From bc79c673fa4f8aec6f5a43452fb43975ff5fa3cb Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Fri, 22 Mar 2024 12:53:54 -0400
Subject: [PATCH] Fixes for 6.8

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...-amd-cppc-v2-support-for-family-17h-.patch |   47 +
 ...-register-of-memory-node-for-generic.patch |   62 +
 ...dle-fix-memory-leak-in-acpi_processo.patch |   61 +
 ...d-maibenben-x577-to-irq1_edge_low_fo.patch |   49 +
 ...-irq-override-on-lunnen-ground-lapto.patch |   51 +
 ...x-device-check-notification-handling.patch |   57 +
 ...-data-race-of-gc_in_progress-in-wait.patch |   39 +
 .../afs-don-t-cache-preferred-address.patch   |   81 +
 ...al-rmdir-then-vnovnode-with-generic-.patch |  104 +
 ...ide-silly-rename-files-from-userspac.patch |   55 +
 ...-set-channel-index-correctly-when-sy.patch |   69 +
 ...-fix-alc285-issues-on-hp-envy-x360-l.patch |  147 +
 ...a-tas2781-add-lock-to-system_suspend.patch |   41 +
 ...-do-not-call-pm_runtime_force_-in-sy.patch |   64 +
 ...-do-not-reset-cur_-values-in-runtime.patch |   53 +
 ...-restore-power-state-after-system_re.patch |   84 +
 ...tas2781-use-dev_dbg-in-system_resume.patch |   39 +
 ...ix-scarlett-4th-gen-4i4-low-voltage-.patch |   75 +
 ...ix-scarlett-4th-gen-autogain-status-.patch |  127 +
 ...ix-scarlett-4th-gen-input-gain-range.patch |   58 +
 ...rlett-4th-gen-input-gain-range.patch-21200 |   62 +
 .../alsa-seq-fix-function-cast-warnings.patch |   95 +
 ...top-parsing-channels-bits-when-all-c.patch |   43 +
 ...ntial-use-after-free-problem-in-aoec.patch |   88 +
 ...emove-linux-fb.h-from-backlight-code.patch |   98 +
 ...view-fix-development-chip-rom-compat.patch |   43 +
 ...app4-fix-typo-in-the-qca-switch-regi.patch |   42 +
 ...app4-move-the-internal-switch-phys-u.patch |   98 +
 ...com-msm8974-correct-qfprom-node-size.patch |   46 +
 ...r8a73a4-fix-external-clocks-and-cloc.patch |   82 +
 ...nner-h6-add-rx-dma-channel-for-spdif.patch |   83 +
 ...-kontron-disable-pull-resistors-for-.patch |   80 +
 ...on-disable-pull-resistors-for-.patch-27736 |   80 +
 ...-kontron-disable-pullups-for-i2c-sig.patch |   56 +
 ...on-disable-pullups-for-i2c-sig.patch-24016 |   56 +
 ...-kontron-disable-pullups-for-onboard.patch |   58 +
 ...ron-disable-pullups-for-onboard.patch-1464 |   58 +
 ...-kontron-fix-interrupt-for-rtc-on-os.patch |   36 +
 ...mx8mm-venice-gw71xx-fix-usb-otg-vbus.patch |   85 +
 ...rm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch |  119 +
 ...-set-spi-nor-to-max-40-mhz-on-data-m.patch |   38 +
 ...-align-edma3-power-domains-resources.patch |   48 +
 ...-correct-edma3-power-domains-and-int.patch |   65 +
 ...l-reorder-crypto-interrupts-on-armad.patch |   88 +
 ...ek-mt7622-add-missing-device_type-to.patch |   57 +
 ...ek-mt7986-add-reset-cells-to-infracf.patch |   47 +
 ...tek-mt7986-drop-clock-cells-from-pwm.patch |   45 +
 ...ek-mt7986-drop-crypto-s-unneeded-inv.patch |   46 +
 ...ek-mt7986-fix-reference-to-pwm-in-fa.patch |   44 +
 ...ek-mt7986-fix-spi-bus-width-properti.patch |   63 +
 ...dts-mediatek-mt7986-fix-spi-nodename.patch |   61 +
 ...ek-mt8186-add-missing-clocks-to-ssus.patch |   64 +
 ...ek-mt8186-add-missing-xhci-clock-to-.patch |   74 +
 ...ek-mt8186-fix-venc-power-domain-cloc.patch |   38 +
 ...ek-mt8192-asurada-remove-crosec-base.patch |   49 +
 ...iatek-mt8192-fix-vencoder-clock-name.patch |   40 +
 ...-move-crosec-base-detection-node-to-.patch |  106 +
 ...-cherry-tomato-change-watchdog-reset.patch |   66 +
 ...sm8996-define-ufs-unipro-clock-limit.patch |   42 +
 ...-dts-qcom-msm8996-fix-ufs-phy-clocks.patch |   42 +
 ...sm8998-declare-vls-clamp-register-fo.patch |   53 +
 ...-dts-qcom-msm8998-fix-ufs-phy-clocks.patch |   51 +
 ...cm2290-declare-vls-clamp-register-fo.patch |   51 +
 ...cm6490-fairphone-fp5-add-missing-res.patch |   43 +
 ...cm6490-idp-correct-the-voltage-setti.patch |   41 +
 ...cs6490-rb3gen2-correct-the-voltage-s.patch |   41 +
 ...m64-dts-qcom-rename-pm2250-to-pm4125.patch |  345 ++
 ...a8540p-drop-gfx.lvl-as-power-domain-.patch |   41 +
 ...c7280-add-static-properties-to-crypt.patch |   43 +
 ...sc8180x-add-missing-cpu-mdp_cfg-path.patch |   47 +
 ...om-sc8180x-add-missing-cpu-off-state.patch |   54 +
 ...c8180x-don-t-hold-mdp-core-clock-at-.patch |   40 +
 ...om-sc8180x-fix-edp-phy-power-domains.patch |   37 +
 ...c8180x-fix-up-big-cpu-idle-state-ent.patch |   37 +
 ...c8180x-hook-up-vdd_cx-as-gcc-parent-.patch |   36 +
 ...c8180x-require-low_svs-vote-for-mmcx.patch |   37 +
 ...c8180x-shrink-aoss_qmp-register-spac.patch |   37 +
 ...dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch |   63 +
 ...dm845-db845c-correct-pcie-wake-gpios.patch |   40 +
 ...4-dts-qcom-sdm845-fix-ufs-phy-clocks.patch |   51 +
 ...dm845-oneplus-common-improve-dai-nod.patch |   54 +
 ...dm845-use-the-low-power-island-cx-mx.patch |   39 +
 ...m6115-declare-vls-clamp-register-for.patch |   51 +
 ...com-sm6115-drop-pipe-clock-selection.patch |   57 +
 ...4-dts-qcom-sm6115-fix-ufs-phy-clocks.patch |   47 +
 ...4-dts-qcom-sm6125-fix-ufs-phy-clocks.patch |   48 +
 ...4-dts-qcom-sm6350-fix-ufs-phy-clocks.patch |   51 +
 ...-qcom-sm8150-correct-pcie-wake-gpios.patch |   40 +
 ...4-dts-qcom-sm8150-fix-ufs-phy-clocks.patch |   51 +
 ...4-dts-qcom-sm8250-fix-ufs-phy-clocks.patch |   51 +
 ...4-dts-qcom-sm8350-fix-ufs-phy-clocks.patch |   51 +
 ...m8450-add-missing-interconnects-to-s.patch |   59 +
 ...s-qcom-sm8550-fix-spmi-channels-size.patch |   44 +
 ...4-dts-qcom-sm8550-fix-ufs-phy-clocks.patch |   49 +
 ...s-qcom-sm8650-fix-spmi-channels-size.patch |   44 +
 ...4-dts-qcom-sm8650-fix-ufs-phy-clocks.patch |   48 +
 ...ts-qcom-x1e80100-drop-qcom-drv-count.patch |   37 +
 ...1e80100-qcp-fix-supplies-for-ldos-3e.patch |   46 +
 ...as-r8a779a0-correct-avb-01-reg-sizes.patch |   48 +
 ...nesas-r8a779g0-add-missing-scif_clk2.patch |   67 +
 ...as-r8a779g0-correct-avb-01-reg-sizes.patch |   48 +
 ...-renesas-r8a779g0-restore-sort-order.patch |  126 +
 ...s-r9a08g045-add-missing-interrupts-t.patch |   52 +
 ...s-rzg2l-add-missing-interrupts-to-ir.patch |  131 +
 ...s-rzg3s-smarc-som-guard-ethernet-irq.patch |   64 +
 ...ip-add-missing-interrupt-names-for-r.patch |   40 +
 ...ip-drop-rockchip-trcm-sync-tx-only-f.patch |   55 +
 ...ip-fix-reset-names-for-rk356x-i2s2-c.patch |   48 +
 ...-common1-register-space-for-am62x-so.patch |   44 +
 ...-common1-register-space-for-am65x-so.patch |   44 +
 ...5x-fix-dtbs_install-for-rocktech-old.patch |   37 +
 ...-dts-ti-k3-am62-main-disable-usb-lpm.patch |   65 +
 ...-k3-am62p-fix-memory-ranges-for-dmss.patch |   39 +
 ...am62p-mcu-wakeup-disable-mcu-and-wak.patch |   62 +
 ...i-k3-am62p5-sk-enable-cpsw-mdio-node.patch |   44 +
 ...am64-main-fix-itap-otap-values-for-m.patch |   59 +
 ...k3-am69-sk-fix-pmic-interrupt-number.patch |   43 +
 ...am69-sk-remove-assigned-clock-parent.patch |   55 +
 ...j7200-common-proc-board-modify-pinmu.patch |   64 +
 ...j7200-common-proc-board-remove-clock.patch |   38 +
 ...-j721e-fix-mux-reg-masks-in-hbmc_mux.patch |   44 +
 ...3-j721e-sk-fix-pmic-interrupt-number.patch |   54 +
 ...j721s2-common-proc-board-remove-pinm.patch |   40 +
 ...j721s2-fix-power-domain-for-vtm-node.patch |   38 +
 ...j784s4-evm-remove-pinmux-for-cts-and.patch |   40 +
 ...j784s4-fix-power-domain-for-vtm-node.patch |   38 +
 ...j784s4-main-fix-mux-reg-masks-in-ser.patch |   49 +
 ...-t-forbid-call_ops-cc_optimize_for_s.patch |   52 +
 ...d-missing-error-handling-in-sof-mach.patch |   54 +
 ...ommon-add-stub-for-sof_ssp_get_codec.patch |   49 +
 ...u-fix-function-pointer-type-mismatch.patch |   85 +
 ...dm-interface-add-frame-rate-constrai.patch |   86 +
 ...dm-interface-fix-mclk-setup-without-.patch |   49 +
 ...5-fix-function-pointer-type-mismatch.patch |   83 +
 ...oc-sh-rz-ssi-fix-error-message-print.patch |   39 +
 ...ome-bounds-checking-to-firmware-data.patch |   39 +
 ...-compute-file-paths-on-firmware-load.patch |  141 +
 ...fix-memory-leak-in-amd_sof_acp_probe.patch |   70 +
 ...kip-firmware-test-for-custom-loaders.patch |  103 +
 ...-fully-initialize-backlight_properti.patch |   37 +
 ...-fix-potential-null-pointer-derefere.patch |   48 +
 ...6-correct-the-check-for-of_property_.patch |   53 +
 ...a-don-t-set-bl-props.brightness-in-g.patch |   77 +
 ...a-initialize-backlight_properties-on.patch |   37 +
 ...-fully-initialize-backlight_properti.patch |   37 +
 ...-fully-initialize-backlight_properti.patch |   37 +
 ...ck-between-bd_link_disk_holder-and-p.patch |  113 +
 .../bluetooth-af_bluetooth-fix-deadlock.patch |   90 +
 ...trtl-fix-out-of-bounds-memory-access.patch |  125 +
 .../bluetooth-btusb-fix-memory-leak.patch     |   68 +
 queue-6.8/bluetooth-fix-eir-name-length.patch |  106 +
 ...e-after-free-in-accessing-skb-after-.patch |   61 +
 ...re-cancel-request-on-command-timeout.patch |  245 ++
 ...ci_core-fix-possible-buffer-overflow.patch |   36 +
 ...ent-fix-not-indicating-new-connectio.patch |  115 +
 ...-add-ability-to-allocate-memory-for-.patch |  104 +
 ...a-don-t-use-is_err_or_null-with-gpio.patch |   59 +
 ...ync-fix-overwriting-request-callback.patch |  257 ++
 ...emove-leftover-queuing-of-power_off-.patch |   78 +
 .../bluetooth-msft-fix-memory-leak.patch      |   42 +
 queue-6.8/bluetooth-remove-bt_hs.patch        | 3573 +++++++++++++++++
 ...uetooth-remove-hci_power_off_timeout.patch |   39 +
 ...-superfluous-call-to-hci_conn_check_.patch |   62 +
 ...arnings-intended-for-global-subprogs.patch |   60 +
 ...ptr_to_ctx-for-programs-with-unnamed.patch |   97 +
 ...hash-overflow-check-on-32-bit-arches.patch |   66 +
 ...htab-overflow-check-on-32-bit-arches.patch |   65 +
 ...kmap-overflow-check-on-32-bit-arches.patch |   61 +
 ..._prog_pack_size-to-2mb-num_possible_.patch |   53 +
 ...alar-args-don-t-accept-__arg_nonnull.patch |   53 +
 ...n_-lock-unlock-helpers-with-notrace-.patch |  133 +
 ...-fix-wrong-free-call-in-do_show_link.patch |   39 +
 ...l-silence-build-warning-about-calloc.patch |   54 +
 ...hen-detecting-delalloc-ranges-during.patch |  511 +++
 ...nect-update-dependency-to-arch_tegra.patch |   47 +
 ...cancel-polling-timer-together-with-i.patch |   82 +
 .../cifs-fix-writeback-data-corruption.patch  |  510 +++
 ...lk-fix-clk_core_get-null-dereference.patch |   56 +
 ...3519-release-the-correct-number-of-g.patch |   39 +
 ...-hi3559a-fix-an-erroneous-devm_kfree.patch |   42 +
 ...x-imx8mp-fix-sai_mclk_sel-definition.patch |   62 +
 ...622-apmixedsys-fix-an-error-handling.patch |   41 +
 ...981-topckgen-flag-sgm_reg_sel-as-cri.patch |   44 +
 ...135-fix-an-error-handling-path-in-cl.patch |   48 +
 ...183-correct-parent-of-clk_infra_sspm.patch |   42 +
 ...dd-missing-clocks-to-axg_clk_regmaps.patch |   83 +
 ...sdm845-adjust-internal-gdsc-wait-tim.patch |   38 +
 ...5018-fix-enable_reg-offset-of-gcc_gm.patch |   56 +
 ...5018-fix-halt_reg-offset-of-gcc_pcie.patch |   70 +
 ...5018-fix-register-offset-for-gcc_ubi.patch |   47 +
 ...et-commonize-the-de-assert-functions.patch |   69 +
 ...nsure-write-completion-on-reset-de-a.patch |   45 +
 ...a779f0-correct-pfc-gpio-parent-clock.patch |   43 +
 ...779g0-correct-pfc-gpio-parent-clocks.patch |   78 +
 ...renesas-r8a779g0-fix-pcie-clock-name.patch |   36 +
 ...7g04-34-use-sel_sdhi1_sts-status-con.patch |   53 +
 ...os850-propagate-spi-ipclk-rate-chang.patch |  173 +
 ...-null-pointer-dereference-caused-by-.patch |   74 +
 ...avs-cpufreq-add-check-for-cpufreq_cp.patch |   39 +
 ...-hw-don-t-error-out-if-supply-is-not.patch |   48 +
 ...-hw-wait-for-cpu-supplies-before-pro.patch |   72 +
 ...-hw-add-config_common_clk-dependency.patch |   47 +
 ...o-arm-sha-fix-function-cast-warnings.patch |  115 +
 ...-discarding-errors-in-psp_send_platf.patch |   56 +
 ...r-fix-crypto_jitterentropy-help-text.patch |   51 +
 .../crypto-qat-avoid-division-by-zero.patch   |   45 +
 ...to-qat-avoid-memcpy-overflow-warning.patch |   56 +
 ...ring-to-service-map-for-dcc-in-420xx.patch |   56 +
 ...-ring-to-service-map-for-dcc-in-4xxx.patch |   56 +
 ...emove-double-initialization-of-value.patch |   56 +
 ...move-unused-macros-in-qat_comp_alg.c.patch |   71 +
 ...oved-unused-macro-in-adf_cnv_dbgfs.c.patch |   41 +
 ...ilinx-call-finalize-with-bh-disabled.patch |   72 +
 ...rrect-assignment-of-sslbis-entry-poi.patch |  112 +
 ...nk-fix-length-of-eswitch-inline-mode.patch |   58 +
 ...he-resume-method-on-internal-suspend.patch |  123 +
 ...e-positive-for-requeue-needed-during.patch |   46 +
 ...10-adma-update-dependency-to-arch_te.patch |   60 +
 ...andle-use-kzalloc-to-fix-kernel-info.patch |   72 +
 ..._ref_-_del-for-multiple-registration.patch |   63 +
 ...oper-enum-for-pin-capabilities-attri.patch |   48 +
 ...ct-video-to-provide-cmdline-function.patch |   52 +
 ...add-replay-null-check-in-edp_set_rep.patch |   62 +
 ...fix-a-potential-buffer-overflow-in-d.patch |   46 +
 ...fix-null-checks-for-adev-dm.dc-in-am.patch |   62 +
 ...fix-potential-null-pointer-dereferen.patch |   57 +
 ...x-esm-reg-mask-use-to-get-pcie-speed.patch |   74 +
 ...issing-break-in-atom_arg_imm-case-of.patch |   48 +
 ...otential-out-of-bounds-access-in-amd.patch |   64 +
 ...dv7511-fix-crash-on-irq-during-probe.patch |   83 +
 ...ci-use-clk_ignore_unused-for-apq8016.patch |   49 +
 ...-t-treat-0-as-1-in-drm_fixp2int_ceil.patch |   41 +
 ...ima-fix-a-memleak-in-lima_heap_alloc.patch |   72 +
 ...-fix-dsi-rgb666-formats-and-definiti.patch |   78 +
 ...-a-null-pointer-crash-in-mtk_drm_crt.patch |   81 +
 ...-a6xx-specify-ubwc-config-for-sc7180.patch |   52 +
 queue-6.8/drm-msm-a7xx-fix-llc-typo.patch     |   36 +
 ...division-of-drm_display_mode-s-hskew.patch |   49 +
 ...allow-certain-formats-for-cdm-for-dp.patch |   44 +
 ...msm-dpu-finalise-global-state-object.patch |   50 +
 ...the-programming-of-intf_cfg2_data_hc.patch |  130 +
 ...-enable-dsc_mode_multiplex-if-dsc_me.patch |   46 +
 ...101wum-nl6-make-use-of-prepare_prev_.patch |   42 +
 ...-panel-edp-use-put_sync-in-unprepare.patch |   44 +
 ...x-wrong-firmware-size-logging-in-ni_.patch |   39 +
 ...-rockchip-inno_hdmi-fix-video-timing.patch |   51 +
 ...hip-lvds-do-not-overwrite-error-code.patch |   38 +
 ...s-do-not-print-scary-message-when-pr.patch |   41 +
 ...fix-pm-disable-depth-imbalance-in-te.patch |   77 +
 ...d-missing-check-for-of_find_device_b.patch |   41 +
 ...x-missing-pm_runtime_disable-in-the-.patch |   37 +
 ...x-some-error-handling-paths-in-tegra.patch |  116 +
 ...ix-some-error-handling-paths-in-tegr.patch |   85 +
 ...-fix-missing-i2c_put_adapter-in-the-.patch |   75 +
 ...m_gem_object-ref-on-error-in-tegra_f.patch |   40 +
 ...x-missing-clk_put-in-the-error-handl.patch |   50 +
 ...x-some-error-handling-paths-in-tegra.patch |   81 +
 ...valid-printf-format-specifiers-in-ku.patch |  130 +
 ...lpers-include-missing-drm_drv-header.patch |   44 +
 ...-tidss-fix-initial-plane-zpos-values.patch |   56 +
 ...ix-sync-lost-issue-with-two-displays.patch |   64 +
 ...-vkms-avoid-reading-beyond-lut-array.patch |   66 +
 ...-a-memleak-in-vmw_gmrid_man_get_node.patch |   41 +
 ...mw_du_get_cursor_mob-fencing-of-newl.patch |   57 +
 ...-fix-ref-counting-leak-on-page-fault.patch |   44 +
 ...rouped-target-in-makefile-with-patte.patch |   43 +
 ...-printf-format-specifiers-in-xe_migr.patch |   65 +
 ...smmu-fix-sm8-45-50-gpu-smmu-if-condi.patch |   58 +
 ...qcom-mdss-include-ommited-fam-b-comp.patch |   37 +
 ...p-false-positives-on-initializing-er.patch |  215 +
 ...umber-of-blocks-in-a-current-section.patch |   67 +
 ...x-reserve_cblocks-counting-error-whe.patch |  132 +
 ...x-to-avoid-inconsistence-bewteen-i_b.patch |  146 +
 ...x-to-check-compress-flag-w-.i_sem-lo.patch |   53 +
 ...x-to-check-unreleased-compressed-clu.patch |   56 +
 ...x-to-check-zstd-compress-level-corre.patch |   60 +
 ...x-to-cover-f2fs_disable_compressed_f.patch |   63 +
 ...x-to-cover-normal-cluster-write-with.patch |  125 +
 ...x-to-guarantee-persisting-compressed.patch |  148 +
 ...locate-some-judgments-in-f2fs_reserv.patch |   63 +
 ...inter-dereference-in-f2fs_submit_pag.patch |   77 +
 ...void-potential-panic-during-recovery.patch |  109 +
 ...d-use-after-free-issue-in-f2fs_filem.patch |   77 +
 ...te-selinux-label-during-whiteout-ini.patch |  142 +
 ...ve-unnecessary-f2fs_bug_on-to-avoid-.patch |   41 +
 ...to-truncate-meta-inode-pages-forcely.patch |  140 +
 ...correct-segment-type-in-f2fs_allocat.patch |   44 +
 ...-fix-to-avoid-caching-unaligned-exte.patch |  130 +
 ...-remove-pow2-check-condition-for-zon.patch |   42 +
 ...-wait-completion-of-last-bio-in-zone.patch |   47 +
 ...hange-loglevel-when-the-power-domain.patch |   42 +
 ...i-fix-double-free-in-smc-transport-c.patch |   99 +
 queue-6.8/fs-fix-rw_hint-validation.patch     |   67 +
 ...s-hfsplus-use-better-opf-description.patch |   42 +
 ...work-stack-allocation-hack-for-clang.patch |   67 +
 ...omadik-fix-offset-bug-in-nmk_pmx_set.patch |   57 +
 ...610-allow-disabling-the-vf610-driver.patch |   43 +
 ...sumer-device-through-to-core-in-devm.patch |   97 +
 ...md_sfh-avoid-disabling-the-interrupt.patch |  103 +
 ...update-hpd-sensor-structure-elements.patch |   44 +
 ...iddleclick_workaround-sysfs-knob-for.patch |  134 +
 ...bi-irq-depends-on-hot-join-and-sir-e.patch |   41 +
 ...eing-updated-by-way-too-large-values.patch |   90 +
 .../igb-fix-missing-time-sync-events.patch    |   94 +
 .../igc-fix-missing-time-sync-events.patch    |  108 +
 ...te-data-races-around-inet_diag_table.patch |   58 +
 ...d-support-for-iqs7222d-v1.1-and-v1.2.patch |  147 +
 ...ing-net-correct-the-type-of-variable.patch |   37 +
 ...-overflow-check-in-io_recvmsg_mshot_.patch |   54 +
 ...e-receive-multishot-out-of-the-gener.patch |  274 ++
 ...fy-how-recvmsg-and-sendmsg-copy-in-t.patch |  330 ++
 ...looping-around-handling-traditional-.patch |  126 +
 ...unconditional-looping-in-local-task_.patch |  165 +
 ...per-folio-dirty-bits-on-all-writebac.patch |   71 +
 ...-add-static-iommu_ops-release_domain.patch |   94 +
 .../iommu-amd-mark-interrupt-as-managed.patch |   69 +
 ...3-check-that-the-rid-domain-is-s1-in.patch |   61 +
 ...mpilation-without-config_iommu_intel.patch |   68 +
 ...-issue-ats-invalidation-request-when.patch |  203 +
 ...-d-fix-null-domain-on-device-release.patch |  190 +
 ...ve-ite-fault-handling-if-target-devi.patch |   82 +
 ...device-rbtree-in-iopf-reporting-path.patch |  128 +
 ...rbtree-to-track-iommu-probed-devices.patch |  213 +
 ...ct-parameter-validation-in-the-ip_mr.patch |   45 +
 ...flush-route-cache-when-rule-is-chang.patch |   55 +
 ...e-one-synchronize_net-barrier-in-ipv.patch |   43 +
 ...-setup-dma-masks-on-the-kunit-device.patch |   60 +
 ...he-correct-filter-string-in-executor.patch |   44 +
 ...ct-parameter-validation-in-the-pppol.patch |   47 +
 ...13-unlock-mutex-before-destroying-it.patch |   37 +
 ...-missing-timer-cleanup-and-flash-gpi.patch |   41 +
 ...an-invalid-format-specifier-in-an-as.patch |   43 +
 ...-fix-an-invalid-format-specifier-in-.patch |   51 +
 ...ot-fix-first-entry-having-a-0-handle.patch |  204 +
 ...epot-off-by-one-in-depot_fetch_stack.patch |   45 +
 .../libbpf-add-bpf_token_create-api.patch     |   95 +
 ...new_split-api-that-was-declared-but-.patch |   64 +
 ...bpf-add-missed-btf_ext__raw_data-api.patch |   81 +
 ...ng-libbpf_api-annotation-to-libbpf_s.patch |   40 +
 ..._set_def_max_entries-for-inner_maps-.patch |   54 +
 ..._ctx-type-enforcement-for-perf_event.patch |   74 +
 ...ibbpf-fix-faccessat-usage-on-android.patch |   56 +
 ...n-value-for-perf_event-__arg_ctx-typ.patch |   50 +
 ...-use-opts_set-macro-in-bpf_xdp_query.patch |   52 +
 ...d_closing-when-the-raid-is-about-to-.patch |   73 +
 .../md-fix-kmemleak-of-rdev-serial.patch      |   57 +
 ...ctor-out-helpers-to-add-rdev-to-conf.patch |  171 +
 ...fix-choose-next-idle-in-read_balance.patch |  148 +
 ...nonrot-rdevs-while-adding-removing-r.patch |  139 +
 ...i2rx-use-match-fwnode-for-media-link.patch |   40 +
 ...-h265-fix-configuring-bitstream-size.patch |   72 +
 ...s-techwell-tw9900-fix-port-schema-re.patch |   37 +
 ...nds-avoid-stack-overflow-warnings-wi.patch |   95 +
 ...dia-edia-dvbdev-fix-a-use-after-free.patch |   84 +
 ...otate-unchecked-call-to-media_device.patch |   42 +
 ...-check-of-return-value-of-go7007_rea.patch |   40 +
 ...fix-a-memleak-in-go7007_load_encoder.patch |   57 +
 .../media-i2c-imx290-fix-imx920-typo.patch    |   68 +
 ...aler-fix-v4l2_ctrl_handler-memory-le.patch |   35 +
 ...a-ivsc-csi-swap-sink-and-source-pads.patch |   48 +
 ...codec-avoid-wcast-function-type-stri.patch |   93 +
 ...rusb2-fix-pvr2_stream_callback-casts.patch |  115 +
 ...2-fix-uaf-in-pvr2_context_set_notify.patch |   75 +
 ...-pvrusb2-remove-redundant-null-check.patch |   41 +
 ...i-di-fix-chroma-difference-threshold.patch |   36 +
 ...edia-sun8i-di-fix-coefficient-writes.patch |  102 +
 ...-sun8i-di-fix-power-on-off-sequences.patch |   88 +
 ...egister-v4l2-async-device-only-after.patch |   51 +
 ...fix-two-memleaks-in-budget_av_attach.patch |   52 +
 ...ve-useless-locks-in-usbtv_video_free.patch |   55 +
 ...ia-v4l2-cci-print-leading-0-on-error.patch |   47 +
 ...em-fix-a-memleak-in-v4l2_m2m_registe.patch |   48 +
 ...2-tpg-fix-some-memleaks-in-tpg_alloc.patch |  112 +
 ...add-missing-doc-comment-for-waiting_.patch |   76 +
 ...emory-tegra-correct-dla-client-names.patch |  107 +
 ...r-call-of_node_put-only-when-of_pars.patch |   42 +
 ...wrong-gpio_fn_sel-and-spi_clk_config.patch |   48 +
 ...-cs42l43-fix-wrong-register-defaults.patch |  111 +
 ...of_node_put-only-when-of_parse_phand.patch |   42 +
 ...__mips_cm_l2sync_phys_base-to-weak-f.patch |   90 +
 ...move-an-incorrect-release_mem_region.patch |   50 +
 .../modules-wait-do_free_init-correctly.patch |  125 +
 ...-core-fix-flash-size-larger-than-32-.patch |   39 +
 ...uflash-declare-uflash_devinit-static.patch |   43 +
 ...nand-exec_op-helper-functions-return.patch |   72 +
 ...pc32xx_mlc-fix-irq-handler-prototype.patch |   52 +
 ...d-spinand-esmt-extend-ids-to-5-bytes.patch |   68 +
 .../nbd-null-check-for-nla_nest_start.patch   |   43 +
 ...v-fix-build-warning-for-ethh-set-but.patch |   49 +
 ...p-make-sure-drive-strength-configura.patch |   67 +
 .../net-ena-remove-ena_select_queue.patch     |   66 +
 ...nel-crash-when-1588-is-received-on-h.patch |   84 +
 ...t-duplex-configure-error-in-imp-rese.patch |   44 +
 ...3-fix-wrong-judgment-condition-issue.patch |   36 +
 ...ke-sure-to-pull-inner-header-in-ip_t.patch |  125 +
 ...rrect-parameter-validation-in-the-kc.patch |   45 +
 ...p-copy-skb-ext-data-when-fragmenting.patch |   62 +
 ...822-fix-rgmii-tx-delay-configuration.patch |   91 +
 ...get_internal_delay-accessing-an-empt.patch |   48 +
 ...-an-off-by-one-in-rpc_sockaddr2uaddr.patch |   42 +
 ...ntf-format-specifier-in-skb_segment-.patch |   43 +
 ...rrect-parameter-validation-in-the-x2.patch |   47 +
 ...ndle-acti_netdevs-allocation-failure.patch |   45 +
 ...fs-fix-an-off-by-one-in-root_nfs_cat.patch |   42 +
 ...s_issue_read-xarray-locking-for-writ.patch |  157 +
 ...when-nfs4_ff_layout_prepare_ds-fails.patch |   96 +
 ...fsv4.1-pnfs-fix-nfs-with-tls-in-pnfs.patch |  112 +
 ...ix-listxattr-maximum-xdr-buffer-size.patch |   60 +
 ..._listxattr-kernel-bug-at-mm-usercopy.patch |   99 +
 ...ble-name-leak-in-ntb_register_device.patch |   85 +
 ...uble-free-of-struct-nvme_id_ns-in-ns.patch |   52 +
 ...nd_hint_-save-restore-across-basic-b.patch |   54 +
 .../octeontx2-af-fix-devlink-params.patch     |   72 +
 ...ugfs-fix-warning-around-icc_get_name.patch |   50 +
 ...t-mounting-over-case-insensitive-dir.patch |   98 +
 ...ovl-relax-warn_on-in-ovl_verify_area.patch |   47 +
 ...rootport-attribute-paths-in-abi-docs.patch |   52 +
 ...-broken-brcm_pcie_mdio_write-polling.patch |   44 +
 ...-all-tlp-prefixes-not-just-the-first.patch |   45 +
 ..._is_disconnected-helper-public-for-o.patch |   67 +
 ...650se-root-port-extended-tags-as-bro.patch |   56 +
 ...-sleeping-issue-in-a-rcu-read-sectio.patch |   38 +
 ...x-an-error-handling-path-in-switchte.patch |   51 +
 ...an-up-the-generated-copied-vmlinux.h.patch |   46 +
 ...uplicate-initialization-of-data-id-i.patch |   38 +
 ...s_event-function-for-metric-style-ev.patch |   62 +
 ...etric-don-t-remove-scale-from-counts.patch |   51 +
 ...otential-memory-leak-in-perf_pmu__lo.patch |   46 +
 ...rf-pmu-treat-the-msr-pmu-as-software.patch |   90 +
 ...s-make-is_event_supported-more-robus.patch |  154 +
 ...k-conflict-between-timestamp-filenam.patch |  103 +
 ...possible-incorrect-free-in-record__s.patch |   40 +
 ...-srcline-add-missed-addr2line-closes.patch |   46 +
 .../perf-stat-avoid-metric-only-segv.patch    |   43 +
 ...free-strlist-on-normal-path-in-threa.patch |   45 +
 ...ts-amd-fix-zen-4-cache-latency-event.patch |  231 ++
 ...e-avoid-register-reset-when-cpu-is-d.patch |   42 +
 ...-qcom-qmp-usb-split-usb-c-phy-driver.patch | 1454 +++++++
 ...c-add-support-for-the-type-c-handlin.patch |  205 +
 ...c-handle-clamp-register-in-a-correct.patch |  157 +
 ...-drop-bogus-slew-rate-register-range.patch |   40 +
 ...bogus-slew-rate-register-range.patch-14189 |   40 +
 ...allow-the-compiler-to-optimize-away-.patch |   53 +
 ...r8a779g0-add-missing-scif_clk2-pin-g.patch |   69 +
 ...rzg2l-fix-locking-in-rzg2l_dt_subnod.patch |   74 +
 ...-pmf-do-not-use-readl-for-policy-buf.patch |   46 +
 ...6-intel-pmc-arl-put-gna-device-in-d3.patch |   52 +
 ...6-intel-pmc-lnl-remove-ssram-support.patch |  105 +
 ...ain-qcom-rpmhpd-drop-sa8540p-gfx.lvl.patch |   39 +
 ...ly-mm8013-fix-not-charging-detection.patch |   78 +
 ...u-fix-error-check-against-freq_qos_a.patch |   41 +
 ...erpc-32-fix-adb_cuda-kconfig-warning.patch |   45 +
 ...4xx-fix-warp_gpio_leds-build-failure.patch |   43 +
 ...6xx-fix-no-previous-prototype-for-av.patch |   53 +
 ...lining-of-arch_vmap_p-u-m-d_supporte.patch |   65 +
 ...fix-the-h_get_perf_counter_info-hcal.patch |  118 +
 ...lv1-hcall-assembly-for-elfv2-calling.patch |   99 +
 ...fix-potential-memleak-in-papr_get_at.patch |   44 +
 queue-6.8/printk-add-this_cpu_in_panic.patch  |  102 +
 ...assing-console-lock-owner-completely.patch |  116 +
 ...intk-nbcon-relocate-32bit-seq-macros.patch |  156 +
 ...ingbuffer-cleanup-reader-terminology.patch |   80 +
 ...r-do-not-skip-non-finalized-records-.patch |  319 ++
 ...r-skip-non-finalized-records-in-pani.patch |   79 +
 ...r-all-reserved-records-with-pr_flush.patch |  178 +
 ...re-inode-only-d_invalidate-is-needed.patch |   70 +
 ...fix-clock-imbalance-related-to-suspe.patch |   41 +
 .../pwm-dwc-use-pm_sleep_ptr-macro.patch      |   42 +
 ...ure-for-st-pwm-num-chan-st-capture-n.patch |   62 +
 ...x-potential-null-pointer-dereference.patch |  278 ++
 ...-annotations-of-inode-dquot-pointers.patch |  253 ++
 ...y-annotate-i_dquot-arrays-with-__rcu.patch |  247 ++
 ...nown-device-for-choose_configuration.patch |   39 +
 ...expedited-parallel-grace-period-kwor.patch |   46 +
 ...cu-expedited-grace-period-kworker-al.patch |  128 +
 ...a-race-between-mad_client-and-cm_cli.patch |  133 +
 ...-modifying-default-congestion-contro.patch |  134 +
 ...ma-irdma-remove-duplicate-assignment.patch |   47 +
 ...b-fix-bug-in-creation-of-dma-regions.patch |   36 +
 ...roduce-mana_ib_get_netdev-helper-fun.patch |  273 ++
 ...roduce-mana_ib_install_cq_cb-helper-.patch |  137 +
 ...introduce-mdev_to_gc-helper-function.patch |  294 ++
 ...-virtual-address-in-dma-regions-for-.patch |  216 +
 ...eck-strnlen-return-len-in-sysfs-mpat.patch |   41 +
 ...-register-event-handler-until-srpt-d.patch |   61 +
 ...ace-consumer-add-module-device-table.patch |   39 +
 ...orward-seed-csr-access-to-user-space.patch |   61 +
 ...starfive-jh7100-fix-root-clock-names.patch |   61 +
 ...tc-test-fix-invalid-format-specifier.patch |   41 +
 ...e-prevent-rebuild-of-shared_cpu_list.patch |   49 +
 ...fix-double-module-refcount-decrement.patch |   58 +
 ...asd-use-dev_-for-device-log-messages.patch |  172 +
 ...r_event_free-upper-limit-for-pai-dev.patch |   58 +
 .../s390-vdso-drop-fpic-from-ldflags.patch    |   66 +
 ...the-scheduling-domain-into-account-i.patch |   87 +
 ...heduling-domain-into-account-i.patch-30615 |   55 +
 ...ction-pointer-type-mismatch-for-hcb_.patch |  152 +
 ...siostor-avoid-function-pointer-casts.patch |  135 +
 ...x-a-deadlock-issue-related-to-automa.patch |  125 +
 ...-map_in_maps-with-bpf_map_type_perf_.patch |   98 +
 ...f-disable-ipv6-for-lwt_redirect-test.patch |  131 +
 ...x-potential-premature-unload-in-bpf_.patch |   62 +
 ...fix-the-flaky-tc_redirect_dtime-test.patch |   96 +
 ...ace_helpers.c-do-not-use-poisoned-ty.patch |   43 +
 ...it-for-the-netstamp_needed_key-stati.patch |  186 +
 ...orwarding-add-missing-config-entries.patch |   83 +
 ...ding-add-missing-multicast-routing-c.patch |   46 +
 queue-6.8/series                              |  619 +++
 ...eck-return-value-on-broadcast_or-reg.patch |   41 +
 ...qcom-socinfo-rename-pm2250-to-pm4125.patch |   54 +
 ...te-data-races-around-sock_diag_handl.patch |   74 +
 ...m-add-missing-const-to-documentation.patch |   44 +
 ...parc32-do-not-select-generic_isa_dma.patch |   49 +
 ...x-section-mismatch-in-leon_pci_grpci.patch |   62 +
 ...-use-generic-cmpdi2-ucmpdi2-variants.patch |  133 +
 .../spi-consolidate-setting-message-spi.patch |   72 +
 ...ve-split-xfers-for-cs_word-emulation.patch |  119 +
 ...0-add-check-for-usbnet_get_endpoints.patch |   40 +
 ...arfive-set-16-bpp-for-capture_raw-de.patch |   60 +
 ...x-a-memleak-in-gss_import_v2_context.patch |   59 +
 ...me-memleaks-in-gssx_dec_option_array.patch |   86 +
 ...t-parameter-validation-in-the-do_tcp.patch |   47 +
 ...-test-fix-incorrect-format-specifier.patch |   40 +
 ...cross-timestamp-interpolation-corner.patch |  114 +
 ...cross-timestamp-interpolation-for-no.patch |   58 +
 ...cross-timestamp-interpolation-on-cou.patch |   43 +
 ...fids-fix-cross-compilation-to-non-ho.patch |  121 +
 ...fids-refactor-set-sorting-with-types.patch |  145 +
 ...dc-fix-passing-incompatible-pointer-.patch |   51 +
 ...t-parameter-validation-in-the-udp_li.patch |   47 +
 ...e-check-pm_runtime_enabled-before-de.patch |   51 +
 ...tm32_iwdg-initialize-default-timeout.patch |   59 +
 ...null-pointer-dereference-in-ath10k_w.patch |   42 +
 ...support-to-select-6-ghz-regulatory-t.patch |  160 +
 ...ge-to-move-wmi_vdev_param_set_hemu_m.patch |   98 +
 ...a-possible-dead-lock-caused-by-ab-ba.patch |   75 +
 ...ialize-rx_mcs_80-and-rx_mcs_160-befo.patch |   71 +
 ...e-cur_regulatory_info-for-each-radio.patch |  467 +++
 ...k-fix-fetching-mcbc-flag-for-qcn9274.patch |   62 +
 ...incorrect-logic-of-calculating-vdev_.patch |   49 +
 ...2k-fix-issues-in-channel-list-update.patch |  101 +
 ...-all-of-ath9k_wmi_event_tasklet-unti.patch |  124 +
 .../wifi-b43-disable-qos-for-bcm4331.patch    |   68 +
 ...rrect-queue-in-dma-worker-when-qos-i.patch |   66 +
 ...ke-correct-queue-in-dma-tx-path-when.patch |  167 +
 ...ke-correct-queue-in-pio-tx-path-when.patch |   59 +
 ...211-handle-pmk_op-allocation-failure.patch |   44 +
 ...rcmsmac-avoid-function-pointer-casts.patch |   81 +
 ...dd-rnr-with-reporting-ap-information.patch |  300 ++
 ...t-correct-param-change-count-in-ml-e.patch |  105 +
 .../wifi-iwlwifi-acpi-fix-wpfc-reading.patch  |   73 +
 ...ifi-iwlwifi-always-have-uats_enabled.patch |   42 +
 ...i-change-link-id-in-time-event-to-s8.patch |   80 +
 ...lwifi-dbg-tlv-ensure-nul-termination.patch |   43 +
 ...wlwifi-fix-ewrd-table-validity-check.patch |   44 +
 ...fi-iwlwifi-mvm-d3-fix-ipn-byte-order.patch |   57 +
 ...vm-don-t-set-replay-counters-to-0xff.patch |   52 +
 ...m-don-t-set-the-mfp-flag-for-the-gtk.patch |   74 +
 ...i-mvm-fix-erroneous-queue-index-mask.patch |   68 +
 ...vm-fix-the-listener-mac-filter-flags.patch |   37 +
 ...vm-fix-the-tlc-command-after-add_sta.patch |   54 +
 ...i-mvm-initialize-rates-in-fw-earlier.patch |   56 +
 ...vm-report-beacon-protection-failures.patch |  105 +
 ...ifi-properly-check-if-link-is-active.patch |   43 +
 ...ead-bios-pnvm-only-for-non-intel-sku.patch |   70 +
 .../wifi-iwlwifi-support-eht-for-wh.patch     |   37 +
 ...x-some-memleaks-in-lbs_allocate_cmd_.patch |   57 +
 ...e-deflink-and-fix-typo-in-link-id-ch.patch |   44 +
 ...e-issue-of-missing-txpwr-settings-fr.patch |   38 +
 ...-fix-incorrect-type-conversion-for-c.patch |   47 +
 ...7921e-fix-use-after-free-in-free_irq.patch |   92 +
 ...-add-flow-to-avoid-chip-bt-function-.patch |   54 +
 ...-add-support-to-set-ifs-time-by-mcu-.patch |  136 +
 ...-fix-connect-to-80211b-mode-fail-in-.patch |   40 +
 ...ifi-mt76-mt7925-fix-fw-download-fail.patch |   35 +
 ...76-mt7925-fix-mcu-query-command-fail.patch |   46 +
 ...-fix-sap-no-beacon-issue-in-5ghz-and.patch |   93 +
 ...-fix-the-wrong-header-translation-co.patch |   92 +
 ...fi-mt76-mt7925-fix-wmm-queue-mapping.patch |   76 +
 ...925-fix-wow-failed-in-encrypted-mode.patch |  301 ++
 ...mt76-mt7925-update-pcie-dma-settings.patch |   92 +
 ...7925e-fix-use-after-free-in-free_irq.patch |   38 +
 ...-fix-a-potential-loading-failure-of-.patch |   83 +
 ...wifi-mt76-mt792x-fix-ethtool-warning.patch |   35 +
 ...-check-txs-format-before-getting-skb.patch |   68 +
 ...-mt76-mt7996-fix-efuse-reading-issue.patch |   37 +
 ...i-mt76-mt7996-fix-fw-loading-timeout.patch |   48 +
 ...-fix-he-beamformer-phy-cap-for-stati.patch |   43 +
 ...i-mt76-mt7996-fix-hif_txd_v2_1-value.patch |   37 +
 ...-fix-incorrect-interpretation-of-eht.patch |   61 +
 .../wifi-mt76-mt7996-fix-twt-issues.patch     |  137 +
 ...ugfs-drop-unnecessary-error-check-fo.patch |   46 +
 ...add-cancel_work_sync-for-c2hcmd_work.patch |   37 +
 ...8821c-fix-beacon-loss-and-disconnect.patch |   86 +
 ...fi-rtw88-8821c-fix-false-alarm-count.patch |   40 +
 ...tw88-8821cu-fix-firmware-upload-fail.patch |   96 +
 ...wfx-fix-memory-leak-when-starting-ap.patch |  123 +
 ...-not-realloc-workqueue-everytime-an-.patch |  123 +
 ...i-wilc1000-fix-declarations-ordering.patch |   49 +
 ...x-multi-vif-management-when-deleting.patch |   54 +
 ...lc1000-fix-rcu-usage-in-connect-path.patch |  176 +
 ...event-use-after-free-on-vif-when-cle.patch |  172 +
 ...ilc1000-revert-reset-line-logic-flip.patch |   70 +
 ...call-cpumask_test_cpu-with-1-cpu-in-.patch |   61 +
 .../workqueue-factor-out-pwq_is_empty.patch   |   75 +
 ...ent-system-wide-nr_active-enforcemen.patch |  753 ++++
 ...e-introduce-struct-wq_node_nr_active.patch |  306 ++
 ...q_adjust_max_active-round-robin-pwqs.patch |   82 +
 ...move-nr_active-handling-into-helpers.patch |  183 +
 ...move-pwq-max_active-to-wq-max_active.patch |  299 ++
 ...otect-wq-dfl_pwq-and-implement-acces.patch |  184 +
 ...e-pwq_activate_inactive_work-with-__.patch |   93 +
 ...eue.c-increase-workqueue-name-length.patch |   60 +
 ...he-__iomem-annotation-of-movdir64b-s.patch |  117 +
 ...put-to-pfn_to_kaddr-is-treated-as-a-.patch |   73 +
 ...ignore-relocations-in-.notes-section.patch |   54 +
 ...ement-new-mba_mbps-throttling-heuris.patch |  162 +
 ...-supported-bandwidth-sources-from-cp.patch |  119 +
 ...ve-hard-coded-memory-bandwidth-limit.patch |   79 +
 ...ry-encryption-setting-if-enabled-by-.patch |   82 +
 620 files changed, 53916 insertions(+)
 create mode 100644 queue-6.8/acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch
 create mode 100644 queue-6.8/acpi-hmat-remove-register-of-memory-node-for-generic.patch
 create mode 100644 queue-6.8/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
 create mode 100644 queue-6.8/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
 create mode 100644 queue-6.8/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
 create mode 100644 queue-6.8/acpi-scan-fix-device-check-notification-handling.patch
 create mode 100644 queue-6.8/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
 create mode 100644 queue-6.8/afs-don-t-cache-preferred-address.patch
 create mode 100644 queue-6.8/afs-fix-occasional-rmdir-then-vnovnode-with-generic-.patch
 create mode 100644 queue-6.8/afs-revert-afs-hide-silly-rename-files-from-userspac.patch
 create mode 100644 queue-6.8/alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch
 create mode 100644 queue-6.8/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
 create mode 100644 queue-6.8/alsa-hda-tas2781-add-lock-to-system_suspend.patch
 create mode 100644 queue-6.8/alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch
 create mode 100644 queue-6.8/alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch
 create mode 100644 queue-6.8/alsa-hda-tas2781-restore-power-state-after-system_re.patch
 create mode 100644 queue-6.8/alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch
 create mode 100644 queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-4i4-low-voltage-.patch
 create mode 100644 queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-autogain-status-.patch
 create mode 100644 queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch
 create mode 100644 queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch-21200
 create mode 100644 queue-6.8/alsa-seq-fix-function-cast-warnings.patch
 create mode 100644 queue-6.8/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
 create mode 100644 queue-6.8/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
 create mode 100644 queue-6.8/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
 create mode 100644 queue-6.8/arm-dts-arm-realview-fix-development-chip-rom-compat.patch
 create mode 100644 queue-6.8/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
 create mode 100644 queue-6.8/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
 create mode 100644 queue-6.8/arm-dts-qcom-msm8974-correct-qfprom-node-size.patch
 create mode 100644 queue-6.8/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
 create mode 100644 queue-6.8/arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch
 create mode 100644 queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
 create mode 100644 queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-27736
 create mode 100644 queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
 create mode 100644 queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-24016
 create mode 100644 queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
 create mode 100644 queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-1464
 create mode 100644 queue-6.8/arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch
 create mode 100644 queue-6.8/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
 create mode 100644 queue-6.8/arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch
 create mode 100644 queue-6.8/arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch
 create mode 100644 queue-6.8/arm64-dts-imx8qm-align-edma3-power-domains-resources.patch
 create mode 100644 queue-6.8/arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch
 create mode 100644 queue-6.8/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-nodename.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch
 create mode 100644 queue-6.8/arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch
 create mode 100644 queue-6.8/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
 create mode 100644 queue-6.8/arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-qcm6490-fairphone-fp5-add-missing-res.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-qcm6490-idp-correct-the-voltage-setti.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-qcs6490-rb3gen2-correct-the-voltage-s.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-rename-pm2250-to-pm4125.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc7280-add-static-properties-to-crypt.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-mdp_cfg-path.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm6115-drop-pipe-clock-selection.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8650-fix-spmi-channels-size.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-sm8650-fix-ufs-phy-clocks.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-x1e80100-drop-qcom-drv-count.patch
 create mode 100644 queue-6.8/arm64-dts-qcom-x1e80100-qcp-fix-supplies-for-ldos-3e.patch
 create mode 100644 queue-6.8/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
 create mode 100644 queue-6.8/arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch
 create mode 100644 queue-6.8/arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch
 create mode 100644 queue-6.8/arm64-dts-renesas-r8a779g0-restore-sort-order.patch
 create mode 100644 queue-6.8/arm64-dts-renesas-r9a08g045-add-missing-interrupts-t.patch
 create mode 100644 queue-6.8/arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch
 create mode 100644 queue-6.8/arm64-dts-renesas-rzg3s-smarc-som-guard-ethernet-irq.patch
 create mode 100644 queue-6.8/arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch
 create mode 100644 queue-6.8/arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch
 create mode 100644 queue-6.8/arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch
 create mode 100644 queue-6.8/arm64-dts-ti-add-common1-register-space-for-am62x-so.patch
 create mode 100644 queue-6.8/arm64-dts-ti-add-common1-register-space-for-am65x-so.patch
 create mode 100644 queue-6.8/arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-am69-sk-fix-pmic-interrupt-number.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j721e-fix-mux-reg-masks-in-hbmc_mux.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j721e-sk-fix-pmic-interrupt-number.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch
 create mode 100644 queue-6.8/arm64-dts-ti-k3-j784s4-main-fix-mux-reg-masks-in-ser.patch
 create mode 100644 queue-6.8/arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch
 create mode 100644 queue-6.8/asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch
 create mode 100644 queue-6.8/asoc-intel-ssp-common-add-stub-for-sof_ssp_get_codec.patch
 create mode 100644 queue-6.8/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
 create mode 100644 queue-6.8/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
 create mode 100644 queue-6.8/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
 create mode 100644 queue-6.8/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
 create mode 100644 queue-6.8/asoc-sh-rz-ssi-fix-error-message-print.patch
 create mode 100644 queue-6.8/asoc-sof-add-some-bounds-checking-to-firmware-data.patch
 create mode 100644 queue-6.8/asoc-sof-amd-compute-file-paths-on-firmware-load.patch
 create mode 100644 queue-6.8/asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch
 create mode 100644 queue-6.8/asoc-sof-core-skip-firmware-test-for-custom-loaders.patch
 create mode 100644 queue-6.8/backlight-da9052-fully-initialize-backlight_properti.patch
 create mode 100644 queue-6.8/backlight-hx8357-fix-potential-null-pointer-derefere.patch
 create mode 100644 queue-6.8/backlight-ktz8866-correct-the-check-for-of_property_.patch
 create mode 100644 queue-6.8/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
 create mode 100644 queue-6.8/backlight-lm3630a-initialize-backlight_properties-on.patch
 create mode 100644 queue-6.8/backlight-lm3639-fully-initialize-backlight_properti.patch
 create mode 100644 queue-6.8/backlight-lp8788-fully-initialize-backlight_properti.patch
 create mode 100644 queue-6.8/block-fix-deadlock-between-bd_link_disk_holder-and-p.patch
 create mode 100644 queue-6.8/bluetooth-af_bluetooth-fix-deadlock.patch
 create mode 100644 queue-6.8/bluetooth-btrtl-fix-out-of-bounds-memory-access.patch
 create mode 100644 queue-6.8/bluetooth-btusb-fix-memory-leak.patch
 create mode 100644 queue-6.8/bluetooth-fix-eir-name-length.patch
 create mode 100644 queue-6.8/bluetooth-fix-use-after-free-in-accessing-skb-after-.patch
 create mode 100644 queue-6.8/bluetooth-hci_core-cancel-request-on-command-timeout.patch
 create mode 100644 queue-6.8/bluetooth-hci_core-fix-possible-buffer-overflow.patch
 create mode 100644 queue-6.8/bluetooth-hci_event-fix-not-indicating-new-connectio.patch
 create mode 100644 queue-6.8/bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch
 create mode 100644 queue-6.8/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
 create mode 100644 queue-6.8/bluetooth-hci_sync-fix-overwriting-request-callback.patch
 create mode 100644 queue-6.8/bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch
 create mode 100644 queue-6.8/bluetooth-msft-fix-memory-leak.patch
 create mode 100644 queue-6.8/bluetooth-remove-bt_hs.patch
 create mode 100644 queue-6.8/bluetooth-remove-hci_power_off_timeout.patch
 create mode 100644 queue-6.8/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
 create mode 100644 queue-6.8/bpf-don-t-emit-warnings-intended-for-global-subprogs.patch
 create mode 100644 queue-6.8/bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch
 create mode 100644 queue-6.8/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
 create mode 100644 queue-6.8/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
 create mode 100644 queue-6.8/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
 create mode 100644 queue-6.8/bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch
 create mode 100644 queue-6.8/bpf-make-sure-scalar-args-don-t-accept-__arg_nonnull.patch
 create mode 100644 queue-6.8/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
 create mode 100644 queue-6.8/bpftool-fix-wrong-free-call-in-do_show_link.patch
 create mode 100644 queue-6.8/bpftool-silence-build-warning-about-calloc.patch
 create mode 100644 queue-6.8/btrfs-fix-race-when-detecting-delalloc-ranges-during.patch
 create mode 100644 queue-6.8/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
 create mode 100644 queue-6.8/can-m_can-start-cancel-polling-timer-together-with-i.patch
 create mode 100644 queue-6.8/cifs-fix-writeback-data-corruption.patch
 create mode 100644 queue-6.8/clk-fix-clk_core_get-null-dereference.patch
 create mode 100644 queue-6.8/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
 create mode 100644 queue-6.8/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
 create mode 100644 queue-6.8/clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch
 create mode 100644 queue-6.8/clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch
 create mode 100644 queue-6.8/clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch
 create mode 100644 queue-6.8/clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch
 create mode 100644 queue-6.8/clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch
 create mode 100644 queue-6.8/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
 create mode 100644 queue-6.8/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
 create mode 100644 queue-6.8/clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch
 create mode 100644 queue-6.8/clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch
 create mode 100644 queue-6.8/clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch
 create mode 100644 queue-6.8/clk-qcom-reset-commonize-the-de-assert-functions.patch
 create mode 100644 queue-6.8/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
 create mode 100644 queue-6.8/clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch
 create mode 100644 queue-6.8/clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch
 create mode 100644 queue-6.8/clk-renesas-r8a779g0-fix-pcie-clock-name.patch
 create mode 100644 queue-6.8/clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch
 create mode 100644 queue-6.8/clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch
 create mode 100644 queue-6.8/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
 create mode 100644 queue-6.8/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
 create mode 100644 queue-6.8/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
 create mode 100644 queue-6.8/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
 create mode 100644 queue-6.8/cpufreq-qcom-hw-add-config_common_clk-dependency.patch
 create mode 100644 queue-6.8/crypto-arm-sha-fix-function-cast-warnings.patch
 create mode 100644 queue-6.8/crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch
 create mode 100644 queue-6.8/crypto-jitter-fix-crypto_jitterentropy-help-text.patch
 create mode 100644 queue-6.8/crypto-qat-avoid-division-by-zero.patch
 create mode 100644 queue-6.8/crypto-qat-avoid-memcpy-overflow-warning.patch
 create mode 100644 queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-420xx.patch
 create mode 100644 queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch
 create mode 100644 queue-6.8/crypto-qat-remove-double-initialization-of-value.patch
 create mode 100644 queue-6.8/crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch
 create mode 100644 queue-6.8/crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch
 create mode 100644 queue-6.8/crypto-xilinx-call-finalize-with-bh-disabled.patch
 create mode 100644 queue-6.8/cxl-fix-the-incorrect-assignment-of-sslbis-entry-poi.patch
 create mode 100644 queue-6.8/devlink-fix-length-of-eswitch-inline-mode.patch
 create mode 100644 queue-6.8/dm-call-the-resume-method-on-internal-suspend.patch
 create mode 100644 queue-6.8/dm-raid-fix-false-positive-for-requeue-needed-during.patch
 create mode 100644 queue-6.8/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
 create mode 100644 queue-6.8/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
 create mode 100644 queue-6.8/dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch
 create mode 100644 queue-6.8/dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch
 create mode 100644 queue-6.8/drivers-ps3-select-video-to-provide-cmdline-function.patch
 create mode 100644 queue-6.8/drm-amd-display-add-replay-null-check-in-edp_set_rep.patch
 create mode 100644 queue-6.8/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
 create mode 100644 queue-6.8/drm-amd-display-fix-null-checks-for-adev-dm.dc-in-am.patch
 create mode 100644 queue-6.8/drm-amd-display-fix-potential-null-pointer-dereferen.patch
 create mode 100644 queue-6.8/drm-amd-pm-fix-esm-reg-mask-use-to-get-pcie-speed.patch
 create mode 100644 queue-6.8/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
 create mode 100644 queue-6.8/drm-amdgpu-fix-potential-out-of-bounds-access-in-amd.patch
 create mode 100644 queue-6.8/drm-bridge-adv7511-fix-crash-on-irq-during-probe.patch
 create mode 100644 queue-6.8/drm-ci-use-clk_ignore_unused-for-apq8016.patch
 create mode 100644 queue-6.8/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
 create mode 100644 queue-6.8/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
 create mode 100644 queue-6.8/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
 create mode 100644 queue-6.8/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
 create mode 100644 queue-6.8/drm-msm-a6xx-specify-ubwc-config-for-sc7180.patch
 create mode 100644 queue-6.8/drm-msm-a7xx-fix-llc-typo.patch
 create mode 100644 queue-6.8/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
 create mode 100644 queue-6.8/drm-msm-dpu-allow-certain-formats-for-cdm-for-dp.patch
 create mode 100644 queue-6.8/drm-msm-dpu-finalise-global-state-object.patch
 create mode 100644 queue-6.8/drm-msm-dpu-fix-the-programming-of-intf_cfg2_data_hc.patch
 create mode 100644 queue-6.8/drm-msm-dpu-only-enable-dsc_mode_multiplex-if-dsc_me.patch
 create mode 100644 queue-6.8/drm-panel-boe-tv101wum-nl6-make-use-of-prepare_prev_.patch
 create mode 100644 queue-6.8/drm-panel-edp-use-put_sync-in-unprepare.patch
 create mode 100644 queue-6.8/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
 create mode 100644 queue-6.8/drm-rockchip-inno_hdmi-fix-video-timing.patch
 create mode 100644 queue-6.8/drm-rockchip-lvds-do-not-overwrite-error-code.patch
 create mode 100644 queue-6.8/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
 create mode 100644 queue-6.8/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
 create mode 100644 queue-6.8/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
 create mode 100644 queue-6.8/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
 create mode 100644 queue-6.8/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
 create mode 100644 queue-6.8/drm-tegra-hdmi-fix-some-error-handling-paths-in-tegr.patch
 create mode 100644 queue-6.8/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
 create mode 100644 queue-6.8/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
 create mode 100644 queue-6.8/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
 create mode 100644 queue-6.8/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
 create mode 100644 queue-6.8/drm-tests-fix-invalid-printf-format-specifiers-in-ku.patch
 create mode 100644 queue-6.8/drm-tests-helpers-include-missing-drm_drv-header.patch
 create mode 100644 queue-6.8/drm-tidss-fix-initial-plane-zpos-values.patch
 create mode 100644 queue-6.8/drm-tidss-fix-sync-lost-issue-with-two-displays.patch
 create mode 100644 queue-6.8/drm-vkms-avoid-reading-beyond-lut-array.patch
 create mode 100644 queue-6.8/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
 create mode 100644 queue-6.8/drm-vmwgfx-fix-vmw_du_get_cursor_mob-fencing-of-newl.patch
 create mode 100644 queue-6.8/drm-xe-fix-ref-counting-leak-on-page-fault.patch
 create mode 100644 queue-6.8/drm-xe-replace-grouped-target-in-makefile-with-patte.patch
 create mode 100644 queue-6.8/drm-xe-tests-fix-printf-format-specifiers-in-xe_migr.patch
 create mode 100644 queue-6.8/dt-bindings-arm-smmu-fix-sm8-45-50-gpu-smmu-if-condi.patch
 create mode 100644 queue-6.8/dt-bindings-msm-qcom-mdss-include-ommited-fam-b-comp.patch
 create mode 100644 queue-6.8/erofs-fix-lockdep-false-positives-on-initializing-er.patch
 create mode 100644 queue-6.8/f2fs-check-number-of-blocks-in-a-current-section.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-to-avoid-inconsistence-bewteen-i_b.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-to-check-compress-flag-w-.i_sem-lo.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-to-check-zstd-compress-level-corre.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-to-cover-f2fs_disable_compressed_f.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
 create mode 100644 queue-6.8/f2fs-compress-fix-to-guarantee-persisting-compressed.patch
 create mode 100644 queue-6.8/f2fs-compress-relocate-some-judgments-in-f2fs_reserv.patch
 create mode 100644 queue-6.8/f2fs-fix-null-pointer-dereference-in-f2fs_submit_pag.patch
 create mode 100644 queue-6.8/f2fs-fix-to-avoid-potential-panic-during-recovery.patch
 create mode 100644 queue-6.8/f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filem.patch
 create mode 100644 queue-6.8/f2fs-fix-to-create-selinux-label-during-whiteout-ini.patch
 create mode 100644 queue-6.8/f2fs-fix-to-remove-unnecessary-f2fs_bug_on-to-avoid-.patch
 create mode 100644 queue-6.8/f2fs-fix-to-truncate-meta-inode-pages-forcely.patch
 create mode 100644 queue-6.8/f2fs-fix-to-use-correct-segment-type-in-f2fs_allocat.patch
 create mode 100644 queue-6.8/f2fs-ro-compress-fix-to-avoid-caching-unaligned-exte.patch
 create mode 100644 queue-6.8/f2fs-zone-fix-to-remove-pow2-check-condition-for-zon.patch
 create mode 100644 queue-6.8/f2fs-zone-fix-to-wait-completion-of-last-bio-in-zone.patch
 create mode 100644 queue-6.8/fbdev-simplefb-change-loglevel-when-the-power-domain.patch
 create mode 100644 queue-6.8/firmware-arm_scmi-fix-double-free-in-smc-transport-c.patch
 create mode 100644 queue-6.8/fs-fix-rw_hint-validation.patch
 create mode 100644 queue-6.8/fs-hfsplus-use-better-opf-description.patch
 create mode 100644 queue-6.8/fs-select-rework-stack-allocation-hack-for-clang.patch
 create mode 100644 queue-6.8/gpio-nomadik-fix-offset-bug-in-nmk_pmx_set.patch
 create mode 100644 queue-6.8/gpio-vf610-allow-disabling-the-vf610-driver.patch
 create mode 100644 queue-6.8/gpiolib-pass-consumer-device-through-to-core-in-devm.patch
 create mode 100644 queue-6.8/hid-amd_sfh-avoid-disabling-the-interrupt.patch
 create mode 100644 queue-6.8/hid-amd_sfh-update-hpd-sensor-structure-elements.patch
 create mode 100644 queue-6.8/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
 create mode 100644 queue-6.8/i3c-dw-disable-ibi-irq-depends-on-hot-join-and-sir-e.patch
 create mode 100644 queue-6.8/ice-fix-stats-being-updated-by-way-too-large-values.patch
 create mode 100644 queue-6.8/igb-fix-missing-time-sync-events.patch
 create mode 100644 queue-6.8/igc-fix-missing-time-sync-events.patch
 create mode 100644 queue-6.8/inet_diag-annotate-data-races-around-inet_diag_table.patch
 create mode 100644 queue-6.8/input-iqs7222-add-support-for-iqs7222d-v1.1-and-v1.2.patch
 create mode 100644 queue-6.8/io_uring-net-correct-the-type-of-variable.patch
 create mode 100644 queue-6.8/io_uring-net-fix-overflow-check-in-io_recvmsg_mshot_.patch
 create mode 100644 queue-6.8/io_uring-net-move-receive-multishot-out-of-the-gener.patch
 create mode 100644 queue-6.8/io_uring-net-unify-how-recvmsg-and-sendmsg-copy-in-t.patch
 create mode 100644 queue-6.8/io_uring-remove-looping-around-handling-traditional-.patch
 create mode 100644 queue-6.8/io_uring-remove-unconditional-looping-in-local-task_.patch
 create mode 100644 queue-6.8/iomap-clear-the-per-folio-dirty-bits-on-all-writebac.patch
 create mode 100644 queue-6.8/iommu-add-static-iommu_ops-release_domain.patch
 create mode 100644 queue-6.8/iommu-amd-mark-interrupt-as-managed.patch
 create mode 100644 queue-6.8/iommu-arm-smmu-v3-check-that-the-rid-domain-is-s1-in.patch
 create mode 100644 queue-6.8/iommu-fix-compilation-without-config_iommu_intel.patch
 create mode 100644 queue-6.8/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
 create mode 100644 queue-6.8/iommu-vt-d-fix-null-domain-on-device-release.patch
 create mode 100644 queue-6.8/iommu-vt-d-improve-ite-fault-handling-if-target-devi.patch
 create mode 100644 queue-6.8/iommu-vt-d-use-device-rbtree-in-iopf-reporting-path.patch
 create mode 100644 queue-6.8/iommu-vt-d-use-rbtree-to-track-iommu-probed-devices.patch
 create mode 100644 queue-6.8/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
 create mode 100644 queue-6.8/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
 create mode 100644 queue-6.8/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
 create mode 100644 queue-6.8/kunit-setup-dma-masks-on-the-kunit-device.patch
 create mode 100644 queue-6.8/kunit-test-log-the-correct-filter-string-in-executor.patch
 create mode 100644 queue-6.8/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
 create mode 100644 queue-6.8/leds-aw2013-unlock-mutex-before-destroying-it.patch
 create mode 100644 queue-6.8/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
 create mode 100644 queue-6.8/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
 create mode 100644 queue-6.8/lib-memcpy_kunit-fix-an-invalid-format-specifier-in-.patch
 create mode 100644 queue-6.8/lib-stackdepot-fix-first-entry-having-a-0-handle.patch
 create mode 100644 queue-6.8/lib-stackdepot-off-by-one-in-depot_fetch_stack.patch
 create mode 100644 queue-6.8/libbpf-add-bpf_token_create-api.patch
 create mode 100644 queue-6.8/libbpf-add-btf__new_split-api-that-was-declared-but-.patch
 create mode 100644 queue-6.8/libbpf-add-missed-btf_ext__raw_data-api.patch
 create mode 100644 queue-6.8/libbpf-add-missing-libbpf_api-annotation-to-libbpf_s.patch
 create mode 100644 queue-6.8/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
 create mode 100644 queue-6.8/libbpf-fix-__arg_ctx-type-enforcement-for-perf_event.patch
 create mode 100644 queue-6.8/libbpf-fix-faccessat-usage-on-android.patch
 create mode 100644 queue-6.8/libbpf-fix-return-value-for-perf_event-__arg_ctx-typ.patch
 create mode 100644 queue-6.8/libbpf-use-opts_set-macro-in-bpf_xdp_query.patch
 create mode 100644 queue-6.8/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
 create mode 100644 queue-6.8/md-fix-kmemleak-of-rdev-serial.patch
 create mode 100644 queue-6.8/md-raid1-factor-out-helpers-to-add-rdev-to-conf.patch
 create mode 100644 queue-6.8/md-raid1-fix-choose-next-idle-in-read_balance.patch
 create mode 100644 queue-6.8/md-raid1-record-nonrot-rdevs-while-adding-removing-r.patch
 create mode 100644 queue-6.8/media-cadence-csi2rx-use-match-fwnode-for-media-link.patch
 create mode 100644 queue-6.8/media-cedrus-h265-fix-configuring-bitstream-size.patch
 create mode 100644 queue-6.8/media-dt-bindings-techwell-tw9900-fix-port-schema-re.patch
 create mode 100644 queue-6.8/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
 create mode 100644 queue-6.8/media-edia-dvbdev-fix-a-use-after-free.patch
 create mode 100644 queue-6.8/media-em28xx-annotate-unchecked-call-to-media_device.patch
 create mode 100644 queue-6.8/media-go7007-add-check-of-return-value-of-go7007_rea.patch
 create mode 100644 queue-6.8/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
 create mode 100644 queue-6.8/media-i2c-imx290-fix-imx920-typo.patch
 create mode 100644 queue-6.8/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
 create mode 100644 queue-6.8/media-ivsc-csi-swap-sink-and-source-pads.patch
 create mode 100644 queue-6.8/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
 create mode 100644 queue-6.8/media-pvrusb2-fix-pvr2_stream_callback-casts.patch
 create mode 100644 queue-6.8/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
 create mode 100644 queue-6.8/media-pvrusb2-remove-redundant-null-check.patch
 create mode 100644 queue-6.8/media-sun8i-di-fix-chroma-difference-threshold.patch
 create mode 100644 queue-6.8/media-sun8i-di-fix-coefficient-writes.patch
 create mode 100644 queue-6.8/media-sun8i-di-fix-power-on-off-sequences.patch
 create mode 100644 queue-6.8/media-tc358743-register-v4l2-async-device-only-after.patch
 create mode 100644 queue-6.8/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
 create mode 100644 queue-6.8/media-usbtv-remove-useless-locks-in-usbtv_video_free.patch
 create mode 100644 queue-6.8/media-v4l2-cci-print-leading-0-on-error.patch
 create mode 100644 queue-6.8/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
 create mode 100644 queue-6.8/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
 create mode 100644 queue-6.8/media-videobuf2-add-missing-doc-comment-for-waiting_.patch
 create mode 100644 queue-6.8/memory-tegra-correct-dla-client-names.patch
 create mode 100644 queue-6.8/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
 create mode 100644 queue-6.8/mfd-cs42l43-fix-wrong-gpio_fn_sel-and-spi_clk_config.patch
 create mode 100644 queue-6.8/mfd-cs42l43-fix-wrong-register-defaults.patch
 create mode 100644 queue-6.8/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
 create mode 100644 queue-6.8/mips-cm-convert-__mips_cm_l2sync_phys_base-to-weak-f.patch
 create mode 100644 queue-6.8/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
 create mode 100644 queue-6.8/modules-wait-do_free_init-correctly.patch
 create mode 100644 queue-6.8/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
 create mode 100644 queue-6.8/mtd-maps-sun_uflash-declare-uflash_devinit-static.patch
 create mode 100644 queue-6.8/mtd-rawnand-brcmnand-exec_op-helper-functions-return.patch
 create mode 100644 queue-6.8/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
 create mode 100644 queue-6.8/mtd-spinand-esmt-extend-ids-to-5-bytes.patch
 create mode 100644 queue-6.8/nbd-null-check-for-nla_nest_start.patch
 create mode 100644 queue-6.8/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
 create mode 100644 queue-6.8/net-dsa-microchip-make-sure-drive-strength-configura.patch
 create mode 100644 queue-6.8/net-ena-remove-ena_select_queue.patch
 create mode 100644 queue-6.8/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
 create mode 100644 queue-6.8/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
 create mode 100644 queue-6.8/net-hns3-fix-wrong-judgment-condition-issue.patch
 create mode 100644 queue-6.8/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
 create mode 100644 queue-6.8/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
 create mode 100644 queue-6.8/net-mctp-copy-skb-ext-data-when-fragmenting.patch
 create mode 100644 queue-6.8/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
 create mode 100644 queue-6.8/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
 create mode 100644 queue-6.8/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
 create mode 100644 queue-6.8/net-test-fix-printf-format-specifier-in-skb_segment-.patch
 create mode 100644 queue-6.8/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
 create mode 100644 queue-6.8/nfp-flower-handle-acti_netdevs-allocation-failure.patch
 create mode 100644 queue-6.8/nfs-fix-an-off-by-one-in-root_nfs_cat.patch
 create mode 100644 queue-6.8/nfs-fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch
 create mode 100644 queue-6.8/nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch
 create mode 100644 queue-6.8/nfsv4.1-pnfs-fix-nfs-with-tls-in-pnfs.patch
 create mode 100644 queue-6.8/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
 create mode 100644 queue-6.8/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
 create mode 100644 queue-6.8/ntb-fix-possible-name-leak-in-ntb_register_device.patch
 create mode 100644 queue-6.8/nvme-host-fix-double-free-of-struct-nvme_id_ns-in-ns.patch
 create mode 100644 queue-6.8/objtool-fix-unwind_hint_-save-restore-across-basic-b.patch
 create mode 100644 queue-6.8/octeontx2-af-fix-devlink-params.patch
 create mode 100644 queue-6.8/opp-debugfs-fix-warning-around-icc_get_name.patch
 create mode 100644 queue-6.8/ovl-always-reject-mounting-over-case-insensitive-dir.patch
 create mode 100644 queue-6.8/ovl-relax-warn_on-in-ovl_verify_area.patch
 create mode 100644 queue-6.8/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
 create mode 100644 queue-6.8/pci-brcmstb-fix-broken-brcm_pcie_mdio_write-polling.patch
 create mode 100644 queue-6.8/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
 create mode 100644 queue-6.8/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
 create mode 100644 queue-6.8/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
 create mode 100644 queue-6.8/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
 create mode 100644 queue-6.8/pci-switchtec-fix-an-error-handling-path-in-switchte.patch
 create mode 100644 queue-6.8/perf-bpf-clean-up-the-generated-copied-vmlinux.h.patch
 create mode 100644 queue-6.8/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
 create mode 100644 queue-6.8/perf-expr-fix-has_event-function-for-metric-style-ev.patch
 create mode 100644 queue-6.8/perf-metric-don-t-remove-scale-from-counts.patch
 create mode 100644 queue-6.8/perf-pmu-fix-a-potential-memory-leak-in-perf_pmu__lo.patch
 create mode 100644 queue-6.8/perf-pmu-treat-the-msr-pmu-as-software.patch
 create mode 100644 queue-6.8/perf-print-events-make-is_event_supported-more-robus.patch
 create mode 100644 queue-6.8/perf-record-check-conflict-between-timestamp-filenam.patch
 create mode 100644 queue-6.8/perf-record-fix-possible-incorrect-free-in-record__s.patch
 create mode 100644 queue-6.8/perf-srcline-add-missed-addr2line-closes.patch
 create mode 100644 queue-6.8/perf-stat-avoid-metric-only-segv.patch
 create mode 100644 queue-6.8/perf-thread_map-free-strlist-on-normal-path-in-threa.patch
 create mode 100644 queue-6.8/perf-vendor-events-amd-fix-zen-4-cache-latency-event.patch
 create mode 100644 queue-6.8/perf-x86-amd-core-avoid-register-reset-when-cpu-is-d.patch
 create mode 100644 queue-6.8/phy-qcom-qmp-usb-split-usb-c-phy-driver.patch
 create mode 100644 queue-6.8/phy-qcom-qmp-usbc-add-support-for-the-type-c-handlin.patch
 create mode 100644 queue-6.8/phy-qcom-qmp-usbc-handle-clamp-register-in-a-correct.patch
 create mode 100644 queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
 create mode 100644 queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch-14189
 create mode 100644 queue-6.8/pinctrl-renesas-allow-the-compiler-to-optimize-away-.patch
 create mode 100644 queue-6.8/pinctrl-renesas-r8a779g0-add-missing-scif_clk2-pin-g.patch
 create mode 100644 queue-6.8/pinctrl-renesas-rzg2l-fix-locking-in-rzg2l_dt_subnod.patch
 create mode 100644 queue-6.8/platform-x86-amd-pmf-do-not-use-readl-for-policy-buf.patch
 create mode 100644 queue-6.8/platform-x86-intel-pmc-arl-put-gna-device-in-d3.patch
 create mode 100644 queue-6.8/platform-x86-intel-pmc-lnl-remove-ssram-support.patch
 create mode 100644 queue-6.8/pmdomain-qcom-rpmhpd-drop-sa8540p-gfx.lvl.patch
 create mode 100644 queue-6.8/power-supply-mm8013-fix-not-charging-detection.patch
 create mode 100644 queue-6.8/powercap-dtpm_cpu-fix-error-check-against-freq_qos_a.patch
 create mode 100644 queue-6.8/powerpc-32-fix-adb_cuda-kconfig-warning.patch
 create mode 100644 queue-6.8/powerpc-4xx-fix-warp_gpio_leds-build-failure.patch
 create mode 100644 queue-6.8/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
 create mode 100644 queue-6.8/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
 create mode 100644 queue-6.8/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
 create mode 100644 queue-6.8/powerpc-ps3-fix-lv1-hcall-assembly-for-elfv2-calling.patch
 create mode 100644 queue-6.8/powerpc-pseries-fix-potential-memleak-in-papr_get_at.patch
 create mode 100644 queue-6.8/printk-add-this_cpu_in_panic.patch
 create mode 100644 queue-6.8/printk-disable-passing-console-lock-owner-completely.patch
 create mode 100644 queue-6.8/printk-nbcon-relocate-32bit-seq-macros.patch
 create mode 100644 queue-6.8/printk-ringbuffer-cleanup-reader-terminology.patch
 create mode 100644 queue-6.8/printk-ringbuffer-do-not-skip-non-finalized-records-.patch
 create mode 100644 queue-6.8/printk-ringbuffer-skip-non-finalized-records-in-pani.patch
 create mode 100644 queue-6.8/printk-wait-for-all-reserved-records-with-pr_flush.patch
 create mode 100644 queue-6.8/pstore-inode-only-d_invalidate-is-needed.patch
 create mode 100644 queue-6.8/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
 create mode 100644 queue-6.8/pwm-dwc-use-pm_sleep_ptr-macro.patch
 create mode 100644 queue-6.8/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
 create mode 100644 queue-6.8/quota-fix-potential-null-pointer-dereference.patch
 create mode 100644 queue-6.8/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
 create mode 100644 queue-6.8/quota-properly-annotate-i_dquot-arrays-with-__rcu.patch
 create mode 100644 queue-6.8/r8152-fix-unknown-device-for-choose_configuration.patch
 create mode 100644 queue-6.8/rcu-exp-fix-rcu-expedited-parallel-grace-period-kwor.patch
 create mode 100644 queue-6.8/rcu-exp-handle-rcu-expedited-grace-period-kworker-al.patch
 create mode 100644 queue-6.8/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
 create mode 100644 queue-6.8/rdma-hns-fix-mis-modifying-default-congestion-contro.patch
 create mode 100644 queue-6.8/rdma-irdma-remove-duplicate-assignment.patch
 create mode 100644 queue-6.8/rdma-mana_ib-fix-bug-in-creation-of-dma-regions.patch
 create mode 100644 queue-6.8/rdma-mana_ib-introduce-mana_ib_get_netdev-helper-fun.patch
 create mode 100644 queue-6.8/rdma-mana_ib-introduce-mana_ib_install_cq_cb-helper-.patch
 create mode 100644 queue-6.8/rdma-mana_ib-introduce-mdev_to_gc-helper-function.patch
 create mode 100644 queue-6.8/rdma-mana_ib-use-virtual-address-in-dma-regions-for-.patch
 create mode 100644 queue-6.8/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
 create mode 100644 queue-6.8/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
 create mode 100644 queue-6.8/regulator-userspace-consumer-add-module-device-table.patch
 create mode 100644 queue-6.8/risc-v-kvm-forward-seed-csr-access-to-user-space.patch
 create mode 100644 queue-6.8/riscv-dts-starfive-jh7100-fix-root-clock-names.patch
 create mode 100644 queue-6.8/rtc-test-fix-invalid-format-specifier.patch
 create mode 100644 queue-6.8/s390-cache-prevent-rebuild-of-shared_cpu_list.patch
 create mode 100644 queue-6.8/s390-dasd-fix-double-module-refcount-decrement.patch
 create mode 100644 queue-6.8/s390-dasd-use-dev_-for-device-log-messages.patch
 create mode 100644 queue-6.8/s390-pai-fix-attr_event_free-upper-limit-for-pai-dev.patch
 create mode 100644 queue-6.8/s390-vdso-drop-fpic-from-ldflags.patch
 create mode 100644 queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch
 create mode 100644 queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch-30615
 create mode 100644 queue-6.8/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
 create mode 100644 queue-6.8/scsi-csiostor-avoid-function-pointer-casts.patch
 create mode 100644 queue-6.8/scsi-hisi_sas-fix-a-deadlock-issue-related-to-automa.patch
 create mode 100644 queue-6.8/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
 create mode 100644 queue-6.8/selftests-bpf-disable-ipv6-for-lwt_redirect-test.patch
 create mode 100644 queue-6.8/selftests-bpf-fix-potential-premature-unload-in-bpf_.patch
 create mode 100644 queue-6.8/selftests-bpf-fix-the-flaky-tc_redirect_dtime-test.patch
 create mode 100644 queue-6.8/selftests-bpf-trace_helpers.c-do-not-use-poisoned-ty.patch
 create mode 100644 queue-6.8/selftests-bpf-wait-for-the-netstamp_needed_key-stati.patch
 create mode 100644 queue-6.8/selftests-forwarding-add-missing-config-entries.patch
 create mode 100644 queue-6.8/selftests-forwarding-add-missing-multicast-routing-c.patch
 create mode 100644 queue-6.8/series
 create mode 100644 queue-6.8/soc-qcom-llcc-check-return-value-on-broadcast_or-reg.patch
 create mode 100644 queue-6.8/soc-qcom-socinfo-rename-pm2250-to-pm4125.patch
 create mode 100644 queue-6.8/sock_diag-annotate-data-races-around-sock_diag_handl.patch
 create mode 100644 queue-6.8/soundwire-stream-add-missing-const-to-documentation.patch
 create mode 100644 queue-6.8/sparc32-do-not-select-generic_isa_dma.patch
 create mode 100644 queue-6.8/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
 create mode 100644 queue-6.8/sparc32-use-generic-cmpdi2-ucmpdi2-variants.patch
 create mode 100644 queue-6.8/spi-consolidate-setting-message-spi.patch
 create mode 100644 queue-6.8/spi-move-split-xfers-for-cs_word-emulation.patch
 create mode 100644 queue-6.8/sr9800-add-check-for-usbnet_get_endpoints.patch
 create mode 100644 queue-6.8/staging-media-starfive-set-16-bpp-for-capture_raw-de.patch
 create mode 100644 queue-6.8/sunrpc-fix-a-memleak-in-gss_import_v2_context.patch
 create mode 100644 queue-6.8/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
 create mode 100644 queue-6.8/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
 create mode 100644 queue-6.8/time-test-fix-incorrect-format-specifier.patch
 create mode 100644 queue-6.8/timekeeping-fix-cross-timestamp-interpolation-corner.patch
 create mode 100644 queue-6.8/timekeeping-fix-cross-timestamp-interpolation-for-no.patch
 create mode 100644 queue-6.8/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
 create mode 100644 queue-6.8/tools-resolve_btfids-fix-cross-compilation-to-non-ho.patch
 create mode 100644 queue-6.8/tools-resolve_btfids-refactor-set-sorting-with-types.patch
 create mode 100644 queue-6.8/tty-mips_ejtag_fdc-fix-passing-incompatible-pointer-.patch
 create mode 100644 queue-6.8/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
 create mode 100644 queue-6.8/watchdog-starfive-check-pm_runtime_enabled-before-de.patch
 create mode 100644 queue-6.8/watchdog-stm32_iwdg-initialize-default-timeout.patch
 create mode 100644 queue-6.8/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
 create mode 100644 queue-6.8/wifi-ath11k-add-support-to-select-6-ghz-regulatory-t.patch
 create mode 100644 queue-6.8/wifi-ath11k-change-to-move-wmi_vdev_param_set_hemu_m.patch
 create mode 100644 queue-6.8/wifi-ath11k-fix-a-possible-dead-lock-caused-by-ab-ba.patch
 create mode 100644 queue-6.8/wifi-ath11k-initialize-rx_mcs_80-and-rx_mcs_160-befo.patch
 create mode 100644 queue-6.8/wifi-ath11k-store-cur_regulatory_info-for-each-radio.patch
 create mode 100644 queue-6.8/wifi-ath12k-fix-fetching-mcbc-flag-for-qcn9274.patch
 create mode 100644 queue-6.8/wifi-ath12k-fix-incorrect-logic-of-calculating-vdev_.patch
 create mode 100644 queue-6.8/wifi-ath12k-fix-issues-in-channel-list-update.patch
 create mode 100644 queue-6.8/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
 create mode 100644 queue-6.8/wifi-b43-disable-qos-for-bcm4331.patch
 create mode 100644 queue-6.8/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
 create mode 100644 queue-6.8/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
 create mode 100644 queue-6.8/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
 create mode 100644 queue-6.8/wifi-brcm80211-handle-pmk_op-allocation-failure.patch
 create mode 100644 queue-6.8/wifi-brcmsmac-avoid-function-pointer-casts.patch
 create mode 100644 queue-6.8/wifi-cfg80211-add-rnr-with-reporting-ap-information.patch
 create mode 100644 queue-6.8/wifi-cfg80211-set-correct-param-change-count-in-ml-e.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-acpi-fix-wpfc-reading.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-always-have-uats_enabled.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-change-link-id-in-time-event-to-s8.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-fix-ewrd-table-validity-check.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-d3-fix-ipn-byte-order.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-don-t-set-the-mfp-flag-for-the-gtk.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-fix-erroneous-queue-index-mask.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-fix-the-listener-mac-filter-flags.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-fix-the-tlc-command-after-add_sta.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-initialize-rates-in-fw-earlier.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-properly-check-if-link-is-active.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-read-bios-pnvm-only-for-non-intel-sku.patch
 create mode 100644 queue-6.8/wifi-iwlwifi-support-eht-for-wh.patch
 create mode 100644 queue-6.8/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
 create mode 100644 queue-6.8/wifi-mac80211-use-deflink-and-fix-typo-in-link-id-ch.patch
 create mode 100644 queue-6.8/wifi-mt76-fix-the-issue-of-missing-txpwr-settings-fr.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-c.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-add-flow-to-avoid-chip-bt-function-.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-add-support-to-set-ifs-time-by-mcu-.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-fix-connect-to-80211b-mode-fail-in-.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-fix-fw-download-fail.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-fix-mcu-query-command-fail.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-fix-sap-no-beacon-issue-in-5ghz-and.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-fix-the-wrong-header-translation-co.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-fix-wmm-queue-mapping.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-fix-wow-failed-in-encrypted-mode.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925-update-pcie-dma-settings.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7925e-fix-use-after-free-in-free_irq.patch
 create mode 100644 queue-6.8/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch
 create mode 100644 queue-6.8/wifi-mt76-mt792x-fix-ethtool-warning.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7996-check-txs-format-before-getting-skb.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7996-fix-efuse-reading-issue.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7996-fix-fw-loading-timeout.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7996-fix-he-beamformer-phy-cap-for-stati.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7996-fix-hif_txd_v2_1-value.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7996-fix-incorrect-interpretation-of-eht.patch
 create mode 100644 queue-6.8/wifi-mt76-mt7996-fix-twt-issues.patch
 create mode 100644 queue-6.8/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
 create mode 100644 queue-6.8/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
 create mode 100644 queue-6.8/wifi-rtw88-8821c-fix-beacon-loss-and-disconnect.patch
 create mode 100644 queue-6.8/wifi-rtw88-8821c-fix-false-alarm-count.patch
 create mode 100644 queue-6.8/wifi-rtw88-8821cu-fix-firmware-upload-fail.patch
 create mode 100644 queue-6.8/wifi-wfx-fix-memory-leak-when-starting-ap.patch
 create mode 100644 queue-6.8/wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch
 create mode 100644 queue-6.8/wifi-wilc1000-fix-declarations-ordering.patch
 create mode 100644 queue-6.8/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
 create mode 100644 queue-6.8/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
 create mode 100644 queue-6.8/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
 create mode 100644 queue-6.8/wifi-wilc1000-revert-reset-line-logic-flip.patch
 create mode 100644 queue-6.8/workqueue-don-t-call-cpumask_test_cpu-with-1-cpu-in-.patch
 create mode 100644 queue-6.8/workqueue-factor-out-pwq_is_empty.patch
 create mode 100644 queue-6.8/workqueue-implement-system-wide-nr_active-enforcemen.patch
 create mode 100644 queue-6.8/workqueue-introduce-struct-wq_node_nr_active.patch
 create mode 100644 queue-6.8/workqueue-make-wq_adjust_max_active-round-robin-pwqs.patch
 create mode 100644 queue-6.8/workqueue-move-nr_active-handling-into-helpers.patch
 create mode 100644 queue-6.8/workqueue-move-pwq-max_active-to-wq-max_active.patch
 create mode 100644 queue-6.8/workqueue-rcu-protect-wq-dfl_pwq-and-implement-acces.patch
 create mode 100644 queue-6.8/workqueue-replace-pwq_activate_inactive_work-with-__.patch
 create mode 100644 queue-6.8/workqueue.c-increase-workqueue-name-length.patch
 create mode 100644 queue-6.8/x86-asm-remove-the-__iomem-annotation-of-movdir64b-s.patch
 create mode 100644 queue-6.8/x86-mm-ensure-input-to-pfn_to_kaddr-is-treated-as-a-.patch
 create mode 100644 queue-6.8/x86-relocs-ignore-relocations-in-.notes-section.patch
 create mode 100644 queue-6.8/x86-resctrl-implement-new-mba_mbps-throttling-heuris.patch
 create mode 100644 queue-6.8/x86-resctrl-read-supported-bandwidth-sources-from-cp.patch
 create mode 100644 queue-6.8/x86-resctrl-remove-hard-coded-memory-bandwidth-limit.patch
 create mode 100644 queue-6.8/x86-sme-fix-memory-encryption-setting-if-enabled-by-.patch

diff --git a/queue-6.8/acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch b/queue-6.8/acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch
new file mode 100644
index 00000000000..b0db6de1298
--- /dev/null
+++ b/queue-6.8/acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch
@@ -0,0 +1,47 @@
+From f08c80e3e04d6a71f43fd52bf7808344638bda55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 11:46:28 +0800
+Subject: ACPI: CPPC: enable AMD CPPC V2 support for family 17h processors
+
+From: Perry Yuan <perry.yuan@amd.com>
+
+[ Upstream commit a51ab63b297ce9e26e3ffb9be896018a42d5f32f ]
+
+As there are some AMD processors which only support CPPC V2 firmware and
+BIOS implementation, the amd_pstate driver will be failed to load when
+system booting with below kernel warning message:
+
+[    0.477523] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled
+
+To make the amd_pstate driver can be loaded on those TR40 processors, it
+needs to match x86_model from 0x30 to 0x7F for family 17H.
+With the change, the system can load amd_pstate driver as expected.
+
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Reported-by: Gino Badouri <badouri.g@gmail.com>
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218171
+Fixes: fbd74d1689 ("ACPI: CPPC: Fix enabling CPPC on AMD systems with shared memory")
+Signed-off-by: Perry Yuan <perry.yuan@amd.com>
+Reviewed-by: Gautham R. Shenoy <gautham.shenoy@amd.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/acpi/cppc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/acpi/cppc.c b/arch/x86/kernel/acpi/cppc.c
+index 8d8752b44f113..ff8f25faca3dd 100644
+--- a/arch/x86/kernel/acpi/cppc.c
++++ b/arch/x86/kernel/acpi/cppc.c
+@@ -20,7 +20,7 @@ bool cpc_supported_by_cpu(void)
+ 		    (boot_cpu_data.x86_model >= 0x20 && boot_cpu_data.x86_model <= 0x2f)))
+ 			return true;
+ 		else if (boot_cpu_data.x86 == 0x17 &&
+-			 boot_cpu_data.x86_model >= 0x70 && boot_cpu_data.x86_model <= 0x7f)
++			 boot_cpu_data.x86_model >= 0x30 && boot_cpu_data.x86_model <= 0x7f)
+ 			return true;
+ 		return boot_cpu_has(X86_FEATURE_CPPC);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/acpi-hmat-remove-register-of-memory-node-for-generic.patch b/queue-6.8/acpi-hmat-remove-register-of-memory-node-for-generic.patch
new file mode 100644
index 00000000000..b24f4640849
--- /dev/null
+++ b/queue-6.8/acpi-hmat-remove-register-of-memory-node-for-generic.patch
@@ -0,0 +1,62 @@
+From ec0ac153b89d5cad22cc745d9a8a8975e3f210b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 14:59:20 -0700
+Subject: ACPI: HMAT: Remove register of memory node for generic target
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 54b9460b0a28c4c76a7b455ec1b3b61a13e97291 ]
+
+For generic targets, there's no reason to call
+register_memory_node_under_compute_node() with the access levels that are
+only visible to HMAT handling code. Only update the attributes and rename
+hmat_register_generic_target_initiators() to hmat_update_generic_target().
+
+The original call path ends up triggering register_memory_node_under_compute_node().
+Although the access level would be "3" and not impact any current node arrays, it
+introduces unwanted data into the numa node access_coordinate array.
+
+Fixes: a3a3e341f169 ("acpi: numa: Add setting of generic port system locality attributes")
+Cc: Rafael J. Wysocki <rafael@kernel.org>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Tested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/20240308220055.2172956-2-dave.jiang@intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/numa/hmat.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/acpi/numa/hmat.c b/drivers/acpi/numa/hmat.c
+index d6b85f0f6082f..a26e7793ec4ef 100644
+--- a/drivers/acpi/numa/hmat.c
++++ b/drivers/acpi/numa/hmat.c
+@@ -770,12 +770,12 @@ static void __hmat_register_target_initiators(struct memory_target *target,
+ 	}
+ }
+ 
+-static void hmat_register_generic_target_initiators(struct memory_target *target)
++static void hmat_update_generic_target(struct memory_target *target)
+ {
+ 	static DECLARE_BITMAP(p_nodes, MAX_NUMNODES);
+ 
+-	__hmat_register_target_initiators(target, p_nodes,
+-					  NODE_ACCESS_CLASS_GENPORT_SINK);
++	hmat_update_target_attrs(target, p_nodes,
++				 NODE_ACCESS_CLASS_GENPORT_SINK);
+ }
+ 
+ static void hmat_register_target_initiators(struct memory_target *target)
+@@ -835,7 +835,7 @@ static void hmat_register_target(struct memory_target *target)
+ 	 */
+ 	mutex_lock(&target_lock);
+ 	if (*(u16 *)target->gen_port_device_handle) {
+-		hmat_register_generic_target_initiators(target);
++		hmat_update_generic_target(target);
+ 		target->registered = true;
+ 	}
+ 	mutex_unlock(&target_lock);
+-- 
+2.43.0
+
diff --git a/queue-6.8/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch b/queue-6.8/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
new file mode 100644
index 00000000000..39f824a4606
--- /dev/null
+++ b/queue-6.8/acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
@@ -0,0 +1,61 @@
+From 27be1efb292de4fb1327cc004e619e7038f5963d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 01:41:58 +0100
+Subject: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit e18afcb7b2a12b635ac10081f943fcf84ddacc51 ]
+
+After unregistering the CPU idle device, the memory associated with
+it is not freed, leading to a memory leak:
+
+unreferenced object 0xffff896282f6c000 (size 1024):
+  comm "swapper/0", pid 1, jiffies 4294893170
+  hex dump (first 32 bytes):
+    00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00  ................
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace (crc 8836a742):
+    [<ffffffff993495ed>] kmalloc_trace+0x29d/0x340
+    [<ffffffff9972f3b3>] acpi_processor_power_init+0xf3/0x1c0
+    [<ffffffff9972d263>] __acpi_processor_start+0xd3/0xf0
+    [<ffffffff9972d2bc>] acpi_processor_start+0x2c/0x50
+    [<ffffffff99805872>] really_probe+0xe2/0x480
+    [<ffffffff99805c98>] __driver_probe_device+0x78/0x160
+    [<ffffffff99805daf>] driver_probe_device+0x1f/0x90
+    [<ffffffff9980601e>] __driver_attach+0xce/0x1c0
+    [<ffffffff99803170>] bus_for_each_dev+0x70/0xc0
+    [<ffffffff99804822>] bus_add_driver+0x112/0x210
+    [<ffffffff99807245>] driver_register+0x55/0x100
+    [<ffffffff9aee4acb>] acpi_processor_driver_init+0x3b/0xc0
+    [<ffffffff990012d1>] do_one_initcall+0x41/0x300
+    [<ffffffff9ae7c4b0>] kernel_init_freeable+0x320/0x470
+    [<ffffffff99b231f6>] kernel_init+0x16/0x1b0
+    [<ffffffff99042e6d>] ret_from_fork+0x2d/0x50
+
+Fix this by freeing the CPU idle device after unregistering it.
+
+Fixes: 3d339dcbb56d ("cpuidle / ACPI : move cpuidle_device field out of the acpi_processor_power structure")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/processor_idle.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 55437f5e0c3ae..bd6a7857ce058 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1430,6 +1430,8 @@ int acpi_processor_power_exit(struct acpi_processor *pr)
+ 		acpi_processor_registered--;
+ 		if (acpi_processor_registered == 0)
+ 			cpuidle_unregister_driver(&acpi_idle_driver);
++
++		kfree(dev);
+ 	}
+ 
+ 	pr->flags.power_setup_done = 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch b/queue-6.8/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
new file mode 100644
index 00000000000..c24fe82c22a
--- /dev/null
+++ b/queue-6.8/acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
@@ -0,0 +1,49 @@
+From 875585208d6c7078fa92b41bb3928a5758c5a519 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 19:24:08 +0300
+Subject: ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override
+
+From: Maxim Kudinov <m.kudinovv@gmail.com>
+
+[ Upstream commit 021a67d096154893cd1d883c7be0097e2ee327fd ]
+
+A known issue on some Zen laptops, keyboard stopped working due to commit
+9946e39fe8d0 fael@kernel.org("ACPI: resource: skip IRQ override on AMD
+Zen platforms") on kernel 5.19.10.
+
+The ACPI IRQ override is required for this board due to buggy DSDT, thus
+adding the board vendor and name to irq1_edge_low_force_override fixes
+the issue.
+
+Fixes: 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217394
+Link: https://lore.kernel.org/linux-acpi/20231006123304.32686-1-hdegoede@redhat.com/
+Tested-by: Maxim Trofimov <maxvereschagin@gmail.com>
+Signed-off-by: Maxim Kudinov <m.kudinovv@gmail.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index 3ebb74eb768a5..c843feb02e980 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -602,6 +602,13 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "LL6FA"),
+ 		},
+ 	},
++	{
++		/* MAIBENBEN X577 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "MAIBENBEN"),
++			DMI_MATCH(DMI_BOARD_NAME, "X577"),
++		},
++	},
+ 	{ }
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch b/queue-6.8/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
new file mode 100644
index 00000000000..d90f46366cb
--- /dev/null
+++ b/queue-6.8/acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
@@ -0,0 +1,51 @@
+From 94ff395e054c4a73d71f9bbc2e9a46157c697b46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 12:30:09 +0000
+Subject: ACPI: resource: Do IRQ override on Lunnen Ground laptops
+
+From: Alexey I. Froloff <raorn@raorn.name>
+
+[ Upstream commit e23ad54fef186aa66007895be1382c88f1ee2bf7 ]
+
+The Lunnen Ground 15 and 16 needs IRQ overriding for the keyboard to
+work.
+
+Adding an entries for these laptops to the override_table makes the
+internal keyboard functional.
+
+Signed-off-by: Alexey I. Froloff <raorn@raorn.name>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: 021a67d09615 ("ACPI: resource: Add MAIBENBEN X577 to irq1_edge_low_force_override")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/resource.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
+index dacad1d846c0d..3ebb74eb768a5 100644
+--- a/drivers/acpi/resource.c
++++ b/drivers/acpi/resource.c
+@@ -588,6 +588,20 @@ static const struct dmi_system_id irq1_edge_low_force_override[] = {
+ 			DMI_MATCH(DMI_BOARD_NAME, "GM5RGEE0016COM"),
+ 		},
+ 	},
++	{
++		/* Lunnen Ground 15 / AMD Ryzen 5 5500U */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"),
++			DMI_MATCH(DMI_BOARD_NAME, "LLL5DAW"),
++		},
++	},
++	{
++		/* Lunnen Ground 16 / AMD Ryzen 7 5800U */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Lunnen"),
++			DMI_MATCH(DMI_BOARD_NAME, "LL6FA"),
++		},
++	},
+ 	{ }
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/acpi-scan-fix-device-check-notification-handling.patch b/queue-6.8/acpi-scan-fix-device-check-notification-handling.patch
new file mode 100644
index 00000000000..4614761c7cd
--- /dev/null
+++ b/queue-6.8/acpi-scan-fix-device-check-notification-handling.patch
@@ -0,0 +1,57 @@
+From ddf7b3afbb62b6b72de3b671b5724b6cfc663920 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 17:35:27 +0100
+Subject: ACPI: scan: Fix device check notification handling
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 793551c965116d9dfaf0550dacae1396a20efa69 ]
+
+It is generally invalid to fail a Device Check notification if the scan
+handler has not been attached to the given device after a bus rescan,
+because there may be valid reasons for the scan handler to refuse
+attaching to the device (for example, the device is not ready).
+
+For this reason, modify acpi_scan_device_check() to return 0 in that
+case without printing a warning.
+
+While at it, reduce the log level of the "already enumerated" message
+in the same function, because it is only interesting when debugging
+notification handling
+
+Fixes: 443fc8202272 ("ACPI / hotplug: Rework generic code to handle suprise removals")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index e6ed1ba91e5c9..617f3e0e963d5 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -314,18 +314,14 @@ static int acpi_scan_device_check(struct acpi_device *adev)
+ 		 * again).
+ 		 */
+ 		if (adev->handler) {
+-			dev_warn(&adev->dev, "Already enumerated\n");
+-			return -EALREADY;
++			dev_dbg(&adev->dev, "Already enumerated\n");
++			return 0;
+ 		}
+ 		error = acpi_bus_scan(adev->handle);
+ 		if (error) {
+ 			dev_warn(&adev->dev, "Namespace scan failure\n");
+ 			return error;
+ 		}
+-		if (!adev->handler) {
+-			dev_warn(&adev->dev, "Enumeration failure\n");
+-			error = -ENODEV;
+-		}
+ 	} else {
+ 		error = acpi_scan_device_not_enumerated(adev);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch b/queue-6.8/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
new file mode 100644
index 00000000000..faee4ed0310
--- /dev/null
+++ b/queue-6.8/af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
@@ -0,0 +1,39 @@
+From 47669a6486c383f67188f6f0548042a1b717e628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 09:08:52 -0800
+Subject: af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 31e03207119a535d0b0e3b3a7f91983aeb2cb14d ]
+
+gc_in_progress is changed under spin_lock(&unix_gc_lock),
+but wait_for_unix_gc() reads it locklessly.
+
+Let's use READ_ONCE().
+
+Fixes: 5f23b734963e ("net: Fix soft lockups/OOM issues w/ unix garbage collector")
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://lore.kernel.org/r/20240123170856.41348-2-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/unix/garbage.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index 2a81880dac7b7..027c86e804f8a 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -198,7 +198,7 @@ void wait_for_unix_gc(void)
+ 	if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC &&
+ 	    !READ_ONCE(gc_in_progress))
+ 		unix_gc();
+-	wait_event(unix_gc_wait, gc_in_progress == false);
++	wait_event(unix_gc_wait, !READ_ONCE(gc_in_progress));
+ }
+ 
+ /* The external entry point: unix_gc() */
+-- 
+2.43.0
+
diff --git a/queue-6.8/afs-don-t-cache-preferred-address.patch b/queue-6.8/afs-don-t-cache-preferred-address.patch
new file mode 100644
index 00000000000..01359165b4e
--- /dev/null
+++ b/queue-6.8/afs-don-t-cache-preferred-address.patch
@@ -0,0 +1,81 @@
+From 0f861a92f74159529fd326aa63e958f4006cd058 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 08:15:02 +0000
+Subject: afs: Don't cache preferred address
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 83505bde45e347f1451d007b3ddd7f06cee4c269 ]
+
+In the AFS fileserver rotation algorithm, don't cache the preferred address
+for the server as that will override the explicit preference if a
+non-preferred address responds first.
+
+Fixes: 495f2ae9e355 ("afs: Fix fileserver rotation")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20240313081505.3060173-2-dhowells@redhat.com
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/rotate.c | 21 ++++-----------------
+ 1 file changed, 4 insertions(+), 17 deletions(-)
+
+diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c
+index 700a27bc8c257..ed04bd1eeae89 100644
+--- a/fs/afs/rotate.c
++++ b/fs/afs/rotate.c
+@@ -602,6 +602,8 @@ bool afs_select_fileserver(struct afs_operation *op)
+ 		goto wait_for_more_probe_results;
+ 
+ 	alist = op->estate->addresses;
++	best_prio = -1;
++	addr_index = 0;
+ 	for (i = 0; i < alist->nr_addrs; i++) {
+ 		if (alist->addrs[i].prio > best_prio) {
+ 			addr_index = i;
+@@ -609,9 +611,7 @@ bool afs_select_fileserver(struct afs_operation *op)
+ 		}
+ 	}
+ 
+-	addr_index = READ_ONCE(alist->preferred);
+-	if (!test_bit(addr_index, &set))
+-		addr_index = __ffs(set);
++	alist->preferred = addr_index;
+ 
+ 	op->addr_index = addr_index;
+ 	set_bit(addr_index, &op->addr_tried);
+@@ -656,12 +656,6 @@ bool afs_select_fileserver(struct afs_operation *op)
+ next_server:
+ 	trace_afs_rotate(op, afs_rotate_trace_next_server, 0);
+ 	_debug("next");
+-	ASSERT(op->estate);
+-	alist = op->estate->addresses;
+-	if (op->call_responded &&
+-	    op->addr_index != READ_ONCE(alist->preferred) &&
+-	    test_bit(alist->preferred, &op->addr_tried))
+-		WRITE_ONCE(alist->preferred, op->addr_index);
+ 	op->estate = NULL;
+ 	goto pick_server;
+ 
+@@ -690,14 +684,7 @@ bool afs_select_fileserver(struct afs_operation *op)
+ failed:
+ 	trace_afs_rotate(op, afs_rotate_trace_failed, 0);
+ 	op->flags |= AFS_OPERATION_STOP;
+-	if (op->estate) {
+-		alist = op->estate->addresses;
+-		if (op->call_responded &&
+-		    op->addr_index != READ_ONCE(alist->preferred) &&
+-		    test_bit(alist->preferred, &op->addr_tried))
+-			WRITE_ONCE(alist->preferred, op->addr_index);
+-		op->estate = NULL;
+-	}
++	op->estate = NULL;
+ 	_leave(" = f [failed %d]", afs_op_error(op));
+ 	return false;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/afs-fix-occasional-rmdir-then-vnovnode-with-generic-.patch b/queue-6.8/afs-fix-occasional-rmdir-then-vnovnode-with-generic-.patch
new file mode 100644
index 00000000000..e3a39130d94
--- /dev/null
+++ b/queue-6.8/afs-fix-occasional-rmdir-then-vnovnode-with-generic-.patch
@@ -0,0 +1,104 @@
+From 6cdbf843346615333727d6928ce8fa8dceab5490 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 08:15:03 +0000
+Subject: afs: Fix occasional rmdir-then-VNOVNODE with generic/011
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit b74c02a37987d3ea755f96119c527f5e91950592 ]
+
+Sometimes generic/011 causes kafs to follow up an FS.RemoveDir RPC call by
+spending around a second sending a slew of FS.FetchStatus RPC calls to the
+directory just deleted that then abort with VNOVNODE, indicating deletion
+of the target directory.
+
+This seems to stem from userspace attempting to stat the directory or
+something in it:
+
+    afs_select_fileserver+0x46d/0xaa2
+    afs_wait_for_operation+0x12/0x17e
+    afs_fetch_status+0x56/0x75
+    afs_validate+0xfb/0x240
+    afs_permission+0xef/0x1b0
+    inode_permission+0x90/0x139
+    link_path_walk.part.0.constprop.0+0x6f/0x2f0
+    path_lookupat+0x4c/0xfa
+    filename_lookup+0x63/0xd7
+    vfs_statx+0x62/0x13f
+    vfs_fstatat+0x72/0x8a
+
+The issue appears to be that afs_dir_remove_subdir() marks the callback
+promise as being cancelled by setting the expiry time to AFS_NO_CB_PROMISE
+- which then confuses afs_validate() which sends the FetchStatus to try and
+get a new one before it checks for the AFS_VNODE_DELETED flag which
+indicates that we know the directory got deleted.
+
+Fix this by:
+
+ (1) Make afs_check_validity() return true if AFS_VNODE_DELETED is set, and
+     then tweak the return from afs_validate() if the DELETED flag is set.
+
+ (2) Move the AFS_VNODE_DELETED check in afs_validate() up above the
+     expiration check to immediately after we've grabbed the validate_lock.
+
+Fixes: 453924de6212 ("afs: Overhaul invalidation handling to better support RO volumes")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20240313081505.3060173-3-dhowells@redhat.com
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/validation.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/fs/afs/validation.c b/fs/afs/validation.c
+index 46b37f2cce7d9..32a53fc8dfb26 100644
+--- a/fs/afs/validation.c
++++ b/fs/afs/validation.c
+@@ -122,6 +122,9 @@ bool afs_check_validity(const struct afs_vnode *vnode)
+ 	const struct afs_volume *volume = vnode->volume;
+ 	time64_t deadline = ktime_get_real_seconds() + 10;
+ 
++	if (test_bit(AFS_VNODE_DELETED, &vnode->flags))
++		return true;
++
+ 	if (atomic_read(&volume->cb_v_check) != atomic_read(&volume->cb_v_break) ||
+ 	    atomic64_read(&vnode->cb_expires_at)  <= deadline ||
+ 	    volume->cb_expires_at <= deadline ||
+@@ -389,12 +392,17 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ 	       key_serial(key));
+ 
+ 	if (afs_check_validity(vnode))
+-		return 0;
++		return test_bit(AFS_VNODE_DELETED, &vnode->flags) ? -ESTALE : 0;
+ 
+ 	ret = down_write_killable(&vnode->validate_lock);
+ 	if (ret < 0)
+ 		goto error;
+ 
++	if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
++		ret = -ESTALE;
++		goto error_unlock;
++	}
++
+ 	/* Validate a volume after the v_break has changed or the volume
+ 	 * callback expired.  We only want to do this once per volume per
+ 	 * v_break change.  The actual work will be done when parsing the
+@@ -448,12 +456,6 @@ int afs_validate(struct afs_vnode *vnode, struct key *key)
+ 	vnode->cb_ro_snapshot = cb_ro_snapshot;
+ 	vnode->cb_scrub = cb_scrub;
+ 
+-	if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) {
+-		_debug("file already deleted");
+-		ret = -ESTALE;
+-		goto error_unlock;
+-	}
+-
+ 	/* if the vnode's data version number changed then its contents are
+ 	 * different */
+ 	zap |= test_and_clear_bit(AFS_VNODE_ZAP_DATA, &vnode->flags);
+-- 
+2.43.0
+
diff --git a/queue-6.8/afs-revert-afs-hide-silly-rename-files-from-userspac.patch b/queue-6.8/afs-revert-afs-hide-silly-rename-files-from-userspac.patch
new file mode 100644
index 00000000000..0f2bbe56fe1
--- /dev/null
+++ b/queue-6.8/afs-revert-afs-hide-silly-rename-files-from-userspac.patch
@@ -0,0 +1,55 @@
+From fb51bf3caa3cf70cbb4f194476a894dba0ff2858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 11:08:41 +0000
+Subject: afs: Revert "afs: Hide silly-rename files from userspace"
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 0aec3847d044273733285dcff90afda89ad461d2 ]
+
+This reverts commit 57e9d49c54528c49b8bffe6d99d782ea051ea534.
+
+This undoes the hiding of .__afsXXXX silly-rename files.  The problem with
+hiding them is that rm can't then manually delete them.
+
+This also reverts commit 5f7a07646655fb4108da527565dcdc80124b14c4 ("afs: Fix
+endless loop in directory parsing") as that's a bugfix for the above.
+
+Fixes: 57e9d49c5452 ("afs: Hide silly-rename files from userspace")
+Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
+Link: https://lists.infradead.org/pipermail/linux-afs/2024-February/008102.html
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/3085695.1710328121@warthog.procyon.org.uk
+Reviewed-by: Jeffrey E Altman <jaltman@auristor.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/fs/afs/dir.c b/fs/afs/dir.c
+index 8a67fc427e748..67afe68972d5c 100644
+--- a/fs/afs/dir.c
++++ b/fs/afs/dir.c
+@@ -474,16 +474,6 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode,
+ 			continue;
+ 		}
+ 
+-		/* Don't expose silly rename entries to userspace. */
+-		if (nlen > 6 &&
+-		    dire->u.name[0] == '.' &&
+-		    ctx->actor != afs_lookup_filldir &&
+-		    ctx->actor != afs_lookup_one_filldir &&
+-		    memcmp(dire->u.name, ".__afs", 6) == 0) {
+-			ctx->pos = blkoff + next * sizeof(union afs_xdr_dirent);
+-			continue;
+-		}
+-
+ 		/* found the next entry */
+ 		if (!dir_emit(ctx, dire->u.name, nlen,
+ 			      ntohl(dire->u.vnode),
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch b/queue-6.8/alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch
new file mode 100644
index 00000000000..e4bc223b1f2
--- /dev/null
+++ b/queue-6.8/alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch
@@ -0,0 +1,69 @@
+From d84577ac51269d3eb2c2d32148604ecbe83196de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 16:40:02 +0000
+Subject: ALSA: hda: cs35l41: Set Channel Index correctly when system is
+ missing _DSD
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+[ Upstream commit 135096ebfab656823d0037102a00776f3914fee3 ]
+
+Current method to set Channel Index when the system is missing _DSD
+assumes that the channels alternate, which is not guaranteed.
+Instead use the same methodology as the main driver does when _DSD
+exists.
+
+Fixes: 8c4c216db8fb ("ALSA: hda: cs35l41: Add config table to support many laptops without _DSD")
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20240126164005.367021-2-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/cs35l41_hda_property.c | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff --git a/sound/pci/hda/cs35l41_hda_property.c b/sound/pci/hda/cs35l41_hda_property.c
+index e436d4dab317f..86ddaff915de1 100644
+--- a/sound/pci/hda/cs35l41_hda_property.c
++++ b/sound/pci/hda/cs35l41_hda_property.c
+@@ -210,6 +210,7 @@ static int generic_dsd_config(struct cs35l41_hda *cs35l41, struct device *physde
+ 	struct spi_device *spi;
+ 	bool dsd_found;
+ 	int ret;
++	int i;
+ 
+ 	for (cfg = cs35l41_config_table; cfg->ssid; cfg++) {
+ 		if (!strcasecmp(cfg->ssid, cs35l41->acpi_subsystem_id))
+@@ -295,16 +296,6 @@ static int generic_dsd_config(struct cs35l41_hda *cs35l41, struct device *physde
+ 			cs35l41->index = id == 0x40 ? 0 : 1;
+ 	}
+ 
+-	if (cfg->num_amps == 3)
+-		/* 3 amps means a center channel, so no duplicate channels */
+-		cs35l41->channel_index = 0;
+-	else
+-		/*
+-		 * if 4 amps, there are duplicate channels, so they need different indexes
+-		 * if 2 amps, no duplicate channels, channel_index would be 0
+-		 */
+-		cs35l41->channel_index = cs35l41->index / 2;
+-
+ 	cs35l41->reset_gpio = fwnode_gpiod_get_index(acpi_fwnode_handle(cs35l41->dacpi), "reset",
+ 						     cs35l41->index, GPIOD_OUT_LOW,
+ 						     "cs35l41-reset");
+@@ -312,6 +303,11 @@ static int generic_dsd_config(struct cs35l41_hda *cs35l41, struct device *physde
+ 
+ 	hw_cfg->spk_pos = cfg->channel[cs35l41->index];
+ 
++	cs35l41->channel_index = 0;
++	for (i = 0; i < cs35l41->index; i++)
++		if (cfg->channel[i] == hw_cfg->spk_pos)
++			cs35l41->channel_index++;
++
+ 	if (cfg->boost_type == INTERNAL) {
+ 		hw_cfg->bst_type = CS35L41_INT_BOOST;
+ 		hw_cfg->bst_ind = cfg->boost_ind_nanohenry;
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch b/queue-6.8/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
new file mode 100644
index 00000000000..c45469bdc09
--- /dev/null
+++ b/queue-6.8/alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
@@ -0,0 +1,147 @@
+From afeefbf0db84fe96ccb76fead9dd1ce6b08933f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Mar 2024 20:58:44 +0700
+Subject: ALSA: hda/realtek: fix ALC285 issues on HP Envy x360 laptops
+
+From: Athaariq Ardhiansyah <foss@athaariq.my.id>
+
+[ Upstream commit c062166995c9e57d5cd508b332898f79da319802 ]
+
+Realtek codec on HP Envy laptop series are heavily modified by vendor.
+Therefore, need intervention to make it work properly. The patch fixes:
+
+- B&O soundbar speakers (between lid and keyboard) activation
+- Enable LED on mute button
+- Add missing process coefficient which affects the output amplifier
+- Volume control synchronization between B&O soundbar and side speakers
+- Unmute headset output on several HP Envy models
+- Auto-enable headset mic when plugged
+
+This patch was tested on HP Envy x360 13-AR0107AU with Realtek ALC285
+
+The only unsolved problem is output amplifier of all built-in speakers
+is too weak, which causes volume of built-in speakers cannot be loud
+as vendor's proprietary driver due to missing _DSD parameter in the
+firmware. The solution is currently on research. Expected to has another
+patch in the future.
+
+Potential fix to related issues, need test before close those issues:
+
+- https://bugzilla.kernel.org/show_bug.cgi?id=189331
+- https://bugzilla.kernel.org/show_bug.cgi?id=216632
+- https://bugzilla.kernel.org/show_bug.cgi?id=216311
+- https://bugzilla.kernel.org/show_bug.cgi?id=213507
+
+Signed-off-by: Athaariq Ardhiansyah <foss@athaariq.my.id>
+Message-ID: <20240310140249.3695-1-foss@athaariq.my.id>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 63 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 63 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a1facdb98d9a0..1dc5eb92ddcad 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6696,6 +6696,60 @@ static void alc285_fixup_hp_spectre_x360(struct hda_codec *codec,
+ 	}
+ }
+ 
++static void alc285_fixup_hp_envy_x360(struct hda_codec *codec,
++				      const struct hda_fixup *fix,
++				      int action)
++{
++	static const struct coef_fw coefs[] = {
++		WRITE_COEF(0x08, 0x6a0c), WRITE_COEF(0x0d, 0xa023),
++		WRITE_COEF(0x10, 0x0320), WRITE_COEF(0x1a, 0x8c03),
++		WRITE_COEF(0x25, 0x1800), WRITE_COEF(0x26, 0x003a),
++		WRITE_COEF(0x28, 0x1dfe), WRITE_COEF(0x29, 0xb014),
++		WRITE_COEF(0x2b, 0x1dfe), WRITE_COEF(0x37, 0xfe15),
++		WRITE_COEF(0x38, 0x7909), WRITE_COEF(0x45, 0xd489),
++		WRITE_COEF(0x46, 0x00f4), WRITE_COEF(0x4a, 0x21e0),
++		WRITE_COEF(0x66, 0x03f0), WRITE_COEF(0x67, 0x1000),
++		WRITE_COEF(0x6e, 0x1005), { }
++	};
++
++	static const struct hda_pintbl pincfgs[] = {
++		{ 0x12, 0xb7a60130 },  /* Internal microphone*/
++		{ 0x14, 0x90170150 },  /* B&O soundbar speakers */
++		{ 0x17, 0x90170153 },  /* Side speakers */
++		{ 0x19, 0x03a11040 },  /* Headset microphone */
++		{ }
++	};
++
++	switch (action) {
++	case HDA_FIXUP_ACT_PRE_PROBE:
++		snd_hda_apply_pincfgs(codec, pincfgs);
++
++		/* Fixes volume control problem for side speakers */
++		alc295_fixup_disable_dac3(codec, fix, action);
++
++		/* Fixes no sound from headset speaker */
++		snd_hda_codec_amp_stereo(codec, 0x21, HDA_OUTPUT, 0, -1, 0);
++
++		/* Auto-enable headset mic when plugged */
++		snd_hda_jack_set_gating_jack(codec, 0x19, 0x21);
++
++		/* Headset mic volume enhancement */
++		snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREF50);
++		break;
++	case HDA_FIXUP_ACT_INIT:
++		alc_process_coef_fw(codec, coefs);
++		break;
++	case HDA_FIXUP_ACT_BUILD:
++		rename_ctl(codec, "Bass Speaker Playback Volume",
++			   "B&O-Tuned Playback Volume");
++		rename_ctl(codec, "Front Playback Switch",
++			   "B&O Soundbar Playback Switch");
++		rename_ctl(codec, "Bass Speaker Playback Switch",
++			   "Side Speaker Playback Switch");
++		break;
++	}
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+ 
+@@ -7297,6 +7351,7 @@ enum {
+ 	ALC280_FIXUP_HP_9480M,
+ 	ALC245_FIXUP_HP_X360_AMP,
+ 	ALC285_FIXUP_HP_SPECTRE_X360_EB1,
++	ALC285_FIXUP_HP_ENVY_X360,
+ 	ALC288_FIXUP_DELL_HEADSET_MODE,
+ 	ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 	ALC288_FIXUP_DELL_XPS_13,
+@@ -9273,6 +9328,12 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc285_fixup_hp_spectre_x360_eb1
+ 	},
++	[ALC285_FIXUP_HP_ENVY_X360] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc285_fixup_hp_envy_x360,
++		.chained = true,
++		.chain_id = ALC285_FIXUP_HP_GPIO_AMP_INIT,
++	},
+ 	[ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc285_fixup_ideapad_s740_coef,
+@@ -9861,6 +9922,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ 	SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
+ 	SND_PCI_QUIRK(0x103c, 0x8537, "HP ProBook 440 G6", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
++	SND_PCI_QUIRK(0x103c, 0x85de, "HP Envy x360 13-ar0xxx", ALC285_FIXUP_HP_ENVY_X360),
+ 	SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ 	SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+@@ -10559,6 +10621,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"},
+ 	{.id = ALC285_FIXUP_HP_SPECTRE_X360, .name = "alc285-hp-spectre-x360"},
+ 	{.id = ALC285_FIXUP_HP_SPECTRE_X360_EB1, .name = "alc285-hp-spectre-x360-eb1"},
++	{.id = ALC285_FIXUP_HP_ENVY_X360, .name = "alc285-hp-envy-x360"},
+ 	{.id = ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP, .name = "alc287-ideapad-bass-spk-amp"},
+ 	{.id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN, .name = "alc287-yoga9-bass-spk-pin"},
+ 	{.id = ALC623_FIXUP_LENOVO_THINKSTATION_P340, .name = "alc623-lenovo-thinkstation-p340"},
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-tas2781-add-lock-to-system_suspend.patch b/queue-6.8/alsa-hda-tas2781-add-lock-to-system_suspend.patch
new file mode 100644
index 00000000000..2481e52f9ba
--- /dev/null
+++ b/queue-6.8/alsa-hda-tas2781-add-lock-to-system_suspend.patch
@@ -0,0 +1,41 @@
+From c0c8ae53ca7ddc620e6bf76d19520eaab65da991 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 18:41:41 +0100
+Subject: ALSA: hda/tas2781: add lock to system_suspend
+
+From: Gergo Koteles <soyer@irl.hu>
+
+[ Upstream commit c58e6ed55a1bb9811d6d936d001b068bb0419467 ]
+
+Add the missing lock around tasdevice_tuning_switch().
+
+Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver")
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <c666da13d4bc48cd1ab1357479e0c6096541372c.1709918447.git.soyer@irl.hu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/tas2781_hda_i2c.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c
+index ee3e0afc9b313..750e49fbb91e5 100644
+--- a/sound/pci/hda/tas2781_hda_i2c.c
++++ b/sound/pci/hda/tas2781_hda_i2c.c
+@@ -885,9 +885,13 @@ static int tas2781_system_suspend(struct device *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	mutex_lock(&tas_hda->priv->codec_lock);
++
+ 	/* Shutdown chip before system suspend */
+ 	tasdevice_tuning_switch(tas_hda->priv, 1);
+ 
++	mutex_unlock(&tas_hda->priv->codec_lock);
++
+ 	/*
+ 	 * Reset GPIO may be shared, so cannot reset here.
+ 	 * However beyond this point, amps may be powered down.
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch b/queue-6.8/alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch
new file mode 100644
index 00000000000..778353df618
--- /dev/null
+++ b/queue-6.8/alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch
@@ -0,0 +1,64 @@
+From ff28fd94e4bb4e38fd5560e94b7f00180891cc39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 18:41:43 +0100
+Subject: ALSA: hda/tas2781: do not call pm_runtime_force_* in
+ system_resume/suspend
+
+From: Gergo Koteles <soyer@irl.hu>
+
+[ Upstream commit 5f51de7e30c7282162a631af8a425b54a4576346 ]
+
+The runtime_resume function calls prmg_load and apply_calibration
+functions, but system_resume also calls them, so calling
+pm_runtime_force_resume before reset is unnecessary.
+
+For consistency, do not call the pm_runtime_force_suspend in
+system_suspend, as runtime_suspend does the same.
+
+Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver")
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <d0b4cc1248b9d375d59c009563da42d60d69eac3.1709918447.git.soyer@irl.hu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/tas2781_hda_i2c.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c
+index 0e61e872bb716..a99f490c6a234 100644
+--- a/sound/pci/hda/tas2781_hda_i2c.c
++++ b/sound/pci/hda/tas2781_hda_i2c.c
+@@ -870,14 +870,9 @@ static int tas2781_runtime_resume(struct device *dev)
+ static int tas2781_system_suspend(struct device *dev)
+ {
+ 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
+-	int ret;
+ 
+ 	dev_dbg(tas_hda->priv->dev, "System Suspend\n");
+ 
+-	ret = pm_runtime_force_suspend(dev);
+-	if (ret)
+-		return ret;
+-
+ 	mutex_lock(&tas_hda->priv->codec_lock);
+ 
+ 	/* Shutdown chip before system suspend */
+@@ -895,14 +890,10 @@ static int tas2781_system_suspend(struct device *dev)
+ static int tas2781_system_resume(struct device *dev)
+ {
+ 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
+-	int i, ret;
++	int i;
+ 
+ 	dev_dbg(tas_hda->priv->dev, "System Resume\n");
+ 
+-	ret = pm_runtime_force_resume(dev);
+-	if (ret)
+-		return ret;
+-
+ 	mutex_lock(&tas_hda->priv->codec_lock);
+ 
+ 	for (i = 0; i < tas_hda->priv->ndev; i++) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch b/queue-6.8/alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch
new file mode 100644
index 00000000000..cd0c47fb066
--- /dev/null
+++ b/queue-6.8/alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch
@@ -0,0 +1,53 @@
+From a9e09b91e3e4a4362a4f24a6f9619039558d75cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 18:41:42 +0100
+Subject: ALSA: hda/tas2781: do not reset cur_* values in runtime_suspend
+
+From: Gergo Koteles <soyer@irl.hu>
+
+[ Upstream commit bec7760a6c5fa59593dac264fa0c628e46815986 ]
+
+The amplifier doesn't loose register state in software shutdown mode, so
+there is no need to reset the cur_* values.
+
+Without these resets, the amplifier can be turned on after
+runtime_suspend without waiting for the program and
+profile to be restored.
+
+Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver")
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <aa27ae084150988bf6a0ead7e3403bc485d790f8.1709918447.git.soyer@irl.hu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/tas2781_hda_i2c.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c
+index 750e49fbb91e5..0e61e872bb716 100644
+--- a/sound/pci/hda/tas2781_hda_i2c.c
++++ b/sound/pci/hda/tas2781_hda_i2c.c
+@@ -832,7 +832,6 @@ static void tas2781_hda_i2c_remove(struct i2c_client *clt)
+ static int tas2781_runtime_suspend(struct device *dev)
+ {
+ 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
+-	int i;
+ 
+ 	dev_dbg(tas_hda->dev, "Runtime Suspend\n");
+ 
+@@ -843,12 +842,6 @@ static int tas2781_runtime_suspend(struct device *dev)
+ 		tas_hda->priv->playback_started = false;
+ 	}
+ 
+-	for (i = 0; i < tas_hda->priv->ndev; i++) {
+-		tas_hda->priv->tasdevice[i].cur_book = -1;
+-		tas_hda->priv->tasdevice[i].cur_prog = -1;
+-		tas_hda->priv->tasdevice[i].cur_conf = -1;
+-	}
+-
+ 	mutex_unlock(&tas_hda->priv->codec_lock);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-tas2781-restore-power-state-after-system_re.patch b/queue-6.8/alsa-hda-tas2781-restore-power-state-after-system_re.patch
new file mode 100644
index 00000000000..ac94da4d1b2
--- /dev/null
+++ b/queue-6.8/alsa-hda-tas2781-restore-power-state-after-system_re.patch
@@ -0,0 +1,84 @@
+From eb0808aab77798a933bc64ccd59108cd1332ed59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 18:41:44 +0100
+Subject: ALSA: hda/tas2781: restore power state after system_resume
+
+From: Gergo Koteles <soyer@irl.hu>
+
+[ Upstream commit 9fc91a6fe37c78ef301aed4251f7e50b8524e72d ]
+
+After system_resume the amplifers will remain off, even if they were on
+before system_suspend.
+
+Use playback_started bool to save the playback state, and restore power
+state based on it.
+
+Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver")
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <1742b61901781826f6e6212ffe1d21af542d134a.1709918447.git.soyer@irl.hu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/tas2781_hda_i2c.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c
+index a99f490c6a234..7aef93126ed0c 100644
+--- a/sound/pci/hda/tas2781_hda_i2c.c
++++ b/sound/pci/hda/tas2781_hda_i2c.c
+@@ -160,11 +160,13 @@ static void tas2781_hda_playback_hook(struct device *dev, int action)
+ 		pm_runtime_get_sync(dev);
+ 		mutex_lock(&tas_hda->priv->codec_lock);
+ 		tasdevice_tuning_switch(tas_hda->priv, 0);
++		tas_hda->priv->playback_started = true;
+ 		mutex_unlock(&tas_hda->priv->codec_lock);
+ 		break;
+ 	case HDA_GEN_PCM_ACT_CLOSE:
+ 		mutex_lock(&tas_hda->priv->codec_lock);
+ 		tasdevice_tuning_switch(tas_hda->priv, 1);
++		tas_hda->priv->playback_started = false;
+ 		mutex_unlock(&tas_hda->priv->codec_lock);
+ 
+ 		pm_runtime_mark_last_busy(dev);
+@@ -666,6 +668,7 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
+ 	tasdevice_save_calibration(tas_priv);
+ 
+ 	tasdevice_tuning_switch(tas_hda->priv, 0);
++	tas_hda->priv->playback_started = true;
+ 
+ out:
+ 	mutex_unlock(&tas_hda->priv->codec_lock);
+@@ -837,6 +840,9 @@ static int tas2781_runtime_suspend(struct device *dev)
+ 
+ 	mutex_lock(&tas_hda->priv->codec_lock);
+ 
++	/* The driver powers up the amplifiers at module load time.
++	 * Stop the playback if it's unused.
++	 */
+ 	if (tas_hda->priv->playback_started) {
+ 		tasdevice_tuning_switch(tas_hda->priv, 1);
+ 		tas_hda->priv->playback_started = false;
+@@ -876,7 +882,8 @@ static int tas2781_system_suspend(struct device *dev)
+ 	mutex_lock(&tas_hda->priv->codec_lock);
+ 
+ 	/* Shutdown chip before system suspend */
+-	tasdevice_tuning_switch(tas_hda->priv, 1);
++	if (tas_hda->priv->playback_started)
++		tasdevice_tuning_switch(tas_hda->priv, 1);
+ 
+ 	mutex_unlock(&tas_hda->priv->codec_lock);
+ 
+@@ -908,6 +915,10 @@ static int tas2781_system_resume(struct device *dev)
+ 	 * calibrated data inside algo.
+ 	 */
+ 	tasdevice_apply_calibration(tas_hda->priv);
++
++	if (tas_hda->priv->playback_started)
++		tasdevice_tuning_switch(tas_hda->priv, 0);
++
+ 	mutex_unlock(&tas_hda->priv->codec_lock);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch b/queue-6.8/alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch
new file mode 100644
index 00000000000..9fa0f784668
--- /dev/null
+++ b/queue-6.8/alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch
@@ -0,0 +1,39 @@
+From df907fef579ca5181e3aef66a7c1693c6e8770df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 18:41:40 +0100
+Subject: ALSA: hda/tas2781: use dev_dbg in system_resume
+
+From: Gergo Koteles <soyer@irl.hu>
+
+[ Upstream commit c850c9121cc8de867ce3ac36b9ae9d05f62bef14 ]
+
+The system_resume function uses dev_info for tracing, but the other pm
+functions use dev_dbg.
+
+Use dev_dbg as the other pm functions.
+
+Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver")
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <140f3c689c9eb5874e6eb48a570fcd8207f06a41.1709918447.git.soyer@irl.hu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/tas2781_hda_i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c
+index 1bfb00102a77a..ee3e0afc9b313 100644
+--- a/sound/pci/hda/tas2781_hda_i2c.c
++++ b/sound/pci/hda/tas2781_hda_i2c.c
+@@ -900,7 +900,7 @@ static int tas2781_system_resume(struct device *dev)
+ 	struct tas2781_hda *tas_hda = dev_get_drvdata(dev);
+ 	int i, ret;
+ 
+-	dev_info(tas_hda->priv->dev, "System Resume\n");
++	dev_dbg(tas_hda->priv->dev, "System Resume\n");
+ 
+ 	ret = pm_runtime_force_resume(dev);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-4i4-low-voltage-.patch b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-4i4-low-voltage-.patch
new file mode 100644
index 00000000000..5a732c61d2e
--- /dev/null
+++ b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-4i4-low-voltage-.patch
@@ -0,0 +1,75 @@
+From 710cd8c9f07844eff3148636befc89524044e143 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Mar 2024 21:04:27 +1030
+Subject: ALSA: scarlett2: Fix Scarlett 4th Gen 4i4 low-voltage detection
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 6ef1f08b53fdb6f5f00f17f85a60b3247d77fa54 ]
+
+The value currently being read to determine the low-voltage state is
+actually the front panel state. Fix the code to use the correct offset
+for the low-voltage state.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: d7cfa2fdfc8a ("ALSA: scarlett2: Add power status control")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <d97b7d87f43b0e54f37e1552394be2f3ae182704.1710047969.git.g@b4.vu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index 6de605a601e5f..bce69a78c5052 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -415,7 +415,7 @@ enum {
+ 	SCARLETT2_CONFIG_INPUT_SELECT_SWITCH,
+ 	SCARLETT2_CONFIG_INPUT_LINK_SWITCH,
+ 	SCARLETT2_CONFIG_POWER_EXT,
+-	SCARLETT2_CONFIG_POWER_STATUS,
++	SCARLETT2_CONFIG_POWER_LOW,
+ 	SCARLETT2_CONFIG_PCM_INPUT_SWITCH,
+ 	SCARLETT2_CONFIG_DIRECT_MONITOR_GAIN,
+ 	SCARLETT2_CONFIG_COUNT
+@@ -723,8 +723,8 @@ static const struct scarlett2_config_set scarlett2_config_set_gen4_4i4 = {
+ 		[SCARLETT2_CONFIG_POWER_EXT] = {
+ 			.offset = 0x168 },
+ 
+-		[SCARLETT2_CONFIG_POWER_STATUS] = {
+-			.offset = 0x66 }
++		[SCARLETT2_CONFIG_POWER_LOW] = {
++			.offset = 0x16d }
+ 	}
+ };
+ 
+@@ -6294,8 +6294,7 @@ static int scarlett2_update_power_status(struct usb_mixer_interface *mixer)
+ {
+ 	struct scarlett2_data *private = mixer->private_data;
+ 	int err;
+-	u8 power_ext;
+-	u8 power_status;
++	u8 power_ext, power_low;
+ 
+ 	private->power_status_updated = 0;
+ 
+@@ -6304,12 +6303,12 @@ static int scarlett2_update_power_status(struct usb_mixer_interface *mixer)
+ 	if (err < 0)
+ 		return err;
+ 
+-	err = scarlett2_usb_get_config(mixer, SCARLETT2_CONFIG_POWER_STATUS,
+-				       1, &power_status);
++	err = scarlett2_usb_get_config(mixer, SCARLETT2_CONFIG_POWER_LOW,
++				       1, &power_low);
+ 	if (err < 0)
+ 		return err;
+ 
+-	if (power_status > 1)
++	if (power_low)
+ 		private->power_status = SCARLETT2_POWER_STATUS_FAIL;
+ 	else if (power_ext)
+ 		private->power_status = SCARLETT2_POWER_STATUS_EXT;
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-autogain-status-.patch b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-autogain-status-.patch
new file mode 100644
index 00000000000..885d80e3451
--- /dev/null
+++ b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-autogain-status-.patch
@@ -0,0 +1,127 @@
+From 168c851a19bddf2db12ccb230d3201a9414668c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Mar 2024 21:04:41 +1030
+Subject: ALSA: scarlett2: Fix Scarlett 4th Gen autogain status values
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit be157c4683a91857d3fdf319117c9b9dc6e8a849 ]
+
+The meanings of the raw_auto_gain_status values were originally
+guessed through experimentation, but the official names have now been
+discovered. Update the autogain status control strings accordingly.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 0a995e38dc44 ("ALSA: scarlett2: Add support for software-controllable input gain")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <8bd12a5e7dc714801dd9887c4bc5cb35c384e27c.1710047969.git.g@b4.vu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 62 ++++++++++++++++++++-----------------
+ 1 file changed, 34 insertions(+), 28 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index bce69a78c5052..3815ce1d216e6 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -284,14 +284,22 @@ static const char *const scarlett2_dim_mute_names[SCARLETT2_DIM_MUTE_COUNT] = {
+ 	"Mute Playback Switch", "Dim Playback Switch"
+ };
+ 
+-/* Autogain Status Values */
+-enum {
+-	SCARLETT2_AUTOGAIN_STATUS_STOPPED,
+-	SCARLETT2_AUTOGAIN_STATUS_RUNNING,
+-	SCARLETT2_AUTOGAIN_STATUS_FAILED,
+-	SCARLETT2_AUTOGAIN_STATUS_CANCELLED,
+-	SCARLETT2_AUTOGAIN_STATUS_UNKNOWN,
+-	SCARLETT2_AUTOGAIN_STATUS_COUNT
++/* The autogain_status is set based on the autogain_switch and
++ * raw_autogain_status values.
++ *
++ * If autogain_switch is set, autogain_status is set to 0 (Running).
++ * The other status values are from the raw_autogain_status value + 1.
++ */
++static const char *const scarlett2_autogain_status_texts[] = {
++	"Running",
++	"Success",
++	"SuccessDRover",
++	"WarnMinGainLimit",
++	"FailDRunder",
++	"FailMaxGainLimit",
++	"FailClipped",
++	"Cancelled",
++	"Invalid"
+ };
+ 
+ /* Power Status Values */
+@@ -2835,9 +2843,9 @@ static int scarlett2_autogain_is_running(struct scarlett2_data *private)
+ {
+ 	int i;
+ 
++	/* autogain_status[] is 0 if autogain is running */
+ 	for (i = 0; i < private->info->gain_input_count; i++)
+-		if (private->autogain_status[i] ==
+-		    SCARLETT2_AUTOGAIN_STATUS_RUNNING)
++		if (!private->autogain_status[i])
+ 			return 1;
+ 
+ 	return 0;
+@@ -2867,25 +2875,25 @@ static int scarlett2_update_autogain(struct usb_mixer_interface *mixer)
+ 		return err;
+ 
+ 	/* Translate autogain_switch and raw_autogain_status into
+-	 * autogain_status
++	 * autogain_status.
++	 *
++	 * When autogain_switch[] is set, the status is the first
++	 * element in scarlett2_autogain_status_texts[] (Running). The
++	 * subsequent elements correspond to the status value from the
++	 * device (raw_autogain_status[]) + 1. The last element is
++	 * "Invalid", in case the device reports a status outside the
++	 * range of scarlett2_autogain_status_texts[].
