
+ 	keyid = frame[len - key->icv_len - IEEE80211_GMAC_PN_LEN - 2];
+@@ -370,7 +370,7 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 			return -1;
+ 		key = rcu_dereference(mvmvif->bcn_prot.keys[keyid - 6]);
+ 		if (!key)
+-			return -1;
++			goto report;
+ 	}
+ 
+ 	/* Report status to mac80211 */
+@@ -378,6 +378,10 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 		ieee80211_key_mic_failure(key);
+ 	else if (status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)
+ 		ieee80211_key_replay(key);
++report:
++	wdev = ieee80211_vif_to_wdev(mvmsta->vif);
++	if (wdev->netdev)
++		cfg80211_rx_unprot_mlme_mgmt(wdev->netdev, (void *)hdr, len);
+ 
+ 	return -1;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch b/queue-5.15/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
new file mode 100644
index 00000000000..53f8b5e1e74
--- /dev/null
+++ b/queue-5.15/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
@@ -0,0 +1,57 @@
+From cdd705c7e943b454a433ee930ab56e146a6c42a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 15:53:34 +0800
+Subject: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ]
+
+In the for statement of lbs_allocate_cmd_buffer(), if the allocation of
+cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to
+be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().
+
+Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/cmd.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c
+index a4d9dd73b2588..db9a852fa58a3 100644
+--- a/drivers/net/wireless/marvell/libertas/cmd.c
++++ b/drivers/net/wireless/marvell/libertas/cmd.c
+@@ -1133,7 +1133,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
+ 		if (!cmdarray[i].cmdbuf) {
+ 			lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n");
+ 			ret = -1;
+-			goto done;
++			goto free_cmd_array;
+ 		}
+ 	}
+ 
+@@ -1141,8 +1141,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
+ 		init_waitqueue_head(&cmdarray[i].cmdwait_q);
+ 		lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]);
+ 	}
+-	ret = 0;
++	return 0;
+ 
++free_cmd_array:
++	for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {
++		if (cmdarray[i].cmdbuf) {
++			kfree(cmdarray[i].cmdbuf);
++			cmdarray[i].cmdbuf = NULL;
++		}
++	}
++	kfree(priv->cmd_array);
++	priv->cmd_array = NULL;
+ done:
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch b/queue-5.15/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
new file mode 100644
index 00000000000..996052c1762
--- /dev/null
+++ b/queue-5.15/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
@@ -0,0 +1,46 @@
+From 81955dc96c144474ea740472d028b651e2d26d2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Sep 2023 11:02:15 +0800
+Subject: wifi: mwifiex: debugfs: Drop unnecessary error check for
+ debugfs_create_dir()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 50180c7f8e3de7c2d87f619131776598fcb1478d ]
+
+debugfs_create_dir() returns ERR_PTR and never return NULL.
+
+As Russell suggested, this patch removes the error checking for
+debugfs_create_dir(). This is because the DebugFS kernel API is developed
+in a way that the caller can safely ignore the errors that occur during
+the creation of DebugFS nodes. The debugfs APIs have a IS_ERR() judge in
+start_creating() which can handle it gracefully. So these checks are
+unnecessary.
+
+Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20230903030216.1509013-3-ruanjinjie@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/debugfs.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index 1e7dc724c6a94..d48a3e0b36060 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -976,9 +976,6 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
+ 	priv->dfs_dev_dir = debugfs_create_dir(priv->netdev->name,
+ 					       mwifiex_dfs_dir);
+ 
+-	if (!priv->dfs_dev_dir)
+-		return;
+-
+ 	MWIFIEX_DFS_ADD_FILE(info);
+ 	MWIFIEX_DFS_ADD_FILE(debug);
+ 	MWIFIEX_DFS_ADD_FILE(getlog);
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch b/queue-5.15/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
new file mode 100644
index 00000000000..2248500ac6d
--- /dev/null
+++ b/queue-5.15/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
@@ -0,0 +1,37 @@
+From 1af25ce23af446774cb66dd3dcb24ff035f157ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 17:36:27 +0100
+Subject: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
+
+From: Martin Kaistra <martin.kaistra@linutronix.de>
+
+[ Upstream commit 1213acb478a7181cd73eeaf00db430f1e45b1361 ]
+
+The workqueue might still be running, when the driver is stopped. To
+avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().