+ 	 */
+ 	for (i = 0; i < info->gain_input_count; i++)
+ 		if (private->autogain_switch[i])
++			private->autogain_status[i] = 0;
++		else if (raw_autogain_status[i] <
++				ARRAY_SIZE(scarlett2_autogain_status_texts) - 1)
+ 			private->autogain_status[i] =
+-				SCARLETT2_AUTOGAIN_STATUS_RUNNING;
+-		else if (raw_autogain_status[i] == 0)
+-			private->autogain_status[i] =
+-				SCARLETT2_AUTOGAIN_STATUS_STOPPED;
+-		else if (raw_autogain_status[i] >= 2 &&
+-			 raw_autogain_status[i] <= 5)
+-			private->autogain_status[i] =
+-				SCARLETT2_AUTOGAIN_STATUS_FAILED;
+-		else if (raw_autogain_status[i] == 6)
+-			private->autogain_status[i] =
+-				SCARLETT2_AUTOGAIN_STATUS_CANCELLED;
++				raw_autogain_status[i] + 1;
+ 		else
+ 			private->autogain_status[i] =
+-				SCARLETT2_AUTOGAIN_STATUS_UNKNOWN;
++				ARRAY_SIZE(scarlett2_autogain_status_texts) - 1;
+ 
+ 	return 0;
+ }
+@@ -3111,12 +3119,10 @@ static int scarlett2_autogain_switch_ctl_put(
+ static int scarlett2_autogain_status_ctl_info(
+ 	struct snd_kcontrol *kctl, struct snd_ctl_elem_info *uinfo)
+ {
+-	static const char *const values[SCARLETT2_AUTOGAIN_STATUS_COUNT] = {
+-		"Stopped", "Running", "Failed", "Cancelled", "Unknown"
+-	};
+-
+ 	return snd_ctl_enum_info(
+-		uinfo, 1, SCARLETT2_AUTOGAIN_STATUS_COUNT, values);
++		uinfo, 1,
++		ARRAY_SIZE(scarlett2_autogain_status_texts),
++		scarlett2_autogain_status_texts);
+ }
+ 
+ static const struct snd_kcontrol_new scarlett2_autogain_switch_ctl = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch
new file mode 100644
index 00000000000..6dbd253057f
--- /dev/null
+++ b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch
@@ -0,0 +1,58 @@
+From 1824ef6dcf983f23e453268a0e64ff62a96e0030 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Mar 2024 21:04:59 +1030
+Subject: ALSA: scarlett2: Fix Scarlett 4th Gen input gain range
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit a45cf0a0834779c741ac204c0320469e9aaef006 ]
+
+The input gain range TLV was declared as -70dB to 0dB, but the preamp
+gain range is actually 0dB to +70dB. Rename SCARLETT2_GAIN_BIAS to
+SCARLETT2_MAX_GAIN and update the TLV to fix.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 0a995e38dc44 ("ALSA: scarlett2: Add support for software-controllable input gain")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Message-ID: <9168317b5ac5335943d3f14dbcd1cc2d9b2299d0.1710047969.git.g@b4.vu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index 3815ce1d216e6..ffb8bcebf9ad6 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -173,7 +173,9 @@
+ 
+ /* some gui mixers can't handle negative ctl values */
+ #define SCARLETT2_VOLUME_BIAS 127
+-#define SCARLETT2_GAIN_BIAS 70
++
++/* maximum preamp input gain */
++#define SCARLETT2_MAX_GAIN 70
+ 
+ /* mixer range from -80dB to +6dB in 0.5dB steps */
+ #define SCARLETT2_MIXER_MIN_DB -80
+@@ -3464,7 +3466,7 @@ static int scarlett2_input_gain_ctl_info(struct snd_kcontrol *kctl,
+ 	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+ 	uinfo->count = elem->channels;
+ 	uinfo->value.integer.min = 0;
+-	uinfo->value.integer.max = SCARLETT2_GAIN_BIAS;
++	uinfo->value.integer.max = SCARLETT2_MAX_GAIN;
+ 	uinfo->value.integer.step = 1;
+ 
+ unlock:
+@@ -3541,7 +3543,7 @@ static int scarlett2_input_gain_ctl_put(struct snd_kcontrol *kctl,
+ }
+ 
+ static const DECLARE_TLV_DB_MINMAX(
+-	db_scale_scarlett2_gain, -SCARLETT2_GAIN_BIAS * 100, 0
++	db_scale_scarlett2_gain, 0, SCARLETT2_MAX_GAIN * 100
+ );
+ 
+ static const struct snd_kcontrol_new scarlett2_input_gain_ctl = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch-21200 b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch-21200
new file mode 100644
index 00000000000..01d4763c4d7
--- /dev/null
+++ b/queue-6.8/alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch-21200
@@ -0,0 +1,62 @@
+From c80f38fc036253689d82a41f12995db5df0e3fb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 19:56:08 +1030
+Subject: ALSA: scarlett2: Fix Scarlett 4th Gen input gain range again
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 6719cd5e45111449f4021e08f2e488f17a9b292b ]
+
+The 4th Gen input preamp gain range is 0dB to +69dB, although the
+control values range from 0 to 70. Replace SCARLETT2_MAX_GAIN with
+SCARLETT2_MAX_GAIN_VALUE and SCARLETT2_MAX_GAIN_DB, and update the TLV
+again.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: a45cf0a08347 ("ALSA: scarlett2: Fix Scarlett 4th Gen input gain range")
+Message-ID: <Ze7OMA8ntG7KteGa@m.b4.vu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index ffb8bcebf9ad6..bd114be537d7a 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -174,8 +174,11 @@
+ /* some gui mixers can't handle negative ctl values */
+ #define SCARLETT2_VOLUME_BIAS 127
+ 
+-/* maximum preamp input gain */
+-#define SCARLETT2_MAX_GAIN 70
++/* maximum preamp input gain and value
++ * values are from 0 to 70, preamp gain is from 0 to 69 dB
++ */
++#define SCARLETT2_MAX_GAIN_VALUE 70
++#define SCARLETT2_MAX_GAIN_DB 69
+ 
+ /* mixer range from -80dB to +6dB in 0.5dB steps */
+ #define SCARLETT2_MIXER_MIN_DB -80
+@@ -3466,7 +3469,7 @@ static int scarlett2_input_gain_ctl_info(struct snd_kcontrol *kctl,
+ 	uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+ 	uinfo->count = elem->channels;
+ 	uinfo->value.integer.min = 0;
+-	uinfo->value.integer.max = SCARLETT2_MAX_GAIN;
++	uinfo->value.integer.max = SCARLETT2_MAX_GAIN_VALUE;
+ 	uinfo->value.integer.step = 1;
+ 
+ unlock:
+@@ -3543,7 +3546,7 @@ static int scarlett2_input_gain_ctl_put(struct snd_kcontrol *kctl,
+ }
+ 
+ static const DECLARE_TLV_DB_MINMAX(
+-	db_scale_scarlett2_gain, 0, SCARLETT2_MAX_GAIN * 100
++	db_scale_scarlett2_gain, 0, SCARLETT2_MAX_GAIN_DB * 100
+ );
+ 
+ static const struct snd_kcontrol_new scarlett2_input_gain_ctl = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-seq-fix-function-cast-warnings.patch b/queue-6.8/alsa-seq-fix-function-cast-warnings.patch
new file mode 100644
index 00000000000..28728a4532e
--- /dev/null
+++ b/queue-6.8/alsa-seq-fix-function-cast-warnings.patch
@@ -0,0 +1,95 @@
+From bd03ffa19ef6323037f4684d51abe38813e85764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 14:53:43 +0100
+Subject: ALSA: seq: fix function cast warnings
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit d7bf73809849463f76de42aad62c850305dd6c5d ]
+
+clang-16 points out a control flow integrity (kcfi) issue when event
+callbacks get converted to incompatible types:
+
+sound/core/seq/seq_midi.c:135:30: error: cast from 'int (*)(struct snd_rawmidi_substream *, const char *, int)' to 'snd_seq_dump_func_t' (aka 'int (*)(void *, void *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  135 |                 snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream);
+      |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+sound/core/seq/seq_virmidi.c:83:31: error: cast from 'int (*)(struct snd_rawmidi_substream *, const unsigned char *, int)' to 'snd_seq_dump_func_t' (aka 'int (*)(void *, void *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   83 |                         snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
+      |                                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For addressing those errors, introduce wrapper functions that are used
+for callbacks and bridge to the actual function call with pointer
+cast.
+
+The code was originally added with the initial ALSA merge in linux-2.5.4.
+
+[ the patch description shamelessly copied from Arnd's original patch
+  -- tiwai ]
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240213101020.459183-1-arnd@kernel.org
+Link: https://lore.kernel.org/r/20240213135343.16411-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/seq/seq_midi.c    | 8 +++++++-
+ sound/core/seq/seq_virmidi.c | 9 ++++++++-
+ 2 files changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c
+index 18320a248aa7d..78dcb0ea15582 100644
+--- a/sound/core/seq/seq_midi.c
++++ b/sound/core/seq/seq_midi.c
+@@ -113,6 +113,12 @@ static int dump_midi(struct snd_rawmidi_substream *substream, const char *buf, i
+ 	return 0;
+ }
+ 
++/* callback for snd_seq_dump_var_event(), bridging to dump_midi() */
++static int __dump_midi(void *ptr, void *buf, int count)
++{
++	return dump_midi(ptr, buf, count);
++}
++
+ static int event_process_midi(struct snd_seq_event *ev, int direct,
+ 			      void *private_data, int atomic, int hop)
+ {
+@@ -132,7 +138,7 @@ static int event_process_midi(struct snd_seq_event *ev, int direct,
+ 			pr_debug("ALSA: seq_midi: invalid sysex event flags = 0x%x\n", ev->flags);
+ 			return 0;
+ 		}
+-		snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)dump_midi, substream);
++		snd_seq_dump_var_event(ev, __dump_midi, substream);
+ 		snd_midi_event_reset_decode(msynth->parser);
+ 	} else {
+ 		if (msynth->parser == NULL)
+diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
+index 1b9260108e482..1678737f11be7 100644
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -62,6 +62,13 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi,
+ /*
+  * decode input event and put to read buffer of each opened file
+  */
++
++/* callback for snd_seq_dump_var_event(), bridging to snd_rawmidi_receive() */
++static int dump_to_rawmidi(void *ptr, void *buf, int count)
++{
++	return snd_rawmidi_receive(ptr, buf, count);
++}
++
+ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+ 					 struct snd_seq_event *ev,
+ 					 bool atomic)
+@@ -80,7 +87,7 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
+ 		if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
+ 			if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+ 				continue;
+-			snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream);
++			snd_seq_dump_var_event(ev, dump_to_rawmidi, vmidi->substream);
+ 			snd_midi_event_reset_decode(vmidi->parser);
+ 		} else {
+ 			len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev);
+-- 
+2.43.0
+
diff --git a/queue-6.8/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch b/queue-6.8/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
new file mode 100644
index 00000000000..e37b4e2eabe
--- /dev/null
+++ b/queue-6.8/alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
@@ -0,0 +1,43 @@
+From 78e5af36508d7d800f3387cb90e8a57834019bec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2024 09:15:09 +0100
+Subject: ALSA: usb-audio: Stop parsing channels bits when all channels are
+ found.
+
+From: Johan Carlsson <johan.carlsson@teenage.engineering>
+
+[ Upstream commit a39d51ff1f52cd0b6fe7d379ac93bd8b4237d1b7 ]
+
+If a usb audio device sets more bits than the amount of channels
+it could write outside of the map array.
+
+Signed-off-by: Johan Carlsson <johan.carlsson@teenage.engineering>
+Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support")
+Message-ID: <20240313081509.9801-1-johan.carlsson@teenage.engineering>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/stream.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 3d4add94e367d..d5409f3879455 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -300,9 +300,12 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
+ 	c = 0;
+ 
+ 	if (bits) {
+-		for (; bits && *maps; maps++, bits >>= 1)
++		for (; bits && *maps; maps++, bits >>= 1) {
+ 			if (bits & 1)
+ 				chmap->map[c++] = *maps;
++			if (c == chmap->channels)
++				break;
++		}
+ 	} else {
+ 		/* If we're missing wChannelConfig, then guess something
+ 		    to make sure the channel map is not skipped entirely */
+-- 
+2.43.0
+
diff --git a/queue-6.8/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch b/queue-6.8/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
new file mode 100644
index 00000000000..9a27fcbad1d
--- /dev/null
+++ b/queue-6.8/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
@@ -0,0 +1,88 @@
+From 3d9cad798445bb10f0bd61c923a80cce7e1cebef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 16:20:48 +0800
+Subject: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
+
+From: Chun-Yi Lee <jlee@suse.com>
+
+[ Upstream commit f98364e926626c678fb4b9004b75cacf92ff0662 ]
+
+This patch is against CVE-2023-6270. The description of cve is:
+
+  A flaw was found in the ATA over Ethernet (AoE) driver in the Linux
+  kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on
+  `struct net_device`, and a use-after-free can be triggered by racing
+  between the free on the struct and the access through the `skbtxq`
+  global queue. This could lead to a denial of service condition or
+  potential code execution.
+
+In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial
+code is finished. But the net_device ifp will still be used in
+later tx()->dev_queue_xmit() in kthread. Which means that the
+dev_put(ifp) should NOT be called in the success path of skb
+initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into
+use-after-free because the net_device is freed.
+
+This patch removed the dev_put(ifp) in the success path in
+aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().
+
+Link: https://nvd.nist.gov/vuln/detail/CVE-2023-6270
+Fixes: 7562f876cd93 ("[NET]: Rework dev_base via list_head (v3)")
+Signed-off-by: Chun-Yi Lee <jlee@suse.com>
+Link: https://lore.kernel.org/r/20240305082048.25526-1-jlee@suse.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/aoe/aoecmd.c | 12 ++++++------
+ drivers/block/aoe/aoenet.c |  1 +
+ 2 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
+index d7317425be510..cc9077b588d7e 100644
+--- a/drivers/block/aoe/aoecmd.c
++++ b/drivers/block/aoe/aoecmd.c
+@@ -419,13 +419,16 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu
+ 	rcu_read_lock();
+ 	for_each_netdev_rcu(&init_net, ifp) {
+ 		dev_hold(ifp);
+-		if (!is_aoe_netif(ifp))
+-			goto cont;
++		if (!is_aoe_netif(ifp)) {
++			dev_put(ifp);
++			continue;
++		}
+ 
+ 		skb = new_skb(sizeof *h + sizeof *ch);
+ 		if (skb == NULL) {
+ 			printk(KERN_INFO "aoe: skb alloc failure\n");
+-			goto cont;
++			dev_put(ifp);
++			continue;
+ 		}
+ 		skb_put(skb, sizeof *h + sizeof *ch);
+ 		skb->dev = ifp;
+@@ -440,9 +443,6 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff_head *qu
+ 		h->major = cpu_to_be16(aoemajor);
+ 		h->minor = aoeminor;
+ 		h->cmd = AOECMD_CFG;
+-
+-cont:
+-		dev_put(ifp);
+ 	}
+ 	rcu_read_unlock();
+ }
+diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
+index c51ea95bc2ce4..923a134fd7665 100644
+--- a/drivers/block/aoe/aoenet.c
++++ b/drivers/block/aoe/aoenet.c
+@@ -63,6 +63,7 @@ tx(int id) __must_hold(&txlock)
+ 			pr_warn("aoe: packet could not be sent on %s.  %s\n",
+ 				ifp ? ifp->name : "netif",
+ 				"consider increasing tx_queue_len");
++		dev_put(ifp);
+ 		spin_lock_irq(&txlock);
+ 	}
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch b/queue-6.8/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
new file mode 100644
index 00000000000..bfaf3f6bad0
--- /dev/null
+++ b/queue-6.8/arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
@@ -0,0 +1,98 @@
+From 6873f153d744b21560e4409feb0f7a51b3258c6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 13:28:20 +0100
+Subject: arch/powerpc: Remove <linux/fb.h> from backlight code
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit 838f865802b9f26135ea7df4e30f89ac2f50c23e ]
+
+Replace <linux/fb.h> with a forward declaration in <asm/backlight.h> to
+resolve an unnecessary dependency. Remove pmac_backlight_curve_lookup()
+and struct fb_info from source and header files. The function and the
+framebuffer struct are unused. No functional changes.
+
+v3:
+	* Add Fixes tag (Christophe)
+	* fix typos in commit message (Jani)
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: d565dd3b0824 ("[PATCH] powerpc: More via-pmu backlight fixes")
+Reviewed-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au> # (powerpc)
+Link: https://patchwork.freedesktop.org/patch/msgid/20240306122935.10626-4-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/backlight.h        |  5 ++--
+ arch/powerpc/platforms/powermac/backlight.c | 26 ---------------------
+ 2 files changed, 2 insertions(+), 29 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/backlight.h b/arch/powerpc/include/asm/backlight.h
+index 1b5eab62ed047..061a910d74929 100644
+--- a/arch/powerpc/include/asm/backlight.h
++++ b/arch/powerpc/include/asm/backlight.h
+@@ -10,15 +10,14 @@
+ #define __ASM_POWERPC_BACKLIGHT_H
+ #ifdef __KERNEL__
+ 
+-#include <linux/fb.h>
+ #include <linux/mutex.h>
+ 
++struct backlight_device;
++
+ /* For locking instructions, see the implementation file */
+ extern struct backlight_device *pmac_backlight;
+ extern struct mutex pmac_backlight_mutex;
+ 
+-extern int pmac_backlight_curve_lookup(struct fb_info *info, int value);
+-
+ extern int pmac_has_backlight_type(const char *type);
+ 
+ extern void pmac_backlight_key(int direction);
+diff --git a/arch/powerpc/platforms/powermac/backlight.c b/arch/powerpc/platforms/powermac/backlight.c
+index aeb79a8b3e109..12bc01353bd3c 100644
+--- a/arch/powerpc/platforms/powermac/backlight.c
++++ b/arch/powerpc/platforms/powermac/backlight.c
+@@ -9,7 +9,6 @@
+  */
+ 
+ #include <linux/kernel.h>
+-#include <linux/fb.h>
+ #include <linux/backlight.h>
+ #include <linux/adb.h>
+ #include <linux/pmu.h>
+@@ -72,31 +71,6 @@ int pmac_has_backlight_type(const char *type)
+ 	return 0;
+ }
+ 
+-int pmac_backlight_curve_lookup(struct fb_info *info, int value)
+-{
+-	int level = (FB_BACKLIGHT_LEVELS - 1);
+-
+-	if (info && info->bl_dev) {
+-		int i, max = 0;
+-
+-		/* Look for biggest value */
+-		for (i = 0; i < FB_BACKLIGHT_LEVELS; i++)
+-			max = max((int)info->bl_curve[i], max);
+-
+-		/* Look for nearest value */
+-		for (i = 0; i < FB_BACKLIGHT_LEVELS; i++) {
+-			int diff = abs(info->bl_curve[i] - value);
+-			if (diff < max) {
+-				max = diff;
+-				level = i;
+-			}
+-		}
+-
+-	}
+-
+-	return level;
+-}
+-
+ static void pmac_backlight_key_worker(struct work_struct *work)
+ {
+ 	if (atomic_read(&kernel_backlight_disabled))
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm-dts-arm-realview-fix-development-chip-rom-compat.patch b/queue-6.8/arm-dts-arm-realview-fix-development-chip-rom-compat.patch
new file mode 100644
index 00000000000..2a804c5a848
--- /dev/null
+++ b/queue-6.8/arm-dts-arm-realview-fix-development-chip-rom-compat.patch
@@ -0,0 +1,43 @@
+From b619bb3601e2b16caf26b46bb0304471319d8876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Aug 2023 17:03:04 +0200
+Subject: ARM: dts: arm: realview: Fix development chip ROM compatible value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 3baa4c5143d65ebab2de0d99a395e5f4f1f46608 ]
+
+When the development chip ROM was added, the "direct-mapped" compatible
+value was already obsolete.  In addition, the device node lacked the
+accompanying "probe-type" property, causing the old physmap_of_core
+driver to fall back to trying all available probe types.
+Unfortunately this fallback was lost when the DT and pdata cases were
+merged.
+
+Fix this by using the modern "mtd-rom" compatible value instead.
+
+Fixes: 5c3f5edbe0a1dff3 ("ARM: realview: add flash devices to the PB1176 DTS")
+Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm/arm-realview-pb1176.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/arm/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm/arm-realview-pb1176.dts
+index efed325af88d2..d99bac02232b3 100644
+--- a/arch/arm/boot/dts/arm/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm/arm-realview-pb1176.dts
+@@ -451,7 +451,7 @@ pb1176_serial3: serial@1010f000 {
+ 
+ 		/* Direct-mapped development chip ROM */
+ 		pb1176_rom@10200000 {
+-			compatible = "direct-mapped";
++			compatible = "mtd-rom";
+ 			reg = <0x10200000 0x4000>;
+ 			bank-width = <1>;
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch b/queue-6.8/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
new file mode 100644
index 00000000000..ec39544d919
--- /dev/null
+++ b/queue-6.8/arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
@@ -0,0 +1,42 @@
+From 673230f0bc85209e4bff8ecb6a1b099cc9117940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 10:03:27 +0100
+Subject: ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Vokáč <michal.vokac@ysoft.com>
+
+[ Upstream commit 023bd910d3ab735459f84b22bb99fb9e00bd9d76 ]
+
+This change does not have any functional effect. The switch works just
+fine without this patch as it has full access to all the addresses
+on the bus. This is simply a clean-up to set the node name address
+and reg address to the same value.
+
+Fixes: 15b43e497ffd ("ARM: dts: imx6dl-yapp4: Use correct pseudo PHY address for the switch")
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
+index 3be38a3c4bb11..d2b3e09eb7df8 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
+@@ -127,7 +127,7 @@ phy_port3: phy@2 {
+ 
+ 		switch@10 {
+ 			compatible = "qca,qca8334";
+-			reg = <10>;
++			reg = <0x10>;
+ 			reset-gpios = <&gpio1 25 GPIO_ACTIVE_LOW>;
+ 
+ 			switch_ports: ports {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch b/queue-6.8/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
new file mode 100644
index 00000000000..b2d8c01eb02
--- /dev/null
+++ b/queue-6.8/arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
@@ -0,0 +1,98 @@
+From a5c8b39a03e4bf1c6678318a1a99c7239d1035e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 10:03:28 +0100
+Subject: ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the
+ switch node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Vokáč <michal.vokac@ysoft.com>
+
+[ Upstream commit 79978bff2e4b8e05ebdf5fc3ee6b794002393484 ]
+
+We identified that the PHYs actually do not work since commit 7da7b84fee58
+("ARM: dts: imx6dl-yapp4: Move phy reset into switch node") as
+a coincidence of several circumstances.
+
+The reset signal is kept asserted by a pull-down resistor on the board
+unless it is deasserted by GPIO from the SoC. This is to keep the switch
+dead until it is configured properly by the kernel and user space.
+
+Prior to the referenced commit the switch was reset by the FEC driver
+and the reset GPIO was actively deasserted. The mdio-bus was scanned
+and the attached switch and its PHYs were found and configured.
+
+With the referenced commit the switch is reset by the qca8k driver.
+Because of another bug in the qca8k driver, functionality of the reset
+pin depends on its pre-kernel configuration. See commit c44fc98f0a8f
+("net: dsa: qca8k: fix illegal usage of GPIO")
+
+The problem did not appear until we removed support for the switch
+and configuration of its reset pin from the bootloader.
+
+To fix that, properly describe the internal mdio-bus configuration of
+the qca8334 switch. The PHYs are internal to the switch and sit on its
+internal mdio-bus.
+
+Fixes: 7da7b84fee58 ("ARM: dts: imx6dl-yapp4: Move phy reset into switch node")
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi | 23 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
+index d2b3e09eb7df8..c32ea040fecdd 100644
+--- a/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
++++ b/arch/arm/boot/dts/nxp/imx/imx6dl-yapp4-common.dtsi
+@@ -117,14 +117,6 @@ mdio {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		phy_port2: phy@1 {
+-			reg = <1>;
+-		};
+-
+-		phy_port3: phy@2 {
+-			reg = <2>;
+-		};
+-
+ 		switch@10 {
+ 			compatible = "qca,qca8334";
+ 			reg = <0x10>;
+@@ -149,15 +141,30 @@ fixed-link {
+ 				eth2: port@2 {
+ 					reg = <2>;
+ 					label = "eth2";
++					phy-mode = "internal";
+ 					phy-handle = <&phy_port2>;
+ 				};
+ 
+ 				eth1: port@3 {
+ 					reg = <3>;
+ 					label = "eth1";
++					phy-mode = "internal";
+ 					phy-handle = <&phy_port3>;
+ 				};
+ 			};
++
++			mdio {
++				#address-cells = <1>;
++				#size-cells = <0>;
++
++				phy_port2: ethernet-phy@1 {
++					reg = <1>;
++				};
++
++				phy_port3: ethernet-phy@2 {
++					reg = <2>;
++				};
++			};
+ 		};
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm-dts-qcom-msm8974-correct-qfprom-node-size.patch b/queue-6.8/arm-dts-qcom-msm8974-correct-qfprom-node-size.patch
new file mode 100644
index 00000000000..6ae70d33fa1
--- /dev/null
+++ b/queue-6.8/arm-dts-qcom-msm8974-correct-qfprom-node-size.patch
@@ -0,0 +1,46 @@
+From be3671b4c0748b3868a2f920d443203ca5c38865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Feb 2024 17:45:40 +0100
+Subject: ARM: dts: qcom: msm8974: correct qfprom node size
+
+From: Craig Tatlor <ctatlor97@gmail.com>
+
+[ Upstream commit 724c4bf0e4bf81dba77736afb93964c986c3c123 ]
+
+The qfprom actually is bigger than 0x1000, so adjust the reg.
+
+Note that the non-ECC-corrected qfprom can be found at 0xfc4b8000
+(-0x4000). The current reg points to the ECC-corrected qfprom block
+which should have equivalent values at all offsets compared to the
+non-corrected version.
+
+[luca@z3ntu.xyz: extract to standalone patch and adjust for review
+comments]
+
+Fixes: c59ffb519357 ("arm: dts: msm8974: Add thermal zones, tsens and qfprom nodes")
+Signed-off-by: Craig Tatlor <ctatlor97@gmail.com>
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240210-msm8974-qfprom-v3-1-26c424160334@z3ntu.xyz
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom/qcom-msm8974.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi b/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi
+index b1413983787c2..083ab780ab7e4 100644
+--- a/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi
++++ b/arch/arm/boot/dts/qcom/qcom-msm8974.dtsi
+@@ -1234,7 +1234,7 @@ restart@fc4ab000 {
+ 
+ 		qfprom: qfprom@fc4bc000 {
+ 			compatible = "qcom,msm8974-qfprom", "qcom,qfprom";
+-			reg = <0xfc4bc000 0x1000>;
++			reg = <0xfc4bc000 0x2100>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch b/queue-6.8/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
new file mode 100644
index 00000000000..219482b303d
--- /dev/null
+++ b/queue-6.8/arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
@@ -0,0 +1,82 @@
+From 74454922cf37828e1d4a2269db9e025142aa05c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 12:03:03 +0100
+Subject: ARM: dts: renesas: r8a73a4: Fix external clocks and clock rate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 090c4094574705b0afc7d37825cdc5d06f0e7e02 ]
+
+External clocks should be defined as zero-Hz clocks in the SoC .dtsi,
+and overridden in the board .dts when present.
+
+Correct the clock rate of extal1 from 25 to 26 MHz, to match the crystal
+oscillator present on the APE6-EVM board.
+
+Fixes: a76809a329d6ebae ("ARM: shmobile: r8a73a4: Common clock framework DT description")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/1692bc8cd465d62168cbf110522ad62a7af3f606.1705315614.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts | 12 ++++++++++++
+ arch/arm/boot/dts/renesas/r8a73a4.dtsi        |  9 ++++++---
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts b/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts
+index ed75c01dbee10..3d02f065f71c2 100644
+--- a/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts
++++ b/arch/arm/boot/dts/renesas/r8a73a4-ape6evm.dts
+@@ -209,6 +209,18 @@ &cmt1 {
+ 	status = "okay";
+ };
+ 
++&extal1_clk {
++	clock-frequency = <26000000>;
++};
++
++&extal2_clk {
++	clock-frequency = <48000000>;
++};
++
++&extalr_clk {
++	clock-frequency = <32768>;
++};
++
+ &pfc {
+ 	scifa0_pins: scifa0 {
+ 		groups = "scifa0_data";
+diff --git a/arch/arm/boot/dts/renesas/r8a73a4.dtsi b/arch/arm/boot/dts/renesas/r8a73a4.dtsi
+index c39066967053f..d1f4cbd099efb 100644
+--- a/arch/arm/boot/dts/renesas/r8a73a4.dtsi
++++ b/arch/arm/boot/dts/renesas/r8a73a4.dtsi
+@@ -450,17 +450,20 @@ clocks {
+ 		extalr_clk: extalr {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+-			clock-frequency = <32768>;
++			/* This value must be overridden by the board. */
++			clock-frequency = <0>;
+ 		};
+ 		extal1_clk: extal1 {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+-			clock-frequency = <25000000>;
++			/* This value must be overridden by the board. */
++			clock-frequency = <0>;
+ 		};
+ 		extal2_clk: extal2 {
+ 			compatible = "fixed-clock";
+ 			#clock-cells = <0>;
+-			clock-frequency = <48000000>;
++			/* This value must be overridden by the board. */
++			clock-frequency = <0>;
+ 		};
+ 		fsiack_clk: fsiack {
+ 			compatible = "fixed-clock";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch b/queue-6.8/arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch
new file mode 100644
index 00000000000..477138664ca
--- /dev/null
+++ b/queue-6.8/arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch
@@ -0,0 +1,83 @@
+From 1b4aee47ae4f54086e6b09c9771aaa02787e6ba4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 00:32:45 +0800
+Subject: arm64: dts: allwinner: h6: Add RX DMA channel for SPDIF
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 7b59348c11f3355e284d77bbe3d33632ddadcfc2 ]
+
+The SPDIF hardware found on the H6 supports both transmit and receive
+functions. However it is missing the RX DMA channel.
+
+Add the SPDIF hardware block's RX DMA channel. Also remove the
+by-default pinmux, since the end device can choose to implement
+either or both functionalities.
+
+Fixes: f95b598df419 ("arm64: dts: allwinner: Add SPDIF node for Allwinner H6")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://lore.kernel.org/r/20240127163247.384439-6-wens@kernel.org
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 2 ++
+ arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi      | 2 ++
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi            | 7 +++----
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+index 9ec49ac2f6fd5..381d58cea092d 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+@@ -291,6 +291,8 @@ sw {
+ };
+ 
+ &spdif {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spdif_tx_pin>;
+ 	status = "okay";
+ };
+ 
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi
+index 4903d6358112d..855b7d43bc503 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-tanix.dtsi
+@@ -166,6 +166,8 @@ &r_ir {
+ };
+ 
+ &spdif {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spdif_tx_pin>;
+ 	status = "okay";
+ };
+ 
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index ca1d287a0a01d..d11e5041bae9a 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -406,6 +406,7 @@ spi1_cs_pin: spi1-cs-pin {
+ 				function = "spi1";
+ 			};
+ 
++			/omit-if-no-ref/
+ 			spdif_tx_pin: spdif-tx-pin {
+ 				pins = "PH7";
+ 				function = "spdif";
+@@ -655,10 +656,8 @@ spdif: spdif@5093000 {
+ 			clocks = <&ccu CLK_BUS_SPDIF>, <&ccu CLK_SPDIF>;
+ 			clock-names = "apb", "spdif";
+ 			resets = <&ccu RST_BUS_SPDIF>;
+-			dmas = <&dma 2>;
+-			dma-names = "tx";
+-			pinctrl-names = "default";
+-			pinctrl-0 = <&spdif_tx_pin>;
++			dmas = <&dma 2>, <&dma 2>;
++			dma-names = "rx", "tx";
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
new file mode 100644
index 00000000000..5b63a49af9a
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
@@ -0,0 +1,80 @@
+From 2f289db9fbc4aed9f7dcd80ab08cbd72bb12767a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:49:02 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pull resistors for SD card
+ signals on BL OSM-S board
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 5a940ba3e4d7c8710c9073ff5d0ca4644d4da9db ]
+
+Some signals have external pullup resistors on the board and don't need
+the internal ones to be enabled. Due to silicon errata ERR050080 let's
+disable the internal pull resistors whererever possible and prevent
+any unwanted behavior in case they wear out.
+
+Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-kontron-bl-osm-s.dts  | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
+index 1dd03ef0a7835..d9fa0deea7002 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
+@@ -337,40 +337,40 @@ MX8MM_IOMUXC_NAND_CE1_B_GPIO3_IO2		0x19
+ 
+ 	pinctrl_usdhc2: usdhc2grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x190
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x90
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d0
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ 
+ 	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x194
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x94
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d4
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ 
+ 	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x196
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x96
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d6
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-27736 b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-27736
new file mode 100644
index 00000000000..4c7e4b6cf16
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-27736
@@ -0,0 +1,80 @@
+From db1e0b9db770ed189d266fb8510d536f7a236946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:49:03 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pull resistors for SD card
+ signals on BL board
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 008820524844326ffb3123cebceba1960c0ad0dc ]
+
+Some signals have external pullup resistors on the board and don't need
+the internal ones to be enabled. Due to silicon errata ERR050080 let's
+disable the internal pull resistors whererever possible and prevent
+any unwanted behavior in case they wear out.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx8mm-kontron-bl.dts   | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
+index ee93db11c0d06..aab8e24216501 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
+@@ -316,40 +316,40 @@ MX8MM_IOMUXC_NAND_CE1_B_GPIO3_IO2		0x19
+ 
+ 	pinctrl_usdhc2: usdhc2grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x190
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x90
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d0
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d0
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ 
+ 	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x194
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x94
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d4
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d4
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ 
+ 	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x196
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK			0x96
+ 			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD			0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2		0x1d6
+ 			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3		0x1d6
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x019
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0x1d0
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12		0x19
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT		0xd0
+ 		>;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
new file mode 100644
index 00000000000..c3956815a56
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
@@ -0,0 +1,56 @@
+From 871d62af4a8635d6889f53c5cd2434a7e840c367 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:48:58 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on OSM-S
+ i.MX8MM
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 96293af54f6aa859015d8ca40a1437d3115ad50c ]
+
+There are external pullup resistors on the board and due to silicon
+errata ERR050080 let's disable the internal ones to prevent any
+unwanted behavior in case they wear out.
+
+Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts | 4 ++--
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi   | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
+index 8b16bd68576c0..0730c22e5b6b9 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
+@@ -294,8 +294,8 @@ MX8MM_IOMUXC_SAI3_MCLK_GPIO5_IO2		0x19
+ 
+ 	pinctrl_i2c4: i2c4grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x400001c3
+-			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x400001c3
++			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x40000083
++			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x40000083
+ 		>;
+ 	};
+ 
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
+index 6e75ab879bf59..3e7db968f7e64 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
+@@ -252,8 +252,8 @@ MX8MM_IOMUXC_ECSPI1_SS0_GPIO5_IO9		0x19
+ 
+ 	pinctrl_i2c1: i2c1grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x400001c3
+-			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x400001c3
++			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x40000083
++			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x40000083
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-24016 b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-24016
new file mode 100644
index 00000000000..1027db5395f
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-24016
@@ -0,0 +1,56 @@
+From 6f38c0453ea21b874e48d0d3f8207b3bbe0a9a99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:48:59 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pullups for I2C signals on SL/BL
+ i.MX8MM
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit f19e5bb91d53264d7dac5d845a4825afadf72440 ]
+
+There are external pullup resistors on the board and due to silicon
+errata ERR050080 let's disable the internal ones to prevent any
+unwanted behavior in case they wear out.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts  | 4 ++--
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
+index dcec57c20399e..5fd2e45258b11 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
+@@ -279,8 +279,8 @@ MX8MM_IOMUXC_SAI3_MCLK_GPIO5_IO2		0x19
+ 
+ 	pinctrl_i2c4: i2c4grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x400001c3
+-			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x400001c3
++			MX8MM_IOMUXC_I2C4_SCL_I2C4_SCL			0x40000083
++			MX8MM_IOMUXC_I2C4_SDA_I2C4_SDA			0x40000083
+ 		>;
+ 	};
+ 
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi
+index 1f8326613ee9e..2076148e08627 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-sl.dtsi
+@@ -237,8 +237,8 @@ MX8MM_IOMUXC_ECSPI1_SS0_GPIO5_IO9		0x19
+ 
+ 	pinctrl_i2c1: i2c1grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x400001c3
+-			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x400001c3
++			MX8MM_IOMUXC_I2C1_SCL_I2C1_SCL			0x40000083
++			MX8MM_IOMUXC_I2C1_SDA_I2C1_SDA			0x40000083
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
new file mode 100644
index 00000000000..e41dba1cb0e
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
@@ -0,0 +1,58 @@
+From c79720a86a6c33d4e87a2ebf27cc478b90a06b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:49:00 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals
+ on BL OSM-S board
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit c6d9b5672a0e2c4b1079a50d2fc8780c40cfd3eb ]
+
+These signals are actively driven by the SoC or by the onboard
+transceiver. There's no need to enable the internal pull resistors
+and due to silicon errata ERR050080 let's disable the internal ones
+to prevent any unwanted behavior in case they wear out.
+
+Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-kontron-bl-osm-s.dts    | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
+index 0730c22e5b6b9..1dd03ef0a7835 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl-osm-s.dts
+@@ -313,19 +313,19 @@ MX8MM_IOMUXC_SAI5_MCLK_GPIO3_IO25		0x19
+ 
+ 	pinctrl_uart1: uart1grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x140
+-			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x140
+-			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x140
+-			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x140
++			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x0
++			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x0
++			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x0
++			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x0
+ 		>;
+ 	};
+ 
+ 	pinctrl_uart2: uart2grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x140
+-			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x140
+-			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x140
+-			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x140
++			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x0
++			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x0
++			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x0
++			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x0
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-1464 b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-1464
new file mode 100644
index 00000000000..a4f77428c62
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-1464
@@ -0,0 +1,58 @@
+From 922c6f983f5819505544714eeb6aaabbc2a9b640 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:49:01 +0100
+Subject: arm64: dts: imx8mm-kontron: Disable pullups for onboard UART signals
+ on BL board
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 162aadaa0df8217b0cc49d919dd00022fef65e78 ]
+
+These signals are actively driven by the SoC or by the onboard
+transceiver. There's no need to enable the internal pull resistors
+and due to silicon errata ERR050080 let's disable the internal ones
+to prevent any unwanted behavior in case they wear out.
+
+Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/freescale/imx8mm-kontron-bl.dts     | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
+index 5fd2e45258b11..ee93db11c0d06 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-bl.dts
+@@ -292,19 +292,19 @@ MX8MM_IOMUXC_SPDIF_RX_PWM2_OUT			0x19
+ 
+ 	pinctrl_uart1: uart1grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x140
+-			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x140
+-			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x140
+-			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x140
++			MX8MM_IOMUXC_SAI2_RXC_UART1_DCE_RX		0x0
++			MX8MM_IOMUXC_SAI2_RXFS_UART1_DCE_TX		0x0
++			MX8MM_IOMUXC_SAI2_RXD0_UART1_DCE_RTS_B		0x0
++			MX8MM_IOMUXC_SAI2_TXFS_UART1_DCE_CTS_B		0x0
+ 		>;
+ 	};
+ 
+ 	pinctrl_uart2: uart2grp {
+ 		fsl,pins = <
+-			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x140
+-			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x140
+-			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x140
+-			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x140
++			MX8MM_IOMUXC_SAI3_TXFS_UART2_DCE_RX		0x0
++			MX8MM_IOMUXC_SAI3_TXC_UART2_DCE_TX		0x0
++			MX8MM_IOMUXC_SAI3_RXD_UART2_DCE_RTS_B		0x0
++			MX8MM_IOMUXC_SAI3_RXC_UART2_DCE_CTS_B		0x0
+ 		>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch b/queue-6.8/arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch
new file mode 100644
index 00000000000..8e94d99fe29
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch
@@ -0,0 +1,36 @@
+From b0416b95db3c1078698862baddb22f308fd01b31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 09:49:04 +0100
+Subject: arm64: dts: imx8mm-kontron: Fix interrupt for RTC on OSM-S i.MX8MM
+ module
+
+From: Frieder Schrempf <frieder.schrempf@kontron.de>
+
+[ Upstream commit 8d0f39b7d04d864e89b84063b124fd10aa4b8809 ]
+
+The level of the interrupt signal is active low instead. Fix this.
+
+Fixes: de9618e84f76 ("arm64: dts: Add support for Kontron SL/BL i.MX8MM OSM-S")
+Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
+index 3e7db968f7e64..60abcb636cedf 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-osm-s.dtsi
+@@ -210,7 +210,7 @@ rv3028: rtc@52 {
+ 		reg = <0x52>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pinctrl_rtc>;
+-		interrupts-extended = <&gpio4 1 IRQ_TYPE_LEVEL_HIGH>;
++		interrupts-extended = <&gpio4 1 IRQ_TYPE_LEVEL_LOW>;
+ 		trickle-diode-disable;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch b/queue-6.8/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
new file mode 100644
index 00000000000..ee458707a0e
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
@@ -0,0 +1,85 @@
+From 84dc68fcc665fc053e70d8d038edd84ddaa5d48c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 15:30:46 -0800
+Subject: arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS
+
+From: Tim Harvey <tharvey@gateworks.com>
+
+[ Upstream commit ec2cb52fcfef5d58574f2cfbc9a99ffc20ae5a9d ]
+
+The GW71xx does not have a gpio controlled vbus regulator but it does
+require some pinctrl. Remove the regulator and move the valid pinctrl
+into the usbotg1 node.
+
+Fixes: bd306fdb4e60 ("arm64: dts: imx8mm-venice-gw71xx: fix USB OTG VBUS")
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/freescale/imx8mm-venice-gw71xx.dtsi   | 29 ++++++-------------
+ 1 file changed, 9 insertions(+), 20 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
+index 6425773f68e0a..bbbaf2165ea28 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw71xx.dtsi
+@@ -47,17 +47,6 @@ pps {
+ 		gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>;
+ 		status = "okay";
+ 	};
+-
+-	reg_usb_otg1_vbus: regulator-usb-otg1 {
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_reg_usb1_en>;
+-		compatible = "regulator-fixed";
+-		regulator-name = "usb_otg1_vbus";
+-		gpio = <&gpio1 10 GPIO_ACTIVE_HIGH>;
+-		enable-active-high;
+-		regulator-min-microvolt = <5000000>;
+-		regulator-max-microvolt = <5000000>;
+-	};
+ };
+ 
+ /* off-board header */
+@@ -144,9 +133,10 @@ &uart3 {
+ };
+ 
+ &usbotg1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_usbotg1>;
+ 	dr_mode = "otg";
+ 	over-current-active-low;
+-	vbus-supply = <&reg_usb_otg1_vbus>;
+ 	status = "okay";
+ };
+ 
+@@ -204,14 +194,6 @@ MX8MM_IOMUXC_GPIO1_IO15_GPIO1_IO15	0x41
+ 		>;
+ 	};
+ 
+-	pinctrl_reg_usb1_en: regusb1grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_GPIO1_IO10_GPIO1_IO10	0x41
+-			MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12	0x141
+-			MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC	0x41
+-		>;
+-	};
+-
+ 	pinctrl_spi2: spi2grp {
+ 		fsl,pins = <
+ 			MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK	0xd6
+@@ -234,4 +216,11 @@ MX8MM_IOMUXC_UART3_RXD_UART3_DCE_RX	0x140
+ 			MX8MM_IOMUXC_UART3_TXD_UART3_DCE_TX	0x140
+ 		>;
+ 	};
++
++	pinctrl_usbotg1: usbotg1grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12	0x141
++			MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC	0x41
++		>;
++	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch b/queue-6.8/arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch
new file mode 100644
index 00000000000..d27380f2f7b
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch
@@ -0,0 +1,119 @@
+From f8077e7c83d4a271a814c5dd3451498137a888ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 10:57:38 +0800
+Subject: arm64: dts: imx8mp-evk: Fix hdmi@3d node
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit 0ff08803eca417dfa9372194bebf3d1b1f501f98 ]
+
+The hdmi@3d node's compatible string is "adi,adv7535" instead of
+"adi,adv7533" or "adi,adv751*".
+
+Fix the hdmi@3d node by means of:
+* Use default register addresses for "cec", "edid" and "packet", because
+  there is no need to use a non-default address map.
+* Add missing interrupt related properties.
+* Drop "adi,input-*" properties which are only valid for adv751*.
+* Add VEXT_3V3 fixed regulator.
+* Add "*-supply" properties, since most are required.
+* Fix label names - s/adv7533/adv7535/.
+
+Fixes: 65344b9bed3a ("arm64: dts: imx8mp-evk: Add HDMI support")
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-evk.dts | 33 +++++++++++++-------
+ 1 file changed, 21 insertions(+), 12 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-evk.dts b/arch/arm64/boot/dts/freescale/imx8mp-evk.dts
+index f87fa5a948ccc..9beba8d6a0dfe 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-evk.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-evk.dts
+@@ -23,7 +23,7 @@ hdmi-connector {
+ 
+ 		port {
+ 			hdmi_connector_in: endpoint {
+-				remote-endpoint = <&adv7533_out>;
++				remote-endpoint = <&adv7535_out>;
+ 			};
+ 		};
+ 	};
+@@ -107,6 +107,13 @@ reg_usdhc2_vmmc: regulator-usdhc2 {
+ 		enable-active-high;
+ 	};
+ 
++	reg_vext_3v3: regulator-vext-3v3 {
++		compatible = "regulator-fixed";
++		regulator-name = "VEXT_3V3";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++	};
++
+ 	sound {
+ 		compatible = "simple-audio-card";
+ 		simple-audio-card,name = "wm8960-audio";
+@@ -364,7 +371,7 @@ BUCK4 {
+ 				regulator-always-on;
+ 			};
+ 
+-			BUCK5 {
++			reg_buck5: BUCK5 {
+ 				regulator-name = "BUCK5";
+ 				regulator-min-microvolt = <1650000>;
+ 				regulator-max-microvolt = <1950000>;
+@@ -415,14 +422,16 @@ &i2c2 {
+ 
+ 	hdmi@3d {
+ 		compatible = "adi,adv7535";
+-		reg = <0x3d>, <0x3c>, <0x3e>, <0x3f>;
+-		reg-names = "main", "cec", "edid", "packet";
++		reg = <0x3d>;
++		interrupt-parent = <&gpio1>;
++		interrupts = <9 IRQ_TYPE_EDGE_FALLING>;
+ 		adi,dsi-lanes = <4>;
+-		adi,input-depth = <8>;
+-		adi,input-colorspace = "rgb";
+-		adi,input-clock = "1x";
+-		adi,input-style = <1>;
+-		adi,input-justification = "evenly";
++		avdd-supply = <&reg_buck5>;
++		dvdd-supply = <&reg_buck5>;
++		pvdd-supply = <&reg_buck5>;
++		a2vdd-supply = <&reg_buck5>;
++		v3p3-supply = <&reg_vext_3v3>;
++		v1p2-supply = <&reg_buck5>;
+ 
+ 		ports {
+ 			#address-cells = <1>;
+@@ -431,7 +440,7 @@ ports {
+ 			port@0 {
+ 				reg = <0>;
+ 
+-				adv7533_in: endpoint {
++				adv7535_in: endpoint {
+ 					remote-endpoint = <&dsi_out>;
+ 				};
+ 			};
+@@ -439,7 +448,7 @@ adv7533_in: endpoint {
+ 			port@1 {
+ 				reg = <1>;
+ 
+-				adv7533_out: endpoint {
++				adv7535_out: endpoint {
+ 					remote-endpoint = <&hdmi_connector_in>;
+ 				};
+ 			};
+@@ -524,7 +533,7 @@ port@1 {
+ 			reg = <1>;
+ 
+ 			dsi_out: endpoint {
+-				remote-endpoint = <&adv7533_in>;
++				remote-endpoint = <&adv7535_in>;
+ 				data-lanes = <1 2 3 4>;
+ 			};
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch b/queue-6.8/arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch
new file mode 100644
index 00000000000..99a42f60e75
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch
@@ -0,0 +1,38 @@
+From 00b2a5b6c1086369d4aba4633b86d1dda124cb63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 22:33:30 +0100
+Subject: arm64: dts: imx8mp: Set SPI NOR to max 40 MHz on Data Modul i.MX8M
+ Plus eDM SBC
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 13ab6f174a6b577bd7d09124b47ec8ace2682e42 ]
+
+The SPI NOR bus routing on this board cannot go above 50 MHz,
+set the clock frequency to maximum of 40 MHz to be within a
+safe margin. Remove the comment as well.
+
+Fixes: 562d222f23f0 ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts
+index 5828c9d7821de..b5ce7b14b5434 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-data-modul-edm-sbc.dts
+@@ -121,7 +121,7 @@ &ecspi1 {
+ 	flash@0 {	/* W25Q128JVEI */
+ 		compatible = "jedec,spi-nor";
+ 		reg = <0>;
+-		spi-max-frequency = <100000000>;	/* Up to 133 MHz */
++		spi-max-frequency = <40000000>;
+ 		spi-tx-bus-width = <1>;
+ 		spi-rx-bus-width = <1>;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8qm-align-edma3-power-domains-resources.patch b/queue-6.8/arm64-dts-imx8qm-align-edma3-power-domains-resources.patch
new file mode 100644
index 00000000000..7953baa644d
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8qm-align-edma3-power-domains-resources.patch
@@ -0,0 +1,48 @@
+From b9f973996b5b20151fcfd7f9198f515850d4ea0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 14:46:54 -0500
+Subject: arm64: dts: imx8qm: Align edma3 power-domains resources indentation
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 7edee2b297e5a4f805e5b945c0c0e6f4f8f719b5 ]
+
+<&pd IMX_SC_R_DMA_1_CH*> is now properly aligned with the previous line
+for improved code readability.
+
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Stable-dep-of: 5136ea6b109d ("arm64: dts: imx8qm: Correct edma3 power-domains and interrupt numbers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+index 69cb8676732ea..453fabfd17b81 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+@@ -98,13 +98,13 @@ &edma2 {
+ 
+ &edma3 {
+ 	power-domains = <&pd IMX_SC_R_DMA_1_CH0>,
+-		     <&pd IMX_SC_R_DMA_1_CH1>,
+-		     <&pd IMX_SC_R_DMA_1_CH2>,
+-		     <&pd IMX_SC_R_DMA_1_CH3>,
+-		     <&pd IMX_SC_R_DMA_1_CH4>,
+-		     <&pd IMX_SC_R_DMA_1_CH5>,
+-		     <&pd IMX_SC_R_DMA_1_CH6>,
+-		     <&pd IMX_SC_R_DMA_1_CH7>;
++			<&pd IMX_SC_R_DMA_1_CH1>,
++			<&pd IMX_SC_R_DMA_1_CH2>,
++			<&pd IMX_SC_R_DMA_1_CH3>,
++			<&pd IMX_SC_R_DMA_1_CH4>,
++			<&pd IMX_SC_R_DMA_1_CH5>,
++			<&pd IMX_SC_R_DMA_1_CH6>,
++			<&pd IMX_SC_R_DMA_1_CH7>;
+ };
+ 
+ &flexcan1 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch b/queue-6.8/arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch
new file mode 100644
index 00000000000..2d3babe48e1
--- /dev/null
+++ b/queue-6.8/arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch
@@ -0,0 +1,65 @@
+From 4a81c63c21d93f444e77e5cb3e1c5f3253a6041e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 14:46:55 -0500
+Subject: arm64: dts: imx8qm: Correct edma3 power-domains and interrupt numbers
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 5136ea6b109de66b1327a3069f88ad8f5efb37b2 ]
+
+It is eDMA1 at QM, which have the same register with eDMA3 at qxp.
+
+The below commit fix panic problem.
+commit b37e75bddc35 ("arm64: dts: imx8qm: Add imx8qm's own pm to avoid panic during startup")
+
+This fixes the IRQ and DMA channel numbers. While QM eDMA1 technically has
+32 channels, only 10 channels are likely used for I2C. The exact IRQ
+numbers for the remaining channels were unclear in the reference manual.
+
+Fixes: e4d7a330fb7a ("arm64: dts: imx8: add edma[0..3]")
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+index 453fabfd17b81..cafc1383115ab 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8qm-ss-dma.dtsi
+@@ -96,7 +96,20 @@ &edma2 {
+ 	status = "okay";
+ };
+ 
++/* It is eDMA1 in 8QM RM, but 8QXP it is eDMA3 */
+ &edma3 {
++	reg = <0x5a9f0000 0x210000>;
++	dma-channels = <10>;
++	interrupts = <GIC_SPI 424 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 425 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 426 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 427 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 428 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 429 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 430 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 431 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 432 IRQ_TYPE_LEVEL_HIGH>,
++		     <GIC_SPI 433 IRQ_TYPE_LEVEL_HIGH>;
+ 	power-domains = <&pd IMX_SC_R_DMA_1_CH0>,
+ 			<&pd IMX_SC_R_DMA_1_CH1>,
+ 			<&pd IMX_SC_R_DMA_1_CH2>,
+@@ -104,7 +117,9 @@ &edma3 {
+ 			<&pd IMX_SC_R_DMA_1_CH4>,
+ 			<&pd IMX_SC_R_DMA_1_CH5>,
+ 			<&pd IMX_SC_R_DMA_1_CH6>,
+-			<&pd IMX_SC_R_DMA_1_CH7>;
++			<&pd IMX_SC_R_DMA_1_CH7>,
++			<&pd IMX_SC_R_DMA_1_CH8>,
++			<&pd IMX_SC_R_DMA_1_CH9>;
+ };
+ 
+ &flexcan1 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch b/queue-6.8/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
new file mode 100644
index 00000000000..5cb6604a5de
--- /dev/null
+++ b/queue-6.8/arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
@@ -0,0 +1,88 @@
+From 8a312cf3a7cb83f91aabdb8f8779dc931f197929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 13:22:58 +0100
+Subject: arm64: dts: marvell: reorder crypto interrupts on Armada SoCs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit ec55a22149d64f9ac41845d923b884d4a666bf4d ]
+
+Match order specified in binding documentation. It says "mem" should be
+the last interrupt.
+
+This fixes:
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:0: 'ring0' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:1: 'ring1' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:2: 'ring2' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:3: 'ring3' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:4: 'eip' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+arch/arm64/boot/dts/marvell/armada-3720-db.dtb: crypto@90000: interrupt-names:5: 'mem' was expected
+        from schema $id: http://devicetree.org/schemas/crypto/inside-secure,safexcel.yaml#
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/marvell/armada-37xx.dtsi  | 10 +++++-----
+ arch/arm64/boot/dts/marvell/armada-cp11x.dtsi | 10 +++++-----
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+index e300145ad1a6f..1cc3fa1c354de 100644
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -431,14 +431,14 @@ xor11 {
+ 			crypto: crypto@90000 {
+ 				compatible = "inside-secure,safexcel-eip97ies";
+ 				reg = <0x90000 0x20000>;
+-				interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>,
+-					     <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
++				interrupts = <GIC_SPI 20 IRQ_TYPE_LEVEL_HIGH>,
+ 					     <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>,
+ 					     <GIC_SPI 22 IRQ_TYPE_LEVEL_HIGH>,
+ 					     <GIC_SPI 23 IRQ_TYPE_LEVEL_HIGH>,
+-					     <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>;
+-				interrupt-names = "mem", "ring0", "ring1",
+-						  "ring2", "ring3", "eip";
++					     <GIC_SPI 24 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "ring0", "ring1", "ring2",
++						  "ring3", "eip", "mem";
+ 				clocks = <&nb_periph_clk 15>;
+ 			};
+ 
+diff --git a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
+index 4ec1aae0a3a9c..7e595ac80043a 100644
+--- a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi
+@@ -511,14 +511,14 @@ CP11X_LABEL(sdhci0): mmc@780000 {
+ 		CP11X_LABEL(crypto): crypto@800000 {
+ 			compatible = "inside-secure,safexcel-eip197b";
+ 			reg = <0x800000 0x200000>;
+-			interrupts = <87 IRQ_TYPE_LEVEL_HIGH>,
+-				<88 IRQ_TYPE_LEVEL_HIGH>,
++			interrupts = <88 IRQ_TYPE_LEVEL_HIGH>,
+ 				<89 IRQ_TYPE_LEVEL_HIGH>,
+ 				<90 IRQ_TYPE_LEVEL_HIGH>,
+ 				<91 IRQ_TYPE_LEVEL_HIGH>,
+-				<92 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "mem", "ring0", "ring1",
+-				"ring2", "ring3", "eip";
++				<92 IRQ_TYPE_LEVEL_HIGH>,
++				<87 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "ring0", "ring1", "ring2", "ring3",
++					  "eip", "mem";
+ 			clock-names = "core", "reg";
+ 			clocks = <&CP11X_LABEL(clk) 1 26>,
+ 				 <&CP11X_LABEL(clk) 1 17>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch b/queue-6.8/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
new file mode 100644
index 00000000000..0e4d7a82134
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
@@ -0,0 +1,57 @@
+From 5d5fc422d8a7a4468fd1a32a41ebbb6b2cdead31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 14:23:57 +0100
+Subject: arm64: dts: mediatek: mt7622: add missing "device_type" to memory
+ nodes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 99d100e00144bc01b49a697f4bc4398f2f7e7ce4 ]
+
+This fixes:
+arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: /: memory@40000000: 'device_type' is a required property
+        from schema $id: http://devicetree.org/schemas/memory.yaml#
+arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dtb: /: memory@40000000: 'device_type' is a required property
+        from schema $id: http://devicetree.org/schemas/memory.yaml#
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240122132357.31264-1-zajec5@gmail.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts | 1 +
+ arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts             | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+index a1f42048dcc70..850b3e2773680 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -75,6 +75,7 @@ led-1 {
+ 
+ 	memory@40000000 {
+ 		reg = <0 0x40000000 0 0x40000000>;
++		device_type = "memory";
+ 	};
+ 
+ 	reg_1p8v: regulator-1p8v {
+diff --git a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+index 2dc1bdc74e212..5c26021fc4cf1 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-rfb1.dts
+@@ -57,6 +57,7 @@ key-wps {
+ 
+ 	memory@40000000 {
+ 		reg = <0 0x40000000 0 0x20000000>;
++		device_type = "memory";
+ 	};
+ 
+ 	reg_1p8v: regulator-1p8v {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch b/queue-6.8/arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch
new file mode 100644
index 00000000000..fa303db4549
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch
@@ -0,0 +1,47 @@
+From 4ecd5a251ccffefb15f6fb7f4c8c98f62ec319e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jan 2024 19:20:40 +0100
+Subject: arm64: dts: mediatek: mt7986: add "#reset-cells" to infracfg
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit d993daff5962b2dd08f32a83bb1c0e5fa75732ea ]
+
+MT7986's Infrastructure System Configuration Controller includes reset
+controller. It can reset blocks as specified in the
+include/dt-bindings/reset/mt7986-resets.h . Add #reset-cells so it can
+be referenced properly.
+
+This fixes:
+arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: infracfg@10001000: '#reset-cells' is a required property
+        from schema $id: http://devicetree.org/schemas/arm/mediatek/mediatek,infracfg.yaml#
+
+Fixes: 1f9986b258c2 ("arm64: dts: mediatek: add clock support for mt7986a")
+Cc: Sam Shih <sam.shih@mediatek.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20240101182040.28538-2-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+index 7b6591509c54d..d974739eae1c9 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -153,6 +153,7 @@ infracfg: infracfg@10001000 {
+ 			compatible = "mediatek,mt7986-infracfg", "syscon";
+ 			reg = <0 0x10001000 0 0x1000>;
+ 			#clock-cells = <1>;
++			#reset-cells = <1>;
+ 		};
+ 
+ 		wed_pcie: wed-pcie@10003000 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch b/queue-6.8/arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch
new file mode 100644
index 00000000000..888a4236f45
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch
@@ -0,0 +1,45 @@
+From a2df2e9ab17ba577587fd26e19635e2fe6f2c6fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jan 2024 19:20:39 +0100
+Subject: arm64: dts: mediatek: mt7986: drop "#clock-cells" from PWM
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 0b721691f0c80af682d0ef3aa4a177c23d41b072 ]
+
+PWM is not a clock provider and its binding doesn't specify
+"#clock-cells" property.
+
+This fixes:
+arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: pwm@10048000: '#clock-cells' does not match any of the regexes: 'pinctrl-[0-9]+'
+        from schema $id: http://devicetree.org/schemas/pwm/mediatek,mt2712-pwm.yaml#
+
+Fixes: eabb04df46c6 ("arm64: dts: mt7986: add PWM")
+Cc: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20240101182040.28538-1-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+index a7d9c3246a875..7b6591509c54d 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -242,7 +242,6 @@ crypto: crypto@10320000 {
+ 		pwm: pwm@10048000 {
+ 			compatible = "mediatek,mt7986-pwm";
+ 			reg = <0 0x10048000 0 0x1000>;
+-			#clock-cells = <1>;
+ 			#pwm-cells = <2>;
+ 			interrupts = <GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&topckgen CLK_TOP_PWM_SEL>,
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch b/queue-6.8/arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch
new file mode 100644
index 00000000000..8813d7181bb
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch
@@ -0,0 +1,46 @@
+From 6a05bc2216df7b28c0f73f2d62696bc561e235b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Nov 2023 14:24:11 +0100
+Subject: arm64: dts: mediatek: mt7986: drop crypto's unneeded/invalid clock
+ name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit bb69d19c649669f700149df309245cd925612f7c ]
+
+According to the "inside-secure,safexcel-eip97" binding "clock-names" is
+required only if there are two clocks specified. If present the first
+name must by "core".
+
+Name "infra_eip97_ck" is invalid and was probably just a typo. Drop it.
+
+Fixes: ecc5287cfe53 ("arm64: dts: mt7986: add crypto related device nodes")
+Cc: Sam Shih <sam.shih@mediatek.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20231116132411.7665-1-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+index fc751e049953c..a7d9c3246a875 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -234,7 +234,6 @@ crypto: crypto@10320000 {
+ 				     <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "ring0", "ring1", "ring2", "ring3";
+ 			clocks = <&infracfg CLK_INFRA_EIP97_CK>;
+-			clock-names = "infra_eip97_ck";
+ 			assigned-clocks = <&topckgen CLK_TOP_EIP_B_SEL>;
+ 			assigned-clock-parents = <&apmixedsys CLK_APMIXED_NET2PLL>;
+ 			status = "disabled";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch b/queue-6.8/arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch
new file mode 100644
index 00000000000..7140a632594
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch
@@ -0,0 +1,44 @@
+From 975c2f653e7aba31a291c2335379d6248e6e9495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Nov 2023 14:08:16 +0100
+Subject: arm64: dts: mediatek: mt7986: fix reference to PWM in fan node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 7865abbbdf1e1ee57a0bb8ec83079f8840c16854 ]
+
+This fixes typo and resolves following validation error:
+arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dtb: pwm-fan: pwms: [[54, 0, 10000], [0]] is too long
+        from schema $id: http://devicetree.org/schemas/hwmon/pwm-fan.yaml#
+
+Fixes: c26f779a2295 ("arm64: dts: mt7986: add pwm-fan and cooling-maps to BPI-R3 dts")
+Cc: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20231116130816.4932-1-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
+index d06d4af43cbff..e04b1c0c0ebbf 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-bananapi-bpi-r3.dts
+@@ -43,7 +43,7 @@ fan: pwm-fan {
+ 		#cooling-cells = <2>;
+ 		/* cooling level (0, 1, 2) - pwm inverted */
+ 		cooling-levels = <255 96 0>;
+-		pwms = <&pwm 0 10000 0>;
++		pwms = <&pwm 0 10000>;
+ 		status = "okay";
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch b/queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch
new file mode 100644
index 00000000000..050b108d37e
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch
@@ -0,0 +1,63 @@
+From 544441f4f37133490cf57ddf6c186a782178548d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Nov 2023 14:09:51 +0100
+Subject: arm64: dts: mediatek: mt7986: fix SPI bus width properties
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 4e7dc18a753cec130b06f1ddbae10ea9dcfb1723 ]
+
+This fixes SPI setup and resolves following validation errors:
+arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtb: spi_nand@0: Unevaluated properties are not allowed ('spi-rx-buswidth', 'spi-tx-buswidth' were unexpected)
+        from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml#
+arch/arm64/boot/dts/mediatek/mt7986b-rfb.dtb: spi_nand@0: Unevaluated properties are not allowed ('spi-rx-buswidth', 'spi-tx-buswidth' were unexpected)
+        from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml#
+
+Fixes: 885e153ed7c1 ("arm64: dts: mt7986: add spi related device nodes")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20231116130952.5099-1-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts | 4 ++--
+ arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
+index 3ef371ca254e8..bcb3ebb85d708 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
+@@ -241,8 +241,8 @@ spi_nand: spi_nand@0 {
+ 		compatible = "spi-nand";
+ 		reg = <0>;
+ 		spi-max-frequency = <10000000>;
+-		spi-tx-buswidth = <4>;
+-		spi-rx-buswidth = <4>;
++		spi-tx-bus-width = <4>;
++		spi-rx-bus-width = <4>;
+ 	};
+ };
+ 
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
+index dde190442e386..48fe50e671779 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
+@@ -156,8 +156,8 @@ spi_nand: spi_nand@0 {
+ 		compatible = "spi-nand";
+ 		reg = <0>;
+ 		spi-max-frequency = <10000000>;
+-		spi-tx-buswidth = <4>;
+-		spi-rx-buswidth = <4>;
++		spi-tx-bus-width = <4>;
++		spi-rx-bus-width = <4>;
+ 	};
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-nodename.patch b/queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-nodename.patch
new file mode 100644
index 00000000000..bb7ab60ba37
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt7986-fix-spi-nodename.patch
@@ -0,0 +1,61 @@
+From 8f085cf7892d53389af490c3bf4b5fccde9173c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Nov 2023 14:09:52 +0100
+Subject: arm64: dts: mediatek: mt7986: fix SPI nodename
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit bbe266c70e1343ee3e71ca31138141b3da265085 ]
+
+This fixes following validation errors:
+arch/arm64/boot/dts/mediatek/mt7986a-rfb.dtb: spi_nand@0: $nodename:0: 'spi_nand@0' does not match '^(flash|.*sram|nand)(@.*)?$'
+        from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml#
+arch/arm64/boot/dts/mediatek/mt7986b-rfb.dtb: spi_nand@0: $nodename:0: 'spi_nand@0' does not match '^(flash|.*sram|nand)(@.*)?$'
+        from schema $id: http://devicetree.org/schemas/mtd/spi-nand.yaml#
+
+Fixes: 885e153ed7c1 ("arm64: dts: mt7986: add spi related device nodes")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20231116130952.5099-2-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts | 3 ++-
+ arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
+index bcb3ebb85d708..2f884c24f1eb4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986a-rfb.dts
+@@ -237,7 +237,8 @@ &spi0 {
+ 	pinctrl-0 = <&spi_flash_pins>;
+ 	cs-gpios = <0>, <0>;
+ 	status = "okay";
+-	spi_nand: spi_nand@0 {
++
++	spi_nand: flash@0 {
+ 		compatible = "spi-nand";
+ 		reg = <0>;
+ 		spi-max-frequency = <10000000>;
+diff --git a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
+index 48fe50e671779..57dcaeef31d7f 100644
+--- a/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7986b-rfb.dts
+@@ -152,7 +152,8 @@ &spi0 {
+ 	pinctrl-0 = <&spi_flash_pins>;
+ 	cs-gpios = <0>, <0>;
+ 	status = "okay";
+-	spi_nand: spi_nand@0 {
++
++	spi_nand: flash@0 {
+ 		compatible = "spi-nand";
+ 		reg = <0>;
+ 		spi-max-frequency = <10000000>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch b/queue-6.8/arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch
new file mode 100644
index 00000000000..67b6ece5871
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch
@@ -0,0 +1,64 @@
+From 6d13fefda019129f0ee191682e6f9a5c1cc7b3be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 10:02:37 -0500
+Subject: arm64: dts: mediatek: mt8186: Add missing clocks to ssusb power
+ domains
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit a00d4a98af44e025891e97c490b2545368a25e08 ]
+
+The ssusb power domains currently don't list any clocks, despite
+depending on some, and thus rely on the bootloader leaving the required
+clocks on in order to work.
+
+When booting with the upstream arm64 defconfig, the power domain
+controller will defer probe until modules have loaded since it has an
+indirect dependency on CONFIG_MTK_CMDQ, which is configured as a module.
+However at the point where modules are loaded, unused clocks are also
+disabled, causing the ssusb domains to fail to be enabled and
+consequently the controller to fail probe:
+
+mtk-power-controller 10006000.syscon:power-controller: /soc/syscon@10006000/power-controller/power-domain@4: failed to power on domain: -110
+mtk-power-controller: probe of 10006000.syscon:power-controller failed with error -110
+
+Add the missing clocks for the ssusb power domains so that they can
+successfully probe without relying on the bootloader state.
+
+Fixes: d9e43c1e7a38 ("arm64: dts: mt8186: Add power domains controller")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20240213-mt8186-ssusb-domain-clk-fix-v2-1-1f981d35f3fd@collabora.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index ee0feadbf9619..4fd25f0f313d2 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -931,11 +931,17 @@ power-domain@MT8186_POWER_DOMAIN_CSIRX_TOP {
+ 
+ 				power-domain@MT8186_POWER_DOMAIN_SSUSB {
+ 					reg = <MT8186_POWER_DOMAIN_SSUSB>;
++					clocks = <&topckgen CLK_TOP_USB_TOP>,
++						 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_REF>;
++					clock-names = "sys_ck", "ref_ck";
+ 					#power-domain-cells = <0>;
+ 				};
+ 
+ 				power-domain@MT8186_POWER_DOMAIN_SSUSB_P1 {
+ 					reg = <MT8186_POWER_DOMAIN_SSUSB_P1>;
++					clocks = <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_SYS>,
++						 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_REF>;
++					clock-names = "sys_ck", "ref_ck";
+ 					#power-domain-cells = <0>;
+ 				};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch b/queue-6.8/arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch
new file mode 100644
index 00000000000..e6bdf16fb7f
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch
@@ -0,0 +1,74 @@
+From 2d1b0da749a0022a02def5000ba55b10343802eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 10:02:38 -0500
+Subject: arm64: dts: mediatek: mt8186: Add missing xhci clock to usb
+ controllers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 1af98c3e53da5a8f627855cecd68b017e753ffd3 ]
+
+The mtu3 usb controllers don't list the xhci clock, though they require
+it, and thus rely on the bootloader leaving it on in order to work.