+
+Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna")
+Signed-off-by: Martin Kaistra <martin.kaistra@linutronix.de>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240111163628.320697-2-martin.kaistra@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 30d9a195c6fb5..3536b9f8470f4 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -6484,6 +6484,7 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw)
+ 	if (priv->usb_interrupts)
+ 		rtl8xxxu_write32(priv, REG_USB_HIMR, 0);
+ 
++	cancel_work_sync(&priv->c2hcmd_work);
+ 	cancel_delayed_work_sync(&priv->ra_watchdog);
+ 
+ 	rtl8xxxu_free_rx_resources(priv);
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-rtw88-8821c-fix-false-alarm-count.patch b/queue-5.15/wifi-rtw88-8821c-fix-false-alarm-count.patch
new file mode 100644
index 00000000000..75c165d0704
--- /dev/null
+++ b/queue-5.15/wifi-rtw88-8821c-fix-false-alarm-count.patch
@@ -0,0 +1,40 @@
+From cb8edd875c57b88cd4a030330478d2271df086c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 00:35:58 +0200
+Subject: wifi: rtw88: 8821c: Fix false alarm count
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit c238adbc578eeb70cbc8fdd1bef3666b0f585b13 ]
+
+total_fa_cnt is supposed to include cck_fa_cnt and ofdm_fa_cnt, not just
+ofdm_fa_cnt.
+
+Fixes: 960361238b86 ("rtw88: 8821c: add false alarm statistics")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/f3cb6d17-e4e4-44a7-9c9b-72aed994b5c9@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821c.c b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+index 280602a34fe67..eb66f494382ae 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -667,9 +667,9 @@ static void rtw8821c_false_alarm_statistics(struct rtw_dev *rtwdev)
+ 
+ 	dm_info->cck_fa_cnt = cck_fa_cnt;
+ 	dm_info->ofdm_fa_cnt = ofdm_fa_cnt;
++	dm_info->total_fa_cnt = ofdm_fa_cnt;
+ 	if (cck_enable)
+ 		dm_info->total_fa_cnt += cck_fa_cnt;
+-	dm_info->total_fa_cnt = ofdm_fa_cnt;
+ 
+ 	crc32_cnt = rtw_read32(rtwdev, REG_CRC_CCK);
+ 	dm_info->cck_ok_cnt = FIELD_GET(GENMASK(15, 0), crc32_cnt);
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-wilc1000-fix-declarations-ordering.patch b/queue-5.15/wifi-wilc1000-fix-declarations-ordering.patch
new file mode 100644
index 00000000000..e565305ce4b
--- /dev/null
+++ b/queue-5.15/wifi-wilc1000-fix-declarations-ordering.patch
@@ -0,0 +1,49 @@
+From 12f9de1826c0adc8e143458294e2ab776e06105e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 08:57:32 +0100
+Subject: wifi: wilc1000: fix declarations ordering
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexis Lothoré <alexis.lothore@bootlin.com>
+
+[ Upstream commit 535733e90e5d8912ebeccebb05b354a2d06ff459 ]
+
+Reorder parameters declaration in wilc_parse_join_bss_param to enforce
+reverse christmas tree
+
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240105075733.36331-2-alexis.lothore@bootlin.com
+Stable-dep-of: 205c50306acf ("wifi: wilc1000: fix RCU usage in connect path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/hif.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
+index a7bca0475e1ee..edd51592a82da 100644
+--- a/drivers/net/wireless/microchip/wilc1000/hif.c
++++ b/drivers/net/wireless/microchip/wilc1000/hif.c
+@@ -359,13 +359,13 @@ static void handle_connect_timeout(struct work_struct *work)
+ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 				struct cfg80211_crypto_settings *crypto)
+ {
+-	struct wilc_join_bss_param *param;
+-	struct ieee80211_p2p_noa_attr noa_attr;
+-	u8 rates_len = 0;
++	const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies);
+ 	const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
+ 	const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie;
++	struct ieee80211_p2p_noa_attr noa_attr;
++	struct wilc_join_bss_param *param;
++	u8 rates_len = 0;
+ 	int ret;
+-	const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies);
+ 
+ 	param = kzalloc(sizeof(*param), GFP_KERNEL);
+ 	if (!param)
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch b/queue-5.15/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
new file mode 100644
index 00000000000..cc324b8b241
--- /dev/null
+++ b/queue-5.15/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
@@ -0,0 +1,54 @@
+From e58b9aaf8b3d6119e65dd47358003c0504b8071e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 15:56:34 +0100
+Subject: wifi: wilc1000: fix multi-vif management when deleting a vif
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ajay Singh <ajay.kathat@microchip.com>
+
+[ Upstream commit 12cfc9c8d3faf887a202c89bc312202445fca7e8 ]
+
+Adding then removing a second vif currently makes the first vif not working
+anymore. This is visible for example when we have a first interface
+connected to some access point:
+- create a wpa_supplicant.conf with some AP credentials
+- wpa_supplicant -Dnl80211 -c /etc/wpa_supplicant.conf -i wlan0
+- dhclient wlan0
+- iw phy phy0 interface add wlan1 type managed
+- iw dev wlan1 del
+wlan0 does not manage properly traffic anymore (eg: ping not working)
+
+This is due to vif mode being incorrectly reconfigured with some default
+values in del_virtual_intf, affecting by default first vif.
+
+Prevent first vif from being affected on second vif removal by removing vif
+mode change command in del_virtual_intf
+
+Fixes: 9bc061e88054 ("staging: wilc1000: added support to dynamically add/remove interfaces")
+Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
+Co-developed-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240115-wilc_1000_fixes-v1-5-54d29463a738@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/cfg80211.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+index 1688144d78475..0f48204e6e0e4 100644
+--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c
++++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+@@ -1562,7 +1562,6 @@ static int del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
+ 	cfg80211_unregister_netdevice(vif->ndev);
+ 	vif->monitor_flag = 0;
+ 
+-	wilc_set_operation_mode(vif, 0, 0, 0);
+ 	mutex_lock(&wl->vif_mutex);
+ 	list_del_rcu(&vif->list);
+ 	wl->vif_num--;
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch b/queue-5.15/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
new file mode 100644
index 00000000000..5e636664174
--- /dev/null
+++ b/queue-5.15/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
@@ -0,0 +1,176 @@
+From 7683566d0942bd5d945ad47ab0bedc640516742d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 08:57:33 +0100
+Subject: wifi: wilc1000: fix RCU usage in connect path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexis Lothoré <alexis.lothore@bootlin.com>
+
+[ Upstream commit 205c50306acf58a335eb19fa84e40140f4fe814f ]
+
+With lockdep enabled, calls to the connect function from cfg802.11 layer
+lead to the following warning:
+
+=============================
+WARNING: suspicious RCU usage
+6.7.0-rc1-wt+ #333 Not tainted
+-----------------------------
+drivers/net/wireless/microchip/wilc1000/hif.c:386
+suspicious rcu_dereference_check() usage!
+[...]
+stack backtrace:
+CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333
+Hardware name: Atmel SAMA5
+ unwind_backtrace from show_stack+0x18/0x1c
+ show_stack from dump_stack_lvl+0x34/0x48
+ dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4
+ wilc_parse_join_bss_param from connect+0x2c4/0x648
+ connect from cfg80211_connect+0x30c/0xb74
+ cfg80211_connect from nl80211_connect+0x860/0xa94
+ nl80211_connect from genl_rcv_msg+0x3fc/0x59c
+ genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8
+ netlink_rcv_skb from genl_rcv+0x2c/0x3c
+ genl_rcv from netlink_unicast+0x3b0/0x550
+ netlink_unicast from netlink_sendmsg+0x368/0x688
+ netlink_sendmsg from ____sys_sendmsg+0x190/0x430
+ ____sys_sendmsg from ___sys_sendmsg+0x110/0x158
+ ___sys_sendmsg from sys_sendmsg+0xe8/0x150
+ sys_sendmsg from ret_fast_syscall+0x0/0x1c
+
+This warning is emitted because in the connect path, when trying to parse
+target BSS parameters, we dereference a RCU pointer whithout being in RCU
+critical section.
+Fix RCU dereference usage by moving it to a RCU read critical section. To
+avoid wrapping the whole wilc_parse_join_bss_param under the critical
+section, just use the critical section to copy ies data
+
+Fixes: c460495ee072 ("staging: wilc1000: fix incorrent type in initializer")
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240105075733.36331-3-alexis.lothore@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/hif.c | 36 ++++++++++++-------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
+index edd51592a82da..fe95a6201a679 100644
+--- a/drivers/net/wireless/microchip/wilc1000/hif.c
++++ b/drivers/net/wireless/microchip/wilc1000/hif.c
+@@ -359,38 +359,49 @@ static void handle_connect_timeout(struct work_struct *work)
+ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 				struct cfg80211_crypto_settings *crypto)
+ {
+-	const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies);
+-	const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
++	const u8 *ies_data, *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
+ 	const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie;
+ 	struct ieee80211_p2p_noa_attr noa_attr;
++	const struct cfg80211_bss_ies *ies;
+ 	struct wilc_join_bss_param *param;
+-	u8 rates_len = 0;
++	u8 rates_len = 0, ies_len;
+ 	int ret;
+ 
+ 	param = kzalloc(sizeof(*param), GFP_KERNEL);
+ 	if (!param)
+ 		return NULL;
+ 
++	rcu_read_lock();
++	ies = rcu_dereference(bss->ies);
++	ies_data = kmemdup(ies->data, ies->len, GFP_ATOMIC);
++	if (!ies_data) {
++		rcu_read_unlock();
++		kfree(param);
++		return NULL;
++	}
++	ies_len = ies->len;
++	rcu_read_unlock();
++
+ 	param->beacon_period = cpu_to_le16(bss->beacon_interval);