+
+When booting with the upstream arm64 defconfig, the usb controllers will
+defer probe until modules have loaded since they have an indirect
+dependency on CONFIG_MTK_CMDQ, which is configured as a module. However
+at the point where modules are loaded, unused clocks are also disabled,
+causing the usb controllers to probe without the xhci clock enabled and
+fail to probe:
+
+mtu3 11201000.usb: clks of sts1 are not stable!
+mtu3 11201000.usb: device enable failed -110
+mtu3 11201000.usb: mtu3 hw init failed:-110
+mtu3 11201000.usb: failed to initialize gadget
+mtu3: probe of 11201000.usb failed with error -110
+
+(and same for the one at 11281000)
+
+Add the missing clock for the usb controllers so that they can
+successfully probe without relying on the bootloader state.
+
+Fixes: f6c3e61c5486 ("arm64: dts: mediatek: mt8186: Add MTU3 nodes")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20240213-mt8186-ssusb-domain-clk-fix-v2-2-1f981d35f3fd@collabora.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index 4fd25f0f313d2..84ec6c1aa12b9 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -1536,8 +1536,9 @@ ssusb0: usb@11201000 {
+ 			clocks = <&topckgen CLK_TOP_USB_TOP>,
+ 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_REF>,
+ 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_HCLK>,
+-				 <&infracfg_ao CLK_INFRA_AO_ICUSB>;
+-			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck";
++				 <&infracfg_ao CLK_INFRA_AO_ICUSB>,
++				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_XHCI>;
++			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck";
+ 			interrupts = <GIC_SPI 303 IRQ_TYPE_LEVEL_HIGH 0>;
+ 			phys = <&u2port0 PHY_TYPE_USB2>;
+ 			power-domains = <&spm MT8186_POWER_DOMAIN_SSUSB>;
+@@ -1601,8 +1602,9 @@ ssusb1: usb@11281000 {
+ 			clocks = <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_SYS>,
+ 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_REF>,
+ 				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_HCLK>,
+-				 <&clk26m>;
+-			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck";
++				 <&clk26m>,
++				 <&infracfg_ao CLK_INFRA_AO_SSUSB_TOP_P1_XHCI>;
++			clock-names = "sys_ck", "ref_ck", "mcu_ck", "dma_ck", "xhci_ck";
+ 			interrupts = <GIC_SPI 331 IRQ_TYPE_LEVEL_HIGH 0>;
+ 			phys = <&u2port1 PHY_TYPE_USB2>, <&u3port1 PHY_TYPE_USB3>;
+ 			power-domains = <&spm MT8186_POWER_DOMAIN_SSUSB_P1>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch b/queue-6.8/arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch
new file mode 100644
index 00000000000..22b1eb375c3
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch
@@ -0,0 +1,38 @@
+From a8b517c572cc6b13633dd54518d88f7c8ce7e472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Dec 2023 13:32:44 +0200
+Subject: arm64: dts: mediatek: mt8186: fix VENC power domain clocks
+
+From: Eugen Hristev <eugen.hristev@collabora.com>
+
+[ Upstream commit 09860910c589a3bb3b5268ff6f704cf6b18ada73 ]
+
+The larb clock is in fact a subsys clock, so it must be prefixed by
+'subsys-' to be correctly identified in the driver.
+
+Fixes: d9e43c1e7a38 ("arm64: dts: mt8186: Add power domains controller")
+Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20231228113245.174706-6-eugen.hristev@collabora.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index 2fec6fd1c1a71..ee0feadbf9619 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -1061,7 +1061,7 @@ power-domain@MT8186_POWER_DOMAIN_VENC {
+ 						reg = <MT8186_POWER_DOMAIN_VENC>;
+ 						clocks = <&topckgen CLK_TOP_VENC>,
+ 							 <&vencsys CLK_VENC_CKE1_VENC>;
+-						clock-names = "venc0", "larb";
++						clock-names = "venc0", "subsys-larb";
+ 						mediatek,infracfg = <&infracfg_ao>;
+ 						#power-domain-cells = <0>;
+ 					};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch b/queue-6.8/arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch
new file mode 100644
index 00000000000..b7e70701634
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch
@@ -0,0 +1,49 @@
+From f3d47ff5ee4ce60793af8ae0dfc05f1582832131 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 15:08:42 -0500
+Subject: arm64: dts: mediatek: mt8192-asurada: Remove CrosEC base detection
+ node
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 9b49cabe631b0a25aaf8fc2ba81b5b9ea6ff01b7 ]
+
+The commit adding the ChromeOS EC to the Asurada Devicetree mistakenly
+added a base detection node. While tablet mode detection is supported by
+CrosEC and used by Hayato, it is done through the cros-ec-keyb driver.
+The base detection node, which is handled by the hid-google-hammer
+driver, also provides tablet mode detection but by checking base
+attachment status on the CrosEC, which is not supported for Asurada.
+
+Hence, remove the unused CrosEC base detection node for Asurada.
+
+Fixes: eb188a2aaa82 ("arm64: dts: mediatek: asurada: Add ChromeOS EC")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Link: https://lore.kernel.org/r/20240207-mt8192-asurada-cbas-remove-v1-1-04cb65951975@collabora.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+index d87aab8d7a79e..d4dd5e8b2e1d3 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192-asurada.dtsi
+@@ -1336,10 +1336,6 @@ cros_ec: ec@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+ 
+-		base_detection: cbas {
+-			compatible = "google,cros-cbas";
+-		};
+-
+ 		cros_ec_pwm: pwm {
+ 			compatible = "google,cros-ec-pwm";
+ 			#pwm-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch b/queue-6.8/arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch
new file mode 100644
index 00000000000..8dc0ad6a9a7
--- /dev/null
+++ b/queue-6.8/arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch
@@ -0,0 +1,40 @@
+From 0c8bc69bf80af57993f93bcd2a8c7df849435ba6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Dec 2023 13:32:42 +0200
+Subject: arm64: dts: mediatek: mt8192: fix vencoder clock name
+
+From: Eugen Hristev <eugen.hristev@collabora.com>
+
+[ Upstream commit 76aac0f2a46847ed4a7a4fdd848dd66023c19ad1 ]
+
+Clock name should be `venc_sel` as per binding.
+Fix the warning message :
+arch/arm64/boot/dts/mediatek/mt8192-asurada-hayato-r1.dtb: vcodec@17020000: clock-names:0: 'venc_sel' was expected
+        from schema $id: http://devicetree.org/schemas/media/mediatek,vcodec-encoder.yaml#
+
+Fixes: aa8f3711fc87 ("arm64: dts: mt8192: Add H264 venc device node")
+Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20231228113245.174706-4-eugen.hristev@collabora.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8192.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8192.dtsi b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+index 6dd32dbfb832e..0e432636b8c23 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8192.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8192.dtsi
+@@ -1814,7 +1814,7 @@ vcodec_enc: vcodec@17020000 {
+ 			mediatek,scp = <&scp>;
+ 			power-domains = <&spm MT8192_POWER_DOMAIN_VENC>;
+ 			clocks = <&vencsys CLK_VENC_SET1_VENC>;
+-			clock-names = "venc-set1";
++			clock-names = "venc_sel";
+ 			assigned-clocks = <&topckgen CLK_TOP_VENC_SEL>;
+ 			assigned-clock-parents = <&topckgen CLK_TOP_UNIVPLL_D4>;
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch b/queue-6.8/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
new file mode 100644
index 00000000000..7fb0fc67a97
--- /dev/null
+++ b/queue-6.8/arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
@@ -0,0 +1,106 @@
+From 122e39db9993870a34f529f5e258b3f3c6cf84db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 18:38:34 -0300
+Subject: arm64: dts: mt8183: Move CrosEC base detection node to kukui-based
+ DTs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 04bd6411f506357fd1faedc2b2156e7ef206aa9a ]
+
+The cbas node is used to describe base detection functionality in the
+ChromeOS EC, which is used for units that have a detachable keyboard and
+thus rely on this functionality to switch between tablet and laptop
+mode.
+
+Despite the original commit having added the cbas node to the
+mt8183-kukui.dtsi, not all machines that include it are detachables. In
+fact all machines that include from mt8183-kukui-jacuzzi.dtsi are either
+clamshells (ie normal laptops) or convertibles, meaning the keyboard can
+be flipped but not detached. The detection for the keyboard getting
+flipped is handled by the driver bound to the keyboard-controller node
+in the EC.
+
+Move the base detection node from the base kukui dtsi to the dtsis where
+all machines are detachables, and thus actually make use of the node.
+
+Fixes: 4fa8492d1e5b ("arm64: dts: mt8183: add cbas node under cros_ec")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240116-mt8183-kukui-cbas-remove-v3-1-055e21406e86@collabora.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi  | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi        | 4 ----
+ 4 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+index b6a9830af2696..bfb9e42c8acaa 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kakadu.dtsi
+@@ -360,6 +360,10 @@ pen_eject {
+ };
+ 
+ &cros_ec {
++	cbas {
++		compatible = "google,cros-cbas";
++	};
++
+ 	keyboard-controller {
+ 		compatible = "google,cros-ec-keyb-switches";
+ 	};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+index 306c95166f3fe..5c1bf6a1e4758 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-kodama.dtsi
+@@ -339,6 +339,10 @@ touch_pin_reset: pin_reset {
+ };
+ 
+ &cros_ec {
++	cbas {
++		compatible = "google,cros-cbas";
++	};
++
+ 	keyboard-controller {
+ 		compatible = "google,cros-ec-keyb-switches";
+ 	};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+index 382e4c6d7191c..0f5fa893a7742 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui-krane.dtsi
+@@ -343,6 +343,10 @@ rst_pin {
+ };
+ 
+ &cros_ec {
++	cbas {
++		compatible = "google,cros-cbas";
++	};
++
+ 	keyboard-controller {
+ 		compatible = "google,cros-ec-keyb-switches";
+ 	};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+index 1b3396b1cee39..90c5ad917a9ba 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183-kukui.dtsi
+@@ -937,10 +937,6 @@ usbc_extcon: extcon0 {
+ 			google,usb-port-id = <0>;
+ 		};
+ 
+-		cbas {
+-			compatible = "google,cros-cbas";
+-		};
+-
+ 		typec {
+ 			compatible = "google,cros-ec-typec";
+ 			#address-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch b/queue-6.8/arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch
new file mode 100644
index 00000000000..1e1b7cf9c73
--- /dev/null
+++ b/queue-6.8/arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch
@@ -0,0 +1,66 @@
+From b6f1708fe9cd6d255bb71d93c5e1e197c1272d00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 07:51:57 +0000
+Subject: arm64: dts: mt8195-cherry-tomato: change watchdog reset boot flow
+
+From: Hsin-Te Yuan <yuanhsinte@google.com>
+
+[ Upstream commit ef569d5db50e7edd709e482157769a5b3c367e22 ]
+
+The external output reset signal was originally disabled and sent from
+firmware. However, an unfixed bug in the firmware on tomato prevents
+the signal from being sent, causing the device to fail to boot. To fix
+this, enable external output reset signal to allow the device to reboot
+normally.
+
+Fixes: 5eb2e303ec6b ("arm64: dts: mediatek: Introduce MT8195 Cherry platform's Tomato")
+Signed-off-by: Hsin-Te Yuan <yuanhsinte@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240124-send-upstream-v3-1-5097c9862a73@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts | 4 ++++
+ arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts | 4 ++++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts
+index 2d5e8f371b6de..a82d716f10d44 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r1.dts
+@@ -23,3 +23,7 @@ &sound {
+ &ts_10 {
+ 	status = "okay";
+ };
++
++&watchdog {
++	/delete-property/ mediatek,disable-extrst;
++};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts
+index 2586c32ce6e6f..2fe20e0dad836 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r2.dts
+@@ -43,3 +43,7 @@ &sound {
+ &ts_10 {
+ 	status = "okay";
+ };
++
++&watchdog {
++	/delete-property/ mediatek,disable-extrst;
++};
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts
+index f54f9477b99da..dd294ca98194c 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8195-cherry-tomato-r3.dts
+@@ -44,3 +44,7 @@ &sound {
+ &ts_10 {
+ 	status = "okay";
+ };
++
++&watchdog {
++	/delete-property/ mediatek,disable-extrst;
++};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch b/queue-6.8/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
new file mode 100644
index 00000000000..265e9536bce
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
@@ -0,0 +1,42 @@
+From d862ef35cead2bf2e9802d4c05f8669a89ca0aad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 13:39:42 +0000
+Subject: arm64: dts: qcom: msm8996: Define UFS UniPro clock limits
+
+From: Yassine Oudjana <y.oudjana@protonmail.com>
+
+[ Upstream commit 68c4c20848d71b0e69c3403becb5dd23e89e5896 ]
+
+These limits were always defined as 0, but that didn't cause any issue
+since the driver had hardcoded limits. In commit b4e13e1ae95e ("scsi: ufs:
+qcom: Add multiple frequency support for MAX_CORE_CLK_1US_CYCLES") the
+hardcoded limits were removed and the driver started reading them from DT,
+causing UFS to stop working on MSM8996. Add real UniPro clock limits to fix
+UFS.
+
+Signed-off-by: Yassine Oudjana <y.oudjana@protonmail.com>
+Fixes: 57fc67ef0d35 ("arm64: dts: qcom: msm8996: Add ufs related nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218133917.78770-1-y.oudjana@protonmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index a66f2f8ef3be5..8ec95bfd884f2 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -2077,7 +2077,7 @@ ufshc: ufshc@624000 {
+ 				<0 0>,
+ 				<0 0>,
+ 				<150000000 300000000>,
+-				<0 0>,
++				<75000000 150000000>,
+ 				<0 0>,
+ 				<0 0>,
+ 				<0 0>,
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..d363f4b6f16
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
@@ -0,0 +1,42 @@
+From 6d7ea5f8f533c6a08cbd1f35b8981881c24c82a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:28 +0530
+Subject: arm64: dts: qcom: msm8996: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit c83fdb4335cec507d685ba9661ed7c4ccbaf12ff ]
+
+QMP PHY used in MSM8996 requires 2 clocks:
+
+* ref - 19.2MHz reference clock from RPM
+* qref - QREF clock from GCC
+
+Fixes: 27520210e881 ("arm64: dts: qcom: msm8996: Use generic QMP driver for UFS")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-5-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index ee6f87c828aef..a66f2f8ef3be5 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -2096,8 +2096,8 @@ ufsphy: phy@627000 {
+ 			compatible = "qcom,msm8996-qmp-ufs-phy";
+ 			reg = <0x00627000 0x1000>;
+ 
+-			clocks = <&gcc GCC_UFS_CLKREF_CLK>;
+-			clock-names = "ref";
++			clocks = <&rpmcc RPM_SMD_LN_BB_CLK>, <&gcc GCC_UFS_CLKREF_CLK>;
++			clock-names = "ref", "qref";
+ 
+ 			resets = <&ufshc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch b/queue-6.8/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
new file mode 100644
index 00000000000..31db293ab06
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
@@ -0,0 +1,53 @@
+From c0abd45869e90dfffcf4c9b1eb6b5f3d1aef5133 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:04:25 +0200
+Subject: arm64: dts: qcom: msm8998: declare VLS CLAMP register for USB3 PHY
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit fc835b2311d4deb85d776c1d73562338462aa7ac ]
+
+The USB3 PHY on the MSM8998 platform doesn't have built-in
+PCS_MISC_CLAMP_ENABLE register. Instead clamping is handled separately
+via the register in the TCSR space. Declare corresponding register.
+
+Fixes: 026dad8f5873 ("arm64: dts: qcom: msm8998: Add USB-related nodes")
+Cc: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-4-a950c223f10f@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 2793cc22d381a..317a91d669f82 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1072,6 +1072,11 @@ tcsr_regs_1: syscon@1f60000 {
+ 			reg = <0x01f60000 0x20000>;
+ 		};
+ 
++		tcsr_regs_2: syscon@1fc0000 {
++			compatible = "qcom,msm8998-tcsr", "syscon";
++			reg = <0x01fc0000 0x26000>;
++		};
++
+ 		tlmm: pinctrl@3400000 {
+ 			compatible = "qcom,msm8998-pinctrl";
+ 			reg = <0x03400000 0xc00000>;
+@@ -2174,6 +2179,8 @@ usb3phy: phy@c010000 {
+ 			reset-names = "phy",
+ 				      "phy_phy";
+ 
++			qcom,tcsr-reg = <&tcsr_regs_2 0xb244>;
++
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..790d7453c77
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From 1ed7d0d9f95e7c0a179492be0aff880e60a36b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:29 +0530
+Subject: arm64: dts: qcom: msm8998: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 5e653a7ff4426242f22dd8bc6af7f29e10ee0d68 ]
+
+QMP PHY used in MSM8998 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPM
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+Fixes: cd3dbe2a4e6c ("arm64: dts: qcom: msm8998: Add UFS nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-6-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8998.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+index 317a91d669f82..20200a0d76a6b 100644
+--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi
+@@ -1047,12 +1047,12 @@ ufsphy: phy@1da7000 {
+ 			compatible = "qcom,msm8998-qmp-ufs-phy";
+ 			reg = <0x01da7000 0x1000>;
+ 
+-			clock-names =
+-				"ref",
+-				"ref_aux";
+-			clocks =
+-				<&gcc GCC_UFS_CLKREF_CLK>,
+-				<&gcc GCC_UFS_PHY_AUX_CLK>;
++			clocks = <&rpmcc RPM_SMD_LN_BB_CLK1>,
++				 <&gcc GCC_UFS_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_CLKREF_CLK>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			reset-names = "ufsphy";
+ 			resets = <&ufshc 0>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch b/queue-6.8/arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch
new file mode 100644
index 00000000000..e9e9a380fba
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch
@@ -0,0 +1,51 @@
+From 5324ad07862d058139098638d1cba3fea314258d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:04:26 +0200
+Subject: arm64: dts: qcom: qcm2290: declare VLS CLAMP register for USB3 PHY
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit acb94d67f5a23dbb2e0021b6c30609ed05d7d6a5 ]
+
+The USB3 PHY on the QCM2290 platform doesn't have built-in
+PCS_MISC_CLAMP_ENABLE register. Instead clamping is handled separately
+via the register in the TCSR space. Declare corresponding register.
+
+Fixes: 0c55f6229bc3 ("arm64: dts: qcom: qcm2290: Add USB3 PHY")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-5-a950c223f10f@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qcm2290.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/qcm2290.dtsi b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+index 0911fb08ed632..89beac833d435 100644
+--- a/arch/arm64/boot/dts/qcom/qcm2290.dtsi
++++ b/arch/arm64/boot/dts/qcom/qcm2290.dtsi
+@@ -442,6 +442,11 @@ tcsr_mutex: hwlock@340000 {
+ 			#hwlock-cells = <1>;
+ 		};
+ 
++		tcsr_regs: syscon@3c0000 {
++			compatible = "qcom,qcm2290-tcsr", "syscon";
++			reg = <0x0 0x003c0000 0x0 0x40000>;
++		};
++
+ 		tlmm: pinctrl@500000 {
+ 			compatible = "qcom,qcm2290-tlmm";
+ 			reg = <0x0 0x00500000 0x0 0x300000>;
+@@ -690,6 +695,8 @@ usb_qmpphy: phy@1615000 {
+ 
+ 			#phy-cells = <0>;
+ 
++			qcom,tcsr-reg = <&tcsr_regs 0xb244>;
++
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-qcm6490-fairphone-fp5-add-missing-res.patch b/queue-6.8/arm64-dts-qcom-qcm6490-fairphone-fp5-add-missing-res.patch
new file mode 100644
index 00000000000..4037b1b0a57
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-qcm6490-fairphone-fp5-add-missing-res.patch
@@ -0,0 +1,43 @@
+From 701cfd1b2e63c6ddd737e3459ddce2872793c272 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 13:53:17 +0100
+Subject: arm64: dts: qcom: qcm6490-fairphone-fp5: Add missing reserved-memory
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 5dbbe7e0a2b91ac5901ee188724a997004759171 ]
+
+It seems we also need to reserve a region of 81 MiB called "removed_mem"
+otherwise we can easily hit the following error with higher RAM usage:
+
+  [ 1467.809274] Internal error: synchronous external abort: 0000000096000010 [#2] SMP
+
+Fixes: eee9602ad649 ("arm64: dts: qcom: qcm6490: Add device-tree for Fairphone 5")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231229-fp5-reserved-mem-v1-1-87bb818f1397@fairphone.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
+index 176898c9dbbd7..1e85c43a6fd14 100644
+--- a/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
++++ b/arch/arm64/boot/dts/qcom/qcm6490-fairphone-fp5.dts
+@@ -82,6 +82,11 @@ cdsp_mem: cdsp@88f00000 {
+ 			no-map;
+ 		};
+ 
++		removed_mem: removed@c0000000 {
++			reg = <0x0 0xc0000000 0x0 0x5100000>;
++			no-map;
++		};
++
+ 		rmtfs_mem: memory@f8500000 {
+ 			compatible = "qcom,rmtfs-mem";
+ 			reg = <0x0 0xf8500000 0x0 0x600000>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-qcm6490-idp-correct-the-voltage-setti.patch b/queue-6.8/arm64-dts-qcom-qcm6490-idp-correct-the-voltage-setti.patch
new file mode 100644
index 00000000000..8e1b466f1de
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-qcm6490-idp-correct-the-voltage-setti.patch
@@ -0,0 +1,41 @@
+From 4985ac0138a571aaef4d39e36eab8dce9ac715da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 16:30:14 +0530
+Subject: arm64: dts: qcom: qcm6490-idp: Correct the voltage setting for
+ vph_pwr
+
+From: Komal Bajaj <quic_kbajaj@quicinc.com>
+
+[ Upstream commit aa56130e88de50773f84de4039c7de81ab783744 ]
+
+Min and max voltages for vph_pwr should be same, otherwise rpmh
+will not probe, so correcting the min and max voltages for vph_pwr.
+
+Fixes: 9af6a9f32ad0 ("arm64: dts: qcom: Add base qcm6490 idp board dts")
+Signed-off-by: Komal Bajaj <quic_kbajaj@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231220110015.25378-2-quic_kbajaj@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qcm6490-idp.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qcm6490-idp.dts b/arch/arm64/boot/dts/qcom/qcm6490-idp.dts
+index 03e97e27d16d4..74f5a43d53db9 100644
+--- a/arch/arm64/boot/dts/qcom/qcm6490-idp.dts
++++ b/arch/arm64/boot/dts/qcom/qcm6490-idp.dts
+@@ -123,8 +123,8 @@ debug_vm_mem: debug-vm@d0600000 {
+ 	vph_pwr: vph-pwr-regulator {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "vph_pwr";
+-		regulator-min-microvolt = <2500000>;
+-		regulator-max-microvolt = <4350000>;
++		regulator-min-microvolt = <3700000>;
++		regulator-max-microvolt = <3700000>;
+ 	};
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-qcs6490-rb3gen2-correct-the-voltage-s.patch b/queue-6.8/arm64-dts-qcom-qcs6490-rb3gen2-correct-the-voltage-s.patch
new file mode 100644
index 00000000000..7b6e55b29cb
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-qcs6490-rb3gen2-correct-the-voltage-s.patch
@@ -0,0 +1,41 @@
+From 752e8ee82075b6d278418c69d105009af16b0fe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 16:30:15 +0530
+Subject: arm64: dts: qcom: qcs6490-rb3gen2: Correct the voltage setting for
+ vph_pwr
+
+From: Komal Bajaj <quic_kbajaj@quicinc.com>
+
+[ Upstream commit 05f439c0e64b877c1f9cc7f0bed894b6df45d43d ]
+
+Min and max voltages for vph_pwr should be same, otherwise rpmh
+will not probe, so correcting the min and max voltages for vph_pwr.
+
+Fixes: 04cf333afc75 ("arm64: dts: qcom: Add base qcs6490-rb3gen2 board dts")
+Signed-off-by: Komal Bajaj <quic_kbajaj@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231220110015.25378-3-quic_kbajaj@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
+index 8bb7d13d85f66..ae1632182d7c1 100644
+--- a/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
++++ b/arch/arm64/boot/dts/qcom/qcs6490-rb3gen2.dts
+@@ -124,8 +124,8 @@ debug_vm_mem: debug-vm@d0600000 {
+ 	vph_pwr: vph-pwr-regulator {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "vph_pwr";
+-		regulator-min-microvolt = <2500000>;
+-		regulator-max-microvolt = <4350000>;
++		regulator-min-microvolt = <3700000>;
++		regulator-max-microvolt = <3700000>;
+ 	};
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-rename-pm2250-to-pm4125.patch b/queue-6.8/arm64-dts-qcom-rename-pm2250-to-pm4125.patch
new file mode 100644
index 00000000000..b7ebec59c69
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-rename-pm2250-to-pm4125.patch
@@ -0,0 +1,345 @@
+From f3ee63de2ba80ad671be1bcc87a7a9e8b5b3401c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 03:32:45 +0200
+Subject: arm64: dts: qcom: rename PM2250 to PM4125
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 39e62f41c3ce210554cc054f345d4135ef4e587b ]
+
+It seems, the only actual mentions of PM2250 can be found are related to
+the Qualcomm RB1 platform. However even RB1 schematics use PM4125 as a
+PMIC name. Rename PM2250 to PM4125 to follow the documentation.
+
+Note, this doesn't change the compatible strings. There was a previous
+argument regarding renaming of compat strings.
+
+Fixes: c309b9a54039 ("arm64: dts: qcom: Add initial PM2250 device tree")
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240128-pm2250-pm4125-rename-v2-2-d51987e9f83a@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/qcom/{pm2250.dtsi => pm4125.dtsi}     |  8 +-
+ arch/arm64/boot/dts/qcom/qrb2210-rb1.dts      | 78 +++++++++----------
+ 2 files changed, 43 insertions(+), 43 deletions(-)
+ rename arch/arm64/boot/dts/qcom/{pm2250.dtsi => pm4125.dtsi} (91%)
+
+diff --git a/arch/arm64/boot/dts/qcom/pm2250.dtsi b/arch/arm64/boot/dts/qcom/pm4125.dtsi
+similarity index 91%
+rename from arch/arm64/boot/dts/qcom/pm2250.dtsi
+rename to arch/arm64/boot/dts/qcom/pm4125.dtsi
+index 5f1d15db5c993..d886a9e4b0918 100644
+--- a/arch/arm64/boot/dts/qcom/pm2250.dtsi
++++ b/arch/arm64/boot/dts/qcom/pm4125.dtsi
+@@ -19,7 +19,7 @@ pon@800 {
+ 			compatible = "qcom,pm8916-pon";
+ 			reg = <0x800>;
+ 
+-			pm2250_pwrkey: pwrkey {
++			pm4125_pwrkey: pwrkey {
+ 				compatible = "qcom,pm8941-pwrkey";
+ 				interrupts-extended = <&spmi_bus 0x0 0x8 0 IRQ_TYPE_EDGE_BOTH>;
+ 				linux,code = <KEY_POWER>;
+@@ -27,7 +27,7 @@ pm2250_pwrkey: pwrkey {
+ 				bias-pull-up;
+ 			};
+ 
+-			pm2250_resin: resin {
++			pm4125_resin: resin {
+ 				compatible = "qcom,pm8941-resin";
+ 				interrupts-extended = <&spmi_bus 0x0 0x8 1 IRQ_TYPE_EDGE_BOTH>;
+ 				debounce = <15625>;
+@@ -43,11 +43,11 @@ rtc@6000 {
+ 			interrupts-extended = <&spmi_bus 0x0 0x61 0x1 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+-		pm2250_gpios: gpio@c000 {
++		pm4125_gpios: gpio@c000 {
+ 			compatible = "qcom,pm2250-gpio", "qcom,spmi-gpio";
+ 			reg = <0xc000>;
+ 			gpio-controller;
+-			gpio-ranges = <&pm2250_gpios 0 0 10>;
++			gpio-ranges = <&pm4125_gpios 0 0 10>;
+ 			#gpio-cells = <2>;
+ 			interrupt-controller;
+ 			#interrupt-cells = <2>;
+diff --git a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
+index aa53b6af6d9cb..64b2ab2862793 100644
+--- a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
++++ b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
+@@ -7,7 +7,7 @@
+ 
+ #include <dt-bindings/leds/common.h>
+ #include "qcm2290.dtsi"
+-#include "pm2250.dtsi"
++#include "pm4125.dtsi"
+ 
+ / {
+ 	model = "Qualcomm Technologies, Inc. Robotics RB1";
+@@ -226,7 +226,7 @@ &mdss {
+ };
+ 
+ &mdss_dsi0 {
+-	vdda-supply = <&pm2250_l5>;
++	vdda-supply = <&pm4125_l5>;
+ 	status = "okay";
+ };
+ 
+@@ -239,7 +239,7 @@ &mdss_dsi0_phy {
+ 	status = "okay";
+ };
+ 
+-&pm2250_resin {
++&pm4125_resin {
+ 	linux,code = <KEY_VOLUMEDOWN>;
+ 	status = "okay";
+ };
+@@ -263,23 +263,23 @@ regulators {
+ 		compatible = "qcom,rpm-pm2250-regulators";
+ 		vdd_s3-supply = <&vph_pwr>;
+ 		vdd_s4-supply = <&vph_pwr>;
+-		vdd_l1_l2_l3_l5_l6_l7_l8_l9_l10_l11_l12-supply = <&pm2250_s3>;
++		vdd_l1_l2_l3_l5_l6_l7_l8_l9_l10_l11_l12-supply = <&pm4125_s3>;
+ 		vdd_l4_l17_l18_l19_l20_l21_l22-supply = <&vph_pwr>;
+-		vdd_l13_l14_l15_l16-supply = <&pm2250_s4>;
++		vdd_l13_l14_l15_l16-supply = <&pm4125_s4>;
+ 
+ 		/*
+ 		 * S1 - VDD_APC
+ 		 * S2 - VDD_CX
+ 		 */
+ 
+-		pm2250_s3: s3 {
++		pm4125_s3: s3 {
+ 			/* 0.4V-1.6625V -> 1.3V (Power tree requirements) */
+ 			regulator-min-microvolt = <1352000>;
+ 			regulator-max-microvolt = <1352000>;
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_s4: s4 {
++		pm4125_s4: s4 {
+ 			/* 1.2V-2.35V -> 2.05V (Power tree requirements) */
+ 			regulator-min-microvolt = <2072000>;
+ 			regulator-max-microvolt = <2072000>;
+@@ -288,7 +288,7 @@ pm2250_s4: s4 {
+ 
+ 		/* L1 - VDD_MX */
+ 
+-		pm2250_l2: l2 {
++		pm4125_l2: l2 {
+ 			/* LPDDR4X VDD2 */
+ 			regulator-min-microvolt = <1136000>;
+ 			regulator-max-microvolt = <1136000>;
+@@ -296,7 +296,7 @@ pm2250_l2: l2 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l3: l3 {
++		pm4125_l3: l3 {
+ 			/* LPDDR4X VDDQ */
+ 			regulator-min-microvolt = <616000>;
+ 			regulator-max-microvolt = <616000>;
+@@ -304,14 +304,14 @@ pm2250_l3: l3 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l4: l4 {
++		pm4125_l4: l4 {
+ 			/* max = 3.05V -> max = 2.7 to disable 3V signaling (SDHCI2) */
+ 			regulator-min-microvolt = <1800000>;
+ 			regulator-max-microvolt = <2700000>;
+ 			regulator-allow-set-load;
+ 		};
+ 
+-		pm2250_l5: l5 {
++		pm4125_l5: l5 {
+ 			/* CSI/DSI */
+ 			regulator-min-microvolt = <1232000>;
+ 			regulator-max-microvolt = <1232000>;
+@@ -319,7 +319,7 @@ pm2250_l5: l5 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l6: l6 {
++		pm4125_l6: l6 {
+ 			/* DRAM PLL */
+ 			regulator-min-microvolt = <928000>;
+ 			regulator-max-microvolt = <928000>;
+@@ -327,7 +327,7 @@ pm2250_l6: l6 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l7: l7 {
++		pm4125_l7: l7 {
+ 			/* Wi-Fi CX/MX */
+ 			regulator-min-microvolt = <664000>;
+ 			regulator-max-microvolt = <664000>;
+@@ -338,20 +338,20 @@ pm2250_l7: l7 {
+ 		 * L9 - VDD_LPI_MX
+ 		 */
+ 
+-		pm2250_l10: l10 {
++		pm4125_l10: l10 {
+ 			/* Wi-Fi RFA */
+ 			regulator-min-microvolt = <1304000>;
+ 			regulator-max-microvolt = <1304000>;
+ 		};
+ 
+-		pm2250_l11: l11 {
++		pm4125_l11: l11 {
+ 			/* GPS RF1 */
+ 			regulator-min-microvolt = <1000000>;
+ 			regulator-max-microvolt = <1000000>;
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l12: l12 {
++		pm4125_l12: l12 {
+ 			/* USB PHYs */
+ 			regulator-min-microvolt = <928000>;
+ 			regulator-max-microvolt = <928000>;
+@@ -359,7 +359,7 @@ pm2250_l12: l12 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l13: l13 {
++		pm4125_l13: l13 {
+ 			/* USB/QFPROM/PLLs */
+ 			regulator-min-microvolt = <1800000>;
+ 			regulator-max-microvolt = <1800000>;
+@@ -367,7 +367,7 @@ pm2250_l13: l13 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l14: l14 {
++		pm4125_l14: l14 {
+ 			/* SDHCI1 VQMMC */
+ 			regulator-min-microvolt = <1800000>;
+ 			regulator-max-microvolt = <1800000>;
+@@ -376,7 +376,7 @@ pm2250_l14: l14 {
+ 			regulator-always-on;
+ 		};
+ 
+-		pm2250_l15: l15 {
++		pm4125_l15: l15 {
+ 			/* WCD/DSI/BT VDDIO */
+ 			regulator-min-microvolt = <1800000>;
+ 			regulator-max-microvolt = <1800000>;
+@@ -385,38 +385,38 @@ pm2250_l15: l15 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l16: l16 {
++		pm4125_l16: l16 {
+ 			/* GPS RF2 */
+ 			regulator-min-microvolt = <1800000>;
+ 			regulator-max-microvolt = <1800000>;
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l17: l17 {
++		pm4125_l17: l17 {
+ 			regulator-min-microvolt = <3000000>;
+ 			regulator-max-microvolt = <3000000>;
+ 		};
+ 
+-		pm2250_l18: l18 {
++		pm4125_l18: l18 {
+ 			/* VDD_PXn */
+ 			regulator-min-microvolt = <1800000>;
+ 			regulator-max-microvolt = <1800000>;
+ 		};
+ 
+-		pm2250_l19: l19 {
++		pm4125_l19: l19 {
+ 			/* VDD_PXn */
+ 			regulator-min-microvolt = <1800000>;
+ 			regulator-max-microvolt = <1800000>;
+ 		};
+ 
+-		pm2250_l20: l20 {
++		pm4125_l20: l20 {
+ 			/* SDHCI1 VMMC */
+ 			regulator-min-microvolt = <2400000>;
+ 			regulator-max-microvolt = <3600000>;
+ 			regulator-allow-set-load;
+ 		};
+ 
+-		pm2250_l21: l21 {
++		pm4125_l21: l21 {
+ 			/* SDHCI2 VMMC */
+ 			regulator-min-microvolt = <2960000>;
+ 			regulator-max-microvolt = <3300000>;
+@@ -424,7 +424,7 @@ pm2250_l21: l21 {
+ 			regulator-boot-on;
+ 		};
+ 
+-		pm2250_l22: l22 {
++		pm4125_l22: l22 {
+ 			/* Wi-Fi */
+ 			regulator-min-microvolt = <3312000>;
+ 			regulator-max-microvolt = <3312000>;
+@@ -433,8 +433,8 @@ pm2250_l22: l22 {
+ };
+ 
+ &sdhc_1 {
+-	vmmc-supply = <&pm2250_l20>;
+-	vqmmc-supply = <&pm2250_l14>;
++	vmmc-supply = <&pm4125_l20>;
++	vqmmc-supply = <&pm4125_l14>;
+ 	pinctrl-0 = <&sdc1_state_on>;
+ 	pinctrl-1 = <&sdc1_state_off>;
+ 	pinctrl-names = "default", "sleep";
+@@ -446,8 +446,8 @@ &sdhc_1 {
+ };
+ 
+ &sdhc_2 {
+-	vmmc-supply = <&pm2250_l21>;
+-	vqmmc-supply = <&pm2250_l4>;
++	vmmc-supply = <&pm4125_l21>;
++	vqmmc-supply = <&pm4125_l4>;
+ 	cd-gpios = <&tlmm 88 GPIO_ACTIVE_LOW>;
+ 	pinctrl-0 = <&sdc2_state_on &sd_det_in_on>;
+ 	pinctrl-1 = <&sdc2_state_off &sd_det_in_off>;
+@@ -518,8 +518,8 @@ &usb {
+ };
+ 
+ &usb_qmpphy {
+-	vdda-phy-supply = <&pm2250_l12>;
+-	vdda-pll-supply = <&pm2250_l13>;
++	vdda-phy-supply = <&pm4125_l12>;
++	vdda-pll-supply = <&pm4125_l13>;
+ 	status = "okay";
+ };
+ 
+@@ -528,17 +528,17 @@ &usb_dwc3 {
+ };
+ 
+ &usb_hsphy {
+-	vdd-supply = <&pm2250_l12>;
+-	vdda-pll-supply = <&pm2250_l13>;
+-	vdda-phy-dpdm-supply = <&pm2250_l21>;
++	vdd-supply = <&pm4125_l12>;
++	vdda-pll-supply = <&pm4125_l13>;
++	vdda-phy-dpdm-supply = <&pm4125_l21>;
+ 	status = "okay";
+ };
+ 
+ &wifi {
+-	vdd-0.8-cx-mx-supply = <&pm2250_l7>;
+-	vdd-1.8-xo-supply = <&pm2250_l13>;
+-	vdd-1.3-rfa-supply = <&pm2250_l10>;
+-	vdd-3.3-ch0-supply = <&pm2250_l22>;
++	vdd-0.8-cx-mx-supply = <&pm4125_l7>;
++	vdd-1.8-xo-supply = <&pm4125_l13>;
++	vdd-1.3-rfa-supply = <&pm4125_l10>;
++	vdd-3.3-ch0-supply = <&pm4125_l22>;
+ 	qcom,ath10k-calibration-variant = "Thundercomm_RB1";
+ 	status = "okay";
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch b/queue-6.8/arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch
new file mode 100644
index 00000000000..d251350b9fe
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch
@@ -0,0 +1,41 @@
+From f138d458c681cdddcc8e492dc437271f9742581a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 13:05:11 -0800
+Subject: arm64: dts: qcom: sa8540p: Drop gfx.lvl as power-domain for gpucc
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit fd5821a1a83c969ed2dcc72fef885f3a82c1d978 ]
+
+The SA8295P and SA8540P uses an external regulator (max20411), and
+gfx.lvl is not provided by rpmh. Drop the power-domains property of the
+gpucc node to reflect this.
+
+Fixes: eec51ab2fd6f ("arm64: dts: qcom: sc8280xp: Add GPU related nodes")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Link: https://lore.kernel.org/r/20240125-sa8295p-gpu-v4-5-7011c2a63037@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sa8540p.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sa8540p.dtsi b/arch/arm64/boot/dts/qcom/sa8540p.dtsi
+index 96b2c59ad02b4..23888029cc117 100644
+--- a/arch/arm64/boot/dts/qcom/sa8540p.dtsi
++++ b/arch/arm64/boot/dts/qcom/sa8540p.dtsi
+@@ -168,6 +168,9 @@ opp-2592000000 {
+ };
+ 
+ &gpucc {
++	/* SA8295P and SA8540P doesn't provide gfx.lvl */
++	/delete-property/ power-domains;
++
+ 	status = "disabled";
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc7280-add-static-properties-to-crypt.patch b/queue-6.8/arm64-dts-qcom-sc7280-add-static-properties-to-crypt.patch
new file mode 100644
index 00000000000..8a9e2927336
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc7280-add-static-properties-to-crypt.patch
@@ -0,0 +1,43 @@
+From a400f2cc86d63dcac97efdc349bd088b7dea7890 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 09:51:37 +0100
+Subject: arm64: dts: qcom: sc7280: Add static properties to cryptobam
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 40ec6a2817d927367461fb0335b42b0d494ff927 ]
+
+When the properties num-channels & qcom,num-ees are not specified, the
+driver tries to read the values from registers, but this read fails and
+resets the device if the interconnect from the qcom,qce node is not
+already active when that happens.
+
+Add the static properties to not touch any registers during probe, the
+rest of the time when the BAM is used by QCE then the interconnect will
+be active already.
+
+Fixes: d488f903a860 ("arm64: dts: qcom: sc7280: add QCrypto nodes")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Link: https://lore.kernel.org/r/20231229-sc7280-cryptobam-fixup-v1-1-bd8f68589b80@fairphone.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 83b5b76ba1794..ce0d24ee7eedb 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2345,6 +2345,8 @@ cryptobam: dma-controller@1dc4000 {
+ 				 <&apps_smmu 0x4e6 0x0011>;
+ 			qcom,ee = <0>;
+ 			qcom,controlled-remotely;
++			num-channels = <16>;
++			qcom,num-ees = <4>;
+ 		};
+ 
+ 		crypto: crypto@1dfa000 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-mdp_cfg-path.patch b/queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-mdp_cfg-path.patch
new file mode 100644
index 00000000000..f963c943b97
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-mdp_cfg-path.patch
@@ -0,0 +1,47 @@
+From 43da8889836b3c5990b65e95a34828790e1aa754 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:09 +0100
+Subject: arm64: dts: qcom: sc8180x: Add missing CPU<->MDP_CFG path
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit f0cd5a0ebd419bd151ed79baf5f044da797521ac ]
+
+To guarantee the required resources are enabled, describe the
+interconnect path between the MDSS and the CPU.
+
+Fixes: 494dec9b6f54 ("arm64: dts: qcom: sc8180x: Add display and gpu nodes")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-8-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 97c139d0399d4..960058624a2f5 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -2701,9 +2701,15 @@ mdss: mdss@ae00000 {
+ 			interrupt-controller;
+ 			#interrupt-cells = <1>;
+ 
+-			interconnects = <&mmss_noc MASTER_MDP_PORT0 0 &mc_virt SLAVE_EBI_CH0 0>,
+-					<&mmss_noc MASTER_MDP_PORT1 0 &mc_virt SLAVE_EBI_CH0 0>;
+-			interconnect-names = "mdp0-mem", "mdp1-mem";
++			interconnects = <&mmss_noc MASTER_MDP_PORT0 QCOM_ICC_TAG_ALWAYS
++					 &mc_virt SLAVE_EBI_CH0 QCOM_ICC_TAG_ALWAYS>,
++					<&mmss_noc MASTER_MDP_PORT1 QCOM_ICC_TAG_ALWAYS
++					 &mc_virt SLAVE_EBI_CH0 QCOM_ICC_TAG_ALWAYS>,
++					<&gem_noc MASTER_AMPSS_M0 QCOM_ICC_TAG_ALWAYS
++					 &config_noc SLAVE_DISPLAY_CFG QCOM_ICC_TAG_ALWAYS>;
++			interconnect-names = "mdp0-mem",
++					     "mdp1-mem",
++					     "cpu-cfg";
+ 
+ 			iommus = <&apps_smmu 0x800 0x420>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch b/queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch
new file mode 100644
index 00000000000..8eb9ca95520
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch
@@ -0,0 +1,54 @@
+From db77741c09a25b932245d81c4b07e2dd90878440 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:05 +0100
+Subject: arm64: dts: qcom: sc8180x: Add missing CPU off state
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 07b600dfdfea65d58dd80ea25becd8cff69bfafc ]
+
+The CPUs can be powered off without pulling the plug from the rest of
+the system. Describe the idle state responsible for this.
+
+Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-4-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index b84fe5f3b41cb..8849469d0aa10 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -298,7 +298,15 @@ BIG_CPU_SLEEP_0: cpu-sleep-1-0 {
+ 		};
+ 
+ 		domain-idle-states {
+-			CLUSTER_SLEEP_0: cluster-sleep-0 {
++			CLUSTER_SLEEP_APSS_OFF: cluster-sleep-0 {
++				compatible = "domain-idle-state";
++				arm,psci-suspend-param = <0x41000044>;
++				entry-latency-us = <3300>;
++				exit-latency-us = <3300>;
++				min-residency-us = <6000>;
++			};
++
++			CLUSTER_SLEEP_AOSS_SLEEP: cluster-sleep-1 {
+ 				compatible = "domain-idle-state";
+ 				arm,psci-suspend-param = <0x4100a344>;
+ 				entry-latency-us = <3263>;
+@@ -582,7 +590,7 @@ CPU_PD7: power-domain-cpu7 {
+ 
+ 		CLUSTER_PD: power-domain-cpu-cluster0 {
+ 			#power-domain-cells = <0>;
+-			domain-idle-states = <&CLUSTER_SLEEP_0>;
++			domain-idle-states = <&CLUSTER_SLEEP_APSS_OFF &CLUSTER_SLEEP_AOSS_SLEEP>;
+ 		};
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch b/queue-6.8/arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch
new file mode 100644
index 00000000000..1d8c83c41c5
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch
@@ -0,0 +1,40 @@
+From 0cddab3b2e360894cac6434458aeaace744ab097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:07 +0100
+Subject: arm64: dts: qcom: sc8180x: Don't hold MDP core clock at FMAX
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 309b5774f45aafd002efdb2656673542419abd6f ]
+
+There's an OPP table to handle this, drop the permanent vote.
+
+Fixes: 494dec9b6f54 ("arm64: dts: qcom: sc8180x: Add display and gpu nodes")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-6-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 8f7f5b74cdb9f..3bb9d25b1dec6 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -2732,10 +2732,8 @@ mdss_mdp: mdp@ae01000 {
+ 					      "rot",
+ 					      "lut";
+ 
+-				assigned-clocks = <&dispcc DISP_CC_MDSS_MDP_CLK>,
+-						  <&dispcc DISP_CC_MDSS_VSYNC_CLK>;
+-				assigned-clock-rates = <460000000>,
+-						       <19200000>;
++				assigned-clocks = <&dispcc DISP_CC_MDSS_VSYNC_CLK>;
++				assigned-clock-rates = <19200000>;
+ 
+ 				operating-points-v2 = <&mdp_opp_table>;
+ 				power-domains = <&rpmhpd SC8180X_MMCX>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch b/queue-6.8/arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch
new file mode 100644
index 00000000000..daea61d62ed
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch
@@ -0,0 +1,37 @@
+From 63741cc94297cfb7261f6d6cd6b5815dacab1323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:06 +0100
+Subject: arm64: dts: qcom: sc8180x: Fix eDP PHY power-domains
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 24e98cb3d5e2c86565680e00008a794b4eac0040 ]
+
+The (e)DP PHYs are powered by the MX line, not through the MDSS GDSC.
+Fix that up.
+
+Fixes: 494dec9b6f54 ("arm64: dts: qcom: sc8180x: Add display and gpu nodes")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-5-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 8849469d0aa10..8f7f5b74cdb9f 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -3193,7 +3193,7 @@ edp_phy: phy@aec2a00 {
+ 				 <&dispcc DISP_CC_MDSS_AHB_CLK>;
+ 			clock-names = "aux", "cfg_ahb";
+ 
+-			power-domains = <&dispcc MDSS_GDSC>;
++			power-domains = <&rpmhpd SC8180X_MX>;
+ 
+ 			#clock-cells = <1>;
+ 			#phy-cells = <0>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch b/queue-6.8/arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch
new file mode 100644
index 00000000000..0473ecc6918
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch
@@ -0,0 +1,37 @@
+From 7a76df82ead203436d198c7c28602a080cad0349 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:04 +0100
+Subject: arm64: dts: qcom: sc8180x: Fix up big CPU idle state entry latency
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 266a3a92044b89c392b3e9cfcc328d4167c18294 ]
+
+The entry latency was oddly low.. Turns out somebody forgot about a
+second '1'! Fix it.
+
+Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-3-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 91fd805f17a1b..b84fe5f3b41cb 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -290,7 +290,7 @@ LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 {
+ 			BIG_CPU_SLEEP_0: cpu-sleep-1-0 {
+ 				compatible = "arm,idle-state";
+ 				arm,psci-suspend-param = <0x40000004>;
+-				entry-latency-us = <241>;
++				entry-latency-us = <2411>;
+ 				exit-latency-us = <1461>;
+ 				min-residency-us = <4488>;
+ 				local-timer-stop;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch b/queue-6.8/arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch
new file mode 100644
index 00000000000..cb30c5681fb
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch
@@ -0,0 +1,36 @@
+From 0153ef94dcd2462a61e8850e1729d7fb0dd06d5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:03 +0100
+Subject: arm64: dts: qcom: sc8180x: Hook up VDD_CX as GCC parent domain
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 3c58b96df110a80e78fa36ef928f1e6c375008e3 ]
+
+Most of GCC is powered by the CX rail. Describe that relationship to
+let the performance state requests trickle up the chain.
+
+Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-2-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 0430d99091e30..91fd805f17a1b 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -782,6 +782,7 @@ gcc: clock-controller@100000 {
+ 			clock-names = "bi_tcxo",
+ 				      "bi_tcxo_ao",
+ 				      "sleep_clk";
++			power-domains = <&rpmhpd SC8180X_CX>;
+ 		};
+ 
+ 		qupv3_id_0: geniqup@8c0000 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch b/queue-6.8/arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch
new file mode 100644
index 00000000000..fd2b14fc947
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch
@@ -0,0 +1,37 @@
+From baba33314717867c091bb1857972d22994c1f6a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:08 +0100
+Subject: arm64: dts: qcom: sc8180x: Require LOW_SVS vote for MMCX if DISPCC is
+ on
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 6d9fb9e4c473cdfd2adca019b46d8e482105cae7 ]
+
+To ensure the PLLs are getting enough power, cast a vote with DISPCC so
+that MMCX is at least at LOW_SVS.
+
+Fixes: 494dec9b6f54 ("arm64: dts: qcom: sc8180x: Add display and gpu nodes")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-7-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 3bb9d25b1dec6..97c139d0399d4 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -3217,6 +3217,7 @@ dispcc: clock-controller@af00000 {
+ 				      "edp_phy_pll_link_clk",
+ 				      "edp_phy_pll_vco_div_clk";
+ 			power-domains = <&rpmhpd SC8180X_MMCX>;
++			required-opps = <&rpmhpd_opp_low_svs>;
+ 			#clock-cells = <1>;
+ 			#reset-cells = <1>;
+ 			#power-domain-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch b/queue-6.8/arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch
new file mode 100644
index 00000000000..de64492c980
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch
@@ -0,0 +1,37 @@
+From 23cd617fb37e509854608667dde8ab0f0faeea38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Dec 2023 01:05:10 +0100
+Subject: arm64: dts: qcom: sc8180x: Shrink aoss_qmp register space size
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit dcad0590d1ea4278a55c30dd2903611a96111601 ]
+
+The AOSS_QMP region is overallocated, bleeding into space that's supposed
+to be used by other peripherals. Fix it.
+
+Fixes: 8575f197b077 ("arm64: dts: qcom: Introduce the SC8180x platform")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231230-topic-8180_more_fixes-v1-9-93b5c107ed43@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 960058624a2f5..c0dd44f146748 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -3262,7 +3262,7 @@ tsens1: thermal-sensor@c265000 {
+ 
+ 		aoss_qmp: power-controller@c300000 {
+ 			compatible = "qcom,sc8180x-aoss-qmp", "qcom,aoss-qmp";
+-			reg = <0x0 0x0c300000 0x0 0x100000>;
++			reg = <0x0 0x0c300000 0x0 0x400>;
+ 			interrupts = <GIC_SPI 389 IRQ_TYPE_EDGE_RISING>;
+ 			mboxes = <&apss_shared 0>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..c96576e6f5f
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch
@@ -0,0 +1,63 @@
+From ded687f305f7c8f497b2f71fd79cc0644d622ffc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:37 +0530
+Subject: arm64: dts: qcom: sc8280xp: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 1d4ef9644e219202ed89ac42f3e1defebcab9c7d ]
+
+QMP PHY used in SC8280XP requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-14-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index febf28356ff8b..bb0786ab2864d 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -2257,9 +2257,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sc8280xp-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
+-			clocks = <&gcc GCC_UFS_CARD_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
+-			clock-names = "ref", "ref_aux";
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_CARD_CLKREF_CLK>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			power-domains = <&gcc UFS_PHY_GDSC>;
+ 
+@@ -2319,9 +2322,12 @@ ufs_card_phy: phy@1da7000 {
+ 			compatible = "qcom,sc8280xp-qmp-ufs-phy";
+ 			reg = <0 0x01da7000 0 0x1000>;
+ 
+-			clocks = <&gcc GCC_UFS_1_CARD_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_CARD_PHY_AUX_CLK>;
+-			clock-names = "ref", "ref_aux";
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_CARD_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_1_CARD_CLKREF_CLK>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			power-domains = <&gcc UFS_CARD_GDSC>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch b/queue-6.8/arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch
new file mode 100644
index 00000000000..70e6db2b5ed
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch
@@ -0,0 +1,40 @@
+From 89fccee38a5552419b44431bb6456a37834ece4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 14:12:15 +0100
+Subject: arm64: dts: qcom: sdm845-db845c: correct PCIe wake-gpios
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 584a327c5cffc36369b2a8953d9448826240f1ac ]
+
+Bindings allow a "wake", not "enable", GPIO.  Schematics also use WAKE
+name for the pin:
+
+  sdm845-db845c.dtb: pcie@1c00000: Unevaluated properties are not allowed ('enable-gpio' was unexpected)
+
+Fixes: 4a657c264b78 ("arm64: dts: qcom: db845c: Enable PCIe controllers")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240108131216.53867-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index ab6220456513c..1f517328199b9 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -580,7 +580,7 @@ &mss_pil {
+ &pcie0 {
+ 	status = "okay";
+ 	perst-gpios = <&tlmm 35 GPIO_ACTIVE_LOW>;
+-	enable-gpio = <&tlmm 134 GPIO_ACTIVE_HIGH>;
++	wake-gpios = <&tlmm 134 GPIO_ACTIVE_HIGH>;
+ 
+ 	vddpe-3v3-supply = <&pcie0_3p3v_dual>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..1df41dc6d25
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From aee7a0f6fc799a34d1bb8d2795c35ed907ba84b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:30 +0530
+Subject: arm64: dts: qcom: sdm845: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit ca8fb2bd2248ae05890c011d691ba5d4a1e7d8d6 ]
+
+QMP PHY used in SDM845 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: cc16687fbd74 ("arm64: dts: qcom: sdm845: add UFS controller")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-7-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index c2244824355a2..5ee98ff84d171 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -2639,10 +2639,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sdm845-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_MEM_CLKREF_CLK>;
+ 			clock-names = "ref",
+-				      "ref_aux";
+-			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch b/queue-6.8/arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch
new file mode 100644
index 00000000000..5ce9eedf65a
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch
@@ -0,0 +1,54 @@
+From 17c6954515b4ddb41fd1a11795c4bad85b91705e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 21:02:33 +0100
+Subject: arm64: dts: qcom: sdm845-oneplus-common: improve DAI node naming
+
+From: David Heidelberg <david@ixit.cz>
+
+[ Upstream commit afe9867a0c0e10ba618c15d4ef6f8699872f6cc3 ]
+
+Make it easier to understand what the reg in those nodes is by using the
+constants provided by qcom,q6dsp-lpass-ports.h.
+
+Name nodes according to dt-binding expectations.
+
+Fix for
+```
+arch/arm64/boot/dts/qcom/sdm845-oneplus-enchilada.dtb: service@4: dais: Unevaluated properties are not allowed ('qi2s@22', 'qi2s@23' were unexpected)
+```
+
+Fixes: b7b734286856 ("arm64: dts: qcom: sdm845-oneplus-*: add audio devices")
+Signed-off-by: David Heidelberg <david@ixit.cz>
+Reviewed-by: Luca Weiss <luca@z3ntu.xyz>
+Link: https://lore.kernel.org/r/20231229200245.259689-1-david@ixit.cz
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
+index e821103d49c0a..46e25c53829ad 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
+@@ -508,13 +508,13 @@ led-1 {
+ };
+ 
+ &q6afedai {
+-	qi2s@22 {
+-		reg = <22>;
++	dai@22 {
++		reg = <QUATERNARY_MI2S_RX>;
+ 		qcom,sd-lines = <1>;
+ 	};
+ 
+-	qi2s@23 {
+-		reg = <23>;
++	dai@23 {
++		reg = <QUATERNARY_MI2S_TX>;
+ 		qcom,sd-lines = <0>;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch b/queue-6.8/arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch
new file mode 100644
index 00000000000..68df97e3593
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch
@@ -0,0 +1,39 @@
+From ac17e35dd8f0bca2a41b372469fcec1440907114 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 15:15:11 +0100
+Subject: arm64: dts: qcom: sdm845: Use the Low Power Island CX/MX for SLPI
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 5dd227ccfb9568935bdaf82bc1893b36457dd4d3 ]
+
+The SLPI is powered by the Low Power Island power rails. Fix the incorrect
+assignment.
+
+Fixes: 74588aada59a ("arm64: dts: qcom: sdm845: add SLPI remoteproc")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231220-topic-sdm845_slpi_lcxmx-v1-1-db7c72ef99ae@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index 5ee98ff84d171..29349d715b2cc 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -3368,8 +3368,8 @@ slpi_pas: remoteproc@5c00000 {
+ 
+ 			qcom,qmp = <&aoss_qmp>;
+ 
+-			power-domains = <&rpmhpd SDM845_CX>,
+-					<&rpmhpd SDM845_MX>;
++			power-domains = <&rpmhpd SDM845_LCX>,
++					<&rpmhpd SDM845_LMX>;
+ 			power-domain-names = "lcx", "lmx";
+ 
+ 			memory-region = <&slpi_mem>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch b/queue-6.8/arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch
new file mode 100644
index 00000000000..21cd24f128c
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch
@@ -0,0 +1,51 @@
+From e3f64ad92f848b840a43dd8362c300a3d121d0c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:04:27 +0200
+Subject: arm64: dts: qcom: sm6115: declare VLS CLAMP register for USB3 PHY
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 95d739ed962c9aaa17d77b739606dbdf31879f6e ]
+
+The USB3 PHY on the SM6115 platform doesn't have built-in
+PCS_MISC_CLAMP_ENABLE register. Instead clamping is handled separately
+via the register in the TCSR space. Declare corresponding register.
+
+Fixes: 9dd5f6dba729 ("arm64: dts: qcom: sm6115: Add USB SS qmp phy node")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-6-a950c223f10f@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6115.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+index f9849b8befbf2..b627c473ffa54 100644
+--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+@@ -614,6 +614,11 @@ tcsr_mutex: hwlock@340000 {
+ 			#hwlock-cells = <1>;
+ 		};
+ 
++		tcsr_regs: syscon@3c0000 {
++			compatible = "qcom,sm6115-tcsr", "syscon";
++			reg = <0x0 0x003c0000 0x0 0x40000>;
++		};
++
+ 		tlmm: pinctrl@500000 {
+ 			compatible = "qcom,sm6115-tlmm";
+ 			reg = <0x0 0x00500000 0x0 0x400000>,
+@@ -879,6 +884,8 @@ usb_qmpphy: phy@1615000 {
+ 
+ 			#phy-cells = <0>;
+ 
++			qcom,tcsr-reg = <&tcsr_regs 0xb244>;
++
+ 			status = "disabled";
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm6115-drop-pipe-clock-selection.patch b/queue-6.8/arm64-dts-qcom-sm6115-drop-pipe-clock-selection.patch
new file mode 100644
index 00000000000..b390ab45229
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm6115-drop-pipe-clock-selection.patch
@@ -0,0 +1,57 @@
+From 6bfbc3b5a87ae3180325cab39b210be6be52a8d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 21:32:58 +0200
+Subject: arm64: dts: qcom: sm6115: drop pipe clock selection
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit 7e3a1f6470f7243c81156d2ead60f87da1184225 ]
+
+Stop selecting UTMI clock as the USB3 PIPE clock. This setting is
+incompatible with the USB host working in USB3 (SuperSpeed) mode.
+While we are at it, also drop the default setting for the port speed.
+
+Fixes: 9dd5f6dba729 ("arm64: dts: qcom: sm6115: Add USB SS qmp phy node")
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+[DB: fixed commit message, dropped dr_mode setting]
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Tested-by: Luca Weiss <luca.weiss@fairphone.com> # sdm632-fairphone-fp3
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240130-pmi632-typec-v3-5-b05fe44f0a51@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb4210-rb2.dts | 4 ----
+ arch/arm64/boot/dts/qcom/sm6115.dtsi     | 1 -
+ 2 files changed, 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
+index 7c19f874fa716..52f31f3166c2f 100644
+--- a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
++++ b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
+@@ -607,10 +607,6 @@ &usb {
+ 	status = "okay";
+ };
+ 
+-&usb_dwc3 {
+-	maximum-speed = "super-speed";
+-};
+-
+ &usb_hsphy {
+ 	vdd-supply = <&vreg_l4a_0p9>;
+ 	vdda-pll-supply = <&vreg_l12a_1p8>;
+diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+index 4808982659eda..27b4a7836e247 100644
+--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+@@ -1614,7 +1614,6 @@ &bimc SLAVE_EBI_CH0 RPM_ALWAYS_TAG>,
+ 			interconnect-names = "usb-ddr",
+ 					     "apps-usb";
+ 
+-			qcom,select-utmi-as-pipe-clk;
+ 			status = "disabled";
+ 
+ 			usb_dwc3: usb@4e00000 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..ac1df7ac172
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch
@@ -0,0 +1,47 @@
+From 9b3676bb66eaf5cf80bea43080add0b435aceb65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:31 +0530
+Subject: arm64: dts: qcom: sm6115: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit a820a285ef1b7c7fd94055bbb114c0413c04b96b ]
+
+QMP PHY used in SM6115 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPM
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+Fixes: 97e563bf5ba1 ("arm64: dts: qcom: sm6115: Add basic soc dtsi")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-8-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6115.dtsi | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6115.dtsi b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+index b627c473ffa54..4808982659eda 100644
+--- a/arch/arm64/boot/dts/qcom/sm6115.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6115.dtsi
+@@ -1201,8 +1201,12 @@ ufs_mem_phy: phy@4807000 {
+ 			compatible = "qcom,sm6115-qmp-ufs-phy";
+ 			reg = <0x0 0x04807000 0x0 0x1000>;
+ 
+-			clocks = <&gcc GCC_UFS_CLKREF_CLK>, <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
+-			clock-names = "ref", "ref_aux";
++			clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_CLKREF_CLK>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..c236ad23672
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch
@@ -0,0 +1,48 @@
+From 4a649dc5fa5c78a69eb53b0de015c49e647ab62e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:32 +0530
+Subject: arm64: dts: qcom: sm6125: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 3823a877f25baa152e34325818d5140990d6464f ]
+
+QMP PHY used in SM6125 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPM
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+Fixes: f8399e8a2f80 ("arm64: dts: qcom: sm6125: Add UFS nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-9-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6125.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+index 1dd3a4056e26f..e180f7c6e8c93 100644
+--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+@@ -812,10 +812,12 @@ ufs_mem_phy: phy@4807000 {
+ 			compatible = "qcom,sm6125-qmp-ufs-phy";
+ 			reg = <0x04807000 0xdb8>;
+ 
+-			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++			clocks = <&rpmcc RPM_SMD_XO_CLK_SRC>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_MEM_CLKREF_CLK>;
+ 			clock-names = "ref",
+-				      "ref_aux";
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..4e70feff822
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From 54908b940a4311f6e92adb053334998de5ec691d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:33 +0530
+Subject: arm64: dts: qcom: sm6350: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 68f9fcba3a0c015d649907805534fe66c9c60865 ]
+
+QMP PHY used in SM6350 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: 5a814af5fc22 ("arm64: dts: qcom: sm6350: Add UFS nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-10-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6350.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+index 43cffe8e1247e..7a2df6bcef7ec 100644
+--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+@@ -1189,10 +1189,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm6350-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_MEM_CLKREF_CLK>;
+ 			clock-names = "ref",
+-				      "ref_aux";
+-			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch b/queue-6.8/arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch
new file mode 100644
index 00000000000..3764285e2ac
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch
@@ -0,0 +1,40 @@
+From f58e2ea982e19d5ea34f65a25e2247cae1e93140 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 14:12:16 +0100
+Subject: arm64: dts: qcom: sm8150: correct PCIe wake-gpios
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 7c38989d0f7a35c83e7c4781271d42662903fa8d ]
+
+Bindings allow a "wake", not "enable", GPIO.  Schematics also use WAKE
+name for the pin:
+
+  sa8155p-adp.dtb: pcie@1c00000: Unevaluated properties are not allowed ('enable-gpio' was unexpected)
+
+Fixes: a1c86c680533 ("arm64: dts: qcom: sm8150: Add PCIe nodes")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240108131216.53867-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index d44b799b1c511..d7849a2eb5eb2 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -1879,7 +1879,7 @@ pcie0: pcie@1c00000 {
+ 			phy-names = "pciephy";
+ 
+ 			perst-gpios = <&tlmm 35 GPIO_ACTIVE_HIGH>;
+-			enable-gpio = <&tlmm 37 GPIO_ACTIVE_HIGH>;
++			wake-gpios = <&tlmm 37 GPIO_ACTIVE_HIGH>;
+ 
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&pcie0_default_state>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..3766c44af21
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From a681cf6c94a6c717a36f1367a6e1d39374156496 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:34 +0530
+Subject: arm64: dts: qcom: sm8150: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit eff7496b72810ca54da8c9c4542bf2aca479dd44 ]
+
+QMP PHY used in SM8150 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: 3834a2e92229 ("arm64: dts: qcom: sm8150: Add ufs nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-11-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index 761a6757dc26f..d44b799b1c511 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -2063,10 +2063,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm8150-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_MEM_CLKREF_CLK>;
+ 			clock-names = "ref",
+-				      "ref_aux";
+-			clocks = <&gcc GCC_UFS_MEM_CLKREF_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				      "ref_aux",
++				      "qref";
+ 
+ 			power-domains = <&gcc UFS_PHY_GDSC>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..7b3ab710929
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From 5a15a5c0b16dfecd9d6026379146826e57cfd100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:35 +0530
+Subject: arm64: dts: qcom: sm8250: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 55ee02b10bdd9577b6eabe98ebb383ec4e0674a7 ]
+
+QMP PHY used in SM8250 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: b7e2fba06622 ("arm64: dts: qcom: sm8250: Add UFS controller and PHY")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-12-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index 760501c1301a6..5e4265b2d80bd 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -2506,10 +2506,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm8250-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
+-			clock-names = "ref",
+-				      "ref_aux";
+ 			clocks = <&rpmhcc RPMH_CXO_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_1X_CLKREF_EN>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..bc4c2f0a0c8
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch
@@ -0,0 +1,51 @@
+From 5e53494e4e751873918d75dfa190fb348fee0d3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:38 +0530
+Subject: arm64: dts: qcom: sm8350: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 8edbdefee1c9eb24690d5794556af08f00ecc576 ]
+
+QMP PHY used in SM8350 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from GCC
+
+While at it, let's move 'clocks' property before 'clock-names' to match
+the style used commonly.
+
+Fixes: 59c7cf814783 ("arm64: dts: qcom: sm8350: Add UFS nodes")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-15-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index e78c83a897c28..ab233d6843931 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -1726,10 +1726,12 @@ ufs_mem_phy: phy@1d87000 {
+ 			compatible = "qcom,sm8350-qmp-ufs-phy";
+ 			reg = <0 0x01d87000 0 0x1000>;
+ 
+-			clock-names = "ref",
+-				      "ref_aux";
+ 			clocks = <&rpmhcc RPMH_CXO_CLK>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&gcc GCC_UFS_1_CLKREF_EN>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch b/queue-6.8/arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch
new file mode 100644
index 00000000000..ead30137cd3
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch
@@ -0,0 +1,59 @@
+From 7bd278a77418cd8fbe028c3d237eb8c8a1333220 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 13:25:44 +0100
+Subject: arm64: dts: qcom: sm8450: Add missing interconnects to serial
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 6e115b75b43bd12d4061e53c8ff175e387783d8a ]
+
+The serial ports did not have their interconnect paths specified when
+they were first introduced. Fix that.
+
+Fixes: 5188049c9b36 ("arm64: dts: qcom: Add base SM8450 DTSI")
+Fixes: f5837418479a ("arm64: dts: qcom: sm8450: add uart20 node")
+Reported-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Suggested-by: Georgi Djakov <djakov@kernel.org>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Tested-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240116-topic-8450serial-v1-1-b685e6a5ad78@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+index 01e4dfc4babd2..06f183ef8c78f 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+@@ -1028,6 +1028,12 @@ uart20: serial@894000 {
+ 				pinctrl-names = "default";
+ 				pinctrl-0 = <&qup_uart20_default>;
+ 				interrupts = <GIC_SPI 587 IRQ_TYPE_LEVEL_HIGH>;
++				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
++						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
++						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
++						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
++				interconnect-names = "qup-core",
++						     "qup-config";
+ 				status = "disabled";
+ 			};
+ 
+@@ -1420,6 +1426,12 @@ uart7: serial@99c000 {
+ 				pinctrl-names = "default";
+ 				pinctrl-0 = <&qup_uart7_tx>, <&qup_uart7_rx>;
+ 				interrupts = <GIC_SPI 608 IRQ_TYPE_LEVEL_HIGH>;
++				interconnects = <&clk_virt MASTER_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS
++						 &clk_virt SLAVE_QUP_CORE_2 QCOM_ICC_TAG_ALWAYS>,
++						<&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ALWAYS
++						 &config_noc SLAVE_QUP_2 QCOM_ICC_TAG_ALWAYS>;
++				interconnect-names = "qup-core",
++						     "qup-config";
+ 				status = "disabled";
+ 			};
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch b/queue-6.8/arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch
new file mode 100644
index 00000000000..5abb0728917
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch
@@ -0,0 +1,44 @@
+From 289d47dbd1f747a9814b237b1affc3192426d38e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 15:04:25 +0200
+Subject: arm64: dts: qcom: sm8550: Fix SPMI channels size
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 77dd1e50ffcba33c3195ae4fc78f354368ddacb2 ]
+
+The actual size of the channels registers region is 4MB, according to the
+documentation. This issue was not caught until now because the driver was
+supposed to allow same regions being mapped multiple times for supporting
+multiple buses. Thie driver is using platform_get_resource_byname() and
+devm_ioremap() towards that purpose, which intentionally avoids
+devm_request_mem_region() altogether.