+ 	param->cap_info = cpu_to_le16(bss->capability);
+ 	param->bss_type = WILC_FW_BSS_TYPE_INFRA;
+ 	param->ch = ieee80211_frequency_to_channel(bss->channel->center_freq);
+ 	ether_addr_copy(param->bssid, bss->bssid);
+ 
+-	ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
++	ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies_data, ies_len);
+ 	if (ssid_elm) {
+ 		if (ssid_elm[1] <= IEEE80211_MAX_SSID_LEN)
+ 			memcpy(param->ssid, ssid_elm + 2, ssid_elm[1]);
+ 	}
+ 
+-	tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
++	tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies_data, ies_len);
+ 	if (tim_elm && tim_elm[1] >= 2)
+ 		param->dtim_period = tim_elm[3];
+ 
+ 	memset(param->p_suites, 0xFF, 3);
+ 	memset(param->akm_suites, 0xFF, 3);
+ 
+-	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len);
++	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies_data, ies_len);
+ 	if (rates_ie) {
+ 		rates_len = rates_ie[1];
+ 		if (rates_len > WILC_MAX_RATES_SUPPORTED)
+@@ -401,7 +412,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 
+ 	if (rates_len < WILC_MAX_RATES_SUPPORTED) {
+ 		supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,
+-						 ies->data, ies->len);
++						 ies_data, ies_len);
+ 		if (supp_rates_ie) {
+ 			u8 ext_rates = supp_rates_ie[1];
+ 
+@@ -416,11 +427,11 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 		}
+ 	}
+ 
+-	ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len);
++	ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies_data, ies_len);
+ 	if (ht_ie)
+ 		param->ht_capable = true;
+ 
+-	ret = cfg80211_get_p2p_attr(ies->data, ies->len,
++	ret = cfg80211_get_p2p_attr(ies_data, ies_len,
+ 				    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+ 				    (u8 *)&noa_attr, sizeof(noa_attr));
+ 	if (ret > 0) {
+@@ -444,7 +455,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 	}
+ 	wmm_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+ 					 WLAN_OUI_TYPE_MICROSOFT_WMM,
+-					 ies->data, ies->len);
++					 ies_data, ies_len);
+ 	if (wmm_ie) {
+ 		struct ieee80211_wmm_param_ie *ie;
+ 
+@@ -459,13 +470,13 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 
+ 	wpa_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+ 					 WLAN_OUI_TYPE_MICROSOFT_WPA,
+-					 ies->data, ies->len);
++					 ies_data, ies_len);
+ 	if (wpa_ie) {
+ 		param->mode_802_11i = 1;
+ 		param->rsn_found = true;
+ 	}
+ 
+-	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len);
++	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies_data, ies_len);
+ 	if (rsn_ie) {
+ 		int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
+ 		int offset = 8;
+@@ -499,6 +510,7 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 			param->akm_suites[i] = crypto->akm_suites[i] & 0xFF;
+ 	}
+ 
++	kfree(ies_data);
+ 	return (void *)param;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch b/queue-5.15/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
new file mode 100644
index 00000000000..532256f17ea
--- /dev/null
+++ b/queue-5.15/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
@@ -0,0 +1,172 @@
+From 3d482ecbfa205f610ac7d3d7e0fe0cdd9fac1856 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 13:57:37 +0100
+Subject: wifi: wilc1000: prevent use-after-free on vif when cleaning up all
+ interfaces
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexis Lothoré <alexis.lothore@bootlin.com>
+
+[ Upstream commit cb5942b77c05d54310a0420cac12935e9b6aa21c ]
+
+wilc_netdev_cleanup currently triggers a KASAN warning, which can be
+observed on interface registration error path, or simply by
+removing the module/unbinding device from driver:
+
+echo spi0.1 > /sys/bus/spi/drivers/wilc1000_spi/unbind
+
+==================================================================
+BUG: KASAN: slab-use-after-free in wilc_netdev_cleanup+0x508/0x5cc
+Read of size 4 at addr c54d1ce8 by task sh/86
+
+CPU: 0 PID: 86 Comm: sh Not tainted 6.8.0-rc1+ #117
+Hardware name: Atmel SAMA5
+ unwind_backtrace from show_stack+0x18/0x1c
+ show_stack from dump_stack_lvl+0x34/0x58
+ dump_stack_lvl from print_report+0x154/0x500
+ print_report from kasan_report+0xac/0xd8
+ kasan_report from wilc_netdev_cleanup+0x508/0x5cc
+ wilc_netdev_cleanup from wilc_bus_remove+0xc8/0xec
+ wilc_bus_remove from spi_remove+0x8c/0xac
+ spi_remove from device_release_driver_internal+0x434/0x5f8
+ device_release_driver_internal from unbind_store+0xbc/0x108
+ unbind_store from kernfs_fop_write_iter+0x398/0x584
+ kernfs_fop_write_iter from vfs_write+0x728/0xf88
+ vfs_write from ksys_write+0x110/0x1e4
+ ksys_write from ret_fast_syscall+0x0/0x1c
+
+[...]
+
+Allocated by task 1:
+ kasan_save_track+0x30/0x5c
+ __kasan_kmalloc+0x8c/0x94
+ __kmalloc_node+0x1cc/0x3e4
+ kvmalloc_node+0x48/0x180
+ alloc_netdev_mqs+0x68/0x11dc
+ alloc_etherdev_mqs+0x28/0x34
+ wilc_netdev_ifc_init+0x34/0x8ec
+ wilc_cfg80211_init+0x690/0x910
+ wilc_bus_probe+0xe0/0x4a0
+ spi_probe+0x158/0x1b0
+ really_probe+0x270/0xdf4
+ __driver_probe_device+0x1dc/0x580
+ driver_probe_device+0x60/0x140
+ __driver_attach+0x228/0x5d4
+ bus_for_each_dev+0x13c/0x1a8
+ bus_add_driver+0x2a0/0x608
+ driver_register+0x24c/0x578
+ do_one_initcall+0x180/0x310
+ kernel_init_freeable+0x424/0x484
+ kernel_init+0x20/0x148
+ ret_from_fork+0x14/0x28
+
+Freed by task 86:
+ kasan_save_track+0x30/0x5c
+ kasan_save_free_info+0x38/0x58
+ __kasan_slab_free+0xe4/0x140
+ kfree+0xb0/0x238
+ device_release+0xc0/0x2a8
+ kobject_put+0x1d4/0x46c
+ netdev_run_todo+0x8fc/0x11d0
+ wilc_netdev_cleanup+0x1e4/0x5cc
+ wilc_bus_remove+0xc8/0xec
+ spi_remove+0x8c/0xac
+ device_release_driver_internal+0x434/0x5f8
+ unbind_store+0xbc/0x108
+ kernfs_fop_write_iter+0x398/0x584
+ vfs_write+0x728/0xf88
+ ksys_write+0x110/0x1e4
+ ret_fast_syscall+0x0/0x1c
+ [...]
+
+David Mosberger-Tan initial investigation [1] showed that this
+use-after-free is due to netdevice unregistration during vif list
+traversal. When unregistering a net device, since the needs_free_netdev has
+been set to true during registration, the netdevice object is also freed,
+and as a consequence, the corresponding vif object too, since it is
+attached to it as private netdevice data. The next occurrence of the loop
+then tries to access freed vif pointer to the list to move forward in the
+list.
+
+Fix this use-after-free thanks to two mechanisms:
+- navigate in the list with list_for_each_entry_safe, which allows to
+  safely modify the list as we go through each element. For each element,
+  remove it from the list with list_del_rcu
+- make sure to wait for RCU grace period end after each vif removal to make
+  sure it is safe to free the corresponding vif too (through
+  unregister_netdev)
+
+Since we are in a RCU "modifier" path (not a "reader" path), and because
+such path is expected not to be concurrent to any other modifier (we are
+using the vif_mutex lock), we do not need to use RCU list API, that's why
+we can benefit from list_for_each_entry_safe.
+
+[1] https://lore.kernel.org/linux-wireless/ab077dbe58b1ea5de0a3b2ca21f275a07af967d2.camel@egauge.net/
+
+Fixes: 8399918f3056 ("staging: wilc1000: use RCU list to maintain vif interfaces list")
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240212-wilc_rework_deinit-v1-1-9203ae56c27f@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/microchip/wilc1000/netdev.c  | 28 +++++--------------
+ 1 file changed, 7 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c
+index dc91739eff8c6..0cf9e123d8c7d 100644
+--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
+@@ -862,8 +862,7 @@ static const struct net_device_ops wilc_netdev_ops = {
+ 
+ void wilc_netdev_cleanup(struct wilc *wilc)
+ {
+-	struct wilc_vif *vif;
+-	int srcu_idx, ifc_cnt = 0;
++	struct wilc_vif *vif, *vif_tmp;
+ 
+ 	if (!wilc)
+ 		return;
+@@ -873,32 +872,19 @@ void wilc_netdev_cleanup(struct wilc *wilc)
+ 		wilc->firmware = NULL;
+ 	}
+ 
+-	srcu_idx = srcu_read_lock(&wilc->srcu);
+-	list_for_each_entry_rcu(vif, &wilc->vif_list, list) {
++	list_for_each_entry_safe(vif, vif_tmp, &wilc->vif_list, list) {
++		mutex_lock(&wilc->vif_mutex);
++		list_del_rcu(&vif->list);
++		wilc->vif_num--;
++		mutex_unlock(&wilc->vif_mutex);
++		synchronize_srcu(&wilc->srcu);
+ 		if (vif->ndev)
+ 			unregister_netdev(vif->ndev);
+ 	}
+-	srcu_read_unlock(&wilc->srcu, srcu_idx);
+ 
+ 	wilc_wfi_deinit_mon_interface(wilc, false);
+ 	destroy_workqueue(wilc->hif_workqueue);
+ 
+-	while (ifc_cnt < WILC_NUM_CONCURRENT_IFC) {