+
+Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8550-QRD
+Link: https://lore.kernel.org/r/20240221-dts-qcom-sm8550-fix-spmi-chnls-size-v2-1-72b5efd9dc4f@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index 72b1b8caafaa7..d3170b86ba1e8 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -3251,7 +3251,7 @@ sram@c3f0000 {
+ 		spmi_bus: spmi@c400000 {
+ 			compatible = "qcom,spmi-pmic-arb";
+ 			reg = <0 0x0c400000 0 0x3000>,
+-			      <0 0x0c500000 0 0x4000000>,
++			      <0 0x0c500000 0 0x400000>,
+ 			      <0 0x0c440000 0 0x80000>,
+ 			      <0 0x0c4c0000 0 0x20000>,
+ 			      <0 0x0c42d000 0 0x4000>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..17bc197fc5a
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch
@@ -0,0 +1,49 @@
+From d35f8901acab8f3774c9d34f7c81d01e38b8ae16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:39 +0530
+Subject: arm64: dts: qcom: sm8550: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 746ae23ad02004fe283e2edb45b7a060bbc36d46 ]
+
+QMP PHY used in SM8550 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from TCSR
+
+Fixes: 35cf1aaab169 ("arm64: dts: qcom: sm8550: Add UFS host controller and phy nodes")
+Reviewed-by: Can Guo <quic_cang@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-16-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index ee1ba5a8c8fc2..72b1b8caafaa7 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -1907,9 +1907,12 @@ crypto: crypto@1dfa000 {
+ 		ufs_mem_phy: phy@1d80000 {
+ 			compatible = "qcom,sm8550-qmp-ufs-phy";
+ 			reg = <0x0 0x01d80000 0x0 0x2000>;
+-			clocks = <&tcsr TCSR_UFS_CLKREF_EN>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
+-			clock-names = "ref", "ref_aux";
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&tcsr TCSR_UFS_CLKREF_EN>;
++			clock-names = "ref",
++				      "ref_aux",
++				      "qref";
+ 
+ 			power-domains = <&gcc UFS_MEM_PHY_GDSC>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8650-fix-spmi-channels-size.patch b/queue-6.8/arm64-dts-qcom-sm8650-fix-spmi-channels-size.patch
new file mode 100644
index 00000000000..e0247aa5614
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8650-fix-spmi-channels-size.patch
@@ -0,0 +1,44 @@
+From 6384a900a28056f5531b681ccb965711e212e2f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 15:04:26 +0200
+Subject: arm64: dts: qcom: sm8650: Fix SPMI channels size
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit a4f82b8045e3c7913266aa6ea1ee15752a062abd ]
+
+The actual size of the channels registers region is 4MB, according to the
+documentation. This issue was not caught until now because the driver was
+supposed to allow same regions being mapped multiple times for supporting
+multiple buses. Thie driver is using platform_get_resource_byname() and
+devm_ioremap() towards that purpose, which intentionally avoids
+devm_request_mem_region() altogether.
+
+Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on SM8650-QRD
+Link: https://lore.kernel.org/r/20240221-dts-qcom-sm8550-fix-spmi-chnls-size-v2-2-72b5efd9dc4f@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8650.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8650.dtsi b/arch/arm64/boot/dts/qcom/sm8650.dtsi
+index bad0eb84549fe..0e4bd83b2c68a 100644
+--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
+@@ -3705,7 +3705,7 @@ sram@c3f0000 {
+ 		spmi_bus: spmi@c400000 {
+ 			compatible = "qcom,spmi-pmic-arb";
+ 			reg = <0 0x0c400000 0 0x3000>,
+-			      <0 0x0c500000 0 0x4000000>,
++			      <0 0x0c500000 0 0x400000>,
+ 			      <0 0x0c440000 0 0x80000>,
+ 			      <0 0x0c4c0000 0 0x20000>,
+ 			      <0 0x0c42d000 0 0x4000>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-sm8650-fix-ufs-phy-clocks.patch b/queue-6.8/arm64-dts-qcom-sm8650-fix-ufs-phy-clocks.patch
new file mode 100644
index 00000000000..afbd49d86c0
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-sm8650-fix-ufs-phy-clocks.patch
@@ -0,0 +1,48 @@
+From 2893a7c558facbaa91a9463c848cb6749fd23e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:37:40 +0530
+Subject: arm64: dts: qcom: sm8650: Fix UFS PHY clocks
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 0f9b8054bb4abd7b4686cc66b85f71fec9160136 ]
+
+QMP PHY used in SM8650 requires 3 clocks:
+
+* ref - 19.2MHz reference clock from RPMh
+* ref_aux - Auxiliary reference clock from GCC
+* qref - QREF clock from TCSR
+
+Fixes: 10e024671295 ("arm64: dts: qcom: sm8650: add interconnect dependent device nodes")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240131-ufs-phy-clock-v3-17-58a49d2f4605@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8650.dtsi | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8650.dtsi b/arch/arm64/boot/dts/qcom/sm8650.dtsi
+index 2df77123a8c7b..bad0eb84549fe 100644
+--- a/arch/arm64/boot/dts/qcom/sm8650.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8650.dtsi
+@@ -2448,10 +2448,12 @@ ufs_mem_phy: phy@1d80000 {
+ 			compatible = "qcom,sm8650-qmp-ufs-phy";
+ 			reg = <0 0x01d80000 0 0x2000>;
+ 
+-			clocks = <&tcsr TCSR_UFS_CLKREF_EN>,
+-				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>;
++			clocks = <&rpmhcc RPMH_CXO_CLK>,
++				 <&gcc GCC_UFS_PHY_PHY_AUX_CLK>,
++				 <&tcsr TCSR_UFS_CLKREF_EN>;
+ 			clock-names = "ref",
+-				      "ref_aux";
++				      "ref_aux",
++				      "qref";
+ 
+ 			resets = <&ufs_mem_hc 0>;
+ 			reset-names = "ufsphy";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-x1e80100-drop-qcom-drv-count.patch b/queue-6.8/arm64-dts-qcom-x1e80100-drop-qcom-drv-count.patch
new file mode 100644
index 00000000000..8e96be28071
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-x1e80100-drop-qcom-drv-count.patch
@@ -0,0 +1,37 @@
+From 39f2c26deaeb8bc6202625dc4c4075714ea7a0da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 15:50:50 +0100
+Subject: arm64: dts: qcom: x1e80100: drop qcom,drv-count
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit e81e86765f957f3c5d48df9e275c527bd8c14156 ]
+
+Property qcom,drv-count in the RSC node is not allowed and not used:
+
+  x1e80100-crd.dtb: rsc@17500000: 'qcom,drv-count' does not match any of the regexes: '^regulators(-[0-9])?$', 'pinctrl-[0-9]+'
+
+Fixes: af16b00578a7 ("arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20231218145050.66394-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/x1e80100.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/x1e80100.dtsi b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+index 6f75fc342ceb3..be1285d9919e0 100644
+--- a/arch/arm64/boot/dts/qcom/x1e80100.dtsi
++++ b/arch/arm64/boot/dts/qcom/x1e80100.dtsi
+@@ -3315,7 +3315,6 @@ apps_rsc: rsc@17500000 {
+ 			      <0 0x17510000 0 0x10000>,
+ 			      <0 0x17520000 0 0x10000>;
+ 			reg-names = "drv-0", "drv-1", "drv-2";
+-			qcom,drv-count = <3>;
+ 
+ 			interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-qcom-x1e80100-qcp-fix-supplies-for-ldos-3e.patch b/queue-6.8/arm64-dts-qcom-x1e80100-qcp-fix-supplies-for-ldos-3e.patch
new file mode 100644
index 00000000000..a01b3ecd347
--- /dev/null
+++ b/queue-6.8/arm64-dts-qcom-x1e80100-qcp-fix-supplies-for-ldos-3e.patch
@@ -0,0 +1,46 @@
+From a63f8e2677eab481c08f510876b1763acc9071dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 14:45:43 +0200
+Subject: arm64: dts: qcom: x1e80100-qcp: Fix supplies for LDOs 3E and 2J
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 7eac281cbedbd71d777eabca3a52d97983c61692 ]
+
+The LDOs 3E and 2J are actually supplied by SMPS 5J. Fix accordingly.
+
+Fixes: af16b00578a7 ("arm64: dts: qcom: Add base X1E80100 dtsi and the QCP dts")
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20240129-x1e80100-dts-missing-nodes-v6-11-2c0e691cfa3b@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/x1e80100-qcp.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts b/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
+index a37ad9475c90d..3112487d2a168 100644
+--- a/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
++++ b/arch/arm64/boot/dts/qcom/x1e80100-qcp.dts
+@@ -243,7 +243,7 @@ regulators-3 {
+ 		qcom,pmic-id = "e";
+ 
+ 		vdd-l2-supply = <&vreg_s1f_0p7>;
+-		vdd-l3-supply = <&vph_pwr>;
++		vdd-l3-supply = <&vreg_s5j_1p2>;
+ 
+ 		vreg_l2e_0p8: ldo2 {
+ 			regulator-name = "vreg_l2e_0p8";
+@@ -349,7 +349,7 @@ regulators-7 {
+ 		qcom,pmic-id = "j";
+ 
+ 		vdd-l1-supply = <&vreg_s1f_0p7>;
+-		vdd-l2-supply = <&vph_pwr>;
++		vdd-l2-supply = <&vreg_s5j_1p2>;
+ 		vdd-l3-supply = <&vreg_s1f_0p7>;
+ 		vdd-s5-supply = <&vph_pwr>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch b/queue-6.8/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
new file mode 100644
index 00000000000..41ca93dae25
--- /dev/null
+++ b/queue-6.8/arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
@@ -0,0 +1,48 @@
+From 6b33a2cc113d9e39e2d6840d05caf65bd05845a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 15:21:30 +0100
+Subject: arm64: dts: renesas: r8a779a0: Correct avb[01] reg sizes
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0c51912331f8ba5ce5fb52f46e340945160672a3 ]
+
+All Ethernet AVB instances on R-Car V3U have registers related to UDP/IP
+support, but the declared register blocks for the first two instances
+are too small to cover them.
+
+Fix this by extending the register block sizes.
+
+Fixes: 5a633320f08b8c9b ("arm64: dts: renesas: r8a779a0: Add Ethernet-AVB support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/ce6ce3c4b1495e02e7c1803fca810a7178a84500.1707660323.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779a0.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+index 4e67a03564971..504ac8c93faf5 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779a0.dtsi
+@@ -658,7 +658,7 @@ channel7 {
+ 		avb0: ethernet@e6800000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+ 				     "renesas,etheravb-rcar-gen4";
+-			reg = <0 0xe6800000 0 0x800>;
++			reg = <0 0xe6800000 0 0x1000>;
+ 			interrupts = <GIC_SPI 256 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 257 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 258 IRQ_TYPE_LEVEL_HIGH>,
+@@ -706,7 +706,7 @@ avb0: ethernet@e6800000 {
+ 		avb1: ethernet@e6810000 {
+ 			compatible = "renesas,etheravb-r8a779a0",
+ 				     "renesas,etheravb-rcar-gen4";
+-			reg = <0 0xe6810000 0 0x800>;
++			reg = <0 0xe6810000 0 0x1000>;
+ 			interrupts = <GIC_SPI 281 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 282 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 283 IRQ_TYPE_LEVEL_HIGH>,
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch b/queue-6.8/arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch
new file mode 100644
index 00000000000..ef3bcb4a41c
--- /dev/null
+++ b/queue-6.8/arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch
@@ -0,0 +1,67 @@
+From a29837c8fc31f71be74c37ef576ad8478ee9cda2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 17:32:37 +0100
+Subject: arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 08e799f6bce80dd63c174d8d0fc61d1a6149960b ]
+
+R-Car V4H actually has two SCIF_CLK pins.
+The second pin provides the SCIF_CLK signal for HSCIF2 and SCIF4.
+
+Fixes: a4c31c56d2d35641 ("arm64: dts: renesas: r8a779g0: Add SCIF nodes")
+Fixes: 39d9dfc6fbe1860e ("arm64: dts: renesas: r8a779g0: Add remaining HSCIF nodes")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/72f20c1bf32187bd30a963cafe27252907d661f9.1705589612.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
+index 3be1159982b20..0c83940b3d8a1 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
+@@ -185,13 +185,19 @@ psci {
+ 		method = "smc";
+ 	};
+ 
+-	/* External SCIF clock - to be overridden by boards that provide it */
++	/* External SCIF clocks - to be overridden by boards that provide them */
+ 	scif_clk: scif {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
+ 		clock-frequency = <0>;
+ 	};
+ 
++	scif_clk2: scif2 {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <0>;
++	};
++
+ 	soc: soc {
+ 		compatible = "simple-bus";
+ 		interrupt-parent = <&gic>;
+@@ -681,7 +687,7 @@ hscif2: serial@e6560000 {
+ 			interrupts = <GIC_SPI 248 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 516>,
+ 				 <&cpg CPG_CORE R8A779G0_CLK_SASYNCPERD1>,
+-				 <&scif_clk>;
++				 <&scif_clk2>;
+ 			clock-names = "fck", "brg_int", "scif_clk";
+ 			dmas = <&dmac0 0x35>, <&dmac0 0x34>,
+ 			       <&dmac1 0x35>, <&dmac1 0x34>;
+@@ -1057,7 +1063,7 @@ scif4: serial@e6c40000 {
+ 			interrupts = <GIC_SPI 254 IRQ_TYPE_LEVEL_HIGH>;
+ 			clocks = <&cpg CPG_MOD 705>,
+ 				 <&cpg CPG_CORE R8A779G0_CLK_SASYNCPERD1>,
+-				 <&scif_clk>;
++				 <&scif_clk2>;
+ 			clock-names = "fck", "brg_int", "scif_clk";
+ 			dmas = <&dmac0 0x59>, <&dmac0 0x58>,
+ 			       <&dmac1 0x59>, <&dmac1 0x58>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch b/queue-6.8/arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch
new file mode 100644
index 00000000000..f42d1d45cfd
--- /dev/null
+++ b/queue-6.8/arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch
@@ -0,0 +1,48 @@
+From 0b6ba561348b296e36ddcae13635a57850907390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 15:21:31 +0100
+Subject: arm64: dts: renesas: r8a779g0: Correct avb[01] reg sizes
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7edbb5880dc3317a5eaec2166de71ff394598e6b ]
+
+All Ethernet AVB instances on R-Car V4H have registers related to UDP/IP
+support, but the declared register blocks for the first two instances
+are too small to cover them.
+
+Fix this by extending the register block sizes.
+
+Fixes: 848c82db56923a8b ("arm64: dts: renesas: r8a779g0: Add RAVB nodes")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/83437778614a7c96f4d8f1be98dffeee29bb4a0b.1707660323.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
+index 0c83940b3d8a1..d7677595204dc 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
+@@ -767,7 +767,7 @@ channel7 {
+ 		avb0: ethernet@e6800000 {
+ 			compatible = "renesas,etheravb-r8a779g0",
+ 				     "renesas,etheravb-rcar-gen4";
+-			reg = <0 0xe6800000 0 0x800>;
++			reg = <0 0xe6800000 0 0x1000>;
+ 			interrupts = <GIC_SPI 335 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 336 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 337 IRQ_TYPE_LEVEL_HIGH>,
+@@ -814,7 +814,7 @@ avb0: ethernet@e6800000 {
+ 		avb1: ethernet@e6810000 {
+ 			compatible = "renesas,etheravb-r8a779g0",
+ 				     "renesas,etheravb-rcar-gen4";
+-			reg = <0 0xe6810000 0 0x800>;
++			reg = <0 0xe6810000 0 0x1000>;
+ 			interrupts = <GIC_SPI 360 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 362 IRQ_TYPE_LEVEL_HIGH>,
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-renesas-r8a779g0-restore-sort-order.patch b/queue-6.8/arm64-dts-renesas-r8a779g0-restore-sort-order.patch
new file mode 100644
index 00000000000..c7397b5239b
--- /dev/null
+++ b/queue-6.8/arm64-dts-renesas-r8a779g0-restore-sort-order.patch
@@ -0,0 +1,126 @@
+From a3bc20eff0e18fc980399b9c21825fdfbbd06c7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 14:33:18 +0100
+Subject: arm64: dts: renesas: r8a779g0: Restore sort order
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 8b93657c976a61726d7ffbe8d019b84b4abfb673 ]
+
+Numerical by unit address, alphabetical by node name.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/f00ef274a73c8fd60f940a1649423a8927b9ae8a.1705324708.git.geert+renesas@glider.be
+Stable-dep-of: 08e799f6bce8 ("arm64: dts: renesas: r8a779g0: Add missing SCIF_CLK2")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g0.dtsi | 72 +++++++++++------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
+index d3d25e077c5d5..3be1159982b20 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779g0.dtsi
+@@ -161,11 +161,6 @@ L3_CA76_1: cache-controller-1 {
+ 		};
+ 	};
+ 
+-	psci {
+-		compatible = "arm,psci-1.0", "arm,psci-0.2";
+-		method = "smc";
+-	};
+-
+ 	extal_clk: extal {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
+@@ -185,6 +180,11 @@ pmu_a76 {
+ 		interrupts-extended = <&gic GIC_PPI 7 IRQ_TYPE_LEVEL_LOW>;
+ 	};
+ 
++	psci {
++		compatible = "arm,psci-1.0", "arm,psci-0.2";
++		method = "smc";
++	};
++
+ 	/* External SCIF clock - to be overridden by boards that provide it */
+ 	scif_clk: scif {
+ 		compatible = "fixed-clock";
+@@ -1777,6 +1777,37 @@ ssi0: ssi-0 {
+ 			};
+ 		};
+ 
++		mmc0: mmc@ee140000 {
++			compatible = "renesas,sdhi-r8a779g0",
++				     "renesas,rcar-gen4-sdhi";
++			reg = <0 0xee140000 0 0x2000>;
++			interrupts = <GIC_SPI 440 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&cpg CPG_MOD 706>,
++				 <&cpg CPG_CORE R8A779G0_CLK_SD0H>;
++			clock-names = "core", "clkh";
++			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
++			resets = <&cpg 706>;
++			max-frequency = <200000000>;
++			iommus = <&ipmmu_ds0 32>;
++			status = "disabled";
++		};
++
++		rpc: spi@ee200000 {
++			compatible = "renesas,r8a779g0-rpc-if",
++				     "renesas,rcar-gen4-rpc-if";
++			reg = <0 0xee200000 0 0x200>,
++			      <0 0x08000000 0 0x04000000>,
++			      <0 0xee208000 0 0x100>;
++			reg-names = "regs", "dirmap", "wbuf";
++			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
++			clocks = <&cpg CPG_MOD 629>;
++			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
++			resets = <&cpg 629>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "disabled";
++		};
++
+ 		ipmmu_rt0: iommu@ee480000 {
+ 			compatible = "renesas,ipmmu-r8a779g0",
+ 				     "renesas,rcar-gen4-ipmmu-vmsa";
+@@ -1886,37 +1917,6 @@ ipmmu_mm: iommu@eefc0000 {
+ 			#iommu-cells = <1>;
+ 		};
+ 
+-		mmc0: mmc@ee140000 {
+-			compatible = "renesas,sdhi-r8a779g0",
+-				     "renesas,rcar-gen4-sdhi";
+-			reg = <0 0xee140000 0 0x2000>;
+-			interrupts = <GIC_SPI 440 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&cpg CPG_MOD 706>,
+-				 <&cpg CPG_CORE R8A779G0_CLK_SD0H>;
+-			clock-names = "core", "clkh";
+-			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
+-			resets = <&cpg 706>;
+-			max-frequency = <200000000>;
+-			iommus = <&ipmmu_ds0 32>;
+-			status = "disabled";
+-		};
+-
+-		rpc: spi@ee200000 {
+-			compatible = "renesas,r8a779g0-rpc-if",
+-				     "renesas,rcar-gen4-rpc-if";
+-			reg = <0 0xee200000 0 0x200>,
+-			      <0 0x08000000 0 0x04000000>,
+-			      <0 0xee208000 0 0x100>;
+-			reg-names = "regs", "dirmap", "wbuf";
+-			interrupts = <GIC_SPI 225 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&cpg CPG_MOD 629>;
+-			power-domains = <&sysc R8A779G0_PD_ALWAYS_ON>;
+-			resets = <&cpg 629>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			status = "disabled";
+-		};
+-
+ 		gic: interrupt-controller@f1000000 {
+ 			compatible = "arm,gic-v3";
+ 			#interrupt-cells = <3>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-renesas-r9a08g045-add-missing-interrupts-t.patch b/queue-6.8/arm64-dts-renesas-r9a08g045-add-missing-interrupts-t.patch
new file mode 100644
index 00000000000..a9878466e3f
--- /dev/null
+++ b/queue-6.8/arm64-dts-renesas-r9a08g045-add-missing-interrupts-t.patch
@@ -0,0 +1,52 @@
+From 957750256e449fa72120591cc34a37a06b48b17c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Feb 2024 14:44:21 +0000
+Subject: arm64: dts: renesas: r9a08g045: Add missing interrupts to IRQC node
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit bf7e37716d995c54630c30540db5642f58ea037a ]
+
+The IRQC block on the RZ/G3S (R9A08G045) SoC supports ECCRAM error
+interrupts too.  Add those missing interrupts to the IRQC node.
+
+Fixes: 837918aa3fdd ("arm64: dts: renesas: r9a08g045: Add IA55 interrupt controller node")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240205144421.51195-4-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a08g045.dtsi | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a08g045.dtsi b/arch/arm64/boot/dts/renesas/r9a08g045.dtsi
+index 5facfad961583..6315ffa6c1bb9 100644
+--- a/arch/arm64/boot/dts/renesas/r9a08g045.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a08g045.dtsi
+@@ -152,7 +152,10 @@ irqc: interrupt-controller@11050000 {
+ 				     <GIC_SPI 458 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 459 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 460 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>;
++				     <GIC_SPI 29 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 32 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 33 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "nmi",
+ 					  "irq0", "irq1", "irq2", "irq3",
+ 					  "irq4", "irq5", "irq6", "irq7",
+@@ -164,7 +167,8 @@ irqc: interrupt-controller@11050000 {
+ 					  "tint20", "tint21", "tint22", "tint23",
+ 					  "tint24", "tint25", "tint26", "tint27",
+ 					  "tint28", "tint29", "tint30", "tint31",
+-					  "bus-err";
++					  "bus-err", "ec7tie1-0", "ec7tie2-0",
++					  "ec7tiovf-0";
+ 			clocks = <&cpg CPG_MOD R9A08G045_IA55_CLK>,
+ 				 <&cpg CPG_MOD R9A08G045_IA55_PCLK>;
+ 			clock-names = "clk", "pclk";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch b/queue-6.8/arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch
new file mode 100644
index 00000000000..a805292d730
--- /dev/null
+++ b/queue-6.8/arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch
@@ -0,0 +1,131 @@
+From e26183dcd1244d4f3f0de587a47d7c448e3924c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Feb 2024 14:44:20 +0000
+Subject: arm64: dts: renesas: rzg2l: Add missing interrupts to IRQC nodes
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 14fe225dd5fcd5928583b0bcc34398a581f51602 ]
+
+The IRQC IP block supports Bus error and ECCRAM interrupts on RZ/G2L and
+alike SoC's (listed below).  Update the IRQC nodes with the missing
+interrupts, and additionally, include the 'interrupt-names' properties
+in the IRQC nodes so that the driver can parse interrupts by name.
+
+  - R9A07G043U              - RZ/G2UL
+  - R9A07G044L/R9A07G044LC  - RZ/{G2L,G2LC}
+  - R9A07G054               - RZ/V2L
+
+Fixes: 5edc51af5b30 ("arm64: dts: renesas: r9a07g044: Add IRQC node")
+Fixes: 48ab6eddd8bb ("arm64: dts: renesas: r9a07g043u: Add IRQC node")
+Fixes: 379478ab09e0 ("arm64: dts: renesas: r9a07g054: Add IRQC node")
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240205144421.51195-3-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r9a07g043u.dtsi | 12 +++++++++--
+ arch/arm64/boot/dts/renesas/r9a07g044.dtsi  | 22 ++++++++++++++++++++-
+ arch/arm64/boot/dts/renesas/r9a07g054.dtsi  | 22 ++++++++++++++++++++-
+ 3 files changed, 52 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
+index 2ab231572d95f..b3f83d0ebcbb5 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g043u.dtsi
+@@ -109,7 +109,13 @@ irqc: interrupt-controller@110a0000 {
+ 			     <SOC_PERIPHERAL_IRQ(473) IRQ_TYPE_LEVEL_HIGH>,
+ 			     <SOC_PERIPHERAL_IRQ(474) IRQ_TYPE_LEVEL_HIGH>,
+ 			     <SOC_PERIPHERAL_IRQ(475) IRQ_TYPE_LEVEL_HIGH>,
+-			     <SOC_PERIPHERAL_IRQ(25) IRQ_TYPE_EDGE_RISING>;
++			     <SOC_PERIPHERAL_IRQ(25) IRQ_TYPE_EDGE_RISING>,
++			     <SOC_PERIPHERAL_IRQ(34) IRQ_TYPE_EDGE_RISING>,
++			     <SOC_PERIPHERAL_IRQ(35) IRQ_TYPE_EDGE_RISING>,
++			     <SOC_PERIPHERAL_IRQ(36) IRQ_TYPE_EDGE_RISING>,
++			     <SOC_PERIPHERAL_IRQ(37) IRQ_TYPE_EDGE_RISING>,
++			     <SOC_PERIPHERAL_IRQ(38) IRQ_TYPE_EDGE_RISING>,
++			     <SOC_PERIPHERAL_IRQ(39) IRQ_TYPE_EDGE_RISING>;
+ 		interrupt-names = "nmi",
+ 				  "irq0", "irq1", "irq2", "irq3",
+ 				  "irq4", "irq5", "irq6", "irq7",
+@@ -121,7 +127,9 @@ irqc: interrupt-controller@110a0000 {
+ 				  "tint20", "tint21", "tint22", "tint23",
+ 				  "tint24", "tint25", "tint26", "tint27",
+ 				  "tint28", "tint29", "tint30", "tint31",
+-				  "bus-err";
++				  "bus-err", "ec7tie1-0", "ec7tie2-0",
++				  "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1",
++				  "ec7tiovf-1";
+ 		clocks = <&cpg CPG_MOD R9A07G043_IA55_CLK>,
+ 			<&cpg CPG_MOD R9A07G043_IA55_PCLK>;
+ 		clock-names = "clk", "pclk";
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
+index 66f68fc2b2411..081d8f49db879 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g044.dtsi
+@@ -905,7 +905,27 @@ irqc: interrupt-controller@110a0000 {
+ 				     <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 474 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>;
++				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 25 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 34 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 37 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 38 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 39 IRQ_TYPE_EDGE_RISING>;
++			interrupt-names = "nmi", "irq0", "irq1", "irq2", "irq3",
++					  "irq4", "irq5", "irq6", "irq7",
++					  "tint0", "tint1", "tint2", "tint3",
++					  "tint4", "tint5", "tint6", "tint7",
++					  "tint8", "tint9", "tint10", "tint11",
++					  "tint12", "tint13", "tint14", "tint15",
++					  "tint16", "tint17", "tint18", "tint19",
++					  "tint20", "tint21", "tint22", "tint23",
++					  "tint24", "tint25", "tint26", "tint27",
++					  "tint28", "tint29", "tint30", "tint31",
++					  "bus-err", "ec7tie1-0", "ec7tie2-0",
++					  "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1",
++					  "ec7tiovf-1";
+ 			clocks = <&cpg CPG_MOD R9A07G044_IA55_CLK>,
+ 				 <&cpg CPG_MOD R9A07G044_IA55_PCLK>;
+ 			clock-names = "clk", "pclk";
+diff --git a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
+index 1f1d481dc7830..0d327464d2baf 100644
+--- a/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
++++ b/arch/arm64/boot/dts/renesas/r9a07g054.dtsi
+@@ -912,7 +912,27 @@ irqc: interrupt-controller@110a0000 {
+ 				     <GIC_SPI 472 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 473 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 474 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>;
++				     <GIC_SPI 475 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 25 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 34 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 35 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 36 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 37 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 38 IRQ_TYPE_EDGE_RISING>,
++				     <GIC_SPI 39 IRQ_TYPE_EDGE_RISING>;
++			interrupt-names = "nmi", "irq0", "irq1", "irq2", "irq3",
++					  "irq4", "irq5", "irq6", "irq7",
++					  "tint0", "tint1", "tint2", "tint3",
++					  "tint4", "tint5", "tint6", "tint7",
++					  "tint8", "tint9", "tint10", "tint11",
++					  "tint12", "tint13", "tint14", "tint15",
++					  "tint16", "tint17", "tint18", "tint19",
++					  "tint20", "tint21", "tint22", "tint23",
++					  "tint24", "tint25", "tint26", "tint27",
++					  "tint28", "tint29", "tint30", "tint31",
++					  "bus-err", "ec7tie1-0", "ec7tie2-0",
++					  "ec7tiovf-0", "ec7tie1-1", "ec7tie2-1",
++					  "ec7tiovf-1";
+ 			clocks = <&cpg CPG_MOD R9A07G054_IA55_CLK>,
+ 				 <&cpg CPG_MOD R9A07G054_IA55_PCLK>;
+ 			clock-names = "clk", "pclk";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-renesas-rzg3s-smarc-som-guard-ethernet-irq.patch b/queue-6.8/arm64-dts-renesas-rzg3s-smarc-som-guard-ethernet-irq.patch
new file mode 100644
index 00000000000..7f685ddb78a
--- /dev/null
+++ b/queue-6.8/arm64-dts-renesas-rzg3s-smarc-som-guard-ethernet-irq.patch
@@ -0,0 +1,64 @@
+From 3ea56c36d81b8dbcb37e9b85d44397528c23ad4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 14:42:55 +0200
+Subject: arm64: dts: renesas: rzg3s-smarc-som: Guard Ethernet IRQ GPIO hogs
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 150d81f7a260f36c118cbec253fdd493c671dc29 ]
+
+Ethernet IRQ GPIOs are marked as GPIO hogs.  Thus, these GPIOs are
+requested at probe time without considering if there are other
+peripherals that need them.  The Ethernet IRQ GPIOs are shared with
+SDHI2.  Selection between Ethernet and SDHI2 is done through a hardware
+switch.  To avoid scenarios where one wants to boot with SDHI2 support
+and some SDHI pins are not propertly configured because of the GPIO
+hogs, guard the Ethernet IRQ GPIO hogs with the proper build flag.
+
+Fixes: 932ff0c802c6 ("arm64: dts: renesas: rzg3s-smarc-som: Enable the Ethernet interfaces")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240208124300.2740313-13-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi b/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi
+index f062d4ad78b79..d33ab4c887878 100644
+--- a/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi
++++ b/arch/arm64/boot/dts/renesas/rzg3s-smarc-som.dtsi
+@@ -193,12 +193,14 @@ &sdhi2 {
+ #endif
+ 
+ &pinctrl {
++#if SW_CONFIG3 == SW_ON
+ 	eth0-phy-irq-hog {
+ 		gpio-hog;
+ 		gpios = <RZG2L_GPIO(12, 0) GPIO_ACTIVE_LOW>;
+ 		input;
+ 		line-name = "eth0-phy-irq";
+ 	};
++#endif
+ 
+ 	eth0_pins: eth0 {
+ 		txc {
+@@ -234,12 +236,14 @@ mux {
+ 		};
+ 	};
+ 
++#if SW_CONFIG3 == SW_ON
+ 	eth1-phy-irq-hog {
+ 		gpio-hog;
+ 		gpios = <RZG2L_GPIO(12, 1) GPIO_ACTIVE_LOW>;
+ 		input;
+ 		line-name = "eth1-phy-irq";
+ 	};
++#endif
+ 
+ 	eth1_pins: eth1 {
+ 		txc {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch b/queue-6.8/arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch
new file mode 100644
index 00000000000..c5104f2630f
--- /dev/null
+++ b/queue-6.8/arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch
@@ -0,0 +1,40 @@
+From 478f2cd21db76429cfb3130c410a50c9a07a3e39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 18:35:25 +0100
+Subject: arm64: dts: rockchip: add missing interrupt-names for rk356x vdpu
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit d1c44d9afa6f89aa0e10a191f30868eb12cd719f ]
+
+The video-codec@fdea0400 was missing the interrupt-names property that is
+part of the binding. Add it.
+
+Fixes: 944be6fba401 ("arm64: dts: rockchip: Add VPU support for RK3568/RK3566")
+Cc: Piotr Oniszczuk <piotr.oniszczuk@gmail.com>
+Acked-by: Uwe Kleine-König <ukleinek@debian.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20240227173526.710056-1-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk356x.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+index c19c0f1b3778f..6a9bfb0550c04 100644
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -597,6 +597,7 @@ vpu: video-codec@fdea0400 {
+ 		compatible = "rockchip,rk3568-vpu";
+ 		reg = <0x0 0xfdea0000 0x0 0x800>;
+ 		interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "vdpu";
+ 		clocks = <&cru ACLK_VPU>, <&cru HCLK_VPU>;
+ 		clock-names = "aclk", "hclk";
+ 		iommus = <&vdpu_mmu>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch b/queue-6.8/arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch
new file mode 100644
index 00000000000..71a3a58cccc
--- /dev/null
+++ b/queue-6.8/arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch
@@ -0,0 +1,55 @@
+From a2a548b38b33979617536d9315865d7649576ddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 17:46:56 +0100
+Subject: arm64: dts: rockchip: drop rockchip,trcm-sync-tx-only from rk3588 i2s
+
+From: Heiko Stuebner <heiko.stuebner@cherry.de>
+
+[ Upstream commit a8037ceb89649659831e86a87a9329d1bb43c735 ]
+
+The rockchip,trcm-sync-tx-only property is at this time only documented
+for the tdm variant of Rockchip i2s controllers.
+
+While there was a series [0] adding code and binding for the property,
+it doesn't seem to have gone forward back in 2021.
+
+So for now fix the devicetree check by removing the property from rk3588
+i2s controllers until support for it gets merged.
+
+[0] https://patchwork.kernel.org/project/linux-rockchip/patch/1629796734-4243-5-git-send-email-sugar.zhang@rock-chips.com/
+
+Fixes: 8ae112a5554f ("arm64: dts: rockchip: Add rk3588s I2S nodes")
+Cc: Sugar Zhang <sugar.zhang@rock-chips.com>
+Cc: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
+Reviewed-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Link: https://lore.kernel.org/r/20240227164659.705271-2-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3588s.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3588s.dtsi b/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
+index 36b1b7acfe6a1..82350ddb262f2 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588s.dtsi
+@@ -1704,7 +1704,6 @@ i2s2_2ch: i2s@fe490000 {
+ 		dmas = <&dmac1 0>, <&dmac1 1>;
+ 		dma-names = "tx", "rx";
+ 		power-domains = <&power RK3588_PD_AUDIO>;
+-		rockchip,trcm-sync-tx-only;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&i2s2m1_lrck
+ 			     &i2s2m1_sclk
+@@ -1725,7 +1724,6 @@ i2s3_2ch: i2s@fe4a0000 {
+ 		dmas = <&dmac1 2>, <&dmac1 3>;
+ 		dma-names = "tx", "rx";
+ 		power-domains = <&power RK3588_PD_AUDIO>;
+-		rockchip,trcm-sync-tx-only;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&i2s3_lrck
+ 			     &i2s3_sclk
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch b/queue-6.8/arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch
new file mode 100644
index 00000000000..0a303cd920e
--- /dev/null
+++ b/queue-6.8/arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch
@@ -0,0 +1,48 @@
+From 6e261aa60782fd81a62a9d113ae994f88c56ac24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 18:35:26 +0100
+Subject: arm64: dts: rockchip: fix reset-names for rk356x i2s2 controller
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit 0fc19ab75acde78558bd0f6fe3e5f63cf8ee88b0 ]
+
+The dtbscheck reports a warning for a wrong reset-names property for
+the i2s2 controller on rk356x socs.
+
+The other controllers on the soc provide tx and rx directions and hence
+two resets and separate clocks for each direction, while i2s2 only
+provides one reset. This was so far named just "m" which isn't part of
+the binding.
+
+The clock-names the controller uses all end in "tx", so use the matching
+"tx-m" reset-name for the i2s controller.
+
+Fixes: 755f37010f3e ("arm64: dts: rockchip: RK356x: Add I2S2 device node")
+Acked-by: Uwe Kleine-König <ukleinek@debian.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20240227173526.710056-2-heiko@sntech.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk356x.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk356x.dtsi b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+index 6a9bfb0550c04..92f96ec01385d 100644
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -1124,7 +1124,7 @@ i2s2_2ch: i2s@fe420000 {
+ 		dmas = <&dmac1 4>, <&dmac1 5>;
+ 		dma-names = "tx", "rx";
+ 		resets = <&cru SRST_M_I2S2_2CH>;
+-		reset-names = "m";
++		reset-names = "tx-m";
+ 		rockchip,grf = <&grf>;
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&i2s2m0_sclktx
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-add-common1-register-space-for-am62x-so.patch b/queue-6.8/arm64-dts-ti-add-common1-register-space-for-am62x-so.patch
new file mode 100644
index 00000000000..49b7e327d2f
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-add-common1-register-space-for-am62x-so.patch
@@ -0,0 +1,44 @@
+From d426d0e757432a85c8c223817c6a01e49cc6e394 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 11:54:25 +0530
+Subject: arm64: dts: ti: Add common1 register space for AM62x SoC
+
+From: Devarsh Thakkar <devarsht@ti.com>
+
+[ Upstream commit 7d8ee2c3b8a2aabb9ce75795bad20773bfe1ba13 ]
+
+This adds common1 register space for AM62x SoC which is using TI's Keystone
+display hardware and supporting it as described in
+Documentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml
+
+Fixes: 8ccc1073c7bb ("arm64: dts: ti: k3-am62-main: Add node for DSS")
+Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20240216062426.4170528-4-devarsht@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+index c49fbce5cb707..6d07b65a3614e 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+@@ -783,9 +783,10 @@ dss: dss@30200000 {
+ 		      <0x00 0x30207000 0x00 0x1000>, /* ovr1 */
+ 		      <0x00 0x30208000 0x00 0x1000>, /* ovr2 */
+ 		      <0x00 0x3020a000 0x00 0x1000>, /* vp1: Used for OLDI */
+-		      <0x00 0x3020b000 0x00 0x1000>; /* vp2: Used as DPI Out */
++		      <0x00 0x3020b000 0x00 0x1000>, /* vp2: Used as DPI Out */
++		      <0x00 0x30201000 0x00 0x1000>; /* common1 */
+ 		reg-names = "common", "vidl1", "vid",
+-			    "ovr1", "ovr2", "vp1", "vp2";
++			    "ovr1", "ovr2", "vp1", "vp2", "common1";
+ 		power-domains = <&k3_pds 186 TI_SCI_PD_EXCLUSIVE>;
+ 		clocks = <&k3_clks 186 6>,
+ 			 <&dss_vp1_clk>,
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-add-common1-register-space-for-am65x-so.patch b/queue-6.8/arm64-dts-ti-add-common1-register-space-for-am65x-so.patch
new file mode 100644
index 00000000000..0bb78f6dcbe
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-add-common1-register-space-for-am65x-so.patch
@@ -0,0 +1,44 @@
+From bf0694037f203b4fc917002f599efd9f5b9c00cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 11:54:24 +0530
+Subject: arm64: dts: ti: Add common1 register space for AM65x SoC
+
+From: Devarsh Thakkar <devarsht@ti.com>
+
+[ Upstream commit 1a5010eade10b409d353b770d97b548b0fbdf5d7 ]
+
+This adds common1 register space for AM65x SoC which is using TI's Keystone
+display hardware and supporting it as described in
+Documentation/devicetree/bindings/display/ti/ti,am65x-dss.yaml
+
+Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node")
+Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20240216062426.4170528-3-devarsht@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index fcea544656360..5b2d4365b9111 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -1019,9 +1019,10 @@ dss: dss@4a00000 {
+ 		      <0x0 0x04a07000 0x0 0x1000>, /* ovr1 */
+ 		      <0x0 0x04a08000 0x0 0x1000>, /* ovr2 */
+ 		      <0x0 0x04a0a000 0x0 0x1000>, /* vp1 */
+-		      <0x0 0x04a0b000 0x0 0x1000>; /* vp2 */
++		      <0x0 0x04a0b000 0x0 0x1000>, /* vp2 */
++		      <0x0 0x04a01000 0x0 0x1000>; /* common1 */
+ 		reg-names = "common", "vidl1", "vid",
+-			"ovr1", "ovr2", "vp1", "vp2";
++			"ovr1", "ovr2", "vp1", "vp2", "common1";
+ 
+ 		ti,am65x-oldi-io-ctrl = <&dss_oldi_io_ctrl>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch b/queue-6.8/arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch
new file mode 100644
index 00000000000..0ab557b08a2
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch
@@ -0,0 +1,37 @@
+From 05e05d117fe8ddfc513c947819940c47195b88d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 15:51:43 +0200
+Subject: arm64: dts: ti: am65x: Fix dtbs_install for Rocktech OLDI overlay
+
+From: Roger Quadros <rogerq@kernel.org>
+
+[ Upstream commit 8ada14cafc5e185c668198617cd1ab4f1d8d325a ]
+
+Add the overlay dtbo file to a Makefile target so it can be
+picked by the dtbs_install command.
+
+Fixes: b8690ed3d1d1 ("arm64: dts: ti: am65x: Add Rocktech OLDI panel DT overlay")
+Signed-off-by: Roger Quadros <rogerq@kernel.org>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20240208-for-v6-9-am65-overlays-2-0-v2-1-70bae3e91597@kernel.org
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/ti/Makefile b/arch/arm64/boot/dts/ti/Makefile
+index 52c1dc9103087..08ce34d21d5d0 100644
+--- a/arch/arm64/boot/dts/ti/Makefile
++++ b/arch/arm64/boot/dts/ti/Makefile
+@@ -57,6 +57,7 @@ dtb-$(CONFIG_ARCH_K3) += k3-am654-base-board.dtb
+ dtb-$(CONFIG_ARCH_K3) += k3-am654-gp-evm.dtb
+ dtb-$(CONFIG_ARCH_K3) += k3-am654-evm.dtb
+ dtb-$(CONFIG_ARCH_K3) += k3-am654-idk.dtb
++dtb-$(CONFIG_ARCH_K3) += k3-am654-base-board-rocktech-rk101-panel.dtbo
+ 
+ # Boards with J7200 SoC
+ k3-j7200-evm-dtbs := k3-j7200-common-proc-board.dtb k3-j7200-evm-quad-port-eth-exp.dtbo
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch b/queue-6.8/arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch
new file mode 100644
index 00000000000..153d9eb73bc
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch
@@ -0,0 +1,65 @@
+From 0e46e7256baa6474fa66106322856f32fc12b444 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 14:02:12 +0100
+Subject: arm64: dts: ti: k3-am62-main: disable usb lpm
+
+From: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
+
+[ Upstream commit 9c99b337a8755a09df7735d4324ae26a6eca6261 ]
+
+AM62 USB works with some devices, while failing to operate with others.
+
+[  560.189822] xhci-hcd xhci-hcd.4.auto: xHCI Host Controller
+[  560.195631] xhci-hcd xhci-hcd.4.auto: new USB bus registered, assigned bus number 2
+[  574.388509] xhci-hcd xhci-hcd.4.auto: can't setup: -110
+[  574.393814] xhci-hcd xhci-hcd.4.auto: USB bus 2 deregistered
+[  574.399544] xhci-hcd: probe of xhci-hcd.4.auto failed with error -110
+
+This seems to be related to LPM (Link Power Management), and disabling it
+turns USB into reliable working state.
+
+As per AM62 reference manual:
+
+> 4.8.2.1 USB2SS Unsupported Features
+>
+> The following features are not supported on this family of devices:
+> ...
+> - USB 2.0 ECN: Link Power Management (LPM)
+> ...
+
+Fixes: 2240f96cf3cd ("arm64: dts: ti: k3-am62-main: Add support for USB")
+Signed-off-by: Andrejs Cainikovs <andrejs.cainikovs@toradex.com>
+Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Reviewed-by: Roger Quadros <rogerq@ti.com>
+Link: https://lore.kernel.org/r/20240209130213.38908-1-andrejs.cainikovs@gmail.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62-main.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+index 464b7565d085d..c49fbce5cb707 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62-main.dtsi
+@@ -640,6 +640,8 @@ usb0: usb@31000000 {
+ 			interrupt-names = "host", "peripheral";
+ 			maximum-speed = "high-speed";
+ 			dr_mode = "otg";
++			snps,usb2-gadget-lpm-disable;
++			snps,usb2-lpm-disable;
+ 		};
+ 	};
+ 
+@@ -663,6 +665,8 @@ usb1: usb@31100000 {
+ 			interrupt-names = "host", "peripheral";
+ 			maximum-speed = "high-speed";
+ 			dr_mode = "otg";
++			snps,usb2-gadget-lpm-disable;
++			snps,usb2-lpm-disable;
+ 		};
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch b/queue-6.8/arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch
new file mode 100644
index 00000000000..7cf494a99a4
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch
@@ -0,0 +1,39 @@
+From 29df3e91851dd57ee243381c95591075890d431a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 11:48:02 +0530
+Subject: arm64: dts: ti: k3-am62p: Fix memory ranges for DMSS
+
+From: Jai Luthra <j-luthra@ti.com>
+
+[ Upstream commit 90a67583171f213711de662fab9f8d24a2d291a9 ]
+
+The INTR module for DMASS1 (CSI specific DMASS) is outside the currently
+available ranges, as it starts at 0x4e400000. So fix the ranges property
+to enable programming the interrupts correctly.
+
+Fixes: 29075cc09f43 ("arm64: dts: ti: Introduce AM62P5 family of SoCs")
+Reviewed-by: Vaishnav Achath <vaishnav.a@ti.com>
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Link: https://lore.kernel.org/r/20240220-am62p_csi-v2-1-3e71d9945571@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62p.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62p.dtsi b/arch/arm64/boot/dts/ti/k3-am62p.dtsi
+index 84ffe7b9dcaf3..4f22b5d9fb9f0 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62p.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62p.dtsi
+@@ -71,7 +71,7 @@ cbass_main: bus@f0000 {
+ 			 <0x00 0x43600000 0x00 0x43600000 0x00 0x00010000>, /* SA3 sproxy data */
+ 			 <0x00 0x44043000 0x00 0x44043000 0x00 0x00000fe0>, /* TI SCI DEBUG */
+ 			 <0x00 0x44860000 0x00 0x44860000 0x00 0x00040000>, /* SA3 sproxy config */
+-			 <0x00 0x48000000 0x00 0x48000000 0x00 0x06400000>, /* DMSS */
++			 <0x00 0x48000000 0x00 0x48000000 0x00 0x06408000>, /* DMSS */
+ 			 <0x00 0x60000000 0x00 0x60000000 0x00 0x08000000>, /* FSS0 DAT1 */
+ 			 <0x00 0x70000000 0x00 0x70000000 0x00 0x00010000>, /* OCSRAM */
+ 			 <0x01 0x00000000 0x01 0x00000000 0x00 0x00310000>, /* A53 PERIPHBASE */
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch b/queue-6.8/arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch
new file mode 100644
index 00000000000..86b552174dc
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch
@@ -0,0 +1,62 @@
+From cbfcbefb23136db0359553587de25ee991482de9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jan 2024 19:10:17 +0530
+Subject: arm64: dts: ti: k3-am62p-mcu/wakeup: Disable MCU and wakeup R5FSS
+ nodes
+
+From: Vaishnav Achath <vaishnav.a@ti.com>
+
+[ Upstream commit dfc90e5f1a0fe0f8124521bc1911e38aa6cd9118 ]
+
+K3 Remoteproc R5 driver requires reserved memory carveouts and
+mailbox configuration to instantiate the cores successfully.
+Since this is a board level dependency, keep the R5 subsytem
+disabled at SoC dtsi, otherwise it results in probe errors like
+below during AM62P SK boot:
+
+r5fss@79000000: reserved memory init failed, ret = -22
+r5fss@79000000: k3_r5_cluster_rproc_init failed, ret = -22
+r5fss@78000000: reserved memory init failed, ret = -22
+r5fss@78000000: k3_r5_cluster_rproc_init failed, ret = -22
+
+Fixes: b5080c7c1f7e ("arm64: dts: ti: k3-am62p: Add nodes for more IPs")
+
+Signed-off-by: Vaishnav Achath <vaishnav.a@ti.com>
+Reviewed-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Nishanth Menon <nm@ti.com>
+Link: https://lore.kernel.org/r/20240121134017.374992-1-vaishnav.a@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi    | 2 ++
+ arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi
+index c4b0b91d70cf3..14eb9ba836d32 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62p-mcu.dtsi
+@@ -187,6 +187,8 @@ mcu_r5fss0: r5fss@79000000 {
+ 		ranges = <0x79000000 0x00 0x79000000 0x8000>,
+ 			 <0x79020000 0x00 0x79020000 0x8000>;
+ 		power-domains = <&k3_pds 7 TI_SCI_PD_EXCLUSIVE>;
++		status = "disabled";
++
+ 		mcu_r5fss0_core0: r5f@79000000 {
+ 			compatible = "ti,am62-r5f";
+ 			reg = <0x79000000 0x00008000>,
+diff --git a/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi
+index 19f42b39394ee..10a7059b2d9b5 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62p-wakeup.dtsi
+@@ -78,6 +78,7 @@ wkup_r5fss0: r5fss@78000000 {
+ 		ranges = <0x78000000 0x00 0x78000000 0x8000>,
+ 			 <0x78100000 0x00 0x78100000 0x8000>;
+ 		power-domains = <&k3_pds 119 TI_SCI_PD_EXCLUSIVE>;
++		status = "disabled";
+ 
+ 		wkup_r5fss0_core0: r5f@78000000 {
+ 			compatible = "ti,am62-r5f";
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch b/queue-6.8/arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch
new file mode 100644
index 00000000000..ad9d57b5b3e
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch
@@ -0,0 +1,44 @@
+From f5a919f8719a5ab073945a4ba0117c18ff52eb49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 18:13:53 +0530
+Subject: arm64: dts: ti: k3-am62p5-sk: Enable CPSW MDIO node
+
+From: Ravi Gunasekaran <r-gunasekaran@ti.com>
+
+[ Upstream commit 8839a9af397e803e0447a6b3e69fad54ed22d26d ]
+
+Enable the CPSW MDIO node, and link the pinctrl information to enable
+ethernet on SK-AM62P.
+
+Ethernet was unintentally broken on this board, even though these nodes
+were already present, as enabling them was missed in the original
+patch.
+
+Fixes: c00504ea42c0 ("arm64: dts: ti: k3-am62p5-sk: Updates for SK EVM")
+Signed-off-by: Ravi Gunasekaran <r-gunasekaran@ti.com>
+Signed-off-by: Jai Luthra <j-luthra@ti.com>
+Link: https://lore.kernel.org/r/20240201-am62p_cpsw_mdio-v1-1-05f758300f6e@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62p5-sk.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
+index 1773c05f752cd..60868862e3b43 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am62p5-sk.dts
+@@ -445,6 +445,10 @@ &cpsw_port2 {
+ };
+ 
+ &cpsw3g_mdio {
++	pinctrl-names = "default";
++	pinctrl-0 = <&main_mdio1_pins_default>;
++	status = "okay";
++
+ 	cpsw3g_phy0: ethernet-phy@0 {
+ 		reg = <0>;
+ 		ti,rx-internal-delay = <DP83867_RGMIIDCTL_2_00_NS>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch b/queue-6.8/arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch
new file mode 100644
index 00000000000..aaff7705673
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch
@@ -0,0 +1,59 @@
+From a6f9ed52a72f2aec1aa948faa04ff8ef231e9a4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 17:56:56 -0600
+Subject: arm64: dts: ti: k3-am64-main: Fix ITAP/OTAP values for MMC
+
+From: Judith Mendez <jm@ti.com>
+
+[ Upstream commit 379c7752bbd0e81654544a896dd19c19ebb6faba ]
+
+Update MMC0/MMC1 OTAP/ITAP values according to the datasheet
+[0], refer to Table 7-68 for MMC0 and Table 7-77 for MMC1.
+
+[0] https://www.ti.com/lit/ds/symlink/am6442.pdf
+
+Fixes: 8abae9389bdb ("arm64: dts: ti: Add support for AM642 SoC")
+Signed-off-by: Judith Mendez <jm@ti.com>
+Tested-by: Wadim Egorov <w.egorov@phytec.de>
+Link: https://lore.kernel.org/r/20240213235701.2438513-5-jm@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am64-main.dtsi | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
+index e348114f42e01..ba624ef72f5b4 100644
+--- a/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am64-main.dtsi
+@@ -633,6 +633,9 @@ sdhci0: mmc@fa10000 {
+ 		ti,otap-del-sel-mmc-hs = <0x0>;
+ 		ti,otap-del-sel-ddr52 = <0x6>;
+ 		ti,otap-del-sel-hs200 = <0x7>;
++		ti,itap-del-sel-legacy = <0x10>;
++		ti,itap-del-sel-mmc-hs = <0xa>;
++		ti,itap-del-sel-ddr52 = <0x3>;
+ 		status = "disabled";
+ 	};
+ 
+@@ -645,12 +648,16 @@ sdhci1: mmc@fa00000 {
+ 		clock-names = "clk_ahb", "clk_xin";
+ 		ti,trm-icp = <0x2>;
+ 		ti,otap-del-sel-legacy = <0x0>;
+-		ti,otap-del-sel-sd-hs = <0xf>;
++		ti,otap-del-sel-sd-hs = <0x0>;
+ 		ti,otap-del-sel-sdr12 = <0xf>;
+ 		ti,otap-del-sel-sdr25 = <0xf>;
+ 		ti,otap-del-sel-sdr50 = <0xc>;
+ 		ti,otap-del-sel-sdr104 = <0x6>;
+ 		ti,otap-del-sel-ddr50 = <0x9>;
++		ti,itap-del-sel-legacy = <0x0>;
++		ti,itap-del-sel-sd-hs = <0x0>;
++		ti,itap-del-sel-sdr12 = <0x0>;
++		ti,itap-del-sel-sdr25 = <0x0>;
+ 		ti,clkbuf-sel = <0x7>;
+ 		status = "disabled";
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-am69-sk-fix-pmic-interrupt-number.patch b/queue-6.8/arm64-dts-ti-k3-am69-sk-fix-pmic-interrupt-number.patch
new file mode 100644
index 00000000000..6fb869c25d0
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-am69-sk-fix-pmic-interrupt-number.patch
@@ -0,0 +1,43 @@
+From d9f7c92464a1a355a924a0bbcc99835618ccbe61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 18:11:45 +0100
+Subject: arm64: dts: ti: k3-am69-sk: fix PMIC interrupt number
+
+From: Romain Naour <romain.naour@smile.fr>
+
+[ Upstream commit c205595e3b708c36ef2d7609b9182c6729bb06ae ]
+
+The tps659413 node set WKUP_GPIO0_83 (AA37) pin as input to be used as
+PMIC interrupt but uses 39 (WKUP_GPIO0_39) as "interrupts" property.
+
+Replace 39 by 83 after checking in the board schematic [1].
+
+[1] https://www.ti.com/tool/SK-AM69
+
+Fixes: 865a1593bf99 ("arm64: dts: ti: k3-am69-sk: Add support for TPS6594 PMIC")
+Cc: Neha Malcom Francis <n-francis@ti.com>
+Signed-off-by: Romain Naour <romain.naour@smile.fr>
+Reviewed-by: Neha Malcom Francis <n-francis@ti.com>
+Link: https://lore.kernel.org/r/20240209171146.307465-1-romain.naour@smile.fr
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am69-sk.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+index 370980eb59b02..c8fb9dfb89723 100644
+--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+@@ -646,7 +646,7 @@ tps659413: pmic@48 {
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pmic_irq_pins_default>;
+ 		interrupt-parent = <&wkup_gpio0>;
+-		interrupts = <39 IRQ_TYPE_EDGE_FALLING>;
++		interrupts = <83 IRQ_TYPE_EDGE_FALLING>;
+ 		gpio-controller;
+ 		#gpio-cells = <2>;
+ 		ti,primary-pmic;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch b/queue-6.8/arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch
new file mode 100644
index 00000000000..7abfaa860bf
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch
@@ -0,0 +1,55 @@
+From d8f234f5d3e1389cf781ef70af29525c136d2c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 19:53:08 +0530
+Subject: arm64: dts: ti: k3-am69-sk: remove assigned-clock-parents for unused
+ VP
+
+From: Jayesh Choudhary <j-choudhary@ti.com>
+
+[ Upstream commit cfdb4f7ffdb855c1a3d274dc7757e780dcbf2d55 ]
+
+VP2 and VP3 are unused video ports and VP3 share the same parent
+clock as VP1 causing issue with pixel clock setting for HDMI (VP1).
+The current DM firmware does not support changing parent clock if it
+is shared by another component. It returns 0 for the determine_rate
+query before causing set_rate to set the clock at default maximum of
+1.8GHz which is a lot more than the maximum frequency videoports can
+support (600MHz) causing SYNC LOST issues.
+So remove the parent clocks for unused VPs to avoid conflict.
+
+Fixes: 6f8605fd7d11 ("arm64: dts: ti: k3-am69-sk: Add DP and HDMI support")
+Reported-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Jayesh Choudhary <j-choudhary@ti.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Tested-by: Enric Balletbo i Serra <eballetbo@redhat.com>
+Link: https://lore.kernel.org/r/20240201142308.4954-1-j-choudhary@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am69-sk.dts | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am69-sk.dts b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+index 8da5915798688..370980eb59b02 100644
+--- a/arch/arm64/boot/dts/ti/k3-am69-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-am69-sk.dts
+@@ -918,13 +918,9 @@ &dss {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&dss_vout0_pins_default>;
+ 	assigned-clocks = <&k3_clks 218 2>,
+-			  <&k3_clks 218 5>,
+-			  <&k3_clks 218 14>,
+-			  <&k3_clks 218 18>;
++			  <&k3_clks 218 5>;
+ 	assigned-clock-parents = <&k3_clks 218 3>,
+-				 <&k3_clks 218 7>,
+-				 <&k3_clks 218 16>,
+-				 <&k3_clks 218 22>;
++				 <&k3_clks 218 7>;
+ };
+ 
+ &serdes_wiz4 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch b/queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch
new file mode 100644
index 00000000000..31a82d4832d
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch
@@ -0,0 +1,64 @@
+From cab89dc97b0d9a15e8a19faa04ad2f19a169bbc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 16:28:43 +0530
+Subject: arm64: dts: ti: k3-j7200-common-proc-board: Modify Pinmux for
+ wkup_uart0 and mcu_uart0
+
+From: Bhavya Kapoor <b-kapoor@ti.com>
+
+[ Upstream commit 566feddd2ba5e29d9ccab36d6508592ae563f275 ]
+
+WKUP_PADCONFIG registers for wkup_uart0 and mcu_uart0 lies
+under wkup_pmx2 for J7200. Thus, modify pinmux for both
+of them.
+
+Fixes: 3709ea7f960e ("arm64: dts: ti: k3-j7200-common-proc-board: Add uart pinmux")
+Signed-off-by: Bhavya Kapoor <b-kapoor@ti.com>
+Link: https://lore.kernel.org/r/20240214105846.1096733-2-b-kapoor@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/ti/k3-j7200-common-proc-board.dts  | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+index cee2b4b0eb87d..53594c5fb8e8f 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+@@ -91,24 +91,25 @@ vdd_sd_dv: gpio-regulator-TLV71033 {
+ };
+ 
+ &wkup_pmx0 {
++};
++
++&wkup_pmx2 {
+ 	mcu_uart0_pins_default: mcu-uart0-default-pins {
+ 		pinctrl-single,pins = <
+-			J721E_WKUP_IOPAD(0xf4, PIN_INPUT, 0) /* (D20) MCU_UART0_RXD */
+-			J721E_WKUP_IOPAD(0xf0, PIN_OUTPUT, 0) /* (D19) MCU_UART0_TXD */
+-			J721E_WKUP_IOPAD(0xf8, PIN_INPUT, 0) /* (E20) MCU_UART0_CTSn */
+-			J721E_WKUP_IOPAD(0xfc, PIN_OUTPUT, 0) /* (E21) MCU_UART0_RTSn */
++			J721E_WKUP_IOPAD(0x90, PIN_INPUT, 0) /* (E20) MCU_UART0_CTSn */
++			J721E_WKUP_IOPAD(0x94, PIN_OUTPUT, 0) /* (E21) MCU_UART0_RTSn */
++			J721E_WKUP_IOPAD(0x8c, PIN_INPUT, 0) /* (D20) MCU_UART0_RXD */
++			J721E_WKUP_IOPAD(0x88, PIN_OUTPUT, 0) /* (D19) MCU_UART0_TXD */
+ 		>;
+ 	};
+ 
+ 	wkup_uart0_pins_default: wkup-uart0-default-pins {
+ 		pinctrl-single,pins = <
+-			J721E_WKUP_IOPAD(0xb0, PIN_INPUT, 0) /* (B14) WKUP_UART0_RXD */
+-			J721E_WKUP_IOPAD(0xb4, PIN_OUTPUT, 0) /* (A14) WKUP_UART0_TXD */
++			J721E_WKUP_IOPAD(0x48, PIN_INPUT, 0) /* (B14) WKUP_UART0_RXD */
++			J721E_WKUP_IOPAD(0x4c, PIN_OUTPUT, 0) /* (A14) WKUP_UART0_TXD */
+ 		>;
+ 	};
+-};
+ 
+-&wkup_pmx2 {
+ 	mcu_cpsw_pins_default: mcu-cpsw-default-pins {
+ 		pinctrl-single,pins = <
+ 			J721E_WKUP_IOPAD(0x0000, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch b/queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch
new file mode 100644
index 00000000000..c1f80ab2bb5
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch
@@ -0,0 +1,38 @@
+From 1db4201b902b7922d7a87bcd812bf5728325f8cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 16:28:44 +0530
+Subject: arm64: dts: ti: k3-j7200-common-proc-board: Remove clock-frequency
+ from mcu_uart0
+
+From: Bhavya Kapoor <b-kapoor@ti.com>
+
+[ Upstream commit 0fa8b0e2083d333e4854b9767fb893f924e70ae5 ]
+
+Clock-frequency property is already present in mcu_uart0 node of the
+k3-j7200-mcu-wakeup.dtsi file. Thus, remove redundant clock-frequency
+property from mcu_uart0 node.
+
+Fixes: 3709ea7f960e ("arm64: dts: ti: k3-j7200-common-proc-board: Add uart pinmux")
+Signed-off-by: Bhavya Kapoor <b-kapoor@ti.com>
+Link: https://lore.kernel.org/r/20240214105846.1096733-3-b-kapoor@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+index 53594c5fb8e8f..7a0c599f2b1c3 100644
+--- a/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
++++ b/arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts
+@@ -211,7 +211,6 @@ &mcu_uart0 {
+ 	status = "okay";
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&mcu_uart0_pins_default>;
+-	clock-frequency = <96000000>;
+ };
+ 
+ &main_uart0 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j721e-fix-mux-reg-masks-in-hbmc_mux.patch b/queue-6.8/arm64-dts-ti-k3-j721e-fix-mux-reg-masks-in-hbmc_mux.patch
new file mode 100644
index 00000000000..10f2dc36d3c
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j721e-fix-mux-reg-masks-in-hbmc_mux.patch
@@ -0,0 +1,44 @@
+From 09fbc1550a542ba0c724236958e9535ed17397f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 08:19:57 -0600
+Subject: arm64: dts: ti: k3-j721e: Fix mux-reg-masks in hbmc_mux
+
+From: Andrew Davis <afd@ti.com>
+
+[ Upstream commit 3d585389d454e147187684e492a0eb8f56adf311 ]
+
+Change offset in mux-reg-masks property for hbmc_mux node
+since reg-mux property is used in compatible.
+
+While here, update the reg region to include 4 bytes as this
+is a 32bit register.
+
+Fixes: 2765149273f4 ("mux: mmio: use reg property when parent device is not a syscon")
+Suggested-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20240215141957.13775-1-afd@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
+index a74912d9e4daf..c463e23ced04e 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-mcu-wakeup.dtsi
+@@ -353,9 +353,9 @@ fss: bus@47000000 {
+ 
+ 		hbmc_mux: mux-controller@47000004 {
+ 			compatible = "reg-mux";
+-			reg = <0x00 0x47000004 0x00 0x2>;
++			reg = <0x00 0x47000004 0x00 0x4>;
+ 			#mux-control-cells = <1>;
+-			mux-reg-masks = <0x4 0x2>; /* HBMC select */
++			mux-reg-masks = <0x0 0x2>; /* HBMC select */
+ 		};
+ 
+ 		hbmc: hyperbus@47034000 {
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j721e-sk-fix-pmic-interrupt-number.patch b/queue-6.8/arm64-dts-ti-k3-j721e-sk-fix-pmic-interrupt-number.patch
new file mode 100644
index 00000000000..41fe2499ee6
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j721e-sk-fix-pmic-interrupt-number.patch
@@ -0,0 +1,54 @@
+From 8a4bc357c20de7e0cc134a06dd15e531331e577c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 18:11:46 +0100
+Subject: arm64: dts: ti: k3-j721e-sk: fix PMIC interrupt number
+
+From: Romain Naour <romain.naour@smile.fr>
+
+[ Upstream commit 7f25d6926d178734db17cfc12f0b1841e82914da ]
+
+The tps659413 and tps659411 nodes set WKUP_GPIO0_7 (G28) pin as input
+to be used as PMIC interrupt but uses 9 (WKUP_GPIO0_9) as
+"interrupts" property.
+
+Replace 9 by 7 for both tps659413 and tps659411 after checking in the
+board schematic [1].
+
+[1] https://www.ti.com/tool/SK-TDA4VM
+
+Fixes: b808cef0be46 ("arm64: dts: ti: k3-j721e-sk: Add TPS6594 family PMICs")
+Cc: Neha Malcom Francis <n-francis@ti.com>
+Signed-off-by: Romain Naour <romain.naour@smile.fr>
+Reviewed-by: Neha Malcom Francis <n-francis@ti.com>
+Link: https://lore.kernel.org/r/20240209171146.307465-2-romain.naour@smile.fr
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-sk.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+index 188dfe291a32b..658764f7d5443 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721e-sk.dts
+@@ -574,7 +574,7 @@ tps659413: pmic@48 {
+ 		pinctrl-names = "default";
+ 		pinctrl-0 = <&pmic_irq_pins_default>;
+ 		interrupt-parent = <&wkup_gpio0>;
+-		interrupts = <9 IRQ_TYPE_EDGE_FALLING>;
++		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+ 		gpio-controller;
+ 		#gpio-cells = <2>;
+ 		ti,primary-pmic;
+@@ -651,7 +651,7 @@ tps659411: pmic@4c {
+ 		reg = <0x4c>;
+ 		system-power-controller;
+ 		interrupt-parent = <&wkup_gpio0>;
+-		interrupts = <9 IRQ_TYPE_EDGE_FALLING>;
++		interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+ 		gpio-controller;
+ 		#gpio-cells = <2>;
+ 		buck1234-supply = <&vsys_3v3>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch b/queue-6.8/arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch
new file mode 100644
index 00000000000..e0e0373a8e9
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch
@@ -0,0 +1,40 @@
+From d5929ccad1bef8da03cd06bad88599efaa1221bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 16:28:45 +0530
+Subject: arm64: dts: ti: k3-j721s2-common-proc-board: Remove Pinmux for CTS
+ and RTS in wkup_uart0
+
+From: Bhavya Kapoor <b-kapoor@ti.com>
+
+[ Upstream commit 28e5b74d524050008edf415f20a3e38907b8f176 ]
+
+Only Tx and Rx Signal lines for wkup_uart0 are brought out on
+the Common Proc Board through SoM, but CTS and RTS signal lines
+are not brought on the board. Thus, remove pinmux for CTS and RTS
+signal lines for wkup_uart0 in J721S2.
+
+Fixes: f5e9ee0b354a ("arm64: dts: ti: k3-j721s2-common-proc-board: Add uart pinmux")
+Signed-off-by: Bhavya Kapoor <b-kapoor@ti.com>
+Link: https://lore.kernel.org/r/20240214105846.1096733-4-b-kapoor@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts b/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts
+index c6b85bbf9a179..1ba1f53c72d03 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts
++++ b/arch/arm64/boot/dts/ti/k3-j721s2-common-proc-board.dts
+@@ -190,8 +190,6 @@ J721S2_IOPAD(0x038, PIN_OUTPUT, 0) /* (AB28) MCASP0_ACLKX.MCAN5_TX */
+ &wkup_pmx2 {
+ 	wkup_uart0_pins_default: wkup-uart0-default-pins {
+ 		pinctrl-single,pins = <
+-			J721S2_WKUP_IOPAD(0x070, PIN_INPUT, 0) /* (E25) WKUP_GPIO0_6.WKUP_UART0_CTSn */
+-			J721S2_WKUP_IOPAD(0x074, PIN_OUTPUT, 0) /* (F28) WKUP_GPIO0_7.WKUP_UART0_RTSn */
+ 			J721S2_WKUP_IOPAD(0x048, PIN_INPUT, 0) /* (D28) WKUP_UART0_RXD */
+ 			J721S2_WKUP_IOPAD(0x04c, PIN_OUTPUT, 0) /* (D27) WKUP_UART0_TXD */
+ 		>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch b/queue-6.8/arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch
new file mode 100644
index 00000000000..a235d1e514e
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch
@@ -0,0 +1,38 @@
+From a6fa193b8f35e7004b8cfdda053da9f39139dd2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 13:37:26 +0530
+Subject: arm64: dts: ti: k3-j721s2: Fix power domain for VTM node
+
+From: Manorit Chawdhry <m-chawdhry@ti.com>
+
+[ Upstream commit 5ef196ed912e80a1e64936119ced8d7eb5635f0f ]
+
+Fix the power domain device ID for wkup_vtm0 node.
+
+Link: https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j721s2/devices.html
+Fixes: d148e3fe52c8 ("arm64: dts: ti: j721s2: Add VTM node")
+Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
+Reviewed-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20240201-b4-upstream-j721s2-fix-vtm-devid-v2-1-85fd568b77e3@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
+index 80aa33c58a452..a47cb557dd956 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721s2-mcu-wakeup.dtsi
+@@ -663,7 +663,7 @@ wkup_vtm0: temperature-sensor@42040000 {
+ 		compatible = "ti,j7200-vtm";
+ 		reg = <0x00 0x42040000 0x0 0x350>,
+ 		      <0x00 0x42050000 0x0 0x350>;
+-		power-domains = <&k3_pds 154 TI_SCI_PD_SHARED>;
++		power-domains = <&k3_pds 180 TI_SCI_PD_SHARED>;
+ 		#thermal-sensor-cells = <1>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch b/queue-6.8/arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch
new file mode 100644
index 00000000000..c4c391e4acd
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch
@@ -0,0 +1,40 @@
+From 1cb20c9a4deb99db158b0acb1704b998e68cb81b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 16:28:46 +0530
+Subject: arm64: dts: ti: k3-j784s4-evm: Remove Pinmux for CTS and RTS in
+ wkup_uart0
+
+From: Bhavya Kapoor <b-kapoor@ti.com>
+
+[ Upstream commit d29a6cf980572d8cf7b63935716fca663e2610f0 ]
+
+Only Tx and Rx Signal lines for wkup_uart0 are brought out on
+the J784S4 EVM from SoC, but CTS and RTS signal lines are not
+brought on the EVM. Thus, remove pinmux for CTS and RTS signal
+lines for wkup_uart0 in J784S4.