+-		mutex_lock(&wilc->vif_mutex);
+-		if (wilc->vif_num <= 0) {
+-			mutex_unlock(&wilc->vif_mutex);
+-			break;
+-		}
+-		vif = wilc_get_wl_to_vif(wilc);
+-		if (!IS_ERR(vif))
+-			list_del_rcu(&vif->list);
+-
+-		wilc->vif_num--;
+-		mutex_unlock(&wilc->vif_mutex);
+-		synchronize_srcu(&wilc->srcu);
+-		ifc_cnt++;
+-	}
+-
+ 	wilc_wlan_cfg_deinit(wilc);
+ 	wlan_deinit_locks(wilc);
+ 	wiphy_unregister(wilc->wiphy);
+-- 
+2.43.0
+
diff --git a/queue-5.15/wireless-remove-redundant-flush_workqueue-calls.patch b/queue-5.15/wireless-remove-redundant-flush_workqueue-calls.patch
new file mode 100644
index 00000000000..78cd5fb23fc
--- /dev/null
+++ b/queue-5.15/wireless-remove-redundant-flush_workqueue-calls.patch
@@ -0,0 +1,243 @@
+From 6321bc364fc5175a9e11b94faf18e4c1099c8ff2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Oct 2021 09:09:11 +0200
+Subject: wireless: Remove redundant 'flush_workqueue()' calls
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ff1cc2fa3055ee4c83839f38b74b4ee370a2291c ]
+
+'destroy_workqueue()' already drains the queue before destroying it, so
+there is no need to flush it explicitly.
+
+Remove the redundant 'flush_workqueue()' calls.
+
+This was generated with coccinelle:
+
+@@
+expression E;
+@@
+- 	flush_workqueue(E);
+	destroy_workqueue(E);
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/0855d51423578ad019c0264dad3fe47a2e8af9c7.1633849511.git.christophe.jaillet@wanadoo.fr
+Stable-dep-of: cb5942b77c05 ("wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/core.c             | 3 ---
+ drivers/net/wireless/ath/ath10k/sdio.c             | 1 -
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c     | 1 -
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c     | 1 -
+ drivers/net/wireless/intel/iwlwifi/dvm/main.c      | 1 -
+ drivers/net/wireless/marvell/mwifiex/cfg80211.c    | 2 --
+ drivers/net/wireless/marvell/mwifiex/main.c        | 2 --
+ drivers/net/wireless/microchip/wilc1000/netdev.c   | 1 -
+ drivers/net/wireless/quantenna/qtnfmac/core.c      | 2 --
+ drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c | 2 --
+ drivers/net/wireless/realtek/rtlwifi/pci.c         | 1 -
+ drivers/net/wireless/rndis_wlan.c                  | 2 --
+ drivers/net/wireless/st/cw1200/bh.c                | 2 --
+ 13 files changed, 21 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 58e86e662ab83..eca24a61165ee 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -3544,13 +3544,10 @@ EXPORT_SYMBOL(ath10k_core_create);
+ 
+ void ath10k_core_destroy(struct ath10k *ar)
+ {
+-	flush_workqueue(ar->workqueue);
+ 	destroy_workqueue(ar->workqueue);
+ 
+-	flush_workqueue(ar->workqueue_aux);
+ 	destroy_workqueue(ar->workqueue_aux);
+ 
+-	flush_workqueue(ar->workqueue_tx_complete);
+ 	destroy_workqueue(ar->workqueue_tx_complete);
+ 
+ 	ath10k_debug_destroy(ar);
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index eb705214f3f0a..63e1c2d783c5f 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -2650,7 +2650,6 @@ static void ath10k_sdio_remove(struct sdio_func *func)
+ 
+ 	ath10k_core_destroy(ar);
+ 
+-	flush_workqueue(ar_sdio->workqueue);
+ 	destroy_workqueue(ar_sdio->workqueue);
+ }
+ 
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 04c149ff745e9..dea0012fcdc79 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -3827,7 +3827,6 @@ il3945_pci_remove(struct pci_dev *pdev)
+ 	il3945_unset_hw_params(il);
+ 
+ 	/*netif_stop_queue(dev); */
+-	flush_workqueue(il->workqueue);
+ 
+ 	/* ieee80211_unregister_hw calls il3945_mac_stop, which flushes
+ 	 * il->workqueue... so we can't take down the workqueue
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index ff04282e3db03..ceab7704897de 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -6739,7 +6739,6 @@ il4965_pci_remove(struct pci_dev *pdev)
+ 	il_eeprom_free(il);