+
+Fixes: 6fa5d37a2f34 ("arm64: dts: ti: k3-j784s4-evm: Add mcu and wakeup uarts")
+Signed-off-by: Bhavya Kapoor <b-kapoor@ti.com>
+Link: https://lore.kernel.org/r/20240214105846.1096733-5-b-kapoor@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+index f34b92acc56d8..33795a0bc69cf 100644
+--- a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
++++ b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+@@ -335,8 +335,6 @@ &wkup_pmx2 {
+ 	wkup_uart0_pins_default: wkup-uart0-default-pins {
+ 		bootph-all;
+ 		pinctrl-single,pins = <
+-			J721S2_WKUP_IOPAD(0x070, PIN_INPUT, 0) /* (L37) WKUP_GPIO0_6.WKUP_UART0_CTSn */
+-			J721S2_WKUP_IOPAD(0x074, PIN_INPUT, 0) /* (L36) WKUP_GPIO0_7.WKUP_UART0_RTSn */
+ 			J721S2_WKUP_IOPAD(0x048, PIN_INPUT, 0) /* (K35) WKUP_UART0_RXD */
+ 			J721S2_WKUP_IOPAD(0x04c, PIN_INPUT, 0) /* (K34) WKUP_UART0_TXD */
+ 		>;
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch b/queue-6.8/arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch
new file mode 100644
index 00000000000..33f18ebdb87
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch
@@ -0,0 +1,38 @@
+From 4f0236f1f1a9c0bf877c82a0d326450fc640df18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 13:37:27 +0530
+Subject: arm64: dts: ti: k3-j784s4: Fix power domain for VTM node
+
+From: Manorit Chawdhry <m-chawdhry@ti.com>
+
+[ Upstream commit e4d252e6d29208aea56d4c04270523e306b1e3c2 ]
+
+Fix the power domain device ID for wkup_vtm0 node.
+
+Link: https://software-dl.ti.com/tisci/esd/latest/5_soc_doc/j784s4/devices.html
+Fixes: 64821fbf6738 ("arm64: dts: ti: j784s4: Add VTM node")
+Signed-off-by: Manorit Chawdhry <m-chawdhry@ti.com>
+Reviewed-by: Andrew Davis <afd@ti.com>
+Link: https://lore.kernel.org/r/20240201-b4-upstream-j721s2-fix-vtm-devid-v2-2-85fd568b77e3@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
+index 3902a921d7e58..337122c3f4020 100644
+--- a/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j784s4-mcu-wakeup.dtsi
+@@ -628,7 +628,7 @@ wkup_vtm0: temperature-sensor@42040000 {
+ 		compatible = "ti,j7200-vtm";
+ 		reg = <0x00 0x42040000 0x00 0x350>,
+ 		      <0x00 0x42050000 0x00 0x350>;
+-		power-domains = <&k3_pds 154 TI_SCI_PD_SHARED>;
++		power-domains = <&k3_pds 243 TI_SCI_PD_SHARED>;
+ 		#thermal-sensor-cells = <1>;
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-dts-ti-k3-j784s4-main-fix-mux-reg-masks-in-ser.patch b/queue-6.8/arm64-dts-ti-k3-j784s4-main-fix-mux-reg-masks-in-ser.patch
new file mode 100644
index 00000000000..64feac5ecd3
--- /dev/null
+++ b/queue-6.8/arm64-dts-ti-k3-j784s4-main-fix-mux-reg-masks-in-ser.patch
@@ -0,0 +1,49 @@
+From 5e39efd86b09b5742ee16ddc99b1476c309fca5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 13:33:48 +0530
+Subject: arm64: dts: ti: k3-j784s4-main: Fix mux-reg-masks in serdes_ln_ctrl
+
+From: Chintan Vankar <c-vankar@ti.com>
+
+[ Upstream commit 9a0c0a9baa2d1f906589d715f9baeab93e7fcdcb ]
+
+Change offset in mux-reg-masks property for serdes_ln_ctrl node
+since reg-mux property is used in compatible.
+
+Fixes: 2765149273f4 ("mux: mmio: use reg property when parent device is not a syscon")
+Signed-off-by: Chintan Vankar <c-vankar@ti.com>
+Acked-by: Andrew Davis <afd@ti.com>
+Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
+Link: https://lore.kernel.org/r/20240213080348.248916-1-s-vadapalli@ti.com
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi b/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
+index f2b720ed1e4f2..56c8eaad6324b 100644
+--- a/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi
+@@ -52,12 +52,12 @@ serdes_ln_ctrl: mux-controller@4080 {
+ 			compatible = "reg-mux";
+ 			reg = <0x00004080 0x30>;
+ 			#mux-control-cells = <1>;
+-			mux-reg-masks = <0x4080 0x3>, <0x4084 0x3>, /* SERDES0 lane0/1 select */
+-					<0x4088 0x3>, <0x408c 0x3>, /* SERDES0 lane2/3 select */
+-					<0x4090 0x3>, <0x4094 0x3>, /* SERDES1 lane0/1 select */
+-					<0x4098 0x3>, <0x409c 0x3>, /* SERDES1 lane2/3 select */
+-					<0x40a0 0x3>, <0x40a4 0x3>, /* SERDES2 lane0/1 select */
+-					<0x40a8 0x3>, <0x40ac 0x3>; /* SERDES2 lane2/3 select */
++			mux-reg-masks = <0x0 0x3>, <0x4 0x3>, /* SERDES0 lane0/1 select */
++					<0x8 0x3>, <0xc 0x3>, /* SERDES0 lane2/3 select */
++					<0x10 0x3>, <0x14 0x3>, /* SERDES1 lane0/1 select */
++					<0x18 0x3>, <0x1c 0x3>, /* SERDES1 lane2/3 select */
++					<0x20 0x3>, <0x24 0x3>, /* SERDES2 lane0/1 select */
++					<0x28 0x3>, <0x2c 0x3>; /* SERDES2 lane2/3 select */
+ 			idle-states = <J784S4_SERDES0_LANE0_PCIE1_LANE0>,
+ 				      <J784S4_SERDES0_LANE1_PCIE1_LANE1>,
+ 				      <J784S4_SERDES0_LANE2_IP3_UNUSED>,
+-- 
+2.43.0
+
diff --git a/queue-6.8/arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch b/queue-6.8/arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch
new file mode 100644
index 00000000000..de0a2cb6118
--- /dev/null
+++ b/queue-6.8/arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch
@@ -0,0 +1,52 @@
+From da2c494d0bd711f5f1c87761fcf062e53f1bf3c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 22:40:29 -0800
+Subject: arm64: ftrace: Don't forbid CALL_OPS+CC_OPTIMIZE_FOR_SIZE with Clang
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit a743f26d03a96593c0f3d05dc26b388f45de67c9 ]
+
+Per commit b3f11af9b2ce ("arm64: ftrace: forbid CALL_OPS with
+CC_OPTIMIZE_FOR_SIZE"), GCC is silently ignoring `-falign-functions=N`
+when passed `-Os`, causing functions to be improperly aligned. This
+doesn't seem to be a problem with Clang though, where enabling CALL_OPS
+with CC_OPTIMIZE_FOR_SIZE doesn't spit out any warnings at boot about
+misaligned patch-sites. Only forbid CALL_OPS if GCC is used and we're
+optimizing for size so that CALL_OPS can be used with clang optimizing
+for size.
+
+Cc: Jason Ling <jasonling@chromium.org>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Bill Wendling <morbo@google.com>
+Cc: Justin Stitt <justinstitt@google.com>
+Cc: llvm@lists.linux.dev
+Fixes: b3f11af9b2ce ("arm64: ftrace: forbid CALL_OPS with CC_OPTIMIZE_FOR_SIZE")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Nathan Chancellor <nathan@kernel.org>
+Link: https://lore.kernel.org/r/20240223064032.3463229-1-swboyd@chromium.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
+index aa7c1d4351396..6b96d75a3a3d8 100644
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -198,7 +198,7 @@ config ARM64
+ 		if DYNAMIC_FTRACE_WITH_ARGS && DYNAMIC_FTRACE_WITH_CALL_OPS
+ 	select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS \
+ 		if (DYNAMIC_FTRACE_WITH_ARGS && !CFI_CLANG && \
+-		    !CC_OPTIMIZE_FOR_SIZE)
++		    (CC_IS_CLANG || !CC_OPTIMIZE_FOR_SIZE))
+ 	select FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY \
+ 		if DYNAMIC_FTRACE_WITH_ARGS
+ 	select HAVE_SAMPLE_FTRACE_DIRECT
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch b/queue-6.8/asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch
new file mode 100644
index 00000000000..449a80e7676
--- /dev/null
+++ b/queue-6.8/asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch
@@ -0,0 +1,54 @@
+From 4cacb276df958f29e3e9175952d986f9bcd393ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 05:07:21 +0200
+Subject: ASoC: amd: acp: Add missing error handling in sof-mach
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit d0ada20279db2649a7549a2b8a4a3379c59f238d ]
+
+Handle potential acp_sofdsp_dai_links_create() errors in ACP SOF machine
+driver's probe function.  Note there is no need for an undo.
+
+While at it, switch to dev_err_probe().
+
+Fixes: 9f84940f5004 ("ASoC: amd: acp: Add SOF audio support on Chrome board")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Link: https://msgid.link/r/20231219030728.2431640-4-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/acp/acp-sof-mach.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/amd/acp/acp-sof-mach.c b/sound/soc/amd/acp/acp-sof-mach.c
+index 20b94814a0462..b86f65d420054 100644
+--- a/sound/soc/amd/acp/acp-sof-mach.c
++++ b/sound/soc/amd/acp/acp-sof-mach.c
+@@ -126,16 +126,14 @@ static int acp_sof_probe(struct platform_device *pdev)
+ 	if (dmi_id && dmi_id->driver_data)
+ 		acp_card_drvdata->tdm_mode = dmi_id->driver_data;
+ 
+-	acp_sofdsp_dai_links_create(card);
++	ret = acp_sofdsp_dai_links_create(card);
++	if (ret)
++		return dev_err_probe(&pdev->dev, ret, "Failed to create DAI links\n");
+ 
+ 	ret = devm_snd_soc_register_card(&pdev->dev, card);
+-	if (ret) {
+-		dev_err(&pdev->dev,
+-				"devm_snd_soc_register_card(%s) failed: %d\n",
+-				card->name, ret);
+-		return ret;
+-	}
+-
++	if (ret)
++		return dev_err_probe(&pdev->dev, ret,
++				     "Failed to register card(%s)\n", card->name);
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-intel-ssp-common-add-stub-for-sof_ssp_get_codec.patch b/queue-6.8/asoc-intel-ssp-common-add-stub-for-sof_ssp_get_codec.patch
new file mode 100644
index 00000000000..63096fa0d59
--- /dev/null
+++ b/queue-6.8/asoc-intel-ssp-common-add-stub-for-sof_ssp_get_codec.patch
@@ -0,0 +1,49 @@
+From a9fddc2c986dbb5123c3f513f06a6c93846d2316 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 10:55:41 -0600
+Subject: ASoC: Intel: ssp-common: Add stub for sof_ssp_get_codec_name
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit c1469c3a8a306e5f1eab1ae9585640d08e183f87 ]
+
+As this function is now used in sof_board_helpers it requires a build
+stub for the case SSP_COMMON is not built in.
+
+Fixes: ba0c7c328762 ("ASoC: Intel: board_helpers: support amp link initialization")
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20240208165545.93811-21-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_ssp_common.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_ssp_common.h b/sound/soc/intel/boards/sof_ssp_common.h
+index 6d827103479b5..d24888bc99fde 100644
+--- a/sound/soc/intel/boards/sof_ssp_common.h
++++ b/sound/soc/intel/boards/sof_ssp_common.h
+@@ -67,6 +67,14 @@ enum sof_ssp_codec {
+ 
+ enum sof_ssp_codec sof_ssp_detect_codec_type(struct device *dev);
+ enum sof_ssp_codec sof_ssp_detect_amp_type(struct device *dev);
++
++#if IS_ENABLED(CONFIG_SND_SOC_INTEL_SOF_SSP_COMMON)
+ const char *sof_ssp_get_codec_name(enum sof_ssp_codec codec_type);
++#else
++static inline const char *sof_ssp_get_codec_name(enum sof_ssp_codec codec_type)
++{
++	return NULL;
++}
++#endif
+ 
+ #endif /* __SOF_SSP_COMMON_H */
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch b/queue-6.8/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
new file mode 100644
index 00000000000..0b8e78206db
--- /dev/null
+++ b/queue-6.8/asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
@@ -0,0 +1,85 @@
+From 6e6b1908d9256b4388bd15bdc8fb20729840361b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 22:58:03 +0100
+Subject: ASoC: meson: aiu: fix function pointer type mismatch
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 98ac85a00f31d2e9d5452b825a9ed0153d934043 ]
+
+clang-16 warns about casting functions to incompatible types, as is done
+here to call clk_disable_unprepare:
+
+sound/soc/meson/aiu.c:243:12: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  243 |                                        (void(*)(void *))clk_disable_unprepare,
+
+The pattern of getting, enabling and setting a disable callback for a
+clock can be replaced with devm_clk_get_enabled(), which also fixes
+this warning.
+
+Fixes: 6ae9ca9ce986 ("ASoC: meson: aiu: add i2s and spdif support")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Link: https://msgid.link/r/20240213215807.3326688-2-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/aiu.c | 19 ++++---------------
+ sound/soc/meson/aiu.h |  1 -
+ 2 files changed, 4 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/meson/aiu.c b/sound/soc/meson/aiu.c
+index 7109b81cc3d0a..5d1419ed7a62d 100644
+--- a/sound/soc/meson/aiu.c
++++ b/sound/soc/meson/aiu.c
+@@ -212,11 +212,12 @@ static const char * const aiu_spdif_ids[] = {
+ static int aiu_clk_get(struct device *dev)
+ {
+ 	struct aiu *aiu = dev_get_drvdata(dev);
++	struct clk *pclk;
+ 	int ret;
+ 
+-	aiu->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(aiu->pclk))
+-		return dev_err_probe(dev, PTR_ERR(aiu->pclk), "Can't get the aiu pclk\n");
++	pclk = devm_clk_get_enabled(dev, "pclk");
++	if (IS_ERR(pclk))
++		return dev_err_probe(dev, PTR_ERR(pclk), "Can't get the aiu pclk\n");
+ 
+ 	aiu->spdif_mclk = devm_clk_get(dev, "spdif_mclk");
+ 	if (IS_ERR(aiu->spdif_mclk))
+@@ -233,18 +234,6 @@ static int aiu_clk_get(struct device *dev)
+ 	if (ret)
+ 		return dev_err_probe(dev, ret, "Can't get the spdif clocks\n");
+ 
+-	ret = clk_prepare_enable(aiu->pclk);
+-	if (ret) {
+-		dev_err(dev, "peripheral clock enable failed\n");
+-		return ret;
+-	}
+-
+-	ret = devm_add_action_or_reset(dev,
+-				       (void(*)(void *))clk_disable_unprepare,
+-				       aiu->pclk);
+-	if (ret)
+-		dev_err(dev, "failed to add reset action on pclk");
+-
+ 	return ret;
+ }
+ 
+diff --git a/sound/soc/meson/aiu.h b/sound/soc/meson/aiu.h
+index 393b6c2307e49..0f94c8bf60818 100644
+--- a/sound/soc/meson/aiu.h
++++ b/sound/soc/meson/aiu.h
+@@ -33,7 +33,6 @@ struct aiu_platform_data {
+ };
+ 
+ struct aiu {
+-	struct clk *pclk;
+ 	struct clk *spdif_mclk;
+ 	struct aiu_interface i2s;
+ 	struct aiu_interface spdif;
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch b/queue-6.8/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
new file mode 100644
index 00000000000..ca5abb0dc8d
--- /dev/null
+++ b/queue-6.8/asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
@@ -0,0 +1,86 @@
+From 2a371930f1b31b24f4928f13cf47c94c96ee5415 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 18:51:08 +0100
+Subject: ASoC: meson: axg-tdm-interface: add frame rate constraint
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 59c6a3a43b221cc2a211181b1298e43b2c2df782 ]
+
+According to Amlogic datasheets for the SoCs supported by this driver, the
+maximum bit clock rate is 100MHz.
+
+The tdm interface allows the rates listed by the DAI driver, regardless of
+the number slots or their width. However, these will impact the bit clock
+rate.
+
+Hitting the 100MHz limit is very unlikely for most use cases but it is
+possible.
+
+For example with 32 slots / 32 bits wide, the maximum rate is no longer
+384kHz but ~96kHz.
+
+Add the constraint accordingly if the component is not already active.
+If it is active, the rate is already constrained by the first stream rate.
+
+Fixes: d60e4f1e4be5 ("ASoC: meson: add tdm interface driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://msgid.link/r/20240223175116.2005407-3-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdm-interface.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index cd5168e826df4..2cedbce738373 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -12,6 +12,9 @@
+ 
+ #include "axg-tdm.h"
+ 
++/* Maximum bit clock frequency according the datasheets */
++#define MAX_SCLK 100000000 /* Hz */
++
+ enum {
+ 	TDM_IFACE_PAD,
+ 	TDM_IFACE_LOOPBACK,
+@@ -153,19 +156,27 @@ static int axg_tdm_iface_startup(struct snd_pcm_substream *substream,
+ 		return -EINVAL;
+ 	}
+ 
+-	/* Apply component wide rate symmetry */
+ 	if (snd_soc_component_active(dai->component)) {
++		/* Apply component wide rate symmetry */
+ 		ret = snd_pcm_hw_constraint_single(substream->runtime,
+ 						   SNDRV_PCM_HW_PARAM_RATE,
+ 						   iface->rate);
+-		if (ret < 0) {
+-			dev_err(dai->dev,
+-				"can't set iface rate constraint\n");
+-			return ret;
+-		}
++
++	} else {
++		/* Limit rate according to the slot number and width */
++		unsigned int max_rate =
++			MAX_SCLK / (iface->slots * iface->slot_width);
++		ret = snd_pcm_hw_constraint_minmax(substream->runtime,
++						   SNDRV_PCM_HW_PARAM_RATE,
++						   0, max_rate);
+ 	}
+ 
+-	return 0;
++	if (ret < 0)
++		dev_err(dai->dev, "can't set iface rate constraint\n");
++	else
++		ret = 0;
++
++	return ret;
+ }
+ 
+ static int axg_tdm_iface_set_stream(struct snd_pcm_substream *substream,
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch b/queue-6.8/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
new file mode 100644
index 00000000000..1f6a4413816
--- /dev/null
+++ b/queue-6.8/asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
@@ -0,0 +1,49 @@
+From c5ed03da79c81be070abcf1b829ae68e5b9aba6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 18:51:07 +0100
+Subject: ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit e3741a8d28a1137f8b19ae6f3d6e3be69a454a0a ]
+
+By default, when mclk-fs is not provided, the tdm-interface driver
+requests an MCLK that is 4x the bit clock, SCLK.
+
+However there is no justification for this:
+
+* If the codec needs MCLK for its operation, mclk-fs is expected to be set
+  according to the codec requirements.
+* If the codec does not need MCLK the minimum is 2 * SCLK, because this is
+  minimum the divider between SCLK and MCLK can do.
+
+Multiplying by 4 may cause problems because the PLL limit may be reached
+sooner than it should, so use 2x instead.
+
+Fixes: d60e4f1e4be5 ("ASoC: meson: add tdm interface driver")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://msgid.link/r/20240223175116.2005407-2-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/axg-tdm-interface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c
+index 1c3d433cefd23..cd5168e826df4 100644
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -264,8 +264,8 @@ static int axg_tdm_iface_set_sclk(struct snd_soc_dai *dai,
+ 	srate = iface->slots * iface->slot_width * params_rate(params);
+ 
+ 	if (!iface->mclk_rate) {
+-		/* If no specific mclk is requested, default to bit clock * 4 */
+-		clk_set_rate(iface->mclk, 4 * srate);
++		/* If no specific mclk is requested, default to bit clock * 2 */
++		clk_set_rate(iface->mclk, 2 * srate);
+ 	} else {
+ 		/* Check if we can actually get the bit clock from mclk */
+ 		if (iface->mclk_rate % srate) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch b/queue-6.8/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
new file mode 100644
index 00000000000..d91793967a0
--- /dev/null
+++ b/queue-6.8/asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
@@ -0,0 +1,83 @@
+From 1e1b885ee72c149d6c9c26c03bd16154aaf99e49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 22:58:04 +0100
+Subject: ASoC: meson: t9015: fix function pointer type mismatch
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 5ad992c71b6a8e8a547954addc7af9fbde6ca10a ]
+
+clang-16 warns about casting functions to incompatible types, as is done
+here to call clk_disable_unprepare:
+
+sound/soc/meson/t9015.c:274:4: error: cast from 'void (*)(struct clk *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  274 |                         (void(*)(void *))clk_disable_unprepare,
+
+The pattern of getting, enabling and setting a disable callback for a
+clock can be replaced with devm_clk_get_enabled(), which also fixes
+this warning.
+
+Fixes: 33901f5b9b16 ("ASoC: meson: add t9015 internal DAC driver")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Link: https://msgid.link/r/20240213215807.3326688-3-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/t9015.c | 20 ++++----------------
+ 1 file changed, 4 insertions(+), 16 deletions(-)
+
+diff --git a/sound/soc/meson/t9015.c b/sound/soc/meson/t9015.c
+index 9c6b4dac68932..571f65788c592 100644
+--- a/sound/soc/meson/t9015.c
++++ b/sound/soc/meson/t9015.c
+@@ -48,7 +48,6 @@
+ #define POWER_CFG	0x10
+ 
+ struct t9015 {
+-	struct clk *pclk;
+ 	struct regulator *avdd;
+ };
+ 
+@@ -249,6 +248,7 @@ static int t9015_probe(struct platform_device *pdev)
+ 	struct t9015 *priv;
+ 	void __iomem *regs;
+ 	struct regmap *regmap;
++	struct clk *pclk;
+ 	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -256,26 +256,14 @@ static int t9015_probe(struct platform_device *pdev)
+ 		return -ENOMEM;
+ 	platform_set_drvdata(pdev, priv);
+ 
+-	priv->pclk = devm_clk_get(dev, "pclk");
+-	if (IS_ERR(priv->pclk))
+-		return dev_err_probe(dev, PTR_ERR(priv->pclk), "failed to get core clock\n");
++	pclk = devm_clk_get_enabled(dev, "pclk");
++	if (IS_ERR(pclk))
++		return dev_err_probe(dev, PTR_ERR(pclk), "failed to get core clock\n");
+ 
+ 	priv->avdd = devm_regulator_get(dev, "AVDD");
+ 	if (IS_ERR(priv->avdd))
+ 		return dev_err_probe(dev, PTR_ERR(priv->avdd), "failed to AVDD\n");
+ 
+-	ret = clk_prepare_enable(priv->pclk);
+-	if (ret) {
+-		dev_err(dev, "core clock enable failed\n");
+-		return ret;
+-	}
+-
+-	ret = devm_add_action_or_reset(dev,
+-			(void(*)(void *))clk_disable_unprepare,
+-			priv->pclk);
+-	if (ret)
+-		return ret;
+-
+ 	ret = device_reset(dev);
+ 	if (ret) {
+ 		dev_err(dev, "reset failed\n");
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-sh-rz-ssi-fix-error-message-print.patch b/queue-6.8/asoc-sh-rz-ssi-fix-error-message-print.patch
new file mode 100644
index 00000000000..121e0806631
--- /dev/null
+++ b/queue-6.8/asoc-sh-rz-ssi-fix-error-message-print.patch
@@ -0,0 +1,39 @@
+From b1fb5dee386913912efa7e61d6611ac128411397 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 15:08:22 +0000
+Subject: ASoC: sh: rz-ssi: Fix error message print
+
+From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+
+[ Upstream commit 9a6d7c4fb2801b675a9c31a7ceb78c84b8c439bc ]
+
+The devm_request_irq() call is done for "dma_rt" interrupt but the error
+message printed "dma_tx" interrupt on failure, fix this by updating
+dma_tx -> dma_rt in dev_err_probe() message. While at it aligned the code.
+
+Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
+Fixes: 38c042b59af0248a ("ASoC: sh: rz-ssi: Update interrupt handling for half duplex channels")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://msgid.link/r/20240130150822.327434-1-prabhakar.mahadev-lad.rj@bp.renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rz-ssi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sh/rz-ssi.c b/sound/soc/sh/rz-ssi.c
+index 14cf1a41fb0d1..9d103646973ad 100644
+--- a/sound/soc/sh/rz-ssi.c
++++ b/sound/soc/sh/rz-ssi.c
+@@ -1015,7 +1015,7 @@ static int rz_ssi_probe(struct platform_device *pdev)
+ 					       dev_name(&pdev->dev), ssi);
+ 			if (ret < 0)
+ 				return dev_err_probe(&pdev->dev, ret,
+-						"irq request error (dma_tx)\n");
++						     "irq request error (dma_rt)\n");
+ 		} else {
+ 			if (ssi->irq_tx < 0)
+ 				return ssi->irq_tx;
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-sof-add-some-bounds-checking-to-firmware-data.patch b/queue-6.8/asoc-sof-add-some-bounds-checking-to-firmware-data.patch
new file mode 100644
index 00000000000..c9d9a47b86c
--- /dev/null
+++ b/queue-6.8/asoc-sof-add-some-bounds-checking-to-firmware-data.patch
@@ -0,0 +1,39 @@
+From e48b4b23fcf14a4a290317d374725bda8b56387c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 16:02:16 +0300
+Subject: ASoC: SOF: Add some bounds checking to firmware data
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 98f681b0f84cfc3a1d83287b77697679e0398306 ]
+
+Smatch complains about "head->full_size - head->header_size" can
+underflow.  To some extent, we're always going to have to trust the
+firmware a bit.  However, it's easy enough to add a check for negatives,
+and let's add a upper bounds check as well.
+
+Fixes: d2458baa799f ("ASoC: SOF: ipc3-loader: Implement firmware parsing and loading")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://msgid.link/r/5593d147-058c-4de3-a6f5-540ecb96f6f8@moroto.mountain
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc3-loader.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/sof/ipc3-loader.c b/sound/soc/sof/ipc3-loader.c
+index 28218766d2114..6e3ef06721106 100644
+--- a/sound/soc/sof/ipc3-loader.c
++++ b/sound/soc/sof/ipc3-loader.c
+@@ -148,6 +148,8 @@ static size_t sof_ipc3_fw_parse_ext_man(struct snd_sof_dev *sdev)
+ 
+ 	head = (struct sof_ext_man_header *)fw->data;
+ 	remaining = head->full_size - head->header_size;
++	if (remaining < 0 || remaining > sdev->basefw.fw->size)
++		return -EINVAL;
+ 	ext_man_size = ipc3_fw_ext_man_size(sdev, fw);
+ 
+ 	/* Assert firmware starts with extended manifest */
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-sof-amd-compute-file-paths-on-firmware-load.patch b/queue-6.8/asoc-sof-amd-compute-file-paths-on-firmware-load.patch
new file mode 100644
index 00000000000..7315ee1a602
--- /dev/null
+++ b/queue-6.8/asoc-sof-amd-compute-file-paths-on-firmware-load.patch
@@ -0,0 +1,141 @@
+From 54fd47ca0e51a12365f737d6a962e70b9fba19a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 05:07:26 +0200
+Subject: ASoC: SOF: amd: Compute file paths on firmware load
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit d9cacc1a2af2e1cd781b5cd2a3e57fbde64f5a2d ]
+
+Commit 6c393ebbd74a ("ASoC: SOF: core: Implement IPC version fallback if
+firmware files are missing") changed the order of some operations and
+the firmware paths are not available anymore at snd_sof_probe() time.
+
+Precisely, fw_filename_prefix is set by sof_select_ipc_and_paths() via
+
+  plat_data->fw_filename_prefix = out_profile.fw_path;
+
+but sof_init_environment() which calls this function was moved from
+snd_sof_device_probe() to sof_probe_continue(). Moreover,
+snd_sof_probe() was moved from sof_probe_continue() to
+sof_init_environment(), but before the call to
+sof_select_ipc_and_paths().
+
+The problem here is that amd_sof_acp_probe() uses fw_filename_prefix to
+compute fw_code_bin and fw_data_bin paths, and because the field is not
+yet initialized, the paths end up containing (null):
+
+snd_sof_amd_vangogh 0000:04:00.5: Direct firmware load for (null)/sof-vangogh-code.bin failed with error -2
+snd_sof_amd_vangogh 0000:04:00.5: sof signed firmware code bin is missing
+snd_sof_amd_vangogh 0000:04:00.5: error: failed to load DSP firmware -2
+snd_sof_amd_vangogh: probe of 0000:04:00.5 failed with error -2
+
+Move usage of fw_filename_prefix right before request_firmware() calls
+in acp_sof_load_signed_firmware().
+
+Fixes: 6c393ebbd74a ("ASoC: SOF: core: Implement IPC version fallback if firmware files are missing")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Link: https://msgid.link/r/20231219030728.2431640-9-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/amd/acp-loader.c | 32 ++++++++++++++++++++++++++------
+ sound/soc/sof/amd/acp.c        |  7 ++-----
+ 2 files changed, 28 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/sof/amd/acp-loader.c b/sound/soc/sof/amd/acp-loader.c
+index e05eb7a86dd44..d2d21478399e0 100644
+--- a/sound/soc/sof/amd/acp-loader.c
++++ b/sound/soc/sof/amd/acp-loader.c
+@@ -267,29 +267,49 @@ int acp_sof_load_signed_firmware(struct snd_sof_dev *sdev)
+ {
+ 	struct snd_sof_pdata *plat_data = sdev->pdata;
+ 	struct acp_dev_data *adata = plat_data->hw_pdata;
++	const char *fw_filename;
+ 	int ret;
+ 
+-	ret = request_firmware(&sdev->basefw.fw, adata->fw_code_bin, sdev->dev);
++	fw_filename = kasprintf(GFP_KERNEL, "%s/%s",
++				plat_data->fw_filename_prefix,
++				adata->fw_code_bin);
++	if (!fw_filename)
++		return -ENOMEM;
++
++	ret = request_firmware(&sdev->basefw.fw, fw_filename, sdev->dev);
+ 	if (ret < 0) {
++		kfree(fw_filename);
+ 		dev_err(sdev->dev, "sof signed firmware code bin is missing\n");
+ 		return ret;
+ 	} else {
+-		dev_dbg(sdev->dev, "request_firmware %s successful\n", adata->fw_code_bin);
++		dev_dbg(sdev->dev, "request_firmware %s successful\n", fw_filename);
+ 	}
++	kfree(fw_filename);
++
+ 	ret = snd_sof_dsp_block_write(sdev, SOF_FW_BLK_TYPE_IRAM, 0,
+-				      (void *)sdev->basefw.fw->data, sdev->basefw.fw->size);
++				      (void *)sdev->basefw.fw->data,
++				      sdev->basefw.fw->size);
++
++	fw_filename = kasprintf(GFP_KERNEL, "%s/%s",
++				plat_data->fw_filename_prefix,
++				adata->fw_data_bin);
++	if (!fw_filename)
++		return -ENOMEM;
+ 
+-	ret = request_firmware(&adata->fw_dbin, adata->fw_data_bin, sdev->dev);
++	ret = request_firmware(&adata->fw_dbin, fw_filename, sdev->dev);
+ 	if (ret < 0) {
++		kfree(fw_filename);
+ 		dev_err(sdev->dev, "sof signed firmware data bin is missing\n");
+ 		return ret;
+ 
+ 	} else {
+-		dev_dbg(sdev->dev, "request_firmware %s successful\n", adata->fw_data_bin);
++		dev_dbg(sdev->dev, "request_firmware %s successful\n", fw_filename);
+ 	}
++	kfree(fw_filename);
+ 
+ 	ret = snd_sof_dsp_block_write(sdev, SOF_FW_BLK_TYPE_DRAM, 0,
+-				      (void *)adata->fw_dbin->data, adata->fw_dbin->size);
++				      (void *)adata->fw_dbin->data,
++				      adata->fw_dbin->size);
+ 	return ret;
+ }
+ EXPORT_SYMBOL_NS(acp_sof_load_signed_firmware, SND_SOC_SOF_AMD_COMMON);
+diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c
+index 9aa9600c05d61..9794d64a110fd 100644
+--- a/sound/soc/sof/amd/acp.c
++++ b/sound/soc/sof/amd/acp.c
+@@ -493,7 +493,6 @@ EXPORT_SYMBOL_NS(amd_sof_acp_resume, SND_SOC_SOF_AMD_COMMON);
+ int amd_sof_acp_probe(struct snd_sof_dev *sdev)
+ {
+ 	struct pci_dev *pci = to_pci_dev(sdev->dev);
+-	struct snd_sof_pdata *plat_data = sdev->pdata;
+ 	struct acp_dev_data *adata;
+ 	const struct sof_amd_acp_desc *chip;
+ 	const struct dmi_system_id *dmi_id;
+@@ -561,8 +560,7 @@ int amd_sof_acp_probe(struct snd_sof_dev *sdev)
+ 	dmi_id = dmi_first_match(acp_sof_quirk_table);
+ 	if (dmi_id && dmi_id->driver_data) {
+ 		adata->fw_code_bin = devm_kasprintf(sdev->dev, GFP_KERNEL,
+-						    "%s/sof-%s-code.bin",
+-						    plat_data->fw_filename_prefix,
++						    "sof-%s-code.bin",
+ 						    chip->name);
+ 		if (!adata->fw_code_bin) {
+ 			ret = -ENOMEM;
+@@ -570,8 +568,7 @@ int amd_sof_acp_probe(struct snd_sof_dev *sdev)
+ 		}
+ 
+ 		adata->fw_data_bin = devm_kasprintf(sdev->dev, GFP_KERNEL,
+-						    "%s/sof-%s-data.bin",
+-						    plat_data->fw_filename_prefix,
++						    "sof-%s-data.bin",
+ 						    chip->name);
+ 		if (!adata->fw_data_bin) {
+ 			ret = -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch b/queue-6.8/asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch
new file mode 100644
index 00000000000..112c864e23c
--- /dev/null
+++ b/queue-6.8/asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch
@@ -0,0 +1,70 @@
+From f01daa17ec1396e23357655c246fb0caad51d13b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 05:07:23 +0200
+Subject: ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe()
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 222be59e5eed1554119294edc743ee548c2371d0 ]
+
+Driver uses kasprintf() to initialize fw_{code,data}_bin members of
+struct acp_dev_data, but kfree() is never called to deallocate the
+memory, which results in a memory leak.
+
+Fix the issue by switching to devm_kasprintf(). Additionally, ensure the
+allocation was successful by checking the pointer validity.
+
+Fixes: f7da88003c53 ("ASoC: SOF: amd: Enable signed firmware image loading for Vangogh platform")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Link: https://msgid.link/r/20231219030728.2431640-6-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/amd/acp.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/sof/amd/acp.c b/sound/soc/sof/amd/acp.c
+index 07632ae6ccf5e..9aa9600c05d61 100644
+--- a/sound/soc/sof/amd/acp.c
++++ b/sound/soc/sof/amd/acp.c
+@@ -560,17 +560,27 @@ int amd_sof_acp_probe(struct snd_sof_dev *sdev)
+ 	adata->signed_fw_image = false;
+ 	dmi_id = dmi_first_match(acp_sof_quirk_table);
+ 	if (dmi_id && dmi_id->driver_data) {
+-		adata->fw_code_bin = kasprintf(GFP_KERNEL, "%s/sof-%s-code.bin",
+-					       plat_data->fw_filename_prefix,
+-					       chip->name);
+-		adata->fw_data_bin = kasprintf(GFP_KERNEL, "%s/sof-%s-data.bin",
+-					       plat_data->fw_filename_prefix,
+-					       chip->name);
+-		adata->signed_fw_image = dmi_id->driver_data;
++		adata->fw_code_bin = devm_kasprintf(sdev->dev, GFP_KERNEL,
++						    "%s/sof-%s-code.bin",
++						    plat_data->fw_filename_prefix,
++						    chip->name);
++		if (!adata->fw_code_bin) {
++			ret = -ENOMEM;
++			goto free_ipc_irq;
++		}
++
++		adata->fw_data_bin = devm_kasprintf(sdev->dev, GFP_KERNEL,
++						    "%s/sof-%s-data.bin",
++						    plat_data->fw_filename_prefix,
++						    chip->name);
++		if (!adata->fw_data_bin) {
++			ret = -ENOMEM;
++			goto free_ipc_irq;
++		}
+ 
+-		dev_dbg(sdev->dev, "fw_code_bin:%s, fw_data_bin:%s\n", adata->fw_code_bin,
+-			adata->fw_data_bin);
++		adata->signed_fw_image = dmi_id->driver_data;
+ 	}
++
+ 	adata->enable_fw_debug = enable_fw_debug;
+ 	acp_memory_init(sdev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/asoc-sof-core-skip-firmware-test-for-custom-loaders.patch b/queue-6.8/asoc-sof-core-skip-firmware-test-for-custom-loaders.patch
new file mode 100644
index 00000000000..abbfe7a9214
--- /dev/null
+++ b/queue-6.8/asoc-sof-core-skip-firmware-test-for-custom-loaders.patch
@@ -0,0 +1,103 @@
+From e0c184e163223546a2fa489ebb1fe1aaa110ac16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 05:07:25 +0200
+Subject: ASoC: SOF: core: Skip firmware test for custom loaders
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 369b997a1371aeecd0a1fb0f9f4ef3747a1d07a4 ]
+
+The ACP driver for Vangogh platform uses a quirk for Valve Galileo
+device to setup a custom firmware loader, which neither requires nor
+uses the firmware file indicated via the default_fw_filename member of
+struct sof_dev_desc.
+
+Since commit 6c393ebbd74a ("ASoC: SOF: core: Implement IPC version
+fallback if firmware files are missing"), the provided filename gets
+verified and triggers a fatal error on probe:
+
+[ 7.719337] snd_sof_amd_vangogh 0000:04:00.5: enabling device (0000 -> 0002)
+[ 7.721486] snd_sof_amd_vangogh 0000:04:00.5: SOF firmware and/or topology file not found.
+[ 7.721565] snd_sof_amd_vangogh 0000:04:00.5: Supported default profiles
+[ 7.721569] snd_sof_amd_vangogh 0000:04:00.5: - ipc type 0 (Requested):
+[ 7.721573] snd_sof_amd_vangogh 0000:04:00.5:  Firmware file: amd/sof/sof-vangogh.ri
+[ 7.721577] snd_sof_amd_vangogh 0000:04:00.5:  Topology file: amd/sof-tplg/sof-vangogh-nau8821-max.tplg
+[ 7.721582] snd_sof_amd_vangogh 0000:04:00.5: Check if you have 'sof-firmware' package installed.
+[ 7.721585] snd_sof_amd_vangogh 0000:04:00.5: Optionally it can be manually downloaded from:
+[ 7.721589] snd_sof_amd_vangogh 0000:04:00.5:    https://github.com/thesofproject/sof-bin/
+[ 7.721997] snd_sof_amd_vangogh: probe of 0000:04:00.5 failed with error -2
+
+According to AMD, a combined ".ri" file which includes the code and data
+segments cannot be used due to a limitation preventing the code image to
+be signed on build time.
+
+Fix the issue by skipping the firmware file test if a custom loader is
+being used instead of the generic one.
+
+Fixes: 6c393ebbd74a ("ASoC: SOF: core: Implement IPC version fallback if firmware files are missing")
+Co-developed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Link: https://msgid.link/r/20231219030728.2431640-8-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/fw-file-profile.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sof/fw-file-profile.c b/sound/soc/sof/fw-file-profile.c
+index 138a1ca2c4a85..b56b14232444c 100644
+--- a/sound/soc/sof/fw-file-profile.c
++++ b/sound/soc/sof/fw-file-profile.c
+@@ -89,6 +89,12 @@ static int sof_test_topology_file(struct device *dev,
+ 	return ret;
+ }
+ 
++static bool sof_platform_uses_generic_loader(struct snd_sof_dev *sdev)
++{
++	return (sdev->pdata->desc->ops->load_firmware == snd_sof_load_firmware_raw ||
++		sdev->pdata->desc->ops->load_firmware == snd_sof_load_firmware_memcpy);
++}
++
+ static int
+ sof_file_profile_for_ipc_type(struct snd_sof_dev *sdev,
+ 			      enum sof_ipc_type ipc_type,
+@@ -130,7 +136,8 @@ sof_file_profile_for_ipc_type(struct snd_sof_dev *sdev,
+ 	 * For default path and firmware name do a verification before
+ 	 * continuing further.
+ 	 */
+-	if (base_profile->fw_path || base_profile->fw_name) {
++	if ((base_profile->fw_path || base_profile->fw_name) &&
++	    sof_platform_uses_generic_loader(sdev)) {
+ 		ret = sof_test_firmware_file(dev, out_profile, &ipc_type);
+ 		if (ret)
+ 			return ret;
+@@ -181,7 +188,8 @@ sof_file_profile_for_ipc_type(struct snd_sof_dev *sdev,
+ 	out_profile->ipc_type = ipc_type;
+ 
+ 	/* Test only default firmware file */
+-	if (!base_profile->fw_path && !base_profile->fw_name)
++	if ((!base_profile->fw_path && !base_profile->fw_name) &&
++	    sof_platform_uses_generic_loader(sdev))
+ 		ret = sof_test_firmware_file(dev, out_profile, NULL);
+ 
+ 	if (!ret)
+@@ -267,7 +275,11 @@ static void sof_print_profile_info(struct snd_sof_dev *sdev,
+ 
+ 	dev_info(dev, "Firmware paths/files for ipc type %d:\n", profile->ipc_type);
+ 
+-	dev_info(dev, " Firmware file:     %s/%s\n", profile->fw_path, profile->fw_name);
++	/* The firmware path is only valid when generic loader is used */
++	if (sof_platform_uses_generic_loader(sdev))
++		dev_info(dev, " Firmware file:     %s/%s\n",
++			 profile->fw_path, profile->fw_name);
++
+ 	if (profile->fw_lib_path)
+ 		dev_info(dev, " Firmware lib path: %s\n", profile->fw_lib_path);
+ 	dev_info(dev, " Topology file:     %s/%s\n", profile->tplg_path, profile->tplg_name);
+-- 
+2.43.0
+
diff --git a/queue-6.8/backlight-da9052-fully-initialize-backlight_properti.patch b/queue-6.8/backlight-da9052-fully-initialize-backlight_properti.patch
new file mode 100644
index 00000000000..068fbd0a848
--- /dev/null
+++ b/queue-6.8/backlight-da9052-fully-initialize-backlight_properti.patch
@@ -0,0 +1,37 @@
+From 2ea819fa166911fff96755b1114775aa459077d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:35:24 +0000
+Subject: backlight: da9052: Fully initialize backlight_properties during probe
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit 0285e9efaee8276305db5c52a59baf84e9731556 ]
+
+props is stack allocated and the fields that are not explcitly set
+by the probe function need to be zeroed or we'll get undefined behaviour
+(especially so power/blank states)!
+
+Fixes: 6ede3d832aaa ("backlight: add driver for DA9052/53 PMIC v1")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220153532.76613-2-daniel.thompson@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/da9052_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/da9052_bl.c b/drivers/video/backlight/da9052_bl.c
+index 1cdc8543310b4..b8ff7046510eb 100644
+--- a/drivers/video/backlight/da9052_bl.c
++++ b/drivers/video/backlight/da9052_bl.c
+@@ -117,6 +117,7 @@ static int da9052_backlight_probe(struct platform_device *pdev)
+ 	wleds->led_reg = platform_get_device_id(pdev)->driver_data;
+ 	wleds->state = DA9052_WLEDS_OFF;
+ 
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_RAW;
+ 	props.max_brightness = DA9052_MAX_BRIGHTNESS;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/backlight-hx8357-fix-potential-null-pointer-derefere.patch b/queue-6.8/backlight-hx8357-fix-potential-null-pointer-derefere.patch
new file mode 100644
index 00000000000..f5525f9e717
--- /dev/null
+++ b/queue-6.8/backlight-hx8357-fix-potential-null-pointer-derefere.patch
@@ -0,0 +1,48 @@
+From 04936e6820b559d4fde633e4a3559e3d829c4e87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Jan 2024 16:39:21 +0200
+Subject: backlight: hx8357: Fix potential NULL pointer dereference
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit b1ba8bcb2d1ffce11b308ce166c9cc28d989e3b9 ]
+
+The "im" pins are optional. Add missing check in the hx8357_probe().
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/r/642e1230-3358-4006-a17f-3f297897ae74@moroto.mountain
+Fixes: 7d84a63a39b7 ("backlight: hx8357: Convert to agnostic GPIO API")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240114143921.550736-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/hx8357.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/backlight/hx8357.c b/drivers/video/backlight/hx8357.c
+index d7298376cf74d..bf18337ff0c2c 100644
+--- a/drivers/video/backlight/hx8357.c
++++ b/drivers/video/backlight/hx8357.c
+@@ -609,11 +609,13 @@ static int hx8357_probe(struct spi_device *spi)
+ 	lcd->im_pins = devm_gpiod_get_array_optional(dev, "im", GPIOD_OUT_LOW);
+ 	if (IS_ERR(lcd->im_pins))
+ 		return dev_err_probe(dev, PTR_ERR(lcd->im_pins), "failed to request im GPIOs\n");
+-	if (lcd->im_pins->ndescs < HX8357_NUM_IM_PINS)
+-		return dev_err_probe(dev, -EINVAL, "not enough im GPIOs\n");
++	if (lcd->im_pins) {
++		if (lcd->im_pins->ndescs < HX8357_NUM_IM_PINS)
++			return dev_err_probe(dev, -EINVAL, "not enough im GPIOs\n");
+ 
+-	for (i = 0; i < HX8357_NUM_IM_PINS; i++)
+-		gpiod_set_consumer_name(lcd->im_pins->desc[i], "im_pins");
++		for (i = 0; i < HX8357_NUM_IM_PINS; i++)
++			gpiod_set_consumer_name(lcd->im_pins->desc[i], "im_pins");
++	}
+ 
+ 	lcdev = devm_lcd_device_register(&spi->dev, "mxsfb", &spi->dev, lcd,
+ 					&hx8357_ops);
+-- 
+2.43.0
+
diff --git a/queue-6.8/backlight-ktz8866-correct-the-check-for-of_property_.patch b/queue-6.8/backlight-ktz8866-correct-the-check-for-of_property_.patch
new file mode 100644
index 00000000000..97137c6945f
--- /dev/null
+++ b/queue-6.8/backlight-ktz8866-correct-the-check-for-of_property_.patch
@@ -0,0 +1,53 @@
+From d105ac2627cd92bcf66fe1ffe8a462b474d79d99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 20:28:29 +0800
+Subject: backlight: ktz8866: Correct the check for of_property_read_u32
+
+From: Jianhua Lu <lujianhua000@gmail.com>
+
+[ Upstream commit f1ac3c9825f99c93a9833beee6b78aa386e55b0b ]
+
+of_property_read_u32 returns 0 when success, so reverse the
+return value to get the true value.
+
+Fixes: f8449c8f7355 ("backlight: ktz8866: Add support for Kinetic KTZ8866 backlight")
+Signed-off-by: Jianhua Lu <lujianhua000@gmail.com>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240129122829.16248-1-lujianhua000@gmail.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/ktz8866.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/backlight/ktz8866.c b/drivers/video/backlight/ktz8866.c
+index 9c980f2571ee3..014877b5a9848 100644
+--- a/drivers/video/backlight/ktz8866.c
++++ b/drivers/video/backlight/ktz8866.c
+@@ -97,20 +97,20 @@ static void ktz8866_init(struct ktz8866 *ktz)
+ {
+ 	unsigned int val = 0;
+ 
+-	if (of_property_read_u32(ktz->client->dev.of_node, "current-num-sinks", &val))
++	if (!of_property_read_u32(ktz->client->dev.of_node, "current-num-sinks", &val))
+ 		ktz8866_write(ktz, BL_EN, BIT(val) - 1);
+ 	else
+ 		/* Enable all 6 current sinks if the number of current sinks isn't specified. */
+ 		ktz8866_write(ktz, BL_EN, BIT(6) - 1);
+ 
+-	if (of_property_read_u32(ktz->client->dev.of_node, "kinetic,current-ramp-delay-ms", &val)) {
++	if (!of_property_read_u32(ktz->client->dev.of_node, "kinetic,current-ramp-delay-ms", &val)) {
+ 		if (val <= 128)
+ 			ktz8866_write(ktz, BL_CFG2, BIT(7) | (ilog2(val) << 3) | PWM_HYST);
+ 		else
+ 			ktz8866_write(ktz, BL_CFG2, BIT(7) | ((5 + val / 64) << 3) | PWM_HYST);
+ 	}
+ 
+-	if (of_property_read_u32(ktz->client->dev.of_node, "kinetic,led-enable-ramp-delay-ms", &val)) {
++	if (!of_property_read_u32(ktz->client->dev.of_node, "kinetic,led-enable-ramp-delay-ms", &val)) {
+ 		if (val == 0)
+ 			ktz8866_write(ktz, BL_DIMMING, 0);
+ 		else {
+-- 
+2.43.0
+
diff --git a/queue-6.8/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch b/queue-6.8/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
new file mode 100644
index 00000000000..c168236b218
--- /dev/null
+++ b/queue-6.8/backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
@@ -0,0 +1,77 @@
+From 6e3b0ee4cd620d5acf771309de51fd6ad15565c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 00:11:20 +0100
+Subject: backlight: lm3630a: Don't set bl->props.brightness in get_brightness
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit 4bf7ddd2d2f0f8826f25f74c7eba4e2c323a1446 ]
+
+There's no need to set bl->props.brightness, the get_brightness function
+is just supposed to return the current brightness and not touch the
+struct.
+
+With that done we can also remove the 'goto out' and just return the
+value.
+
+Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220-lm3630a-fixups-v1-2-9ca62f7e4a33@z3ntu.xyz
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 8e275275b808f..26ff4178cc161 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -233,7 +233,7 @@ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl)
+ 		if (rval < 0)
+ 			goto out_i2c_err;
+ 		brightness |= rval;
+-		goto out;
++		return brightness;
+ 	}
+ 
+ 	/* disable sleep */
+@@ -244,11 +244,8 @@ static int lm3630a_bank_a_get_brightness(struct backlight_device *bl)
+ 	rval = lm3630a_read(pchip, REG_BRT_A);
+ 	if (rval < 0)
+ 		goto out_i2c_err;
+-	brightness = rval;
++	return rval;
+ 
+-out:
+-	bl->props.brightness = brightness;
+-	return bl->props.brightness;
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access register\n");
+ 	return 0;
+@@ -310,7 +307,7 @@ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl)
+ 		if (rval < 0)
+ 			goto out_i2c_err;
+ 		brightness |= rval;
+-		goto out;
++		return brightness;
+ 	}
+ 
+ 	/* disable sleep */
+@@ -321,11 +318,8 @@ static int lm3630a_bank_b_get_brightness(struct backlight_device *bl)
+ 	rval = lm3630a_read(pchip, REG_BRT_B);
+ 	if (rval < 0)
+ 		goto out_i2c_err;
+-	brightness = rval;
++	return rval;
+ 
+-out:
+-	bl->props.brightness = brightness;
+-	return bl->props.brightness;
+ out_i2c_err:
+ 	dev_err(pchip->dev, "i2c failed to access register\n");
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/backlight-lm3630a-initialize-backlight_properties-on.patch b/queue-6.8/backlight-lm3630a-initialize-backlight_properties-on.patch
new file mode 100644
index 00000000000..3759eb754a9
--- /dev/null
+++ b/queue-6.8/backlight-lm3630a-initialize-backlight_properties-on.patch
@@ -0,0 +1,37 @@
+From 795c3ac192365d41824b10beed4680549919e1ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 00:11:19 +0100
+Subject: backlight: lm3630a: Initialize backlight_properties on init
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit ad9aeb0e3aa90ebdad5fabf9c21783740eb95907 ]
+
+The backlight_properties struct should be initialized to zero before
+using, otherwise there will be some random values in the struct.
+
+Fixes: 0c2a665a648e ("backlight: add Backlight driver for lm3630 chip")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220-lm3630a-fixups-v1-1-9ca62f7e4a33@z3ntu.xyz
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index a3412c936ca28..8e275275b808f 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -343,6 +343,7 @@ static int lm3630a_backlight_register(struct lm3630a_chip *pchip)
+ 	struct backlight_properties props;
+ 	const char *label;
+ 
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_RAW;
+ 	if (pdata->leda_ctrl != LM3630A_LEDA_DISABLE) {
+ 		props.brightness = pdata->leda_init_brt;
+-- 
+2.43.0
+
diff --git a/queue-6.8/backlight-lm3639-fully-initialize-backlight_properti.patch b/queue-6.8/backlight-lm3639-fully-initialize-backlight_properti.patch
new file mode 100644
index 00000000000..1650571b055
--- /dev/null
+++ b/queue-6.8/backlight-lm3639-fully-initialize-backlight_properti.patch
@@ -0,0 +1,37 @@
+From 501861d0a1e5421fdac2b3ce36dbda950ee0eca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:35:25 +0000
+Subject: backlight: lm3639: Fully initialize backlight_properties during probe
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit abb5a5d951fbea3feb5c4ba179b89bb96a1d3462 ]
+
+props is stack allocated and the fields that are not explcitly set
+by the probe function need to be zeroed or we'll get undefined behaviour
+(especially so power/blank states)!
+
+Fixes: 0f59858d5119 ("backlight: add new lm3639 backlight driver")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220153532.76613-3-daniel.thompson@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3639_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c
+index 5246c171497d6..564f62acd7211 100644
+--- a/drivers/video/backlight/lm3639_bl.c
++++ b/drivers/video/backlight/lm3639_bl.c
+@@ -338,6 +338,7 @@ static int lm3639_probe(struct i2c_client *client)
+ 	}
+ 
+ 	/* backlight */
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_RAW;
+ 	props.brightness = pdata->init_brt_led;
+ 	props.max_brightness = pdata->max_brt_led;
+-- 
+2.43.0
+
diff --git a/queue-6.8/backlight-lp8788-fully-initialize-backlight_properti.patch b/queue-6.8/backlight-lp8788-fully-initialize-backlight_properti.patch
new file mode 100644
index 00000000000..13fa039f53b
--- /dev/null
+++ b/queue-6.8/backlight-lp8788-fully-initialize-backlight_properti.patch
@@ -0,0 +1,37 @@
+From ba39e23018e177fa555e72a664158b13015d5c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:35:26 +0000
+Subject: backlight: lp8788: Fully initialize backlight_properties during probe
+
+From: Daniel Thompson <daniel.thompson@linaro.org>
+
+[ Upstream commit 392346827fbe8a7fd573dfb145170d7949f639a6 ]
+
+props is stack allocated and the fields that are not explcitly set
+by the probe function need to be zeroed or we'll get undefined behaviour
+(especially so power/blank states)!
+
+Fixes: c5a51053cf3b ("backlight: add new lp8788 backlight driver")
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20240220153532.76613-4-daniel.thompson@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lp8788_bl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/backlight/lp8788_bl.c b/drivers/video/backlight/lp8788_bl.c
+index d1a14b0db265b..31f97230ee506 100644
+--- a/drivers/video/backlight/lp8788_bl.c
++++ b/drivers/video/backlight/lp8788_bl.c
+@@ -191,6 +191,7 @@ static int lp8788_backlight_register(struct lp8788_bl *bl)
+ 	int init_brt;
+ 	char *name;
+ 
++	memset(&props, 0, sizeof(struct backlight_properties));
+ 	props.type = BACKLIGHT_PLATFORM;
+ 	props.max_brightness = MAX_BRIGHTNESS;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/block-fix-deadlock-between-bd_link_disk_holder-and-p.patch b/queue-6.8/block-fix-deadlock-between-bd_link_disk_holder-and-p.patch
new file mode 100644
index 00000000000..eda7c85f8c6
--- /dev/null
+++ b/queue-6.8/block-fix-deadlock-between-bd_link_disk_holder-and-p.patch
@@ -0,0 +1,113 @@
+From d1c6037389f445c1ef19f6dbad419bc20f7aa535 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:01:22 +0800
+Subject: block: fix deadlock between bd_link_disk_holder and partition scan
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 03f12122b20b6e6028e9ed69030a49f9cffcbb75 ]
+
+'open_mutex' of gendisk is used to protect open/close block devices. But
+in bd_link_disk_holder(), it is used to protect the creation of symlink
+between holding disk and slave bdev, which introduces some issues.
+
+When bd_link_disk_holder() is called, the driver is usually in the process
+of initialization/modification and may suspend submitting io. At this
+time, any io hold 'open_mutex', such as scanning partitions, can cause
+deadlocks. For example, in raid:
+
+T1                              T2
+bdev_open_by_dev
+ lock open_mutex [1]
+ ...
+  efi_partition
+  ...
+   md_submit_bio
+				md_ioctl mddev_syspend
+				  -> suspend all io
+				 md_add_new_disk
+				  bind_rdev_to_array
+				   bd_link_disk_holder
+				    try lock open_mutex [2]
+    md_handle_request
+     -> wait mddev_resume
+
+T1 scan partition, T2 add a new device to raid. T1 waits for T2 to resume
+mddev, but T2 waits for open_mutex held by T1. Deadlock occurs.
+
+Fix it by introducing a local mutex 'blk_holder_mutex' to replace
+'open_mutex'.
+
+Fixes: 1b0a2d950ee2 ("md: use new apis to suspend array for ioctls involed array reconfiguration")
+Reported-by: mgperkow@gmail.com
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218459
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/20240221090122.1281868-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/holder.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/block/holder.c b/block/holder.c
+index 37d18c13d9581..791091a7eac23 100644
+--- a/block/holder.c
++++ b/block/holder.c
+@@ -8,6 +8,8 @@ struct bd_holder_disk {
+ 	int			refcnt;
+ };
+ 
++static DEFINE_MUTEX(blk_holder_mutex);
++
+ static struct bd_holder_disk *bd_find_holder_disk(struct block_device *bdev,
+ 						  struct gendisk *disk)
+ {
+@@ -80,7 +82,7 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk)
+ 	kobject_get(bdev->bd_holder_dir);
+ 	mutex_unlock(&bdev->bd_disk->open_mutex);
+ 
+-	mutex_lock(&disk->open_mutex);
++	mutex_lock(&blk_holder_mutex);
+ 	WARN_ON_ONCE(!bdev->bd_holder);
+ 
+ 	holder = bd_find_holder_disk(bdev, disk);
+@@ -108,7 +110,7 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk)
+ 		goto out_del_symlink;
+ 	list_add(&holder->list, &disk->slave_bdevs);
+ 
+-	mutex_unlock(&disk->open_mutex);
++	mutex_unlock(&blk_holder_mutex);
+ 	return 0;
+ 
+ out_del_symlink:
+@@ -116,7 +118,7 @@ int bd_link_disk_holder(struct block_device *bdev, struct gendisk *disk)
+ out_free_holder:
+ 	kfree(holder);
+ out_unlock:
+-	mutex_unlock(&disk->open_mutex);
++	mutex_unlock(&blk_holder_mutex);
+ 	if (ret)
+ 		kobject_put(bdev->bd_holder_dir);
+ 	return ret;
+@@ -140,7 +142,7 @@ void bd_unlink_disk_holder(struct block_device *bdev, struct gendisk *disk)
+ 	if (WARN_ON_ONCE(!disk->slave_dir))
+ 		return;
+ 
+-	mutex_lock(&disk->open_mutex);
++	mutex_lock(&blk_holder_mutex);
+ 	holder = bd_find_holder_disk(bdev, disk);
+ 	if (!WARN_ON_ONCE(holder == NULL) && !--holder->refcnt) {
+ 		del_symlink(disk->slave_dir, bdev_kobj(bdev));
+@@ -149,6 +151,6 @@ void bd_unlink_disk_holder(struct block_device *bdev, struct gendisk *disk)
+ 		list_del_init(&holder->list);
+ 		kfree(holder);
+ 	}
+-	mutex_unlock(&disk->open_mutex);
++	mutex_unlock(&blk_holder_mutex);
+ }
+ EXPORT_SYMBOL_GPL(bd_unlink_disk_holder);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-af_bluetooth-fix-deadlock.patch b/queue-6.8/bluetooth-af_bluetooth-fix-deadlock.patch
new file mode 100644
index 00000000000..3746f8437c6
--- /dev/null
+++ b/queue-6.8/bluetooth-af_bluetooth-fix-deadlock.patch
@@ -0,0 +1,90 @@
+From 6da4c8b689b547cbf8318c8fa81adb30ef93e242 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 12:58:11 -0500
+Subject: Bluetooth: af_bluetooth: Fix deadlock
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit f7b94bdc1ec107c92262716b073b3e816d4784fb ]
+
+Attemting to do sock_lock on .recvmsg may cause a deadlock as shown
+bellow, so instead of using sock_sock this uses sk_receive_queue.lock
+on bt_sock_ioctl to avoid the UAF:
+
+INFO: task kworker/u9:1:121 blocked for more than 30 seconds.
+      Not tainted 6.7.6-lemon #183
+Workqueue: hci0 hci_rx_work
+Call Trace:
+ <TASK>
+ __schedule+0x37d/0xa00
+ schedule+0x32/0xe0
+ __lock_sock+0x68/0xa0
+ ? __pfx_autoremove_wake_function+0x10/0x10
+ lock_sock_nested+0x43/0x50
+ l2cap_sock_recv_cb+0x21/0xa0
+ l2cap_recv_frame+0x55b/0x30a0
+ ? psi_task_switch+0xeb/0x270
+ ? finish_task_switch.isra.0+0x93/0x2a0
+ hci_rx_work+0x33a/0x3f0
+ process_one_work+0x13a/0x2f0
+ worker_thread+0x2f0/0x410
+ ? __pfx_worker_thread+0x10/0x10
+ kthread+0xe0/0x110
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork+0x2c/0x50
+ ? __pfx_kthread+0x10/0x10
+ ret_from_fork_asm+0x1b/0x30
+ </TASK>
+
+Fixes: 2e07e8348ea4 ("Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/af_bluetooth.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
+index b93464ac3517f..67604ccec2f42 100644
+--- a/net/bluetooth/af_bluetooth.c
++++ b/net/bluetooth/af_bluetooth.c
+@@ -309,14 +309,11 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 	if (flags & MSG_OOB)
+ 		return -EOPNOTSUPP;
+ 
+-	lock_sock(sk);
+-
+ 	skb = skb_recv_datagram(sk, flags, &err);
+ 	if (!skb) {
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN)
+ 			err = 0;
+ 
+-		release_sock(sk);
+ 		return err;
+ 	}
+ 
+@@ -346,8 +343,6 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ 
+ 	skb_free_datagram(sk, skb);
+ 
+-	release_sock(sk);
+-
+ 	if (flags & MSG_TRUNC)
+ 		copied = skblen;
+ 
+@@ -570,10 +565,11 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ 		if (sk->sk_state == BT_LISTEN)
+ 			return -EINVAL;
+ 
+-		lock_sock(sk);
++		spin_lock(&sk->sk_receive_queue.lock);
+ 		skb = skb_peek(&sk->sk_receive_queue);
+ 		amount = skb ? skb->len : 0;
+-		release_sock(sk);
++		spin_unlock(&sk->sk_receive_queue.lock);
++
+ 		err = put_user(amount, (int __user *)arg);
+ 		break;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-btrtl-fix-out-of-bounds-memory-access.patch b/queue-6.8/bluetooth-btrtl-fix-out-of-bounds-memory-access.patch
new file mode 100644
index 00000000000..1acce5b9df0
--- /dev/null
+++ b/queue-6.8/bluetooth-btrtl-fix-out-of-bounds-memory-access.patch
@@ -0,0 +1,125 @@
+From c4b1368c51804cf03672cf9153b86571260b547b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 00:37:04 +0300
+Subject: Bluetooth: btrtl: fix out of bounds memory access
+
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+
+[ Upstream commit de4e88ec58c4202efd1f02eebb4939bbf6945358 ]
+
+The problem is detected by KASAN.
+btrtl driver uses private hci data to store 'struct btrealtek_data'.
+If btrtl driver is used with btusb, then memory for private hci data
+is allocated in btusb. But no private data is allocated after hci_dev,
+when btrtl is used with hci_h5.
+
+This commit adds memory allocation for hci_h5 case.
+
+ ==================================================================
+ BUG: KASAN: slab-out-of-bounds in btrtl_initialize+0x6cc/0x958 [btrtl]
+ Write of size 8 at addr ffff00000f5a5748 by task kworker/u9:0/76
+
+ Hardware name: Pine64 PinePhone (1.2) (DT)
+ Workqueue: hci0 hci_power_on [bluetooth]
+ Call trace:
+  dump_backtrace+0x9c/0x128
+  show_stack+0x20/0x38
+  dump_stack_lvl+0x48/0x60
+  print_report+0xf8/0x5d8
+  kasan_report+0x90/0xd0
+  __asan_store8+0x9c/0xc0
+  	 [btrtl]
+  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]
+  h5_setup+0x50/0x80 [hci_uart]
+  hci_uart_setup+0xd4/0x260 [hci_uart]
+  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]
+  hci_dev_do_open+0x34/0x90 [bluetooth]
+  hci_power_on+0xc4/0x3c8 [bluetooth]
+  process_one_work+0x328/0x6f0
+  worker_thread+0x410/0x778
+  kthread+0x168/0x178
+  ret_from_fork+0x10/0x20
+
+ Allocated by task 53:
+  kasan_save_stack+0x3c/0x68
+  kasan_save_track+0x20/0x40
+  kasan_save_alloc_info+0x68/0x78
+  __kasan_kmalloc+0xd4/0xd8
+  __kmalloc+0x1b4/0x3b0
+  hci_alloc_dev_priv+0x28/0xa58 [bluetooth]
+  hci_uart_register_device+0x118/0x4f8 [hci_uart]
+  h5_serdev_probe+0xf4/0x178 [hci_uart]
+  serdev_drv_probe+0x54/0xa0
+  really_probe+0x254/0x588
+  __driver_probe_device+0xc4/0x210
+  driver_probe_device+0x64/0x160
+  __driver_attach_async_helper+0x88/0x158
+  async_run_entry_fn+0xd0/0x388
+  process_one_work+0x328/0x6f0
+  worker_thread+0x410/0x778
+  kthread+0x168/0x178
+  ret_from_fork+0x10/0x20
+
+ Last potentially related work creation:
+  kasan_save_stack+0x3c/0x68
+  __kasan_record_aux_stack+0xb0/0x150
+  kasan_record_aux_stack_noalloc+0x14/0x20
+  __queue_work+0x33c/0x960
+  queue_work_on+0x98/0xc0
+  hci_recv_frame+0xc8/0x1e8 [bluetooth]
+  h5_complete_rx_pkt+0x2c8/0x800 [hci_uart]
+  h5_rx_payload+0x98/0xb8 [hci_uart]
+  h5_recv+0x158/0x3d8 [hci_uart]
+  hci_uart_receive_buf+0xa0/0xe8 [hci_uart]
+  ttyport_receive_buf+0xac/0x178
+  flush_to_ldisc+0x130/0x2c8
+  process_one_work+0x328/0x6f0
+  worker_thread+0x410/0x778
+  kthread+0x168/0x178
+  ret_from_fork+0x10/0x20
+
+ Second to last potentially related work creation:
+  kasan_save_stack+0x3c/0x68
+  __kasan_record_aux_stack+0xb0/0x150
+  kasan_record_aux_stack_noalloc+0x14/0x20
+  __queue_work+0x788/0x960
+  queue_work_on+0x98/0xc0
+  __hci_cmd_sync_sk+0x23c/0x7a0 [bluetooth]
+  __hci_cmd_sync+0x24/0x38 [bluetooth]
+  btrtl_initialize+0x760/0x958 [btrtl]
+  h5_btrtl_setup+0xd0/0x2f8 [hci_uart]
+  h5_setup+0x50/0x80 [hci_uart]
+  hci_uart_setup+0xd4/0x260 [hci_uart]
+  hci_dev_open_sync+0x1cc/0xf68 [bluetooth]
+  hci_dev_do_open+0x34/0x90 [bluetooth]
+  hci_power_on+0xc4/0x3c8 [bluetooth]
+  process_one_work+0x328/0x6f0
+  worker_thread+0x410/0x778
+  kthread+0x168/0x178
+  ret_from_fork+0x10/0x20
+ ==================================================================
+
+Fixes: 5b355944b190 ("Bluetooth: btrtl: Add btrealtek data struct")
+Fixes: 044014ce85a1 ("Bluetooth: btrtl: Add Realtek devcoredump support")
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_h5.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index b66136348bd64..c0436881a533c 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -1072,6 +1072,7 @@ static struct h5_vnd rtl_vnd = {
+ 	.suspend	= h5_btrtl_suspend,
+ 	.resume		= h5_btrtl_resume,
+ 	.acpi_gpio_map	= acpi_btrtl_gpios,
++	.sizeof_priv    = sizeof(struct btrealtek_data),
+ };
+ 
+ static const struct h5_device_data h5_data_rtl8822cs = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-btusb-fix-memory-leak.patch b/queue-6.8/bluetooth-btusb-fix-memory-leak.patch
new file mode 100644
index 00000000000..86ec9dffa61
--- /dev/null
+++ b/queue-6.8/bluetooth-btusb-fix-memory-leak.patch
@@ -0,0 +1,68 @@
+From 1b8a74782215009c69c36bdb6c99322e3d2c0c9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 11:17:24 -0500
+Subject: Bluetooth: btusb: Fix memory leak
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 79f4127a502c5905f04da1f20a7bbe07103fb77c ]
+
+This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone
+the skb and also make sure btmtk_process_coredump frees the skb passed
+following the same logic.
+
+Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmtk.c |  4 +++-
+ drivers/bluetooth/btusb.c | 10 ++++++----
+ 2 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
+index aaabb732082cd..285418dbb43f5 100644
+--- a/drivers/bluetooth/btmtk.c
++++ b/drivers/bluetooth/btmtk.c
+@@ -372,8 +372,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
+ 	struct btmediatek_data *data = hci_get_priv(hdev);
+ 	int err;
+ 
+-	if (!IS_ENABLED(CONFIG_DEV_COREDUMP))
++	if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) {
++		kfree_skb(skb);
+ 		return 0;
++	}
+ 
+ 	switch (data->cd_info.state) {
+ 	case HCI_DEVCOREDUMP_IDLE:
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index d31edad7a0560..6cb87d47ad7d5 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -3273,7 +3273,6 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
+ {
+ 	struct btusb_data *data = hci_get_drvdata(hdev);
+ 	u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
+-	struct sk_buff *skb_cd;
+ 
+ 	switch (handle) {
+ 	case 0xfc6f:		/* Firmware dump from device */
+@@ -3286,9 +3285,12 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
+ 		 * for backward compatibility, so we have to clone the packet
+ 		 * extraly for the in-kernel coredump support.