+ 
+ 	/*netif_stop_queue(dev); */
+-	flush_workqueue(il->workqueue);
+ 
+ 	/* ieee80211_unregister_hw calls il_mac_stop, which flushes
+ 	 * il->workqueue... so we can't take down the workqueue
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+index cc7b69fd14d37..69d1aae96bbb4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+@@ -1525,7 +1525,6 @@ static void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
+ 	kfree(priv->nvm_data);
+ 
+ 	/*netif_stop_queue(dev); */
+-	flush_workqueue(priv->workqueue);
+ 
+ 	/* ieee80211_unregister_hw calls iwlagn_mac_stop, which flushes
+ 	 * priv->workqueue... so we can't take down the workqueue
+diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+index 109b1bef4c707..017d9e03d652d 100644
+--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+@@ -3169,13 +3169,11 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
+ 		cfg80211_unregister_netdevice(wdev->netdev);
+ 
+ 	if (priv->dfs_cac_workqueue) {
+-		flush_workqueue(priv->dfs_cac_workqueue);
+ 		destroy_workqueue(priv->dfs_cac_workqueue);
+ 		priv->dfs_cac_workqueue = NULL;
+ 	}
+ 
+ 	if (priv->dfs_chan_sw_workqueue) {
+-		flush_workqueue(priv->dfs_chan_sw_workqueue);
+ 		destroy_workqueue(priv->dfs_chan_sw_workqueue);
+ 		priv->dfs_chan_sw_workqueue = NULL;
+ 	}
+diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c
+index 17399d4aa1290..7943fd3b3058d 100644
+--- a/drivers/net/wireless/marvell/mwifiex/main.c
++++ b/drivers/net/wireless/marvell/mwifiex/main.c
+@@ -498,13 +498,11 @@ static void mwifiex_free_adapter(struct mwifiex_adapter *adapter)
+ static void mwifiex_terminate_workqueue(struct mwifiex_adapter *adapter)
+ {
+ 	if (adapter->workqueue) {
+-		flush_workqueue(adapter->workqueue);
+ 		destroy_workqueue(adapter->workqueue);
+ 		adapter->workqueue = NULL;
+ 	}
+ 
+ 	if (adapter->rx_workqueue) {
+-		flush_workqueue(adapter->rx_workqueue);
+ 		destroy_workqueue(adapter->rx_workqueue);
+ 		adapter->rx_workqueue = NULL;
+ 	}
+diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c
+index 5e3ec20e24dad..dc91739eff8c6 100644
+--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
+@@ -881,7 +881,6 @@ void wilc_netdev_cleanup(struct wilc *wilc)
+ 	srcu_read_unlock(&wilc->srcu, srcu_idx);
+ 
+ 	wilc_wfi_deinit_mon_interface(wilc, false);
+-	flush_workqueue(wilc->hif_workqueue);
+ 	destroy_workqueue(wilc->hif_workqueue);
+ 
+ 	while (ifc_cnt < WILC_NUM_CONCURRENT_IFC) {
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/core.c b/drivers/net/wireless/quantenna/qtnfmac/core.c
+index b4dd60b2ebc90..01725237836e8 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/core.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/core.c
+@@ -811,13 +811,11 @@ void qtnf_core_detach(struct qtnf_bus *bus)
+ 	bus->fw_state = QTNF_FW_STATE_DETACHED;
+ 
+ 	if (bus->workqueue) {
+-		flush_workqueue(bus->workqueue);
+ 		destroy_workqueue(bus->workqueue);
+ 		bus->workqueue = NULL;
+ 	}
+ 
+ 	if (bus->hprio_workqueue) {
+-		flush_workqueue(bus->hprio_workqueue);
+ 		destroy_workqueue(bus->hprio_workqueue);
+ 		bus->hprio_workqueue = NULL;
+ 	}
+diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+index 5d93c874d6669..9ad4c120fa287 100644
+--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c
+@@ -387,7 +387,6 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	return 0;
+ 
+ error:
+-	flush_workqueue(pcie_priv->workqueue);
+ 	destroy_workqueue(pcie_priv->workqueue);
+ 	pci_set_drvdata(pdev, NULL);
+ 	return ret;
+@@ -416,7 +415,6 @@ static void qtnf_pcie_remove(struct pci_dev *dev)
+ 		qtnf_core_detach(bus);
+ 
+ 	netif_napi_del(&bus->mux_napi);
+-	flush_workqueue(priv->workqueue);
+ 	destroy_workqueue(priv->workqueue);
+ 	tasklet_kill(&priv->reclaim_tq);
+ 
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 679ae786cf450..6d9f2a6233a21 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -1704,7 +1704,6 @@ static void rtl_pci_deinit(struct ieee80211_hw *hw)
+ 	tasklet_kill(&rtlpriv->works.irq_tasklet);
+ 	cancel_work_sync(&rtlpriv->works.lps_change_work);
+ 
+-	flush_workqueue(rtlpriv->works.rtl_wq);
+ 	destroy_workqueue(rtlpriv->works.rtl_wq);
+ }
+ 
+diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
+index 70841d131d724..c35e9f5c2897e 100644
+--- a/drivers/net/wireless/rndis_wlan.c
++++ b/drivers/net/wireless/rndis_wlan.c
+@@ -3494,7 +3494,6 @@ static int rndis_wlan_bind(struct usbnet *usbdev, struct usb_interface *intf)
+ 	cancel_delayed_work_sync(&priv->dev_poller_work);
+ 	cancel_delayed_work_sync(&priv->scan_work);
+ 	cancel_work_sync(&priv->work);
+-	flush_workqueue(priv->workqueue);
+ 	destroy_workqueue(priv->workqueue);
+ 
+ 	wiphy_free(wiphy);
+@@ -3511,7 +3510,6 @@ static void rndis_wlan_unbind(struct usbnet *usbdev, struct usb_interface *intf)
+ 	cancel_delayed_work_sync(&priv->dev_poller_work);
+ 	cancel_delayed_work_sync(&priv->scan_work);
+ 	cancel_work_sync(&priv->work);
+-	flush_workqueue(priv->workqueue);
+ 	destroy_workqueue(priv->workqueue);
+ 
+ 	rndis_unbind(usbdev, intf);
+diff --git a/drivers/net/wireless/st/cw1200/bh.c b/drivers/net/wireless/st/cw1200/bh.c
+index 8bade5d89f12f..10e019cddcc65 100644
+--- a/drivers/net/wireless/st/cw1200/bh.c
++++ b/drivers/net/wireless/st/cw1200/bh.c
+@@ -85,8 +85,6 @@ void cw1200_unregister_bh(struct cw1200_common *priv)
+ 	atomic_inc(&priv->bh_term);
+ 	wake_up(&priv->bh_wq);
+ 
+-	flush_workqueue(priv->bh_workqueue);
+-
+ 	destroy_workqueue(priv->bh_workqueue);
+ 	priv->bh_workqueue = NULL;
+ 
+-- 
+2.43.0
+
diff --git a/queue-5.15/x86-relocs-ignore-relocations-in-.notes-section.patch b/queue-5.15/x86-relocs-ignore-relocations-in-.notes-section.patch
new file mode 100644
index 00000000000..0f489977a54
--- /dev/null
+++ b/queue-5.15/x86-relocs-ignore-relocations-in-.notes-section.patch
@@ -0,0 +1,54 @@
+From 44a3f93e9b76c9084603da7f96f87dd215ffb2f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 09:51:12 -0800
+Subject: x86, relocs: Ignore relocations in .notes section
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit aaa8736370db1a78f0e8434344a484f9fd20be3b ]
+
+When building with CONFIG_XEN_PV=y, .text symbols are emitted into
+the .notes section so that Xen can find the "startup_xen" entry point.
+This information is used prior to booting the kernel, so relocations
+are not useful. In fact, performing relocations against the .notes
+section means that the KASLR base is exposed since /sys/kernel/notes
+is world-readable.
+
+To avoid leaking the KASLR base without breaking unprivileged tools that
+are expecting to read /sys/kernel/notes, skip performing relocations in
+the .notes section. The values readable in .notes are then identical to
+those found in System.map.
+
+Reported-by: Guixiong Wei <guixiongwei@gmail.com>
+Closes: https://lore.kernel.org/all/20240218073501.54555-1-guixiongwei@gmail.com/
+Fixes: 5ead97c84fa7 ("xen: Core Xen implementation")
+Fixes: da1a679cde9b ("Add /sys/kernel/notes")
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/tools/relocs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index 27c82207d3878..3167228ca1746 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -599,6 +599,14 @@ static void print_absolute_relocs(void)
+ 		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
+ 			continue;
+ 		}
++		/*
++		 * Do not perform relocations in .notes section; any
++		 * values there are meant for pre-boot consumption (e.g.
++		 * startup_xen).
++		 */
++		if (sec_applies->shdr.sh_type == SHT_NOTE) {
++			continue;
++		}
+ 		sh_symtab  = sec_symtab->symtab;
+ 		sym_strtab = sec_symtab->link->strtab;
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {
+-- 
+2.43.0
+
-- 
2.47.2