+ 		 */
+-		skb_cd = skb_clone(skb, GFP_ATOMIC);
+-		if (skb_cd)
+-			btmtk_process_coredump(hdev, skb_cd);
++		if (IS_ENABLED(CONFIG_DEV_COREDUMP)) {
++			struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC);
++
++			if (skb_cd)
++				btmtk_process_coredump(hdev, skb_cd);
++		}
+ 
+ 		fallthrough;
+ 	case 0x05ff:		/* Firmware debug logging 1 */
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-fix-eir-name-length.patch b/queue-6.8/bluetooth-fix-eir-name-length.patch
new file mode 100644
index 00000000000..372993b3c53
--- /dev/null
+++ b/queue-6.8/bluetooth-fix-eir-name-length.patch
@@ -0,0 +1,106 @@
+From c31b8b4efa61898ab2166ab93bcb7d270ae15074 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 17:42:05 +0100
+Subject: Bluetooth: Fix eir name length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Frédéric Danis <frederic.danis@collabora.com>
+
+[ Upstream commit 2ab3e8d67fc1d4a7638b769cf83023ec209fc0a9 ]
+
+According to Section 1.2 of Core Specification Supplement Part A the
+complete or short name strings are defined as utf8s, which should not
+include the trailing NULL for variable length array as defined in Core
+Specification Vol1 Part E Section 2.9.3.
+
+Removing the trailing NULL allows PTS to retrieve the random address based
+on device name, e.g. for SM/PER/KDU/BV-02-C, SM/PER/KDU/BV-08-C or
+GAP/BROB/BCST/BV-03-C.
+
+Fixes: f61851f64b17 ("Bluetooth: Fix append max 11 bytes of name to scan rsp data")
+Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/eir.c  | 29 +++++++----------------------
+ net/bluetooth/mgmt.c |  2 +-
+ 2 files changed, 8 insertions(+), 23 deletions(-)
+
+diff --git a/net/bluetooth/eir.c b/net/bluetooth/eir.c
+index 9214189279e80..1bc51e2b05a34 100644
+--- a/net/bluetooth/eir.c
++++ b/net/bluetooth/eir.c
+@@ -13,48 +13,33 @@
+ 
+ #define PNP_INFO_SVCLASS_ID		0x1200
+ 
+-static u8 eir_append_name(u8 *eir, u16 eir_len, u8 type, u8 *data, u8 data_len)
+-{
+-	u8 name[HCI_MAX_SHORT_NAME_LENGTH + 1];
+-
+-	/* If data is already NULL terminated just pass it directly */
+-	if (data[data_len - 1] == '\0')
+-		return eir_append_data(eir, eir_len, type, data, data_len);
+-
+-	memcpy(name, data, HCI_MAX_SHORT_NAME_LENGTH);
+-	name[HCI_MAX_SHORT_NAME_LENGTH] = '\0';
+-
+-	return eir_append_data(eir, eir_len, type, name, sizeof(name));
+-}
+-
+ u8 eir_append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len)
+ {
+ 	size_t short_len;
+ 	size_t complete_len;
+ 
+-	/* no space left for name (+ NULL + type + len) */
+-	if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 3)
++	/* no space left for name (+ type + len) */
++	if ((max_adv_len(hdev) - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 2)
+ 		return ad_len;
+ 
+ 	/* use complete name if present and fits */
+ 	complete_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name));
+ 	if (complete_len && complete_len <= HCI_MAX_SHORT_NAME_LENGTH)
+-		return eir_append_name(ptr, ad_len, EIR_NAME_COMPLETE,
+-				       hdev->dev_name, complete_len + 1);
++		return eir_append_data(ptr, ad_len, EIR_NAME_COMPLETE,
++				       hdev->dev_name, complete_len);
+ 
+ 	/* use short name if present */
+ 	short_len = strnlen(hdev->short_name, sizeof(hdev->short_name));
+ 	if (short_len)
+-		return eir_append_name(ptr, ad_len, EIR_NAME_SHORT,
++		return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
+ 				       hdev->short_name,
+-				       short_len == HCI_MAX_SHORT_NAME_LENGTH ?
+-				       short_len : short_len + 1);
++				       short_len);
+ 
+ 	/* use shortened full name if present, we already know that name
+ 	 * is longer then HCI_MAX_SHORT_NAME_LENGTH
+ 	 */
+ 	if (complete_len)
+-		return eir_append_name(ptr, ad_len, EIR_NAME_SHORT,
++		return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
+ 				       hdev->dev_name,
+ 				       HCI_MAX_SHORT_NAME_LENGTH);
+ 
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index cc8efdc4ad431..640d6d54ac6ba 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -8400,7 +8400,7 @@ static int read_adv_features(struct sock *sk, struct hci_dev *hdev,
+ 
+ static u8 calculate_name_len(struct hci_dev *hdev)
+ {
+-	u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3];
++	u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */
+ 
+ 	return eir_append_local_name(hdev, buf, 0);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-fix-use-after-free-in-accessing-skb-after-.patch b/queue-6.8/bluetooth-fix-use-after-free-in-accessing-skb-after-.patch
new file mode 100644
index 00000000000..2f0c281a2cf
--- /dev/null
+++ b/queue-6.8/bluetooth-fix-use-after-free-in-accessing-skb-after-.patch
@@ -0,0 +1,61 @@
+From 0b7cf642048dbc16db86551324323eae4ad89b1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Mar 2024 19:06:23 +0200
+Subject: Bluetooth: fix use-after-free in accessing skb after sending it
+
+From: Pauli Virtanen <pav@iki.fi>
+
+[ Upstream commit 947ec0d002dce8577b655793dcc6fc78d67b7cb6 ]
+
+hci_send_cmd_sync first sends skb and then tries to clone it.  However,
+the driver may have already freed the skb at that point.
+
+Fix by cloning the sent_cmd cloned just above, instead of the original.
+
+Log:
+================================================================
+BUG: KASAN: slab-use-after-free in __copy_skb_header+0x1a/0x240
+...
+Call Trace: ..
+ __skb_clone+0x59/0x2c0
+ hci_cmd_work+0x3b3/0x3d0 [bluetooth]
+ process_one_work+0x459/0x900
+...
+Allocated by task 129: ...
+ __alloc_skb+0x1ae/0x220
+ __hci_cmd_sync_sk+0x44c/0x7a0 [bluetooth]
+ __hci_cmd_sync_status+0x24/0xb0 [bluetooth]
+ set_cig_params_sync+0x778/0x7d0 [bluetooth]
+...
+Freed by task 0: ...
+ kmem_cache_free+0x157/0x3c0
+ __usb_hcd_giveback_urb+0x11e/0x1e0
+ usb_giveback_urb_bh+0x1ad/0x2a0
+ tasklet_action_common.isra.0+0x259/0x4a0
+ __do_softirq+0x15b/0x5a7
+================================================================
+
+Fixes: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 85a91c438d721..7d5334b529834 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -4185,7 +4185,7 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
+ 	if (hci_req_status_pend(hdev) &&
+ 	    !hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
+ 		kfree_skb(hdev->req_skb);
+-		hdev->req_skb = skb_clone(skb, GFP_KERNEL);
++		hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
+ 	}
+ 
+ 	atomic_dec(&hdev->cmd_cnt);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-hci_core-cancel-request-on-command-timeout.patch b/queue-6.8/bluetooth-hci_core-cancel-request-on-command-timeout.patch
new file mode 100644
index 00000000000..9370909aac6
--- /dev/null
+++ b/queue-6.8/bluetooth-hci_core-cancel-request-on-command-timeout.patch
@@ -0,0 +1,245 @@
+From bcb39bf018fb4db5fb7d6c7f5b4eb233ac6d5226 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jan 2024 13:45:40 -0500
+Subject: Bluetooth: hci_core: Cancel request on command timeout
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 63298d6e752fc0ec7f5093860af8bc9f047b30c8 ]
+
+If command has timed out call __hci_cmd_sync_cancel to notify the
+hci_req since it will inevitably cause a timeout.
+
+This also rework the code around __hci_cmd_sync_cancel since it was
+wrongly assuming it needs to cancel timer as well, but sometimes the
+timers have not been started or in fact they already had timed out in
+which case they don't need to be cancel yet again.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Stable-dep-of: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_sync.h |  2 +-
+ net/bluetooth/hci_core.c         | 84 ++++++++++++++++++++++----------
+ net/bluetooth/hci_request.c      |  2 +-
+ net/bluetooth/hci_sync.c         | 20 ++++----
+ net/bluetooth/mgmt.c             |  2 +-
+ 5 files changed, 71 insertions(+), 39 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_sync.h b/include/net/bluetooth/hci_sync.h
+index 6efbc2152146b..e2582c2425449 100644
+--- a/include/net/bluetooth/hci_sync.h
++++ b/include/net/bluetooth/hci_sync.h
+@@ -42,7 +42,7 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
+ void hci_cmd_sync_init(struct hci_dev *hdev);
+ void hci_cmd_sync_clear(struct hci_dev *hdev);
+ void hci_cmd_sync_cancel(struct hci_dev *hdev, int err);
+-void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err);
++void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err);
+ 
+ int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
+ 			void *data, hci_cmd_sync_work_destroy_t destroy);
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 2821a42cefdc6..539305b9a0e27 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1492,10 +1492,11 @@ static void hci_cmd_timeout(struct work_struct *work)
+ 					    cmd_timer.work);
+ 
+ 	if (hdev->sent_cmd) {
+-		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
+-		u16 opcode = __le16_to_cpu(sent->opcode);
++		u16 opcode = hci_skb_opcode(hdev->sent_cmd);
+ 
+ 		bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
++
++		hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT);
+ 	} else {
+ 		bt_dev_err(hdev, "command tx timeout");
+ 	}
+@@ -2826,6 +2827,23 @@ int hci_unregister_suspend_notifier(struct hci_dev *hdev)
+ 	return ret;
+ }
+ 
++/* Cancel ongoing command synchronously:
++ *
++ * - Cancel command timer
++ * - Reset command counter
++ * - Cancel command request
++ */
++static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err)
++{
++	bt_dev_dbg(hdev, "err 0x%2.2x", err);
++
++	cancel_delayed_work_sync(&hdev->cmd_timer);
++	cancel_delayed_work_sync(&hdev->ncmd_timer);
++	atomic_set(&hdev->cmd_cnt, 1);
++
++	hci_cmd_sync_cancel_sync(hdev, -err);
++}
++
+ /* Suspend HCI device */
+ int hci_suspend_dev(struct hci_dev *hdev)
+ {
+@@ -2843,7 +2861,7 @@ int hci_suspend_dev(struct hci_dev *hdev)
+ 		return 0;
+ 
+ 	/* Cancel potentially blocking sync operation before suspend */
+-	__hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
++	hci_cancel_cmd_sync(hdev, -EHOSTDOWN);
+ 
+ 	hci_req_sync_lock(hdev);
+ 	ret = hci_suspend_sync(hdev);
+@@ -4128,6 +4146,33 @@ static void hci_rx_work(struct work_struct *work)
+ 	}
+ }
+ 
++static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
++{
++	int err;
++
++	bt_dev_dbg(hdev, "skb %p", skb);
++
++	kfree_skb(hdev->sent_cmd);
++
++	hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
++	if (!hdev->sent_cmd) {
++		skb_queue_head(&hdev->cmd_q, skb);
++		queue_work(hdev->workqueue, &hdev->cmd_work);
++		return;
++	}
++
++	err = hci_send_frame(hdev, skb);
++	if (err < 0) {
++		hci_cmd_sync_cancel_sync(hdev, err);
++		return;
++	}
++
++	if (hci_req_status_pend(hdev))
++		hci_dev_set_flag(hdev, HCI_CMD_PENDING);
++
++	atomic_dec(&hdev->cmd_cnt);
++}
++
+ static void hci_cmd_work(struct work_struct *work)
+ {
+ 	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
+@@ -4142,30 +4187,15 @@ static void hci_cmd_work(struct work_struct *work)
+ 		if (!skb)
+ 			return;
+ 
+-		kfree_skb(hdev->sent_cmd);
+-
+-		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
+-		if (hdev->sent_cmd) {
+-			int res;
+-			if (hci_req_status_pend(hdev))
+-				hci_dev_set_flag(hdev, HCI_CMD_PENDING);
+-			atomic_dec(&hdev->cmd_cnt);
++		hci_send_cmd_sync(hdev, skb);
+ 
+-			res = hci_send_frame(hdev, skb);
+-			if (res < 0)
+-				__hci_cmd_sync_cancel(hdev, -res);
+-
+-			rcu_read_lock();
+-			if (test_bit(HCI_RESET, &hdev->flags) ||
+-			    hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
+-				cancel_delayed_work(&hdev->cmd_timer);
+-			else
+-				queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
+-						   HCI_CMD_TIMEOUT);
+-			rcu_read_unlock();
+-		} else {
+-			skb_queue_head(&hdev->cmd_q, skb);
+-			queue_work(hdev->workqueue, &hdev->cmd_work);
+-		}
++		rcu_read_lock();
++		if (test_bit(HCI_RESET, &hdev->flags) ||
++		    hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
++			cancel_delayed_work(&hdev->cmd_timer);
++		else
++			queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
++					   HCI_CMD_TIMEOUT);
++		rcu_read_unlock();
+ 	}
+ }
+diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
+index 6e023b0104b03..00e02138003ec 100644
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -895,7 +895,7 @@ void hci_request_setup(struct hci_dev *hdev)
+ 
+ void hci_request_cancel_all(struct hci_dev *hdev)
+ {
+-	__hci_cmd_sync_cancel(hdev, ENODEV);
++	hci_cmd_sync_cancel_sync(hdev, ENODEV);
+ 
+ 	cancel_interleave_scan(hdev);
+ }
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 5716345a26dfb..5236fe72a8553 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -584,7 +584,7 @@ void hci_cmd_sync_clear(struct hci_dev *hdev)
+ 	mutex_unlock(&hdev->cmd_sync_work_lock);
+ }
+ 
+-void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
++void hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
+ {
+ 	bt_dev_dbg(hdev, "err 0x%2.2x", err);
+ 
+@@ -592,15 +592,17 @@ void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
+ 		hdev->req_result = err;
+ 		hdev->req_status = HCI_REQ_CANCELED;
+ 
+-		cancel_delayed_work_sync(&hdev->cmd_timer);
+-		cancel_delayed_work_sync(&hdev->ncmd_timer);
+-		atomic_set(&hdev->cmd_cnt, 1);
+-
+-		wake_up_interruptible(&hdev->req_wait_q);
++		queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
+ 	}
+ }
++EXPORT_SYMBOL(hci_cmd_sync_cancel);
+ 
+-void hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
++/* Cancel ongoing command request synchronously:
++ *
++ * - Set result and mark status to HCI_REQ_CANCELED
++ * - Wakeup command sync thread
++ */
++void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err)
+ {
+ 	bt_dev_dbg(hdev, "err 0x%2.2x", err);
+ 
+@@ -608,10 +610,10 @@ void hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
+ 		hdev->req_result = err;
+ 		hdev->req_status = HCI_REQ_CANCELED;
+ 
+-		queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
++		wake_up_interruptible(&hdev->req_wait_q);
+ 	}
+ }
+-EXPORT_SYMBOL(hci_cmd_sync_cancel);
++EXPORT_SYMBOL(hci_cmd_sync_cancel_sync);
+ 
+ /* Submit HCI command to be run in as cmd_sync_work:
+  *
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 7490092ccb2de..cc8efdc4ad431 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -1404,7 +1404,7 @@ static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
+ 
+ 	/* Cancel potentially blocking sync operation before power off */
+ 	if (cp->val == 0x00) {
+-		__hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
++		hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN);
+ 		err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd,
+ 					 mgmt_set_powered_complete);
+ 	} else {
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-hci_core-fix-possible-buffer-overflow.patch b/queue-6.8/bluetooth-hci_core-fix-possible-buffer-overflow.patch
new file mode 100644
index 00000000000..fc96ed51eef
--- /dev/null
+++ b/queue-6.8/bluetooth-hci_core-fix-possible-buffer-overflow.patch
@@ -0,0 +1,36 @@
+From 7e1ae1413802be5ad839c9ebf6a4c805002ff682 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 10:49:26 -0500
+Subject: Bluetooth: hci_core: Fix possible buffer overflow
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 81137162bfaa7278785b24c1fd2e9e74f082e8e4 ]
+
+struct hci_dev_info has a fixed size name[8] field so in the event that
+hdev->name is bigger than that strcpy would attempt to write past its
+size, so this fixes this problem by switching to use strscpy.
+
+Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 96707deef296b..85a91c438d721 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -908,7 +908,7 @@ int hci_get_dev_info(void __user *arg)
+ 	else
+ 		flags = hdev->flags;
+ 
+-	strcpy(di.name, hdev->name);
++	strscpy(di.name, hdev->name, sizeof(di.name));
+ 	di.bdaddr   = hdev->bdaddr;
+ 	di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
+ 	di.flags    = flags;
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-hci_event-fix-not-indicating-new-connectio.patch b/queue-6.8/bluetooth-hci_event-fix-not-indicating-new-connectio.patch
new file mode 100644
index 00000000000..d9e2a217869
--- /dev/null
+++ b/queue-6.8/bluetooth-hci_event-fix-not-indicating-new-connectio.patch
@@ -0,0 +1,115 @@
+From 7fc8f5f18ab4db0040c87cae25c81535210dc97d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 11:24:19 -0500
+Subject: Bluetooth: hci_event: Fix not indicating new connection for BIG Sync
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit eeda1bf97bb500a901f7a9ee5615bad2160f2378 ]
+
+BIG Sync (aka. Broadcast sink) requires to inform that the device is
+connected when a data path is active otherwise userspace could attempt
+to free resources allocated to the device object while scanning.
+
+Fixes: 1d11d70d1f6b ("Bluetooth: ISO: Pass BIG encryption info through QoS")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 21 ++++++++++++++-------
+ net/bluetooth/mgmt.c      |  4 ++++
+ 2 files changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 55daada8dc15d..9ee66b393981b 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -2524,9 +2524,7 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
+ 	 * Only those in BT_CONFIG or BT_CONNECTED states can be
+ 	 * considered connected.
+ 	 */
+-	if (conn &&
+-	    (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
+-	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
++	if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED))
+ 		mgmt_device_connected(hdev, conn, name, name_len);
+ 
+ 	if (discov->state == DISCOVERY_STOPPED)
+@@ -3758,8 +3756,9 @@ static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
+ 		bacpy(&cp.bdaddr, &conn->dst);
+ 		cp.pscan_rep_mode = 0x02;
+ 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
+-	} else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
++	} else {
+ 		mgmt_device_connected(hdev, conn, NULL, 0);
++	}
+ 
+ 	if (!hci_outgoing_auth_needed(hdev, conn)) {
+ 		conn->state = BT_CONNECTED;
+@@ -3932,6 +3931,11 @@ static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
+ 		 * last.
+ 		 */
+ 		hci_connect_cfm(conn, rp->status);
++
++		/* Notify device connected in case it is a BIG Sync */
++		if (!rp->status && test_bit(HCI_CONN_BIG_SYNC, &conn->flags))
++			mgmt_device_connected(hdev, conn, NULL, 0);
++
+ 		break;
+ 	}
+ 
+@@ -5006,8 +5010,9 @@ static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
+ 		bacpy(&cp.bdaddr, &conn->dst);
+ 		cp.pscan_rep_mode = 0x02;
+ 		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
+-	} else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
++	} else {
+ 		mgmt_device_connected(hdev, conn, NULL, 0);
++	}
+ 
+ 	if (!hci_outgoing_auth_needed(hdev, conn)) {
+ 		conn->state = BT_CONNECTED;
+@@ -5980,8 +5985,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
+ 		goto unlock;
+ 	}
+ 
+-	if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+-		mgmt_device_connected(hdev, conn, NULL, 0);
++	mgmt_device_connected(hdev, conn, NULL, 0);
+ 
+ 	conn->sec_level = BT_SECURITY_LOW;
+ 	conn->state = BT_CONFIG;
+@@ -7210,6 +7214,9 @@ static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
+ 	/* Notify iso layer */
+ 	hci_connect_cfm(pa_sync, 0x00);
+ 
++	/* Notify MGMT layer */
++	mgmt_device_connected(hdev, pa_sync, NULL, 0);
++
+ unlock:
+ 	hci_dev_unlock(hdev);
+ }
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index b2a272bc4d7c5..7490092ccb2de 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -3118,6 +3118,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
+ static u8 link_to_bdaddr(u8 link_type, u8 addr_type)
+ {
+ 	switch (link_type) {
++	case ISO_LINK:
+ 	case LE_LINK:
+ 		switch (addr_type) {
+ 		case ADDR_LE_DEV_PUBLIC:
+@@ -9610,6 +9611,9 @@ void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn,
+ 	u16 eir_len = 0;
+ 	u32 flags = 0;
+ 
++	if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
++		return;
++
+ 	/* allocate buff for LE or BR/EDR adv */
+ 	if (conn->le_adv_data_len > 0)
+ 		skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED,
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch b/queue-6.8/bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch
new file mode 100644
index 00000000000..0838663d520
--- /dev/null
+++ b/queue-6.8/bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch
@@ -0,0 +1,104 @@
+From de0768fd3e48a7cc71f561f64480c032f535e419 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 00:37:03 +0300
+Subject: Bluetooth: hci_h5: Add ability to allocate memory for private data
+
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+
+[ Upstream commit 7a6d793e9ca8bc0c1d2f0aa0a02ec380d1124c74 ]
+
+In some cases uart-base drivers may need to use priv data. For
+example, to store information needed for devcoredump.
+
+Fixes: 044014ce85a1 ("Bluetooth: btrtl: Add Realtek devcoredump support")
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_h5.c     |  4 +++-
+ drivers/bluetooth/hci_serdev.c |  9 +++++----
+ drivers/bluetooth/hci_uart.h   | 12 +++++++++++-
+ 3 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index 71e748a9477e4..b66136348bd64 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -113,6 +113,7 @@ struct h5_vnd {
+ 	int (*suspend)(struct h5 *h5);
+ 	int (*resume)(struct h5 *h5);
+ 	const struct acpi_gpio_mapping *acpi_gpio_map;
++	int sizeof_priv;
+ };
+ 
+ struct h5_device_data {
+@@ -863,7 +864,8 @@ static int h5_serdev_probe(struct serdev_device *serdev)
+ 	if (IS_ERR(h5->device_wake_gpio))
+ 		return PTR_ERR(h5->device_wake_gpio);
+ 
+-	return hci_uart_register_device(&h5->serdev_hu, &h5p);
++	return hci_uart_register_device_priv(&h5->serdev_hu, &h5p,
++					     h5->vnd->sizeof_priv);
+ }
+ 
+ static void h5_serdev_remove(struct serdev_device *serdev)
+diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
+index 39c8b567da3c0..214fff876eae5 100644
+--- a/drivers/bluetooth/hci_serdev.c
++++ b/drivers/bluetooth/hci_serdev.c
+@@ -300,8 +300,9 @@ static const struct serdev_device_ops hci_serdev_client_ops = {
+ 	.write_wakeup = hci_uart_write_wakeup,
+ };
+ 
+-int hci_uart_register_device(struct hci_uart *hu,
+-			     const struct hci_uart_proto *p)
++int hci_uart_register_device_priv(struct hci_uart *hu,
++			     const struct hci_uart_proto *p,
++			     int sizeof_priv)
+ {
+ 	int err;
+ 	struct hci_dev *hdev;
+@@ -325,7 +326,7 @@ int hci_uart_register_device(struct hci_uart *hu,
+ 	set_bit(HCI_UART_PROTO_READY, &hu->flags);
+ 
+ 	/* Initialize and register HCI device */
+-	hdev = hci_alloc_dev();
++	hdev = hci_alloc_dev_priv(sizeof_priv);
+ 	if (!hdev) {
+ 		BT_ERR("Can't allocate HCI device");
+ 		err = -ENOMEM;
+@@ -394,7 +395,7 @@ int hci_uart_register_device(struct hci_uart *hu,
+ 	percpu_free_rwsem(&hu->proto_lock);
+ 	return err;
+ }
+-EXPORT_SYMBOL_GPL(hci_uart_register_device);
++EXPORT_SYMBOL_GPL(hci_uart_register_device_priv);
+ 
+ void hci_uart_unregister_device(struct hci_uart *hu)
+ {
+diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h
+index fb4a2d0d8cc80..68c8c7e95d64d 100644
+--- a/drivers/bluetooth/hci_uart.h
++++ b/drivers/bluetooth/hci_uart.h
+@@ -97,7 +97,17 @@ struct hci_uart {
+ 
+ int hci_uart_register_proto(const struct hci_uart_proto *p);
+ int hci_uart_unregister_proto(const struct hci_uart_proto *p);
+-int hci_uart_register_device(struct hci_uart *hu, const struct hci_uart_proto *p);
++
++int hci_uart_register_device_priv(struct hci_uart *hu,
++				  const struct hci_uart_proto *p,
++				  int sizeof_priv);
++
++static inline int hci_uart_register_device(struct hci_uart *hu,
++					   const struct hci_uart_proto *p)
++{
++	return hci_uart_register_device_priv(hu, p, 0);
++}
++
+ void hci_uart_unregister_device(struct hci_uart *hu);
+ 
+ int hci_uart_tx_wakeup(struct hci_uart *hu);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch b/queue-6.8/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
new file mode 100644
index 00000000000..ce587d58527
--- /dev/null
+++ b/queue-6.8/bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
@@ -0,0 +1,59 @@
+From 00d1075da6daa567b3b47638a4a17a7763043609 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 17:40:17 +0100
+Subject: Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with
+ gpiod_get_optional()
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 56d074d26c5828773b00b2185dd7e1d08273b8e8 ]
+
+The optional variants for the gpiod_get() family of functions return NULL
+if the GPIO in question is not associated with this device. They return
+ERR_PTR() on any other error. NULL descriptors are graciously handled by
+GPIOLIB and can be safely passed to any of the GPIO consumer interfaces
+as they will return 0 and act as if the function succeeded. If one is
+using the optional variant, then there's no point in checking for NULL.
+
+Fixes: 6845667146a2 ("Bluetooth: hci_qca: Fix NULL vs IS_ERR_OR_NULL check in qca_serdev_probe")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_qca.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
+index edd2a81b4d5ed..8a60ad7acd705 100644
+--- a/drivers/bluetooth/hci_qca.c
++++ b/drivers/bluetooth/hci_qca.c
+@@ -2326,7 +2326,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 
+ 		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
+ 					       GPIOD_OUT_LOW);
+-		if (IS_ERR_OR_NULL(qcadev->bt_en) &&
++		if (IS_ERR(qcadev->bt_en) &&
+ 		    (data->soc_type == QCA_WCN6750 ||
+ 		     data->soc_type == QCA_WCN6855)) {
+ 			dev_err(&serdev->dev, "failed to acquire BT_EN gpio\n");
+@@ -2335,7 +2335,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 
+ 		qcadev->sw_ctrl = devm_gpiod_get_optional(&serdev->dev, "swctrl",
+ 					       GPIOD_IN);
+-		if (IS_ERR_OR_NULL(qcadev->sw_ctrl) &&
++		if (IS_ERR(qcadev->sw_ctrl) &&
+ 		    (data->soc_type == QCA_WCN6750 ||
+ 		     data->soc_type == QCA_WCN6855 ||
+ 		     data->soc_type == QCA_WCN7850))
+@@ -2357,7 +2357,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
+ 	default:
+ 		qcadev->bt_en = devm_gpiod_get_optional(&serdev->dev, "enable",
+ 					       GPIOD_OUT_LOW);
+-		if (IS_ERR_OR_NULL(qcadev->bt_en)) {
++		if (IS_ERR(qcadev->bt_en)) {
+ 			dev_warn(&serdev->dev, "failed to acquire enable gpio\n");
+ 			power_ctrl_enabled = false;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-hci_sync-fix-overwriting-request-callback.patch b/queue-6.8/bluetooth-hci_sync-fix-overwriting-request-callback.patch
new file mode 100644
index 00000000000..531793f3f00
--- /dev/null
+++ b/queue-6.8/bluetooth-hci_sync-fix-overwriting-request-callback.patch
@@ -0,0 +1,257 @@
+From 75d6f384c3a291ba3d7e3562803ad7eab9b147ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 16:20:11 -0500
+Subject: Bluetooth: hci_sync: Fix overwriting request callback
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit 2615fd9a7c2507eb3be3fbe49dcec88a2f56454a ]
+
+In a few cases the stack may generate commands as responses to events
+which would happen to overwrite the sent_cmd, so this attempts to store
+the request in req_skb so even if sent_cmd is replaced with a new
+command the pending request will remain in stored in req_skb.
+
+Fixes: 6a98e3836fa2 ("Bluetooth: Add helper for serialized HCI command execution")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h |  1 +
+ net/bluetooth/hci_conn.c         |  2 +-
+ net/bluetooth/hci_core.c         | 46 ++++++++++++++++++++++----------
+ net/bluetooth/hci_event.c        | 18 ++++++-------
+ net/bluetooth/hci_sync.c         | 21 ++++++++++++---
+ 5 files changed, 61 insertions(+), 27 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 8f8dd91737142..d1228857b1d0f 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -552,6 +552,7 @@ struct hci_dev {
+ 	__u32			req_status;
+ 	__u32			req_result;
+ 	struct sk_buff		*req_skb;
++	struct sk_buff		*req_rsp;
+ 
+ 	void			*smp_data;
+ 	void			*smp_bredr_data;
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index fc4d72f83ac25..ba330114d38f7 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -3010,7 +3010,7 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)
+ 		case HCI_EV_LE_CONN_COMPLETE:
+ 		case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
+ 		case HCI_EVT_LE_CIS_ESTABLISHED:
+-			hci_cmd_sync_cancel(hdev, -ECANCELED);
++			hci_cmd_sync_cancel(hdev, ECANCELED);
+ 			break;
+ 		}
+ 	}
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 539305b9a0e27..96707deef296b 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -1491,8 +1491,8 @@ static void hci_cmd_timeout(struct work_struct *work)
+ 	struct hci_dev *hdev = container_of(work, struct hci_dev,
+ 					    cmd_timer.work);
+ 
+-	if (hdev->sent_cmd) {
+-		u16 opcode = hci_skb_opcode(hdev->sent_cmd);
++	if (hdev->req_skb) {
++		u16 opcode = hci_skb_opcode(hdev->req_skb);
+ 
+ 		bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
+ 
+@@ -2796,6 +2796,7 @@ void hci_release_dev(struct hci_dev *hdev)
+ 	ida_destroy(&hdev->unset_handle_ida);
+ 	ida_simple_remove(&hci_index_ida, hdev->id);
+ 	kfree_skb(hdev->sent_cmd);
++	kfree_skb(hdev->req_skb);
+ 	kfree_skb(hdev->recv_event);
+ 	kfree(hdev);
+ }
+@@ -3125,21 +3126,33 @@ int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
+ EXPORT_SYMBOL(__hci_cmd_send);
+ 
+ /* Get data from the previously sent command */
+-void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
++static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode)
+ {
+ 	struct hci_command_hdr *hdr;
+ 
+-	if (!hdev->sent_cmd)
++	if (!skb || skb->len < HCI_COMMAND_HDR_SIZE)
+ 		return NULL;
+ 
+-	hdr = (void *) hdev->sent_cmd->data;
++	hdr = (void *)skb->data;
+ 
+ 	if (hdr->opcode != cpu_to_le16(opcode))
+ 		return NULL;
+ 
+-	BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
++	return skb->data + HCI_COMMAND_HDR_SIZE;
++}
+ 
+-	return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
++/* Get data from the previously sent command */
++void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
++{
++	void *data;
++
++	/* Check if opcode matches last sent command */
++	data = hci_cmd_data(hdev->sent_cmd, opcode);
++	if (!data)
++		/* Check if opcode matches last request */
++		data = hci_cmd_data(hdev->req_skb, opcode);
++
++	return data;
+ }
+ 
+ /* Get data from last received event */
+@@ -4040,17 +4053,19 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
+ 	if (!status && !hci_req_is_complete(hdev))
+ 		return;
+ 
++	skb = hdev->req_skb;
++
+ 	/* If this was the last command in a request the complete
+-	 * callback would be found in hdev->sent_cmd instead of the
++	 * callback would be found in hdev->req_skb instead of the
+ 	 * command queue (hdev->cmd_q).
+ 	 */
+-	if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
+-		*req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
++	if (skb && bt_cb(skb)->hci.req_flags & HCI_REQ_SKB) {
++		*req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
+ 		return;
+ 	}
+ 
+-	if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
+-		*req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
++	if (skb && bt_cb(skb)->hci.req_complete) {
++		*req_complete = bt_cb(skb)->hci.req_complete;
+ 		return;
+ 	}
+ 
+@@ -4167,8 +4182,11 @@ static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
+ 		return;
+ 	}
+ 
+-	if (hci_req_status_pend(hdev))
+-		hci_dev_set_flag(hdev, HCI_CMD_PENDING);
++	if (hci_req_status_pend(hdev) &&
++	    !hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
++		kfree_skb(hdev->req_skb);
++		hdev->req_skb = skb_clone(skb, GFP_KERNEL);
++	}
+ 
+ 	atomic_dec(&hdev->cmd_cnt);
+ }
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 9ee66b393981b..6275b14b56927 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -4381,7 +4381,7 @@ static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
+ 	 * (since for this kind of commands there will not be a command
+ 	 * complete event).
+ 	 */
+-	if (ev->status || (hdev->sent_cmd && !hci_skb_event(hdev->sent_cmd))) {
++	if (ev->status || (hdev->req_skb && !hci_skb_event(hdev->req_skb))) {
+ 		hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
+ 				     req_complete_skb);
+ 		if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
+@@ -7327,10 +7327,10 @@ static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
+ 	bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
+ 
+ 	/* Only match event if command OGF is for LE */
+-	if (hdev->sent_cmd &&
+-	    hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) == 0x08 &&
+-	    hci_skb_event(hdev->sent_cmd) == ev->subevent) {
+-		*opcode = hci_skb_opcode(hdev->sent_cmd);
++	if (hdev->req_skb &&
++	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) == 0x08 &&
++	    hci_skb_event(hdev->req_skb) == ev->subevent) {
++		*opcode = hci_skb_opcode(hdev->req_skb);
+ 		hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
+ 				     req_complete_skb);
+ 	}
+@@ -7717,10 +7717,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ 	}
+ 
+ 	/* Only match event if command OGF is not for LE */
+-	if (hdev->sent_cmd &&
+-	    hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) != 0x08 &&
+-	    hci_skb_event(hdev->sent_cmd) == event) {
+-		hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->sent_cmd),
++	if (hdev->req_skb &&
++	    hci_opcode_ogf(hci_skb_opcode(hdev->req_skb)) != 0x08 &&
++	    hci_skb_event(hdev->req_skb) == event) {
++		hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->req_skb),
+ 				     status, &req_complete, &req_complete_skb);
+ 		req_evt = event;
+ 	}
+diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
+index 5236fe72a8553..684a6ac02b80d 100644
+--- a/net/bluetooth/hci_sync.c
++++ b/net/bluetooth/hci_sync.c
+@@ -32,6 +32,10 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
+ 	hdev->req_result = result;
+ 	hdev->req_status = HCI_REQ_DONE;
+ 
++	/* Free the request command so it is not used as response */
++	kfree_skb(hdev->req_skb);
++	hdev->req_skb = NULL;
++
+ 	if (skb) {
+ 		struct sock *sk = hci_skb_sk(skb);
+ 
+@@ -39,7 +43,7 @@ static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
+ 		if (sk)
+ 			sock_put(sk);
+ 
+-		hdev->req_skb = skb_get(skb);
++		hdev->req_rsp = skb_get(skb);
+ 	}
+ 
+ 	wake_up_interruptible(&hdev->req_wait_q);
+@@ -187,8 +191,8 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
+ 
+ 	hdev->req_status = 0;
+ 	hdev->req_result = 0;
+-	skb = hdev->req_skb;
+-	hdev->req_skb = NULL;
++	skb = hdev->req_rsp;
++	hdev->req_rsp = NULL;
+ 
+ 	bt_dev_dbg(hdev, "end: err %d", err);
+ 
+@@ -4836,6 +4840,11 @@ int hci_dev_open_sync(struct hci_dev *hdev)
+ 			hdev->sent_cmd = NULL;
+ 		}
+ 
++		if (hdev->req_skb) {
++			kfree_skb(hdev->req_skb);
++			hdev->req_skb = NULL;
++		}
++
+ 		clear_bit(HCI_RUNNING, &hdev->flags);
+ 		hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
+ 
+@@ -4996,6 +5005,12 @@ int hci_dev_close_sync(struct hci_dev *hdev)
+ 		hdev->sent_cmd = NULL;
+ 	}
+ 
++	/* Drop last request */
++	if (hdev->req_skb) {
++		kfree_skb(hdev->req_skb);
++		hdev->req_skb = NULL;
++	}
++
+ 	clear_bit(HCI_RUNNING, &hdev->flags);
+ 	hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch b/queue-6.8/bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch
new file mode 100644
index 00000000000..267e655a8e5
--- /dev/null
+++ b/queue-6.8/bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch
@@ -0,0 +1,78 @@
+From 97e28c46c20c89864376b8d949490585ea9c9329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 19:02:48 +0100
+Subject: Bluetooth: mgmt: Remove leftover queuing of power_off work
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Dreßler <verdre@v0yd.nl>
+
+[ Upstream commit fee054b7579fe252f8b9e6c17b9c5bfdaa84dd7e ]
+
+Queuing of power_off work was introduced in these functions with commits
+8b064a3ad377 ("Bluetooth: Clean up HCI state when doing power off") and
+c9910d0fb4fc ("Bluetooth: Fix disconnecting connections in non-connected
+states") in an effort to clean up state and do things like disconnecting
+devices before actually powering off the device.
+
+After that, commit a3172b7eb4a2 ("Bluetooth: Add timer to force power off")
+introduced a timeout to ensure that the device actually got powered off,
+even if some of the cleanup work would never complete.
+
+This code later got refactored with commit cf75ad8b41d2 ("Bluetooth:
+hci_sync: Convert MGMT_SET_POWERED"), which made powering off the device
+synchronous and removed the need for initiating the power_off work from
+other places. The timeout mentioned above got removed too, because we now
+also made use of the command timeout during power on/off.
+
+These days the power_off work still exists, but it only seems to only be
+used for HCI_AUTO_OFF functionality, which is why we never noticed
+those two leftover places where we queue power_off work. So let's remove
+that code.
+
+Fixes: cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED")
+Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/mgmt.c | 16 ----------------
+ 1 file changed, 16 deletions(-)
+
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index ee3b4aad8bd8d..688890f581cba 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -9766,14 +9766,6 @@ void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr,
+ 	struct mgmt_ev_device_disconnected ev;
+ 	struct sock *sk = NULL;
+ 
+-	/* The connection is still in hci_conn_hash so test for 1
+-	 * instead of 0 to know if this is the last one.
+-	 */
+-	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
+-		cancel_delayed_work(&hdev->power_off);
+-		queue_work(hdev->req_workqueue, &hdev->power_off.work);
+-	}
+-
+ 	if (!mgmt_connected)
+ 		return;
+ 
+@@ -9830,14 +9822,6 @@ void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
+ {
+ 	struct mgmt_ev_connect_failed ev;
+ 
+-	/* The connection is still in hci_conn_hash so test for 1
+-	 * instead of 0 to know if this is the last one.
+-	 */
+-	if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) {
+-		cancel_delayed_work(&hdev->power_off);
+-		queue_work(hdev->req_workqueue, &hdev->power_off.work);
+-	}
+-
+ 	bacpy(&ev.addr.bdaddr, bdaddr);
+ 	ev.addr.type = link_to_bdaddr(link_type, addr_type);
+ 	ev.status = mgmt_status(status);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-msft-fix-memory-leak.patch b/queue-6.8/bluetooth-msft-fix-memory-leak.patch
new file mode 100644
index 00000000000..993c2558eb6
--- /dev/null
+++ b/queue-6.8/bluetooth-msft-fix-memory-leak.patch
@@ -0,0 +1,42 @@
+From 1a058990cf39bfcb3bd8153451408ebdb402baaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 10:56:49 -0500
+Subject: Bluetooth: msft: Fix memory leak
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit a6e06258f4c31eba0fcd503e19828b5f8fe7b08b ]
+
+Fix leaking buffer allocated to send MSFT_OP_LE_MONITOR_ADVERTISEMENT.
+
+Fixes: 9e14606d8f38 ("Bluetooth: msft: Extended monitor tracking by address filter")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/msft.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
+index 630e3023273b2..9612c5d1b13f6 100644
+--- a/net/bluetooth/msft.c
++++ b/net/bluetooth/msft.c
+@@ -875,6 +875,7 @@ static int msft_add_address_filter_sync(struct hci_dev *hdev, void *data)
+ 		remove = true;
+ 		goto done;
+ 	}
++
+ 	cp->sub_opcode           = MSFT_OP_LE_MONITOR_ADVERTISEMENT;
+ 	cp->rssi_high		 = address_filter->rssi_high;
+ 	cp->rssi_low		 = address_filter->rssi_low;
+@@ -887,6 +888,8 @@ static int msft_add_address_filter_sync(struct hci_dev *hdev, void *data)
+ 
+ 	skb = __hci_cmd_sync(hdev, hdev->msft_opcode, size, cp,
+ 			     HCI_CMD_TIMEOUT);
++	kfree(cp);
++
+ 	if (IS_ERR(skb)) {
+ 		bt_dev_err(hdev, "Failed to enable address %pMR filter",
+ 			   &address_filter->bdaddr);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-remove-bt_hs.patch b/queue-6.8/bluetooth-remove-bt_hs.patch
new file mode 100644
index 00000000000..651c93c78fc
--- /dev/null
+++ b/queue-6.8/bluetooth-remove-bt_hs.patch
@@ -0,0 +1,3573 @@
+From 7b71d52eae6e57cd36ef4b9f67d509f91a49d83e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 11:18:58 -0500
+Subject: Bluetooth: Remove BT_HS
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit e7b02296fb400ee64822fbdd81a0718449066333 ]
+
+High Speed, Alternate MAC and PHY (AMP) extension, has been removed from
+Bluetooth Core specification on 5.3:
+
+https://www.bluetooth.com/blog/new-core-specification-v5-3-feature-enhancements/
+
+Fixes: 244bc377591c ("Bluetooth: Add BT_HS config option")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci.h   |    1 -
+ include/net/bluetooth/l2cap.h |   42 --
+ net/bluetooth/Kconfig         |    8 -
+ net/bluetooth/Makefile        |    1 -
+ net/bluetooth/a2mp.c          | 1054 --------------------------------
+ net/bluetooth/a2mp.h          |  154 -----
+ net/bluetooth/amp.c           |  590 ------------------
+ net/bluetooth/amp.h           |   60 --
+ net/bluetooth/hci_conn.c      |    4 -
+ net/bluetooth/hci_event.c     |    2 -
+ net/bluetooth/l2cap_core.c    | 1069 +--------------------------------
+ net/bluetooth/l2cap_sock.c    |   18 +-
+ net/bluetooth/mgmt.c          |   73 +--
+ 13 files changed, 20 insertions(+), 3056 deletions(-)
+ delete mode 100644 net/bluetooth/a2mp.c
+ delete mode 100644 net/bluetooth/a2mp.h
+ delete mode 100644 net/bluetooth/amp.c
+ delete mode 100644 net/bluetooth/amp.h
+
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index f7918c7551834..0d231024570a3 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -393,7 +393,6 @@ enum {
+ 	HCI_LIMITED_PRIVACY,
+ 	HCI_RPA_EXPIRED,
+ 	HCI_RPA_RESOLVING,
+-	HCI_HS_ENABLED,
+ 	HCI_LE_ENABLED,
+ 	HCI_ADVERTISING,
+ 	HCI_ADVERTISING_CONNECTABLE,
+diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
+index cf393e72d6ed6..92d7197f9a563 100644
+--- a/include/net/bluetooth/l2cap.h
++++ b/include/net/bluetooth/l2cap.h
+@@ -59,8 +59,6 @@
+ #define L2CAP_WAIT_ACK_POLL_PERIOD	msecs_to_jiffies(200)
+ #define L2CAP_WAIT_ACK_TIMEOUT		msecs_to_jiffies(10000)
+ 
+-#define L2CAP_A2MP_DEFAULT_MTU		670
+-
+ /* L2CAP socket address */
+ struct sockaddr_l2 {
+ 	sa_family_t	l2_family;
+@@ -109,12 +107,6 @@ struct l2cap_conninfo {
+ #define L2CAP_ECHO_RSP		0x09
+ #define L2CAP_INFO_REQ		0x0a
+ #define L2CAP_INFO_RSP		0x0b
+-#define L2CAP_CREATE_CHAN_REQ	0x0c
+-#define L2CAP_CREATE_CHAN_RSP	0x0d
+-#define L2CAP_MOVE_CHAN_REQ	0x0e
+-#define L2CAP_MOVE_CHAN_RSP	0x0f
+-#define L2CAP_MOVE_CHAN_CFM	0x10
+-#define L2CAP_MOVE_CHAN_CFM_RSP	0x11
+ #define L2CAP_CONN_PARAM_UPDATE_REQ	0x12
+ #define L2CAP_CONN_PARAM_UPDATE_RSP	0x13
+ #define L2CAP_LE_CONN_REQ	0x14
+@@ -144,7 +136,6 @@ struct l2cap_conninfo {
+ /* L2CAP fixed channels */
+ #define L2CAP_FC_SIG_BREDR	0x02
+ #define L2CAP_FC_CONNLESS	0x04
+-#define L2CAP_FC_A2MP		0x08
+ #define L2CAP_FC_ATT		0x10
+ #define L2CAP_FC_SIG_LE		0x20
+ #define L2CAP_FC_SMP_LE		0x40
+@@ -267,7 +258,6 @@ struct l2cap_conn_rsp {
+ /* channel identifier */
+ #define L2CAP_CID_SIGNALING	0x0001
+ #define L2CAP_CID_CONN_LESS	0x0002
+-#define L2CAP_CID_A2MP		0x0003
+ #define L2CAP_CID_ATT		0x0004
+ #define L2CAP_CID_LE_SIGNALING	0x0005
+ #define L2CAP_CID_SMP		0x0006
+@@ -282,7 +272,6 @@ struct l2cap_conn_rsp {
+ #define L2CAP_CR_BAD_PSM	0x0002
+ #define L2CAP_CR_SEC_BLOCK	0x0003
+ #define L2CAP_CR_NO_MEM		0x0004
+-#define L2CAP_CR_BAD_AMP	0x0005
+ #define L2CAP_CR_INVALID_SCID	0x0006
+ #define L2CAP_CR_SCID_IN_USE	0x0007
+ 
+@@ -404,29 +393,6 @@ struct l2cap_info_rsp {
+ 	__u8        data[];
+ } __packed;
+ 
+-struct l2cap_create_chan_req {
+-	__le16      psm;
+-	__le16      scid;
+-	__u8        amp_id;
+-} __packed;
+-
+-struct l2cap_create_chan_rsp {
+-	__le16      dcid;
+-	__le16      scid;
+-	__le16      result;
+-	__le16      status;
+-} __packed;
+-
+-struct l2cap_move_chan_req {
+-	__le16      icid;
+-	__u8        dest_amp_id;
+-} __packed;
+-
+-struct l2cap_move_chan_rsp {
+-	__le16      icid;
+-	__le16      result;
+-} __packed;
+-
+ #define L2CAP_MR_SUCCESS	0x0000
+ #define L2CAP_MR_PEND		0x0001
+ #define L2CAP_MR_BAD_ID		0x0002
+@@ -539,8 +505,6 @@ struct l2cap_seq_list {
+ 
+ struct l2cap_chan {
+ 	struct l2cap_conn	*conn;
+-	struct hci_conn		*hs_hcon;
+-	struct hci_chan		*hs_hchan;
+ 	struct kref	kref;
+ 	atomic_t	nesting;
+ 
+@@ -591,12 +555,6 @@ struct l2cap_chan {
+ 	unsigned long	conn_state;
+ 	unsigned long	flags;
+ 
+-	__u8		remote_amp_id;
+-	__u8		local_amp_id;
+-	__u8		move_id;
+-	__u8		move_state;
+-	__u8		move_role;
+-
+ 	__u16		next_tx_seq;
+ 	__u16		expected_ack_seq;
+ 	__u16		expected_tx_seq;
+diff --git a/net/bluetooth/Kconfig b/net/bluetooth/Kconfig
+index da7cac0a1b716..6b2b65a667008 100644
+--- a/net/bluetooth/Kconfig
++++ b/net/bluetooth/Kconfig
+@@ -62,14 +62,6 @@ source "net/bluetooth/cmtp/Kconfig"
+ 
+ source "net/bluetooth/hidp/Kconfig"
+ 
+-config BT_HS
+-	bool "Bluetooth High Speed (HS) features"
+-	depends on BT_BREDR
+-	help
+-	  Bluetooth High Speed includes support for off-loading
+-	  Bluetooth connections via 802.11 (wifi) physical layer
+-	  available with Bluetooth version 3.0 or later.
+-
+ config BT_LE
+ 	bool "Bluetooth Low Energy (LE) features"
+ 	depends on BT
+diff --git a/net/bluetooth/Makefile b/net/bluetooth/Makefile
+index 141ac1fda0bfa..628d448d78be3 100644
+--- a/net/bluetooth/Makefile
++++ b/net/bluetooth/Makefile
+@@ -21,7 +21,6 @@ bluetooth-$(CONFIG_DEV_COREDUMP) += coredump.o
+ 
+ bluetooth-$(CONFIG_BT_BREDR) += sco.o
+ bluetooth-$(CONFIG_BT_LE) += iso.o
+-bluetooth-$(CONFIG_BT_HS) += a2mp.o amp.o
+ bluetooth-$(CONFIG_BT_LEDS) += leds.o
+ bluetooth-$(CONFIG_BT_MSFTEXT) += msft.o
+ bluetooth-$(CONFIG_BT_AOSPEXT) += aosp.o
+diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
+deleted file mode 100644
+index e7adb8a98cf90..0000000000000
+--- a/net/bluetooth/a2mp.c
++++ /dev/null
+@@ -1,1054 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+-   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
+-   Copyright (c) 2011,2012 Intel Corp.
+-
+-*/
+-
+-#include <net/bluetooth/bluetooth.h>
+-#include <net/bluetooth/hci_core.h>
+-#include <net/bluetooth/l2cap.h>
+-
+-#include "hci_request.h"
+-#include "a2mp.h"
+-#include "amp.h"
+-
+-#define A2MP_FEAT_EXT	0x8000
+-
+-/* Global AMP Manager list */
+-static LIST_HEAD(amp_mgr_list);
+-static DEFINE_MUTEX(amp_mgr_list_lock);
+-
+-/* A2MP build & send command helper functions */
+-static struct a2mp_cmd *__a2mp_build(u8 code, u8 ident, u16 len, void *data)
+-{
+-	struct a2mp_cmd *cmd;
+-	int plen;
+-
+-	plen = sizeof(*cmd) + len;
+-	cmd = kzalloc(plen, GFP_KERNEL);
+-	if (!cmd)
+-		return NULL;
+-
+-	cmd->code = code;
+-	cmd->ident = ident;
+-	cmd->len = cpu_to_le16(len);
+-
+-	memcpy(cmd->data, data, len);
+-
+-	return cmd;
+-}
+-
+-static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len, void *data)
+-{
+-	struct l2cap_chan *chan = mgr->a2mp_chan;
+-	struct a2mp_cmd *cmd;
+-	u16 total_len = len + sizeof(*cmd);
+-	struct kvec iv;
+-	struct msghdr msg;
+-
+-	cmd = __a2mp_build(code, ident, len, data);
+-	if (!cmd)
+-		return;
+-
+-	iv.iov_base = cmd;
+-	iv.iov_len = total_len;
+-
+-	memset(&msg, 0, sizeof(msg));
+-
+-	iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, &iv, 1, total_len);
+-
+-	l2cap_chan_send(chan, &msg, total_len);
+-
+-	kfree(cmd);
+-}
+-
+-static u8 __next_ident(struct amp_mgr *mgr)
+-{
+-	if (++mgr->ident == 0)
+-		mgr->ident = 1;
+-
+-	return mgr->ident;
+-}
+-
+-static struct amp_mgr *amp_mgr_lookup_by_state(u8 state)
+-{
+-	struct amp_mgr *mgr;
+-
+-	mutex_lock(&amp_mgr_list_lock);
+-	list_for_each_entry(mgr, &amp_mgr_list, list) {
+-		if (test_and_clear_bit(state, &mgr->state)) {
+-			amp_mgr_get(mgr);
+-			mutex_unlock(&amp_mgr_list_lock);
+-			return mgr;
+-		}
+-	}
+-	mutex_unlock(&amp_mgr_list_lock);
+-
+-	return NULL;
+-}
+-
+-/* hci_dev_list shall be locked */
+-static void __a2mp_add_cl(struct amp_mgr *mgr, struct a2mp_cl *cl)
+-{
+-	struct hci_dev *hdev;
+-	int i = 1;
+-
+-	cl[0].id = AMP_ID_BREDR;
+-	cl[0].type = AMP_TYPE_BREDR;
+-	cl[0].status = AMP_STATUS_BLUETOOTH_ONLY;
+-
+-	list_for_each_entry(hdev, &hci_dev_list, list) {
+-		if (hdev->dev_type == HCI_AMP) {
+-			cl[i].id = hdev->id;
+-			cl[i].type = hdev->amp_type;
+-			if (test_bit(HCI_UP, &hdev->flags))
+-				cl[i].status = hdev->amp_status;
+-			else
+-				cl[i].status = AMP_STATUS_POWERED_DOWN;
+-			i++;
+-		}
+-	}
+-}
+-
+-/* Processing A2MP messages */
+-static int a2mp_command_rej(struct amp_mgr *mgr, struct sk_buff *skb,
+-			    struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_cmd_rej *rej = (void *) skb->data;
+-
+-	if (le16_to_cpu(hdr->len) < sizeof(*rej))
+-		return -EINVAL;
+-
+-	BT_DBG("ident %u reason %d", hdr->ident, le16_to_cpu(rej->reason));
+-
+-	skb_pull(skb, sizeof(*rej));
+-
+-	return 0;
+-}
+-
+-static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb,
+-			     struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_discov_req *req = (void *) skb->data;
+-	u16 len = le16_to_cpu(hdr->len);
+-	struct a2mp_discov_rsp *rsp;
+-	u16 ext_feat;
+-	u8 num_ctrl;
+-	struct hci_dev *hdev;
+-
+-	if (len < sizeof(*req))
+-		return -EINVAL;
+-
+-	skb_pull(skb, sizeof(*req));
+-
+-	ext_feat = le16_to_cpu(req->ext_feat);
+-
+-	BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(req->mtu), ext_feat);
+-
+-	/* check that packet is not broken for now */
+-	while (ext_feat & A2MP_FEAT_EXT) {
+-		if (len < sizeof(ext_feat))
+-			return -EINVAL;
+-
+-		ext_feat = get_unaligned_le16(skb->data);
+-		BT_DBG("efm 0x%4.4x", ext_feat);
+-		len -= sizeof(ext_feat);
+-		skb_pull(skb, sizeof(ext_feat));
+-	}
+-
+-	read_lock(&hci_dev_list_lock);
+-
+-	/* at minimum the BR/EDR needs to be listed */
+-	num_ctrl = 1;
+-
+-	list_for_each_entry(hdev, &hci_dev_list, list) {
+-		if (hdev->dev_type == HCI_AMP)
+-			num_ctrl++;
+-	}
+-
+-	len = struct_size(rsp, cl, num_ctrl);
+-	rsp = kmalloc(len, GFP_ATOMIC);
+-	if (!rsp) {
+-		read_unlock(&hci_dev_list_lock);
+-		return -ENOMEM;
+-	}
+-
+-	rsp->mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
+-	rsp->ext_feat = 0;
+-
+-	__a2mp_add_cl(mgr, rsp->cl);
+-
+-	read_unlock(&hci_dev_list_lock);
+-
+-	a2mp_send(mgr, A2MP_DISCOVER_RSP, hdr->ident, len, rsp);
+-
+-	kfree(rsp);
+-	return 0;
+-}
+-
+-static int a2mp_discover_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
+-			     struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_discov_rsp *rsp = (void *) skb->data;
+-	u16 len = le16_to_cpu(hdr->len);
+-	struct a2mp_cl *cl;
+-	u16 ext_feat;
+-	bool found = false;
+-
+-	if (len < sizeof(*rsp))
+-		return -EINVAL;
+-
+-	len -= sizeof(*rsp);
+-	skb_pull(skb, sizeof(*rsp));
+-
+-	ext_feat = le16_to_cpu(rsp->ext_feat);
+-
+-	BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(rsp->mtu), ext_feat);
+-
+-	/* check that packet is not broken for now */
+-	while (ext_feat & A2MP_FEAT_EXT) {
+-		if (len < sizeof(ext_feat))
+-			return -EINVAL;
+-
+-		ext_feat = get_unaligned_le16(skb->data);
+-		BT_DBG("efm 0x%4.4x", ext_feat);
+-		len -= sizeof(ext_feat);
+-		skb_pull(skb, sizeof(ext_feat));
+-	}
+-
+-	cl = (void *) skb->data;
+-	while (len >= sizeof(*cl)) {
+-		BT_DBG("Remote AMP id %u type %u status %u", cl->id, cl->type,
+-		       cl->status);
+-
+-		if (cl->id != AMP_ID_BREDR && cl->type != AMP_TYPE_BREDR) {
+-			struct a2mp_info_req req;
+-
+-			found = true;
+-
+-			memset(&req, 0, sizeof(req));
+-
+-			req.id = cl->id;
+-			a2mp_send(mgr, A2MP_GETINFO_REQ, __next_ident(mgr),
+-				  sizeof(req), &req);
+-		}
+-
+-		len -= sizeof(*cl);
+-		cl = skb_pull(skb, sizeof(*cl));
+-	}
+-
+-	/* Fall back to L2CAP init sequence */
+-	if (!found) {
+-		struct l2cap_conn *conn = mgr->l2cap_conn;
+-		struct l2cap_chan *chan;
+-
+-		mutex_lock(&conn->chan_lock);
+-
+-		list_for_each_entry(chan, &conn->chan_l, list) {
+-
+-			BT_DBG("chan %p state %s", chan,
+-			       state_to_string(chan->state));
+-
+-			if (chan->scid == L2CAP_CID_A2MP)
+-				continue;
+-
+-			l2cap_chan_lock(chan);
+-
+-			if (chan->state == BT_CONNECT)
+-				l2cap_send_conn_req(chan);
+-
+-			l2cap_chan_unlock(chan);
+-		}
+-
+-		mutex_unlock(&conn->chan_lock);
+-	}
+-
+-	return 0;
+-}
+-
+-static int a2mp_change_notify(struct amp_mgr *mgr, struct sk_buff *skb,
+-			      struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_cl *cl = (void *) skb->data;
+-
+-	while (skb->len >= sizeof(*cl)) {
+-		BT_DBG("Controller id %u type %u status %u", cl->id, cl->type,
+-		       cl->status);
+-		cl = skb_pull(skb, sizeof(*cl));
+-	}
+-
+-	/* TODO send A2MP_CHANGE_RSP */
+-
+-	return 0;
+-}
+-
+-static void read_local_amp_info_complete(struct hci_dev *hdev, u8 status,
+-					 u16 opcode)
+-{
+-	BT_DBG("%s status 0x%2.2x", hdev->name, status);
+-
+-	a2mp_send_getinfo_rsp(hdev);
+-}
+-
+-static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
+-			    struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_info_req *req  = (void *) skb->data;
+-	struct hci_dev *hdev;
+-	struct hci_request hreq;
+-	int err = 0;
+-
+-	if (le16_to_cpu(hdr->len) < sizeof(*req))
+-		return -EINVAL;
+-
+-	BT_DBG("id %u", req->id);
+-
+-	hdev = hci_dev_get(req->id);
+-	if (!hdev || hdev->dev_type != HCI_AMP) {
+-		struct a2mp_info_rsp rsp;
+-
+-		memset(&rsp, 0, sizeof(rsp));
+-
+-		rsp.id = req->id;
+-		rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+-
+-		a2mp_send(mgr, A2MP_GETINFO_RSP, hdr->ident, sizeof(rsp),
+-			  &rsp);
+-
+-		goto done;
+-	}
+-
+-	set_bit(READ_LOC_AMP_INFO, &mgr->state);
+-	hci_req_init(&hreq, hdev);
+-	hci_req_add(&hreq, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
+-	err = hci_req_run(&hreq, read_local_amp_info_complete);
+-	if (err < 0)
+-		a2mp_send_getinfo_rsp(hdev);
+-
+-done:
+-	if (hdev)
+-		hci_dev_put(hdev);
+-
+-	skb_pull(skb, sizeof(*req));
+-	return 0;
+-}
+-
+-static int a2mp_getinfo_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
+-			    struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_info_rsp *rsp = (struct a2mp_info_rsp *) skb->data;
+-	struct a2mp_amp_assoc_req req;
+-	struct amp_ctrl *ctrl;
+-
+-	if (le16_to_cpu(hdr->len) < sizeof(*rsp))
+-		return -EINVAL;
+-
+-	BT_DBG("id %u status 0x%2.2x", rsp->id, rsp->status);
+-
+-	if (rsp->status)
+-		return -EINVAL;
+-
+-	ctrl = amp_ctrl_add(mgr, rsp->id);
+-	if (!ctrl)
+-		return -ENOMEM;
+-
+-	memset(&req, 0, sizeof(req));
+-
+-	req.id = rsp->id;
+-	a2mp_send(mgr, A2MP_GETAMPASSOC_REQ, __next_ident(mgr), sizeof(req),
+-		  &req);
+-
+-	skb_pull(skb, sizeof(*rsp));
+-	return 0;
+-}
+-
+-static int a2mp_getampassoc_req(struct amp_mgr *mgr, struct sk_buff *skb,
+-				struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_amp_assoc_req *req = (void *) skb->data;
+-	struct hci_dev *hdev;
+-	struct amp_mgr *tmp;
+-
+-	if (le16_to_cpu(hdr->len) < sizeof(*req))
+-		return -EINVAL;
+-
+-	BT_DBG("id %u", req->id);
+-
+-	/* Make sure that other request is not processed */
+-	tmp = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC);
+-
+-	hdev = hci_dev_get(req->id);
+-	if (!hdev || hdev->amp_type == AMP_TYPE_BREDR || tmp) {
+-		struct a2mp_amp_assoc_rsp rsp;
+-
+-		memset(&rsp, 0, sizeof(rsp));
+-		rsp.id = req->id;
+-
+-		if (tmp) {
+-			rsp.status = A2MP_STATUS_COLLISION_OCCURED;
+-			amp_mgr_put(tmp);
+-		} else {
+-			rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+-		}
+-
+-		a2mp_send(mgr, A2MP_GETAMPASSOC_RSP, hdr->ident, sizeof(rsp),
+-			  &rsp);
+-
+-		goto done;
+-	}
+-
+-	amp_read_loc_assoc(hdev, mgr);
+-
+-done:
+-	if (hdev)
+-		hci_dev_put(hdev);
+-
+-	skb_pull(skb, sizeof(*req));
+-	return 0;
+-}
+-
+-static int a2mp_getampassoc_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
+-				struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_amp_assoc_rsp *rsp = (void *) skb->data;
+-	u16 len = le16_to_cpu(hdr->len);
+-	struct hci_dev *hdev;
+-	struct amp_ctrl *ctrl;
+-	struct hci_conn *hcon;
+-	size_t assoc_len;
+-
+-	if (len < sizeof(*rsp))
+-		return -EINVAL;
+-
+-	assoc_len = len - sizeof(*rsp);
+-
+-	BT_DBG("id %u status 0x%2.2x assoc len %zu", rsp->id, rsp->status,
+-	       assoc_len);
+-
+-	if (rsp->status)
+-		return -EINVAL;
+-
+-	/* Save remote ASSOC data */
+-	ctrl = amp_ctrl_lookup(mgr, rsp->id);
+-	if (ctrl) {
+-		u8 *assoc;
+-
+-		assoc = kmemdup(rsp->amp_assoc, assoc_len, GFP_KERNEL);
+-		if (!assoc) {
+-			amp_ctrl_put(ctrl);
+-			return -ENOMEM;
+-		}
+-
+-		ctrl->assoc = assoc;
+-		ctrl->assoc_len = assoc_len;
+-		ctrl->assoc_rem_len = assoc_len;
+-		ctrl->assoc_len_so_far = 0;
+-
+-		amp_ctrl_put(ctrl);
+-	}
+-
+-	/* Create Phys Link */
+-	hdev = hci_dev_get(rsp->id);
+-	if (!hdev)
+-		return -EINVAL;
+-
+-	hcon = phylink_add(hdev, mgr, rsp->id, true);
+-	if (!hcon)
+-		goto done;
+-
+-	BT_DBG("Created hcon %p: loc:%u -> rem:%u", hcon, hdev->id, rsp->id);
+-
+-	mgr->bredr_chan->remote_amp_id = rsp->id;
+-
+-	amp_create_phylink(hdev, mgr, hcon);
+-
+-done:
+-	hci_dev_put(hdev);
+-	skb_pull(skb, len);
+-	return 0;
+-}
+-
+-static int a2mp_createphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+-				   struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_physlink_req *req = (void *) skb->data;
+-	struct a2mp_physlink_rsp rsp;
+-	struct hci_dev *hdev;
+-	struct hci_conn *hcon;
+-	struct amp_ctrl *ctrl;
+-
+-	if (le16_to_cpu(hdr->len) < sizeof(*req))
+-		return -EINVAL;
+-
+-	BT_DBG("local_id %u, remote_id %u", req->local_id, req->remote_id);
+-
+-	memset(&rsp, 0, sizeof(rsp));
+-
+-	rsp.local_id = req->remote_id;
+-	rsp.remote_id = req->local_id;
+-
+-	hdev = hci_dev_get(req->remote_id);
+-	if (!hdev || hdev->amp_type == AMP_TYPE_BREDR) {
+-		rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+-		goto send_rsp;
+-	}
+-
+-	ctrl = amp_ctrl_lookup(mgr, rsp.remote_id);
+-	if (!ctrl) {
+-		ctrl = amp_ctrl_add(mgr, rsp.remote_id);
+-		if (ctrl) {
+-			amp_ctrl_get(ctrl);
+-		} else {
+-			rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
+-			goto send_rsp;
+-		}
+-	}
+-
+-	if (ctrl) {
+-		size_t assoc_len = le16_to_cpu(hdr->len) - sizeof(*req);
+-		u8 *assoc;
+-
+-		assoc = kmemdup(req->amp_assoc, assoc_len, GFP_KERNEL);
+-		if (!assoc) {
+-			amp_ctrl_put(ctrl);
+-			hci_dev_put(hdev);
+-			return -ENOMEM;
+-		}
+-
+-		ctrl->assoc = assoc;
+-		ctrl->assoc_len = assoc_len;
+-		ctrl->assoc_rem_len = assoc_len;
+-		ctrl->assoc_len_so_far = 0;
+-
+-		amp_ctrl_put(ctrl);
+-	}
+-
+-	hcon = phylink_add(hdev, mgr, req->local_id, false);
+-	if (hcon) {
+-		amp_accept_phylink(hdev, mgr, hcon);
+-		rsp.status = A2MP_STATUS_SUCCESS;
+-	} else {
+-		rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
+-	}
+-
+-send_rsp:
+-	if (hdev)
+-		hci_dev_put(hdev);
+-
+-	/* Reply error now and success after HCI Write Remote AMP Assoc
+-	   command complete with success status
+-	 */
+-	if (rsp.status != A2MP_STATUS_SUCCESS) {
+-		a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, hdr->ident,
+-			  sizeof(rsp), &rsp);
+-	} else {
+-		set_bit(WRITE_REMOTE_AMP_ASSOC, &mgr->state);
+-		mgr->ident = hdr->ident;
+-	}
+-
+-	skb_pull(skb, le16_to_cpu(hdr->len));
+-	return 0;
+-}
+-
+-static int a2mp_discphyslink_req(struct amp_mgr *mgr, struct sk_buff *skb,
+-				 struct a2mp_cmd *hdr)
+-{
+-	struct a2mp_physlink_req *req = (void *) skb->data;
+-	struct a2mp_physlink_rsp rsp;
+-	struct hci_dev *hdev;
+-	struct hci_conn *hcon;
+-
+-	if (le16_to_cpu(hdr->len) < sizeof(*req))
+-		return -EINVAL;
+-
+-	BT_DBG("local_id %u remote_id %u", req->local_id, req->remote_id);
+-
+-	memset(&rsp, 0, sizeof(rsp));
+-
+-	rsp.local_id = req->remote_id;
+-	rsp.remote_id = req->local_id;
+-	rsp.status = A2MP_STATUS_SUCCESS;
+-
+-	hdev = hci_dev_get(req->remote_id);
+-	if (!hdev) {
+-		rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+-		goto send_rsp;
+-	}
+-
+-	hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
+-				       &mgr->l2cap_conn->hcon->dst);
+-	if (!hcon) {
+-		bt_dev_err(hdev, "no phys link exist");
+-		rsp.status = A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS;
+-		goto clean;
+-	}
+-
+-	/* TODO Disconnect Phys Link here */
+-
+-clean:
+-	hci_dev_put(hdev);
+-
+-send_rsp:
+-	a2mp_send(mgr, A2MP_DISCONNPHYSLINK_RSP, hdr->ident, sizeof(rsp), &rsp);
+-
+-	skb_pull(skb, sizeof(*req));
+-	return 0;
+-}
+-
+-static inline int a2mp_cmd_rsp(struct amp_mgr *mgr, struct sk_buff *skb,
+-			       struct a2mp_cmd *hdr)
+-{
+-	BT_DBG("ident %u code 0x%2.2x", hdr->ident, hdr->code);
+-
+-	skb_pull(skb, le16_to_cpu(hdr->len));
+-	return 0;
+-}
+-
+-/* Handle A2MP signalling */
+-static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
+-{
+-	struct a2mp_cmd *hdr;
+-	struct amp_mgr *mgr = chan->data;
+-	int err = 0;
+-
+-	amp_mgr_get(mgr);
+-
+-	while (skb->len >= sizeof(*hdr)) {
+-		u16 len;
+-
+-		hdr = (void *) skb->data;
+-		len = le16_to_cpu(hdr->len);
+-
+-		BT_DBG("code 0x%2.2x id %u len %u", hdr->code, hdr->ident, len);
+-
+-		skb_pull(skb, sizeof(*hdr));
+-
+-		if (len > skb->len || !hdr->ident) {
+-			err = -EINVAL;
+-			break;
+-		}
+-
+-		mgr->ident = hdr->ident;
+-
+-		switch (hdr->code) {
+-		case A2MP_COMMAND_REJ:
+-			a2mp_command_rej(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_DISCOVER_REQ:
+-			err = a2mp_discover_req(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_CHANGE_NOTIFY:
+-			err = a2mp_change_notify(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_GETINFO_REQ:
+-			err = a2mp_getinfo_req(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_GETAMPASSOC_REQ:
+-			err = a2mp_getampassoc_req(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_CREATEPHYSLINK_REQ:
+-			err = a2mp_createphyslink_req(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_DISCONNPHYSLINK_REQ:
+-			err = a2mp_discphyslink_req(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_DISCOVER_RSP:
+-			err = a2mp_discover_rsp(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_GETINFO_RSP:
+-			err = a2mp_getinfo_rsp(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_GETAMPASSOC_RSP:
+-			err = a2mp_getampassoc_rsp(mgr, skb, hdr);
+-			break;
+-
+-		case A2MP_CHANGE_RSP:
+-		case A2MP_CREATEPHYSLINK_RSP:
+-		case A2MP_DISCONNPHYSLINK_RSP:
+-			err = a2mp_cmd_rsp(mgr, skb, hdr);
+-			break;
+-
+-		default:
+-			BT_ERR("Unknown A2MP sig cmd 0x%2.2x", hdr->code);
+-			err = -EINVAL;
+-			break;
+-		}
+-	}
+-
+-	if (err) {
+-		struct a2mp_cmd_rej rej;
+-
+-		memset(&rej, 0, sizeof(rej));
+-
+-		rej.reason = cpu_to_le16(0);
+-		hdr = (void *) skb->data;
+-
+-		BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
+-
+-		a2mp_send(mgr, A2MP_COMMAND_REJ, hdr->ident, sizeof(rej),
+-			  &rej);
+-	}
+-
+-	/* Always free skb and return success error code to prevent
+-	   from sending L2CAP Disconnect over A2MP channel */
+-	kfree_skb(skb);
+-
+-	amp_mgr_put(mgr);
+-
+-	return 0;
+-}
+-
+-static void a2mp_chan_close_cb(struct l2cap_chan *chan)
+-{
+-	l2cap_chan_put(chan);
+-}
+-
+-static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state,
+-				      int err)
+-{
+-	struct amp_mgr *mgr = chan->data;
+-
+-	if (!mgr)
+-		return;
+-
+-	BT_DBG("chan %p state %s", chan, state_to_string(state));
+-
+-	chan->state = state;
+-
+-	switch (state) {
+-	case BT_CLOSED:
+-		if (mgr)
+-			amp_mgr_put(mgr);
+-		break;
+-	}
+-}
+-
+-static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan,
+-					      unsigned long hdr_len,
+-					      unsigned long len, int nb)
+-{
+-	struct sk_buff *skb;
+-
+-	skb = bt_skb_alloc(hdr_len + len, GFP_KERNEL);
+-	if (!skb)
+-		return ERR_PTR(-ENOMEM);
+-
+-	return skb;
+-}
+-
+-static const struct l2cap_ops a2mp_chan_ops = {
+-	.name = "L2CAP A2MP channel",
+-	.recv = a2mp_chan_recv_cb,
+-	.close = a2mp_chan_close_cb,
+-	.state_change = a2mp_chan_state_change_cb,
+-	.alloc_skb = a2mp_chan_alloc_skb_cb,
+-
+-	/* Not implemented for A2MP */
+-	.new_connection = l2cap_chan_no_new_connection,
+-	.teardown = l2cap_chan_no_teardown,
+-	.ready = l2cap_chan_no_ready,
+-	.defer = l2cap_chan_no_defer,
+-	.resume = l2cap_chan_no_resume,
+-	.set_shutdown = l2cap_chan_no_set_shutdown,
+-	.get_sndtimeo = l2cap_chan_no_get_sndtimeo,
+-};
+-
+-static struct l2cap_chan *a2mp_chan_open(struct l2cap_conn *conn, bool locked)
+-{
+-	struct l2cap_chan *chan;
+-	int err;
+-
+-	chan = l2cap_chan_create();
+-	if (!chan)
+-		return NULL;
+-
+-	BT_DBG("chan %p", chan);
+-
+-	chan->chan_type = L2CAP_CHAN_FIXED;
+-	chan->scid = L2CAP_CID_A2MP;
+-	chan->dcid = L2CAP_CID_A2MP;
+-	chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
+-	chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
+-	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+-
+-	chan->ops = &a2mp_chan_ops;
+-
+-	l2cap_chan_set_defaults(chan);
+-	chan->remote_max_tx = chan->max_tx;
+-	chan->remote_tx_win = chan->tx_win;
+-
+-	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
+-	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+-
+-	skb_queue_head_init(&chan->tx_q);
+-
+-	chan->mode = L2CAP_MODE_ERTM;
+-
+-	err = l2cap_ertm_init(chan);
+-	if (err < 0) {
+-		l2cap_chan_del(chan, 0);
+-		return NULL;
+-	}
+-
+-	chan->conf_state = 0;
+-
+-	if (locked)
+-		__l2cap_chan_add(conn, chan);
+-	else
+-		l2cap_chan_add(conn, chan);
+-
+-	chan->remote_mps = chan->omtu;
+-	chan->mps = chan->omtu;
+-
+-	chan->state = BT_CONNECTED;
+-
+-	return chan;
+-}
+-
+-/* AMP Manager functions */
+-struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr)
+-{
+-	BT_DBG("mgr %p orig refcnt %d", mgr, kref_read(&mgr->kref));
+-
+-	kref_get(&mgr->kref);
+-
+-	return mgr;
+-}
+-
+-static void amp_mgr_destroy(struct kref *kref)
+-{
+-	struct amp_mgr *mgr = container_of(kref, struct amp_mgr, kref);
+-
+-	BT_DBG("mgr %p", mgr);
+-
+-	mutex_lock(&amp_mgr_list_lock);
+-	list_del(&mgr->list);
+-	mutex_unlock(&amp_mgr_list_lock);
+-
+-	amp_ctrl_list_flush(mgr);
+-	kfree(mgr);
+-}
+-
+-int amp_mgr_put(struct amp_mgr *mgr)
+-{
+-	BT_DBG("mgr %p orig refcnt %d", mgr, kref_read(&mgr->kref));
+-
+-	return kref_put(&mgr->kref, &amp_mgr_destroy);
+-}
+-
+-static struct amp_mgr *amp_mgr_create(struct l2cap_conn *conn, bool locked)
+-{
+-	struct amp_mgr *mgr;
+-	struct l2cap_chan *chan;
+-
+-	mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
+-	if (!mgr)
+-		return NULL;
+-
+-	BT_DBG("conn %p mgr %p", conn, mgr);
+-
+-	mgr->l2cap_conn = conn;
+-
+-	chan = a2mp_chan_open(conn, locked);
+-	if (!chan) {
+-		kfree(mgr);
+-		return NULL;
+-	}
+-
+-	mgr->a2mp_chan = chan;
+-	chan->data = mgr;
+-
+-	conn->hcon->amp_mgr = mgr;
+-
+-	kref_init(&mgr->kref);
+-
+-	/* Remote AMP ctrl list initialization */
+-	INIT_LIST_HEAD(&mgr->amp_ctrls);
+-	mutex_init(&mgr->amp_ctrls_lock);
+-
+-	mutex_lock(&amp_mgr_list_lock);
+-	list_add(&mgr->list, &amp_mgr_list);
+-	mutex_unlock(&amp_mgr_list_lock);
+-
+-	return mgr;
+-}
+-
+-struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+-				       struct sk_buff *skb)
+-{
+-	struct amp_mgr *mgr;
+-
+-	if (conn->hcon->type != ACL_LINK)
+-		return NULL;
+-
+-	mgr = amp_mgr_create(conn, false);
+-	if (!mgr) {
+-		BT_ERR("Could not create AMP manager");
+-		return NULL;
+-	}
+-
+-	BT_DBG("mgr: %p chan %p", mgr, mgr->a2mp_chan);
+-
+-	return mgr->a2mp_chan;
+-}
+-
+-void a2mp_send_getinfo_rsp(struct hci_dev *hdev)
+-{
+-	struct amp_mgr *mgr;
+-	struct a2mp_info_rsp rsp;
+-
+-	mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_INFO);
+-	if (!mgr)
+-		return;
+-
+-	BT_DBG("%s mgr %p", hdev->name, mgr);
+-
+-	memset(&rsp, 0, sizeof(rsp));
+-
+-	rsp.id = hdev->id;
+-	rsp.status = A2MP_STATUS_INVALID_CTRL_ID;
+-
+-	if (hdev->amp_type != AMP_TYPE_BREDR) {
+-		rsp.status = 0;
+-		rsp.total_bw = cpu_to_le32(hdev->amp_total_bw);
+-		rsp.max_bw = cpu_to_le32(hdev->amp_max_bw);
+-		rsp.min_latency = cpu_to_le32(hdev->amp_min_latency);
+-		rsp.pal_cap = cpu_to_le16(hdev->amp_pal_cap);
+-		rsp.assoc_size = cpu_to_le16(hdev->amp_assoc_size);
+-	}
+-
+-	a2mp_send(mgr, A2MP_GETINFO_RSP, mgr->ident, sizeof(rsp), &rsp);
+-	amp_mgr_put(mgr);
+-}
+-
+-void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status)
+-{
+-	struct amp_mgr *mgr;
+-	struct amp_assoc *loc_assoc = &hdev->loc_assoc;
+-	struct a2mp_amp_assoc_rsp *rsp;
+-	size_t len;
+-
+-	mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC);
+-	if (!mgr)
+-		return;
+-
+-	BT_DBG("%s mgr %p", hdev->name, mgr);
+-
+-	len = sizeof(struct a2mp_amp_assoc_rsp) + loc_assoc->len;
+-	rsp = kzalloc(len, GFP_KERNEL);
+-	if (!rsp) {
+-		amp_mgr_put(mgr);
+-		return;
+-	}
+-
+-	rsp->id = hdev->id;
+-
+-	if (status) {
+-		rsp->status = A2MP_STATUS_INVALID_CTRL_ID;
+-	} else {
+-		rsp->status = A2MP_STATUS_SUCCESS;
+-		memcpy(rsp->amp_assoc, loc_assoc->data, loc_assoc->len);
+-	}
+-
+-	a2mp_send(mgr, A2MP_GETAMPASSOC_RSP, mgr->ident, len, rsp);
+-	amp_mgr_put(mgr);
+-	kfree(rsp);
+-}
+-
+-void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status)
+-{
+-	struct amp_mgr *mgr;
+-	struct amp_assoc *loc_assoc = &hdev->loc_assoc;
+-	struct a2mp_physlink_req *req;
+-	struct l2cap_chan *bredr_chan;
+-	size_t len;
+-
+-	mgr = amp_mgr_lookup_by_state(READ_LOC_AMP_ASSOC_FINAL);
+-	if (!mgr)
+-		return;
+-
+-	len = sizeof(*req) + loc_assoc->len;
+-
+-	BT_DBG("%s mgr %p assoc_len %zu", hdev->name, mgr, len);
+-
+-	req = kzalloc(len, GFP_KERNEL);
+-	if (!req) {
+-		amp_mgr_put(mgr);
+-		return;
+-	}
+-
+-	bredr_chan = mgr->bredr_chan;
+-	if (!bredr_chan)
+-		goto clean;
+-
+-	req->local_id = hdev->id;
+-	req->remote_id = bredr_chan->remote_amp_id;
+-	memcpy(req->amp_assoc, loc_assoc->data, loc_assoc->len);
+-
+-	a2mp_send(mgr, A2MP_CREATEPHYSLINK_REQ, __next_ident(mgr), len, req);
+-
+-clean:
+-	amp_mgr_put(mgr);
+-	kfree(req);
+-}
+-
+-void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status)
+-{
+-	struct amp_mgr *mgr;
+-	struct a2mp_physlink_rsp rsp;
+-	struct hci_conn *hs_hcon;
+-
+-	mgr = amp_mgr_lookup_by_state(WRITE_REMOTE_AMP_ASSOC);
+-	if (!mgr)
+-		return;
+-
+-	memset(&rsp, 0, sizeof(rsp));
+-
+-	hs_hcon = hci_conn_hash_lookup_state(hdev, AMP_LINK, BT_CONNECT);
+-	if (!hs_hcon) {
+-		rsp.status = A2MP_STATUS_UNABLE_START_LINK_CREATION;
+-	} else {
+-		rsp.remote_id = hs_hcon->remote_id;
+-		rsp.status = A2MP_STATUS_SUCCESS;
+-	}
+-
+-	BT_DBG("%s mgr %p hs_hcon %p status %u", hdev->name, mgr, hs_hcon,
+-	       status);
+-
+-	rsp.local_id = hdev->id;
+-	a2mp_send(mgr, A2MP_CREATEPHYSLINK_RSP, mgr->ident, sizeof(rsp), &rsp);
+-	amp_mgr_put(mgr);
+-}
+-
+-void a2mp_discover_amp(struct l2cap_chan *chan)
+-{
+-	struct l2cap_conn *conn = chan->conn;
+-	struct amp_mgr *mgr = conn->hcon->amp_mgr;
+-	struct a2mp_discov_req req;
+-
+-	BT_DBG("chan %p conn %p mgr %p", chan, conn, mgr);
+-
+-	if (!mgr) {
+-		mgr = amp_mgr_create(conn, true);
+-		if (!mgr)
+-			return;
+-	}
+-
+-	mgr->bredr_chan = chan;
+-
+-	memset(&req, 0, sizeof(req));
+-
+-	req.mtu = cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
+-	req.ext_feat = 0;
+-	a2mp_send(mgr, A2MP_DISCOVER_REQ, 1, sizeof(req), &req);
+-}
+diff --git a/net/bluetooth/a2mp.h b/net/bluetooth/a2mp.h
+deleted file mode 100644
+index 2fd253a61a2a1..0000000000000
+--- a/net/bluetooth/a2mp.h
++++ /dev/null
+@@ -1,154 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only */
+-/*
+-   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
+-   Copyright (c) 2011,2012 Intel Corp.
+-
+-*/
+-
+-#ifndef __A2MP_H
+-#define __A2MP_H
+-
+-#include <net/bluetooth/l2cap.h>
+-
+-enum amp_mgr_state {
+-	READ_LOC_AMP_INFO,
+-	READ_LOC_AMP_ASSOC,
+-	READ_LOC_AMP_ASSOC_FINAL,
+-	WRITE_REMOTE_AMP_ASSOC,
+-};
+-
+-struct amp_mgr {
+-	struct list_head	list;
+-	struct l2cap_conn	*l2cap_conn;
+-	struct l2cap_chan	*a2mp_chan;
+-	struct l2cap_chan	*bredr_chan;
+-	struct kref		kref;
+-	__u8			ident;
+-	__u8			handle;
+-	unsigned long		state;
+-	unsigned long		flags;
+-
+-	struct list_head	amp_ctrls;
+-	struct mutex		amp_ctrls_lock;
+-};
+-
+-struct a2mp_cmd {
+-	__u8	code;
+-	__u8	ident;
+-	__le16	len;
+-	__u8	data[];
+-} __packed;
+-
+-/* A2MP command codes */
+-#define A2MP_COMMAND_REJ         0x01
+-struct a2mp_cmd_rej {
+-	__le16	reason;
+-	__u8	data[];
+-} __packed;
+-
+-#define A2MP_DISCOVER_REQ        0x02
+-struct a2mp_discov_req {
+-	__le16	mtu;
+-	__le16	ext_feat;
+-} __packed;
+-
+-struct a2mp_cl {
+-	__u8	id;
+-	__u8	type;
+-	__u8	status;
+-} __packed;
+-
+-#define A2MP_DISCOVER_RSP        0x03
+-struct a2mp_discov_rsp {
+-	__le16     mtu;
+-	__le16     ext_feat;
+-	struct a2mp_cl cl[];
+-} __packed;
+-
+-#define A2MP_CHANGE_NOTIFY       0x04
+-#define A2MP_CHANGE_RSP          0x05
+-
+-#define A2MP_GETINFO_REQ         0x06
+-struct a2mp_info_req {
+-	__u8       id;
+-} __packed;
+-
+-#define A2MP_GETINFO_RSP         0x07
+-struct a2mp_info_rsp {
+-	__u8	id;
+-	__u8	status;
+-	__le32	total_bw;
+-	__le32	max_bw;
+-	__le32	min_latency;
+-	__le16	pal_cap;
+-	__le16	assoc_size;
+-} __packed;
+-
+-#define A2MP_GETAMPASSOC_REQ     0x08
+-struct a2mp_amp_assoc_req {
+-	__u8	id;
+-} __packed;
+-
+-#define A2MP_GETAMPASSOC_RSP     0x09
+-struct a2mp_amp_assoc_rsp {
+-	__u8	id;
+-	__u8	status;
+-	__u8	amp_assoc[];
+-} __packed;
+-
+-#define A2MP_CREATEPHYSLINK_REQ  0x0A
+-#define A2MP_DISCONNPHYSLINK_REQ 0x0C
+-struct a2mp_physlink_req {
+-	__u8	local_id;
+-	__u8	remote_id;
+-	__u8	amp_assoc[];
+-} __packed;
+-
+-#define A2MP_CREATEPHYSLINK_RSP  0x0B
+-#define A2MP_DISCONNPHYSLINK_RSP 0x0D
+-struct a2mp_physlink_rsp {
+-	__u8	local_id;
+-	__u8	remote_id;
+-	__u8	status;
+-} __packed;
+-
+-/* A2MP response status */
+-#define A2MP_STATUS_SUCCESS			0x00
+-#define A2MP_STATUS_INVALID_CTRL_ID		0x01
+-#define A2MP_STATUS_UNABLE_START_LINK_CREATION	0x02
+-#define A2MP_STATUS_NO_PHYSICAL_LINK_EXISTS	0x02
+-#define A2MP_STATUS_COLLISION_OCCURED		0x03
+-#define A2MP_STATUS_DISCONN_REQ_RECVD		0x04
+-#define A2MP_STATUS_PHYS_LINK_EXISTS		0x05
+-#define A2MP_STATUS_SECURITY_VIOLATION		0x06
+-
+-struct amp_mgr *amp_mgr_get(struct amp_mgr *mgr);
+-
+-#if IS_ENABLED(CONFIG_BT_HS)
+-int amp_mgr_put(struct amp_mgr *mgr);
+-struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+-				       struct sk_buff *skb);
+-void a2mp_discover_amp(struct l2cap_chan *chan);
+-#else
+-static inline int amp_mgr_put(struct amp_mgr *mgr)
+-{
+-	return 0;
+-}
+-
+-static inline struct l2cap_chan *a2mp_channel_create(struct l2cap_conn *conn,
+-						     struct sk_buff *skb)
+-{
+-	return NULL;
+-}
+-
+-static inline void a2mp_discover_amp(struct l2cap_chan *chan)
+-{
+-}
+-#endif
+-
+-void a2mp_send_getinfo_rsp(struct hci_dev *hdev);
+-void a2mp_send_getampassoc_rsp(struct hci_dev *hdev, u8 status);
+-void a2mp_send_create_phy_link_req(struct hci_dev *hdev, u8 status);
+-void a2mp_send_create_phy_link_rsp(struct hci_dev *hdev, u8 status);
+-
+-#endif /* __A2MP_H */
+diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
+deleted file mode 100644
+index 5d698f19868c5..0000000000000
+--- a/net/bluetooth/amp.c
++++ /dev/null
+@@ -1,590 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+-   Copyright (c) 2011,2012 Intel Corp.
+-
+-*/
+-
+-#include <net/bluetooth/bluetooth.h>
+-#include <net/bluetooth/hci.h>
+-#include <net/bluetooth/hci_core.h>
+-#include <crypto/hash.h>
+-
+-#include "hci_request.h"
+-#include "a2mp.h"
+-#include "amp.h"
+-
+-/* Remote AMP Controllers interface */
+-void amp_ctrl_get(struct amp_ctrl *ctrl)
+-{
+-	BT_DBG("ctrl %p orig refcnt %d", ctrl,
+-	       kref_read(&ctrl->kref));
+-
+-	kref_get(&ctrl->kref);
+-}
+-
+-static void amp_ctrl_destroy(struct kref *kref)
+-{
+-	struct amp_ctrl *ctrl = container_of(kref, struct amp_ctrl, kref);
+-
+-	BT_DBG("ctrl %p", ctrl);
+-
+-	kfree(ctrl->assoc);
+-	kfree(ctrl);
+-}
+-
+-int amp_ctrl_put(struct amp_ctrl *ctrl)
+-{
+-	BT_DBG("ctrl %p orig refcnt %d", ctrl,
+-	       kref_read(&ctrl->kref));
+-
+-	return kref_put(&ctrl->kref, &amp_ctrl_destroy);
+-}
+-
+-struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id)
+-{
+-	struct amp_ctrl *ctrl;
+-
+-	ctrl = kzalloc(sizeof(*ctrl), GFP_KERNEL);
+-	if (!ctrl)
+-		return NULL;
+-
+-	kref_init(&ctrl->kref);
+-	ctrl->id = id;
+-
+-	mutex_lock(&mgr->amp_ctrls_lock);
+-	list_add(&ctrl->list, &mgr->amp_ctrls);
+-	mutex_unlock(&mgr->amp_ctrls_lock);
+-
+-	BT_DBG("mgr %p ctrl %p", mgr, ctrl);
+-
+-	return ctrl;
+-}
+-
+-void amp_ctrl_list_flush(struct amp_mgr *mgr)
+-{
+-	struct amp_ctrl *ctrl, *n;
+-
+-	BT_DBG("mgr %p", mgr);
+-
+-	mutex_lock(&mgr->amp_ctrls_lock);
+-	list_for_each_entry_safe(ctrl, n, &mgr->amp_ctrls, list) {
+-		list_del(&ctrl->list);
+-		amp_ctrl_put(ctrl);
+-	}
+-	mutex_unlock(&mgr->amp_ctrls_lock);
+-}
+-
+-struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id)
+-{
+-	struct amp_ctrl *ctrl;
+-
+-	BT_DBG("mgr %p id %u", mgr, id);
+-
+-	mutex_lock(&mgr->amp_ctrls_lock);
+-	list_for_each_entry(ctrl, &mgr->amp_ctrls, list) {
+-		if (ctrl->id == id) {
+-			amp_ctrl_get(ctrl);
+-			mutex_unlock(&mgr->amp_ctrls_lock);
+-			return ctrl;
+-		}
+-	}
+-	mutex_unlock(&mgr->amp_ctrls_lock);
+-
+-	return NULL;
+-}
+-
+-/* Physical Link interface */
+-static u8 __next_handle(struct amp_mgr *mgr)
+-{
+-	if (++mgr->handle == 0)
+-		mgr->handle = 1;
+-
+-	return mgr->handle;
+-}
+-
+-struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr,
+-			     u8 remote_id, bool out)
+-{
+-	bdaddr_t *dst = &mgr->l2cap_conn->hcon->dst;
+-	struct hci_conn *hcon;
+-	u8 role = out ? HCI_ROLE_MASTER : HCI_ROLE_SLAVE;
+-
+-	hcon = hci_conn_add(hdev, AMP_LINK, dst, role, __next_handle(mgr));
+-	if (!hcon)
+-		return NULL;
+-
+-	BT_DBG("hcon %p dst %pMR", hcon, dst);
+-
+-	hcon->state = BT_CONNECT;
+-	hcon->attempt++;
+-	hcon->remote_id = remote_id;
+-	hcon->amp_mgr = amp_mgr_get(mgr);
+-
+-	return hcon;
+-}
+-
+-/* AMP crypto key generation interface */
+-static int hmac_sha256(u8 *key, u8 ksize, char *plaintext, u8 psize, u8 *output)
+-{
+-	struct crypto_shash *tfm;
+-	struct shash_desc *shash;
+-	int ret;
+-
+-	if (!ksize)
+-		return -EINVAL;
+-
+-	tfm = crypto_alloc_shash("hmac(sha256)", 0, 0);
+-	if (IS_ERR(tfm)) {
+-		BT_DBG("crypto_alloc_ahash failed: err %ld", PTR_ERR(tfm));
+-		return PTR_ERR(tfm);
+-	}
+-
+-	ret = crypto_shash_setkey(tfm, key, ksize);
+-	if (ret) {
+-		BT_DBG("crypto_ahash_setkey failed: err %d", ret);
+-		goto failed;
+-	}
+-
+-	shash = kzalloc(sizeof(*shash) + crypto_shash_descsize(tfm),
+-			GFP_KERNEL);
+-	if (!shash) {
+-		ret = -ENOMEM;
+-		goto failed;
+-	}
+-
+-	shash->tfm = tfm;
+-
+-	ret = crypto_shash_digest(shash, plaintext, psize, output);
+-
+-	kfree(shash);
+-
+-failed:
+-	crypto_free_shash(tfm);
+-	return ret;
+-}
+-
+-int phylink_gen_key(struct hci_conn *conn, u8 *data, u8 *len, u8 *type)
+-{
+-	struct hci_dev *hdev = conn->hdev;
+-	struct link_key *key;
+-	u8 keybuf[HCI_AMP_LINK_KEY_SIZE];
+-	u8 gamp_key[HCI_AMP_LINK_KEY_SIZE];
+-	int err;
+-
+-	if (!hci_conn_check_link_mode(conn))
+-		return -EACCES;
+-
+-	BT_DBG("conn %p key_type %d", conn, conn->key_type);
+-
+-	/* Legacy key */
+-	if (conn->key_type < 3) {
+-		bt_dev_err(hdev, "legacy key type %u", conn->key_type);
+-		return -EACCES;
+-	}
+-
+-	*type = conn->key_type;
+-	*len = HCI_AMP_LINK_KEY_SIZE;
+-
+-	key = hci_find_link_key(hdev, &conn->dst);
+-	if (!key) {
+-		BT_DBG("No Link key for conn %p dst %pMR", conn, &conn->dst);
+-		return -EACCES;
+-	}
+-
+-	/* BR/EDR Link Key concatenated together with itself */
+-	memcpy(&keybuf[0], key->val, HCI_LINK_KEY_SIZE);
+-	memcpy(&keybuf[HCI_LINK_KEY_SIZE], key->val, HCI_LINK_KEY_SIZE);
+-
+-	/* Derive Generic AMP Link Key (gamp) */
+-	err = hmac_sha256(keybuf, HCI_AMP_LINK_KEY_SIZE, "gamp", 4, gamp_key);
+-	if (err) {
+-		bt_dev_err(hdev, "could not derive Generic AMP Key: err %d", err);
+-		return err;
+-	}
+-
+-	if (conn->key_type == HCI_LK_DEBUG_COMBINATION) {
+-		BT_DBG("Use Generic AMP Key (gamp)");
+-		memcpy(data, gamp_key, HCI_AMP_LINK_KEY_SIZE);
+-		return err;
+-	}
+-
+-	/* Derive Dedicated AMP Link Key: "802b" is 802.11 PAL keyID */
+-	return hmac_sha256(gamp_key, HCI_AMP_LINK_KEY_SIZE, "802b", 4, data);
+-}
+-
+-static void read_local_amp_assoc_complete(struct hci_dev *hdev, u8 status,
+-					  u16 opcode, struct sk_buff *skb)
+-{
+-	struct hci_rp_read_local_amp_assoc *rp = (void *)skb->data;
+-	struct amp_assoc *assoc = &hdev->loc_assoc;
+-	size_t rem_len, frag_len;
+-
+-	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
+-
+-	if (rp->status)
+-		goto send_rsp;
+-
+-	frag_len = skb->len - sizeof(*rp);
+-	rem_len = __le16_to_cpu(rp->rem_len);
+-
+-	if (rem_len > frag_len) {
+-		BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
+-
+-		memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
+-		assoc->offset += frag_len;
+-
+-		/* Read other fragments */
+-		amp_read_loc_assoc_frag(hdev, rp->phy_handle);
+-
+-		return;
+-	}
+-
+-	memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
+-	assoc->len = assoc->offset + rem_len;
+-	assoc->offset = 0;
+-
+-send_rsp:
+-	/* Send A2MP Rsp when all fragments are received */
+-	a2mp_send_getampassoc_rsp(hdev, rp->status);
+-	a2mp_send_create_phy_link_req(hdev, rp->status);
+-}
+-
+-void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle)
+-{
+-	struct hci_cp_read_local_amp_assoc cp;
+-	struct amp_assoc *loc_assoc = &hdev->loc_assoc;
+-	struct hci_request req;
+-	int err;
+-
+-	BT_DBG("%s handle %u", hdev->name, phy_handle);
+-
+-	cp.phy_handle = phy_handle;
+-	cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
+-	cp.len_so_far = cpu_to_le16(loc_assoc->offset);
+-
+-	hci_req_init(&req, hdev);
+-	hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
+-	err = hci_req_run_skb(&req, read_local_amp_assoc_complete);
+-	if (err < 0)
+-		a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID);
+-}
+-
+-void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr)
+-{
+-	struct hci_cp_read_local_amp_assoc cp;
+-	struct hci_request req;
+-	int err;
+-
+-	memset(&hdev->loc_assoc, 0, sizeof(struct amp_assoc));
+-	memset(&cp, 0, sizeof(cp));
+-
+-	cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
+-
+-	set_bit(READ_LOC_AMP_ASSOC, &mgr->state);
+-	hci_req_init(&req, hdev);
+-	hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
+-	err = hci_req_run_skb(&req, read_local_amp_assoc_complete);
+-	if (err < 0)
+-		a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID);
+-}
+-
+-void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+-				   struct hci_conn *hcon)
+-{
+-	struct hci_cp_read_local_amp_assoc cp;
+-	struct amp_mgr *mgr = hcon->amp_mgr;
+-	struct hci_request req;
+-	int err;
+-
+-	if (!mgr)
+-		return;
+-
+-	cp.phy_handle = hcon->handle;
+-	cp.len_so_far = cpu_to_le16(0);
+-	cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
+-
+-	set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);
+-
+-	/* Read Local AMP Assoc final link information data */
+-	hci_req_init(&req, hdev);
+-	hci_req_add(&req, HCI_OP_READ_LOCAL_AMP_ASSOC, sizeof(cp), &cp);
+-	err = hci_req_run_skb(&req, read_local_amp_assoc_complete);
+-	if (err < 0)
+-		a2mp_send_getampassoc_rsp(hdev, A2MP_STATUS_INVALID_CTRL_ID);
+-}
+-
+-static void write_remote_amp_assoc_complete(struct hci_dev *hdev, u8 status,
+-					    u16 opcode, struct sk_buff *skb)
+-{
+-	struct hci_rp_write_remote_amp_assoc *rp = (void *)skb->data;
+-
+-	BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
+-	       hdev->name, rp->status, rp->phy_handle);
+-
+-	if (rp->status)
+-		return;
+-
+-	amp_write_rem_assoc_continue(hdev, rp->phy_handle);
+-}
+-
+-/* Write AMP Assoc data fragments, returns true with last fragment written*/
+-static bool amp_write_rem_assoc_frag(struct hci_dev *hdev,
+-				     struct hci_conn *hcon)
+-{
+-	struct hci_cp_write_remote_amp_assoc *cp;
+-	struct amp_mgr *mgr = hcon->amp_mgr;
+-	struct amp_ctrl *ctrl;
+-	struct hci_request req;
+-	u16 frag_len, len;
+-
+-	ctrl = amp_ctrl_lookup(mgr, hcon->remote_id);
+-	if (!ctrl)
+-		return false;
+-
+-	if (!ctrl->assoc_rem_len) {
+-		BT_DBG("all fragments are written");
+-		ctrl->assoc_rem_len = ctrl->assoc_len;
+-		ctrl->assoc_len_so_far = 0;
+-
+-		amp_ctrl_put(ctrl);
+-		return true;
+-	}
+-
+-	frag_len = min_t(u16, 248, ctrl->assoc_rem_len);
+-	len = frag_len + sizeof(*cp);
+-
+-	cp = kzalloc(len, GFP_KERNEL);
+-	if (!cp) {
+-		amp_ctrl_put(ctrl);
+-		return false;
+-	}
+-
+-	BT_DBG("hcon %p ctrl %p frag_len %u assoc_len %u rem_len %u",
+-	       hcon, ctrl, frag_len, ctrl->assoc_len, ctrl->assoc_rem_len);
+-
+-	cp->phy_handle = hcon->handle;
+-	cp->len_so_far = cpu_to_le16(ctrl->assoc_len_so_far);
+-	cp->rem_len = cpu_to_le16(ctrl->assoc_rem_len);
+-	memcpy(cp->frag, ctrl->assoc, frag_len);
+-
+-	ctrl->assoc_len_so_far += frag_len;
+-	ctrl->assoc_rem_len -= frag_len;
+-
+-	amp_ctrl_put(ctrl);
+-
+-	hci_req_init(&req, hdev);
+-	hci_req_add(&req, HCI_OP_WRITE_REMOTE_AMP_ASSOC, len, cp);
+-	hci_req_run_skb(&req, write_remote_amp_assoc_complete);
+-
+-	kfree(cp);
+-
+-	return false;
+-}
+-
+-void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle)
+-{
+-	struct hci_conn *hcon;
+-
+-	BT_DBG("%s phy handle 0x%2.2x", hdev->name, handle);
+-
+-	hcon = hci_conn_hash_lookup_handle(hdev, handle);
+-	if (!hcon)
+-		return;
+-
+-	/* Send A2MP create phylink rsp when all fragments are written */
+-	if (amp_write_rem_assoc_frag(hdev, hcon))
+-		a2mp_send_create_phy_link_rsp(hdev, 0);
+-}
+-
+-void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle)
+-{
+-	struct hci_conn *hcon;
+-
+-	BT_DBG("%s phy handle 0x%2.2x", hdev->name, handle);
+-
+-	hcon = hci_conn_hash_lookup_handle(hdev, handle);
+-	if (!hcon)
+-		return;
+-
+-	BT_DBG("%s phy handle 0x%2.2x hcon %p", hdev->name, handle, hcon);
+-
+-	amp_write_rem_assoc_frag(hdev, hcon);
+-}
+-
+-static void create_phylink_complete(struct hci_dev *hdev, u8 status,
+-				    u16 opcode)
+-{
+-	struct hci_cp_create_phy_link *cp;
+-
+-	BT_DBG("%s status 0x%2.2x", hdev->name, status);
+-
+-	cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
+-	if (!cp)
+-		return;
+-
+-	hci_dev_lock(hdev);
+-
+-	if (status) {
+-		struct hci_conn *hcon;
+-
+-		hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
+-		if (hcon)
+-			hci_conn_del(hcon);
+-	} else {
+-		amp_write_remote_assoc(hdev, cp->phy_handle);
+-	}
+-
+-	hci_dev_unlock(hdev);
+-}
+-
+-void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+-			struct hci_conn *hcon)
+-{
+-	struct hci_cp_create_phy_link cp;
+-	struct hci_request req;
+-
+-	cp.phy_handle = hcon->handle;
+-
+-	BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev->name, hcon,
+-	       hcon->handle);
+-
+-	if (phylink_gen_key(mgr->l2cap_conn->hcon, cp.key, &cp.key_len,
+-			    &cp.key_type)) {
+-		BT_DBG("Cannot create link key");
+-		return;
+-	}
+-
+-	hci_req_init(&req, hdev);
+-	hci_req_add(&req, HCI_OP_CREATE_PHY_LINK, sizeof(cp), &cp);
+-	hci_req_run(&req, create_phylink_complete);
+-}
+-
+-static void accept_phylink_complete(struct hci_dev *hdev, u8 status,
+-				    u16 opcode)
+-{
+-	struct hci_cp_accept_phy_link *cp;
+-
+-	BT_DBG("%s status 0x%2.2x", hdev->name, status);
+-
+-	if (status)
+-		return;
+-
+-	cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
+-	if (!cp)
+-		return;
+-
+-	amp_write_remote_assoc(hdev, cp->phy_handle);
+-}
+-
+-void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+-			struct hci_conn *hcon)
+-{
+-	struct hci_cp_accept_phy_link cp;
+-	struct hci_request req;
+-
+-	cp.phy_handle = hcon->handle;
+-
+-	BT_DBG("%s hcon %p phy handle 0x%2.2x", hdev->name, hcon,
+-	       hcon->handle);
+-
+-	if (phylink_gen_key(mgr->l2cap_conn->hcon, cp.key, &cp.key_len,
+-			    &cp.key_type)) {
+-		BT_DBG("Cannot create link key");
+-		return;
+-	}
+-
+-	hci_req_init(&req, hdev);
+-	hci_req_add(&req, HCI_OP_ACCEPT_PHY_LINK, sizeof(cp), &cp);
+-	hci_req_run(&req, accept_phylink_complete);
+-}
+-
+-void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon)
+-{
+-	struct hci_dev *bredr_hdev = hci_dev_hold(bredr_hcon->hdev);
+-	struct amp_mgr *mgr = hs_hcon->amp_mgr;
+-	struct l2cap_chan *bredr_chan;
+-
+-	BT_DBG("bredr_hcon %p hs_hcon %p mgr %p", bredr_hcon, hs_hcon, mgr);
+-
+-	if (!bredr_hdev || !mgr || !mgr->bredr_chan)
+-		return;
+-
+-	bredr_chan = mgr->bredr_chan;
+-
+-	l2cap_chan_lock(bredr_chan);
+-
+-	set_bit(FLAG_EFS_ENABLE, &bredr_chan->flags);
+-	bredr_chan->remote_amp_id = hs_hcon->remote_id;
+-	bredr_chan->local_amp_id = hs_hcon->hdev->id;
+-	bredr_chan->hs_hcon = hs_hcon;
+-	bredr_chan->conn->mtu = hs_hcon->hdev->block_mtu;
+-
+-	__l2cap_physical_cfm(bredr_chan, 0);
+-
+-	l2cap_chan_unlock(bredr_chan);
+-
+-	hci_dev_put(bredr_hdev);
+-}
+-
+-void amp_create_logical_link(struct l2cap_chan *chan)
+-{
+-	struct hci_conn *hs_hcon = chan->hs_hcon;
+-	struct hci_cp_create_accept_logical_link cp;
+-	struct hci_dev *hdev;
+-
+-	BT_DBG("chan %p hs_hcon %p dst %pMR", chan, hs_hcon,
+-	       &chan->conn->hcon->dst);
+-
+-	if (!hs_hcon)
+-		return;
+-
+-	hdev = hci_dev_hold(chan->hs_hcon->hdev);
+-	if (!hdev)
+-		return;
+-
+-	cp.phy_handle = hs_hcon->handle;
+-
+-	cp.tx_flow_spec.id = chan->local_id;
+-	cp.tx_flow_spec.stype = chan->local_stype;
+-	cp.tx_flow_spec.msdu = cpu_to_le16(chan->local_msdu);
+-	cp.tx_flow_spec.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
+-	cp.tx_flow_spec.acc_lat = cpu_to_le32(chan->local_acc_lat);
+-	cp.tx_flow_spec.flush_to = cpu_to_le32(chan->local_flush_to);
+-
+-	cp.rx_flow_spec.id = chan->remote_id;
+-	cp.rx_flow_spec.stype = chan->remote_stype;
+-	cp.rx_flow_spec.msdu = cpu_to_le16(chan->remote_msdu);
+-	cp.rx_flow_spec.sdu_itime = cpu_to_le32(chan->remote_sdu_itime);
+-	cp.rx_flow_spec.acc_lat = cpu_to_le32(chan->remote_acc_lat);
+-	cp.rx_flow_spec.flush_to = cpu_to_le32(chan->remote_flush_to);
+-
+-	if (hs_hcon->out)
+-		hci_send_cmd(hdev, HCI_OP_CREATE_LOGICAL_LINK, sizeof(cp),
+-			     &cp);
+-	else
+-		hci_send_cmd(hdev, HCI_OP_ACCEPT_LOGICAL_LINK, sizeof(cp),
+-			     &cp);
+-
+-	hci_dev_put(hdev);
+-}
+-
+-void amp_disconnect_logical_link(struct hci_chan *hchan)
+-{
+-	struct hci_conn *hcon = hchan->conn;
+-	struct hci_cp_disconn_logical_link cp;
+-
+-	if (hcon->state != BT_CONNECTED) {
+-		BT_DBG("hchan %p not connected", hchan);
+-		return;
+-	}
+-
+-	cp.log_handle = cpu_to_le16(hchan->handle);
+-	hci_send_cmd(hcon->hdev, HCI_OP_DISCONN_LOGICAL_LINK, sizeof(cp), &cp);
+-}
+-
+-void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason)
+-{
+-	BT_DBG("hchan %p", hchan);
+-
+-	hci_chan_del(hchan);
+-}
+diff --git a/net/bluetooth/amp.h b/net/bluetooth/amp.h
+deleted file mode 100644
+index 97c87abd129f6..0000000000000
+--- a/net/bluetooth/amp.h
++++ /dev/null
+@@ -1,60 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0-only */
+-/*
+-   Copyright (c) 2011,2012 Intel Corp.
+-
+-*/
+-
+-#ifndef __AMP_H
+-#define __AMP_H
+-
+-struct amp_ctrl {
+-	struct list_head	list;
+-	struct kref		kref;
+-	__u8			id;
+-	__u16			assoc_len_so_far;
+-	__u16			assoc_rem_len;
+-	__u16			assoc_len;
+-	__u8			*assoc;
+-};
+-
+-int amp_ctrl_put(struct amp_ctrl *ctrl);
+-void amp_ctrl_get(struct amp_ctrl *ctrl);
+-struct amp_ctrl *amp_ctrl_add(struct amp_mgr *mgr, u8 id);
+-struct amp_ctrl *amp_ctrl_lookup(struct amp_mgr *mgr, u8 id);
+-void amp_ctrl_list_flush(struct amp_mgr *mgr);
+-
+-struct hci_conn *phylink_add(struct hci_dev *hdev, struct amp_mgr *mgr,
+-			     u8 remote_id, bool out);
+-
+-int phylink_gen_key(struct hci_conn *hcon, u8 *data, u8 *len, u8 *type);
+-
+-void amp_read_loc_assoc_frag(struct hci_dev *hdev, u8 phy_handle);
+-void amp_read_loc_assoc(struct hci_dev *hdev, struct amp_mgr *mgr);
+-void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+-				   struct hci_conn *hcon);
+-void amp_create_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+-			struct hci_conn *hcon);
+-void amp_accept_phylink(struct hci_dev *hdev, struct amp_mgr *mgr,
+-			struct hci_conn *hcon);
+-
+-#if IS_ENABLED(CONFIG_BT_HS)
+-void amp_create_logical_link(struct l2cap_chan *chan);
+-void amp_disconnect_logical_link(struct hci_chan *hchan);
+-#else
+-static inline void amp_create_logical_link(struct l2cap_chan *chan)
+-{
+-}
+-
+-static inline void amp_disconnect_logical_link(struct hci_chan *hchan)
+-{
+-}
+-#endif
+-
+-void amp_write_remote_assoc(struct hci_dev *hdev, u8 handle);
+-void amp_write_rem_assoc_continue(struct hci_dev *hdev, u8 handle);
+-void amp_physical_cfm(struct hci_conn *bredr_hcon, struct hci_conn *hs_hcon);
+-void amp_create_logical_link(struct l2cap_chan *chan);
+-void amp_disconnect_logical_link(struct hci_chan *hchan);
+-void amp_destroy_logical_link(struct hci_chan *hchan, u8 reason);
+-
+-#endif /* __AMP_H */
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index a41d2693f4d8c..fc4d72f83ac25 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -36,7 +36,6 @@
+ 
+ #include "hci_request.h"
+ #include "smp.h"
+-#include "a2mp.h"
+ #include "eir.h"
+ 
+ struct sco_param {
+@@ -1175,9 +1174,6 @@ void hci_conn_del(struct hci_conn *conn)
+ 		}
+ 	}
+ 
+-	if (conn->amp_mgr)
+-		amp_mgr_put(conn->amp_mgr);
+-
+ 	skb_queue_purge(&conn->data_q);
+ 
+ 	/* Remove the connection from the list and cleanup its remaining
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 1f63f77661dce..55daada8dc15d 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -36,8 +36,6 @@
+ #include "hci_request.h"
+ #include "hci_debugfs.h"
+ #include "hci_codec.h"
+-#include "a2mp.h"
+-#include "amp.h"
+ #include "smp.h"
+ #include "msft.h"
+ #include "eir.h"
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 656f49b299d20..ab5a9d42fae71 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -39,8 +39,6 @@
+ #include <net/bluetooth/l2cap.h>
+ 
+ #include "smp.h"
+-#include "a2mp.h"
+-#include "amp.h"
+ 
+ #define LE_FLOWCTL_MAX_CREDITS 65535
+ 
+@@ -167,24 +165,6 @@ static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
+ 	return NULL;
+ }
+ 
+-static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
+-						  u8 ident)
+-{
+-	struct l2cap_chan *c;
+-
+-	mutex_lock(&conn->chan_lock);
+-	c = __l2cap_get_chan_by_ident(conn, ident);
+-	if (c) {
+-		/* Only lock if chan reference is not 0 */
+-		c = l2cap_chan_hold_unless_zero(c);
+-		if (c)
+-			l2cap_chan_lock(c);
+-	}
+-	mutex_unlock(&conn->chan_lock);
+-
+-	return c;
+-}
+-
+ static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
+ 						      u8 src_type)
+ {
+@@ -651,7 +631,6 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
+ 	chan->ops->teardown(chan, err);
+ 
+ 	if (conn) {
+-		struct amp_mgr *mgr = conn->hcon->amp_mgr;
+ 		/* Delete from channel list */
+ 		list_del(&chan->list);
+ 
+@@ -666,16 +645,6 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
+ 		if (chan->chan_type != L2CAP_CHAN_FIXED ||
+ 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
+ 			hci_conn_drop(conn->hcon);
+-
+-		if (mgr && mgr->bredr_chan == chan)
+-			mgr->bredr_chan = NULL;
+-	}
+-
+-	if (chan->hs_hchan) {
+-		struct hci_chan *hs_hchan = chan->hs_hchan;
+-
+-		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
+-		amp_disconnect_logical_link(hs_hchan);
+ 	}
+ 
+ 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
+@@ -977,12 +946,6 @@ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
+ 	hci_send_acl(conn->hchan, skb, flags);
+ }
+ 
+-static bool __chan_is_moving(struct l2cap_chan *chan)
+-{
+-	return chan->move_state != L2CAP_MOVE_STABLE &&
+-	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
+-}
+-
+ static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
+ {
+ 	struct hci_conn *hcon = chan->conn->hcon;
+@@ -991,15 +954,6 @@ static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
+ 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
+ 	       skb->priority);
+ 
+-	if (chan->hs_hcon && !__chan_is_moving(chan)) {
+-		if (chan->hs_hchan)
+-			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
+-		else
+-			kfree_skb(skb);
+-
+-		return;
+-	}
+-
+ 	/* Use NO_FLUSH for LE links (where this is the only option) or
+ 	 * if the BR/EDR link supports it and flushing has not been
+ 	 * explicitly requested (through FLAG_FLUSHABLE).
+@@ -1180,9 +1134,6 @@ static void l2cap_send_sframe(struct l2cap_chan *chan,
+ 	if (!control->sframe)
+ 		return;
+ 
+-	if (__chan_is_moving(chan))
+-		return;
+-
+ 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
+ 	    !control->poll)
+ 		control->final = 1;
+@@ -1237,40 +1188,6 @@ static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
+ 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
+ }
+ 
+-static bool __amp_capable(struct l2cap_chan *chan)
+-{
+-	struct l2cap_conn *conn = chan->conn;
+-	struct hci_dev *hdev;
+-	bool amp_available = false;
+-
+-	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
+-		return false;
+-
+-	if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
+-		return false;
+-
+-	read_lock(&hci_dev_list_lock);
+-	list_for_each_entry(hdev, &hci_dev_list, list) {
+-		if (hdev->amp_type != AMP_TYPE_BREDR &&
+-		    test_bit(HCI_UP, &hdev->flags)) {
+-			amp_available = true;
+-			break;
+-		}
+-	}
+-	read_unlock(&hci_dev_list_lock);
+-
+-	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
+-		return amp_available;
+-
+-	return false;
+-}
+-
+-static bool l2cap_check_efs(struct l2cap_chan *chan)
+-{
+-	/* Check EFS parameters */
+-	return true;
+-}
+-
+ void l2cap_send_conn_req(struct l2cap_chan *chan)
+ {
+ 	struct l2cap_conn *conn = chan->conn;
+@@ -1286,76 +1203,6 @@ void l2cap_send_conn_req(struct l2cap_chan *chan)
+ 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
+ }
+ 
+-static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
+-{
+-	struct l2cap_create_chan_req req;
+-	req.scid = cpu_to_le16(chan->scid);
+-	req.psm  = chan->psm;
+-	req.amp_id = amp_id;
+-
+-	chan->ident = l2cap_get_ident(chan->conn);
+-
+-	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
+-		       sizeof(req), &req);
+-}
+-
+-static void l2cap_move_setup(struct l2cap_chan *chan)
+-{
+-	struct sk_buff *skb;
+-
+-	BT_DBG("chan %p", chan);
+-
+-	if (chan->mode != L2CAP_MODE_ERTM)
+-		return;
+-
+-	__clear_retrans_timer(chan);
+-	__clear_monitor_timer(chan);
+-	__clear_ack_timer(chan);
+-
+-	chan->retry_count = 0;
+-	skb_queue_walk(&chan->tx_q, skb) {
+-		if (bt_cb(skb)->l2cap.retries)
+-			bt_cb(skb)->l2cap.retries = 1;
+-		else
+-			break;
+-	}
+-
+-	chan->expected_tx_seq = chan->buffer_seq;
+-
+-	clear_bit(CONN_REJ_ACT, &chan->conn_state);
+-	clear_bit(CONN_SREJ_ACT, &chan->conn_state);
+-	l2cap_seq_list_clear(&chan->retrans_list);
+-	l2cap_seq_list_clear(&chan->srej_list);
+-	skb_queue_purge(&chan->srej_q);
+-
+-	chan->tx_state = L2CAP_TX_STATE_XMIT;
+-	chan->rx_state = L2CAP_RX_STATE_MOVE;
+-
+-	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
+-}
+-
+-static void l2cap_move_done(struct l2cap_chan *chan)
+-{
+-	u8 move_role = chan->move_role;
+-	BT_DBG("chan %p", chan);
+-
+-	chan->move_state = L2CAP_MOVE_STABLE;
+-	chan->move_role = L2CAP_MOVE_ROLE_NONE;
+-
+-	if (chan->mode != L2CAP_MODE_ERTM)
+-		return;
+-
+-	switch (move_role) {
+-	case L2CAP_MOVE_ROLE_INITIATOR:
+-		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
+-		chan->rx_state = L2CAP_RX_STATE_WAIT_F;
+-		break;
+-	case L2CAP_MOVE_ROLE_RESPONDER:
+-		chan->rx_state = L2CAP_RX_STATE_WAIT_P;
+-		break;
+-	}
+-}
+-
+ static void l2cap_chan_ready(struct l2cap_chan *chan)
+ {
+ 	/* The channel may have already been flagged as connected in
+@@ -1505,10 +1352,7 @@ static void l2cap_le_start(struct l2cap_chan *chan)
+ 
+ static void l2cap_start_connection(struct l2cap_chan *chan)
+ {
+-	if (__amp_capable(chan)) {
+-		BT_DBG("chan %p AMP capable: discover AMPs", chan);
+-		a2mp_discover_amp(chan);
+-	} else if (chan->conn->hcon->type == LE_LINK) {
++	if (chan->conn->hcon->type == LE_LINK) {
+ 		l2cap_le_start(chan);
+ 	} else {
+ 		l2cap_send_conn_req(chan);
+@@ -1611,11 +1455,6 @@ static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
+ 		__clear_ack_timer(chan);
+ 	}
+ 
+-	if (chan->scid == L2CAP_CID_A2MP) {
+-		l2cap_state_change(chan, BT_DISCONN);
+-		return;
+-	}
+-
+ 	req.dcid = cpu_to_le16(chan->dcid);
+ 	req.scid = cpu_to_le16(chan->scid);
+ 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
+@@ -1754,11 +1593,6 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
+ 
+ 		l2cap_chan_lock(chan);
+ 
+-		if (chan->scid == L2CAP_CID_A2MP) {
+-			l2cap_chan_unlock(chan);
+-			continue;
+-		}
+-
+ 		if (hcon->type == LE_LINK) {
+ 			l2cap_le_start(chan);
+ 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
+@@ -2067,9 +1901,6 @@ static void l2cap_streaming_send(struct l2cap_chan *chan,
+ 
+ 	BT_DBG("chan %p, skbs %p", chan, skbs);
+ 
+-	if (__chan_is_moving(chan))
+-		return;
+-
+ 	skb_queue_splice_tail_init(skbs, &chan->tx_q);
+ 
+ 	while (!skb_queue_empty(&chan->tx_q)) {
+@@ -2112,9 +1943,6 @@ static int l2cap_ertm_send(struct l2cap_chan *chan)
+ 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
+ 		return 0;
+ 
+-	if (__chan_is_moving(chan))
+-		return 0;
+-
+ 	while (chan->tx_send_head &&
+ 	       chan->unacked_frames < chan->remote_tx_win &&
+ 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {
+@@ -2180,9 +2008,6 @@ static void l2cap_ertm_resend(struct l2cap_chan *chan)
+ 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
+ 		return;
+ 
+-	if (__chan_is_moving(chan))
+-		return;
+-
+ 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
+ 		seq = l2cap_seq_list_pop(&chan->retrans_list);
+ 
+@@ -2522,8 +2347,7 @@ static int l2cap_segment_sdu(struct l2cap_chan *chan,
+ 	pdu_len = chan->conn->mtu;
+ 
+ 	/* Constrain PDU size for BR/EDR connections */
+-	if (!chan->hs_hcon)
+-		pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
++	pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
+ 
+ 	/* Adjust for largest possible L2CAP overhead. */
+ 	if (chan->fcs)
+@@ -3287,11 +3111,6 @@ int l2cap_ertm_init(struct l2cap_chan *chan)
+ 
+ 	skb_queue_head_init(&chan->tx_q);
+ 
+-	chan->local_amp_id = AMP_ID_BREDR;
+-	chan->move_id = AMP_ID_BREDR;
+-	chan->move_state = L2CAP_MOVE_STABLE;
+-	chan->move_role = L2CAP_MOVE_ROLE_NONE;
+-
+ 	if (chan->mode != L2CAP_MODE_ERTM)
+ 		return 0;
+ 
+@@ -3326,52 +3145,19 @@ static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
+ 
+ static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
+ {
+-	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
+-		(conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
++	return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
+ }
+ 
+ static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
+ {
+-	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
+-		(conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
++	return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
+ }
+ 
+ static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
+ 				      struct l2cap_conf_rfc *rfc)
+ {
+-	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
+-		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
+-
+-		/* Class 1 devices have must have ERTM timeouts
+-		 * exceeding the Link Supervision Timeout.  The
+-		 * default Link Supervision Timeout for AMP
+-		 * controllers is 10 seconds.
+-		 *
+-		 * Class 1 devices use 0xffffffff for their
+-		 * best-effort flush timeout, so the clamping logic
+-		 * will result in a timeout that meets the above
+-		 * requirement.  ERTM timeouts are 16-bit values, so
+-		 * the maximum timeout is 65.535 seconds.
+-		 */
+-
+-		/* Convert timeout to milliseconds and round */
+-		ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
+-
+-		/* This is the recommended formula for class 2 devices
+-		 * that start ERTM timers when packets are sent to the
+-		 * controller.
+-		 */
+-		ertm_to = 3 * ertm_to + 500;
+-
+-		if (ertm_to > 0xffff)
+-			ertm_to = 0xffff;
+-
+-		rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
+-		rfc->monitor_timeout = rfc->retrans_timeout;
+-	} else {
+-		rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
+-		rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
+-	}
++	rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
++	rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
+ }
+ 
+ static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
+@@ -3623,13 +3409,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
+ 		case L2CAP_CONF_EWS:
+ 			if (olen != 2)
+ 				break;
+-			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
+-				return -ECONNREFUSED;
+-			set_bit(FLAG_EXT_CTRL, &chan->flags);
+-			set_bit(CONF_EWS_RECV, &chan->conf_state);
+-			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
+-			chan->remote_tx_win = val;
+-			break;
++			return -ECONNREFUSED;
+ 
+ 		default:
+ 			if (hint)
+@@ -4027,11 +3807,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
+ 	rsp.dcid   = cpu_to_le16(chan->scid);
+ 	rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+ 	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+-
+-	if (chan->hs_hcon)
+-		rsp_code = L2CAP_CREATE_CHAN_RSP;
+-	else
+-		rsp_code = L2CAP_CONN_RSP;
++	rsp_code = L2CAP_CONN_RSP;
+ 
+ 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);
+ 
+@@ -4190,7 +3966,6 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
+ 	chan->dst_type = bdaddr_dst_type(conn->hcon);
+ 	chan->psm  = psm;
+ 	chan->dcid = scid;
+-	chan->local_amp_id = amp_id;
+ 
+ 	__l2cap_chan_add(conn, chan);
+ 
+@@ -4516,10 +4291,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
+ 		/* check compatibility */
+ 
+ 		/* Send rsp for BR/EDR channel */
+-		if (!chan->hs_hcon)
+-			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
+-		else
+-			chan->ident = cmd->ident;
++		l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
+ 	}
+ 
+ unlock:
+@@ -4571,15 +4343,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn,
+ 				goto done;
+ 			}
+ 
+-			if (!chan->hs_hcon) {
+-				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
+-							0);
+-			} else {
+-				if (l2cap_check_efs(chan)) {
+-					amp_create_logical_link(chan);
+-					chan->ident = cmd->ident;
+-				}
+-			}
++			l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
+ 		}
+ 		goto done;
+ 
+@@ -4750,9 +4514,6 @@ static inline int l2cap_information_req(struct l2cap_conn *conn,
+ 		if (!disable_ertm)
+ 			feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
+ 				| L2CAP_FEAT_FCS;
+-		if (conn->local_fixed_chan & L2CAP_FC_A2MP)
+-			feat_mask |= L2CAP_FEAT_EXT_FLOW
+-				| L2CAP_FEAT_EXT_WINDOW;
+ 
+ 		put_unaligned_le32(feat_mask, rsp->data);
+ 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
+@@ -4841,751 +4602,6 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
+ 	return 0;
+ }
+ 
+-static int l2cap_create_channel_req(struct l2cap_conn *conn,
+-				    struct l2cap_cmd_hdr *cmd,
+-				    u16 cmd_len, void *data)
+-{
+-	struct l2cap_create_chan_req *req = data;
+-	struct l2cap_create_chan_rsp rsp;
+-	struct l2cap_chan *chan;
+-	struct hci_dev *hdev;
+-	u16 psm, scid;
+-
+-	if (cmd_len != sizeof(*req))
+-		return -EPROTO;
+-
+-	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
+-		return -EINVAL;
+-
+-	psm = le16_to_cpu(req->psm);
+-	scid = le16_to_cpu(req->scid);
+-
+-	BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
+-
+-	/* For controller id 0 make BR/EDR connection */
+-	if (req->amp_id == AMP_ID_BREDR) {
+-		l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
+-			      req->amp_id);
+-		return 0;
+-	}
+-
+-	/* Validate AMP controller id */
+-	hdev = hci_dev_get(req->amp_id);
+-	if (!hdev)
+-		goto error;
+-
+-	if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
+-		hci_dev_put(hdev);
+-		goto error;
+-	}
+-
+-	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
+-			     req->amp_id);
+-	if (chan) {
+-		struct amp_mgr *mgr = conn->hcon->amp_mgr;
+-		struct hci_conn *hs_hcon;
+-
+-		hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
+-						  &conn->hcon->dst);
+-		if (!hs_hcon) {
+-			hci_dev_put(hdev);
+-			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
+-					       chan->dcid);
+-			return 0;
+-		}
+-
+-		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
+-
+-		mgr->bredr_chan = chan;
+-		chan->hs_hcon = hs_hcon;
+-		chan->fcs = L2CAP_FCS_NONE;
+-		conn->mtu = hdev->block_mtu;
+-	}
+-
+-	hci_dev_put(hdev);
+-
+-	return 0;
+-
+-error:
+-	rsp.dcid = 0;
+-	rsp.scid = cpu_to_le16(scid);
+-	rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
+-	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+-
+-	l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
+-		       sizeof(rsp), &rsp);
+-
+-	return 0;
+-}
+-
+-static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
+-{
+-	struct l2cap_move_chan_req req;
+-	u8 ident;
+-
+-	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
+-
+-	ident = l2cap_get_ident(chan->conn);
+-	chan->ident = ident;
+-
+-	req.icid = cpu_to_le16(chan->scid);
+-	req.dest_amp_id = dest_amp_id;
+-
+-	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
+-		       &req);
+-
+-	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
+-}
+-
+-static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
+-{
+-	struct l2cap_move_chan_rsp rsp;
+-
+-	BT_DBG("chan %p, result 0x%4.4x", chan, result);
+-
+-	rsp.icid = cpu_to_le16(chan->dcid);
+-	rsp.result = cpu_to_le16(result);
+-
+-	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
+-		       sizeof(rsp), &rsp);
+-}
+-
+-static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
+-{
+-	struct l2cap_move_chan_cfm cfm;
+-
+-	BT_DBG("chan %p, result 0x%4.4x", chan, result);
+-
+-	chan->ident = l2cap_get_ident(chan->conn);
+-
+-	cfm.icid = cpu_to_le16(chan->scid);
+-	cfm.result = cpu_to_le16(result);
+-
+-	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
+-		       sizeof(cfm), &cfm);
+-
+-	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
+-}
+-
+-static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
+-{
+-	struct l2cap_move_chan_cfm cfm;
+-
+-	BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
+-
+-	cfm.icid = cpu_to_le16(icid);
+-	cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
+-
+-	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
+-		       sizeof(cfm), &cfm);
+-}
+-
+-static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
+-					 u16 icid)
+-{
+-	struct l2cap_move_chan_cfm_rsp rsp;
+-
+-	BT_DBG("icid 0x%4.4x", icid);
+-
+-	rsp.icid = cpu_to_le16(icid);
+-	l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
+-}
+-
+-static void __release_logical_link(struct l2cap_chan *chan)
+-{
+-	chan->hs_hchan = NULL;
+-	chan->hs_hcon = NULL;
+-
+-	/* Placeholder - release the logical link */
+-}
+-
+-static void l2cap_logical_fail(struct l2cap_chan *chan)
+-{
+-	/* Logical link setup failed */
+-	if (chan->state != BT_CONNECTED) {
+-		/* Create channel failure, disconnect */
+-		l2cap_send_disconn_req(chan, ECONNRESET);
+-		return;
+-	}
+-
+-	switch (chan->move_role) {
+-	case L2CAP_MOVE_ROLE_RESPONDER:
+-		l2cap_move_done(chan);
+-		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
+-		break;
+-	case L2CAP_MOVE_ROLE_INITIATOR:
+-		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
+-		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
+-			/* Remote has only sent pending or
+-			 * success responses, clean up
+-			 */
+-			l2cap_move_done(chan);
+-		}
+-
+-		/* Other amp move states imply that the move
+-		 * has already aborted
+-		 */
+-		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
+-		break;
+-	}
+-}
+-
+-static void l2cap_logical_finish_create(struct l2cap_chan *chan,
+-					struct hci_chan *hchan)
+-{
+-	struct l2cap_conf_rsp rsp;
+-
+-	chan->hs_hchan = hchan;
+-	chan->hs_hcon->l2cap_data = chan->conn;
+-
+-	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
+-
+-	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
+-		int err;
+-
+-		set_default_fcs(chan);
+-
+-		err = l2cap_ertm_init(chan);
+-		if (err < 0)
+-			l2cap_send_disconn_req(chan, -err);
+-		else
+-			l2cap_chan_ready(chan);
+-	}
+-}
+-
+-static void l2cap_logical_finish_move(struct l2cap_chan *chan,
+-				      struct hci_chan *hchan)
+-{
+-	chan->hs_hcon = hchan->conn;
+-	chan->hs_hcon->l2cap_data = chan->conn;
+-
+-	BT_DBG("move_state %d", chan->move_state);
+-
+-	switch (chan->move_state) {
+-	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
+-		/* Move confirm will be sent after a success
+-		 * response is received
+-		 */
+-		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
+-		break;
+-	case L2CAP_MOVE_WAIT_LOGICAL_CFM:
+-		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
+-			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
+-		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
+-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
+-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
+-		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
+-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
+-			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
+-		}
+-		break;
+-	default:
+-		/* Move was not in expected state, free the channel */
+-		__release_logical_link(chan);
+-
+-		chan->move_state = L2CAP_MOVE_STABLE;
+-	}
+-}
+-
+-/* Call with chan locked */
+-void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
+-		       u8 status)
+-{
+-	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
+-
+-	if (status) {
+-		l2cap_logical_fail(chan);
+-		__release_logical_link(chan);
+-		return;
+-	}
+-
+-	if (chan->state != BT_CONNECTED) {
+-		/* Ignore logical link if channel is on BR/EDR */
+-		if (chan->local_amp_id != AMP_ID_BREDR)
+-			l2cap_logical_finish_create(chan, hchan);
+-	} else {
+-		l2cap_logical_finish_move(chan, hchan);
+-	}
+-}
+-
+-void l2cap_move_start(struct l2cap_chan *chan)
+-{
+-	BT_DBG("chan %p", chan);
+-
+-	if (chan->local_amp_id == AMP_ID_BREDR) {
+-		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
+-			return;
+-		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
+-		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
+-		/* Placeholder - start physical link setup */
+-	} else {
+-		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
+-		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
+-		chan->move_id = 0;
+-		l2cap_move_setup(chan);
+-		l2cap_send_move_chan_req(chan, 0);
+-	}
+-}
+-
+-static void l2cap_do_create(struct l2cap_chan *chan, int result,
+-			    u8 local_amp_id, u8 remote_amp_id)
+-{
+-	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
+-	       local_amp_id, remote_amp_id);
+-
+-	chan->fcs = L2CAP_FCS_NONE;
+-
+-	/* Outgoing channel on AMP */
+-	if (chan->state == BT_CONNECT) {
+-		if (result == L2CAP_CR_SUCCESS) {
+-			chan->local_amp_id = local_amp_id;
+-			l2cap_send_create_chan_req(chan, remote_amp_id);
+-		} else {
+-			/* Revert to BR/EDR connect */
+-			l2cap_send_conn_req(chan);
+-		}
+-
+-		return;
+-	}
+-
+-	/* Incoming channel on AMP */
+-	if (__l2cap_no_conn_pending(chan)) {
+-		struct l2cap_conn_rsp rsp;
+-		char buf[128];
+-		rsp.scid = cpu_to_le16(chan->dcid);
+-		rsp.dcid = cpu_to_le16(chan->scid);
+-
+-		if (result == L2CAP_CR_SUCCESS) {
+-			/* Send successful response */
+-			rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
+-			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+-		} else {
+-			/* Send negative response */
+-			rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
+-			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
+-		}
+-
+-		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
+-			       sizeof(rsp), &rsp);
+-
+-		if (result == L2CAP_CR_SUCCESS) {
+-			l2cap_state_change(chan, BT_CONFIG);
+-			set_bit(CONF_REQ_SENT, &chan->conf_state);
+-			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
+-				       L2CAP_CONF_REQ,
+-				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
+-			chan->num_conf_req++;
+-		}
+-	}
+-}
+-
+-static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
+-				   u8 remote_amp_id)
+-{
+-	l2cap_move_setup(chan);
+-	chan->move_id = local_amp_id;
+-	chan->move_state = L2CAP_MOVE_WAIT_RSP;
+-
+-	l2cap_send_move_chan_req(chan, remote_amp_id);
+-}
+-
+-static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
+-{
+-	struct hci_chan *hchan = NULL;
+-
+-	/* Placeholder - get hci_chan for logical link */
+-
+-	if (hchan) {
+-		if (hchan->state == BT_CONNECTED) {
+-			/* Logical link is ready to go */
+-			chan->hs_hcon = hchan->conn;
+-			chan->hs_hcon->l2cap_data = chan->conn;
+-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
+-			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
+-
+-			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
+-		} else {
+-			/* Wait for logical link to be ready */
+-			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
+-		}
+-	} else {
+-		/* Logical link not available */
+-		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
+-	}
+-}
+-
+-static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
+-{
+-	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
+-		u8 rsp_result;
+-		if (result == -EINVAL)
+-			rsp_result = L2CAP_MR_BAD_ID;
+-		else
+-			rsp_result = L2CAP_MR_NOT_ALLOWED;
+-
+-		l2cap_send_move_chan_rsp(chan, rsp_result);
+-	}
+-
+-	chan->move_role = L2CAP_MOVE_ROLE_NONE;
+-	chan->move_state = L2CAP_MOVE_STABLE;
+-
+-	/* Restart data transmission */
+-	l2cap_ertm_send(chan);
+-}
+-
+-/* Invoke with locked chan */
+-void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
+-{
+-	u8 local_amp_id = chan->local_amp_id;
+-	u8 remote_amp_id = chan->remote_amp_id;
+-
+-	BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
+-	       chan, result, local_amp_id, remote_amp_id);
+-
+-	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
+-		return;
+-
+-	if (chan->state != BT_CONNECTED) {
+-		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
+-	} else if (result != L2CAP_MR_SUCCESS) {
+-		l2cap_do_move_cancel(chan, result);
+-	} else {
+-		switch (chan->move_role) {
+-		case L2CAP_MOVE_ROLE_INITIATOR:
+-			l2cap_do_move_initiate(chan, local_amp_id,
+-					       remote_amp_id);
+-			break;
+-		case L2CAP_MOVE_ROLE_RESPONDER:
+-			l2cap_do_move_respond(chan, result);
+-			break;
+-		default:
+-			l2cap_do_move_cancel(chan, result);
+-			break;
+-		}
+-	}
+-}
+-
+-static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
+-					 struct l2cap_cmd_hdr *cmd,
+-					 u16 cmd_len, void *data)
+-{
+-	struct l2cap_move_chan_req *req = data;
+-	struct l2cap_move_chan_rsp rsp;
+-	struct l2cap_chan *chan;
+-	u16 icid = 0;
+-	u16 result = L2CAP_MR_NOT_ALLOWED;
+-
+-	if (cmd_len != sizeof(*req))
+-		return -EPROTO;
+-
+-	icid = le16_to_cpu(req->icid);
+-
+-	BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
+-
+-	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
+-		return -EINVAL;
+-
+-	chan = l2cap_get_chan_by_dcid(conn, icid);
+-	if (!chan) {
+-		rsp.icid = cpu_to_le16(icid);
+-		rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
+-		l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
+-			       sizeof(rsp), &rsp);
+-		return 0;
+-	}
+-
+-	chan->ident = cmd->ident;
+-
+-	if (chan->scid < L2CAP_CID_DYN_START ||
+-	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
+-	    (chan->mode != L2CAP_MODE_ERTM &&
+-	     chan->mode != L2CAP_MODE_STREAMING)) {
+-		result = L2CAP_MR_NOT_ALLOWED;
+-		goto send_move_response;
+-	}
+-
+-	if (chan->local_amp_id == req->dest_amp_id) {
+-		result = L2CAP_MR_SAME_ID;
+-		goto send_move_response;
+-	}
+-
+-	if (req->dest_amp_id != AMP_ID_BREDR) {
+-		struct hci_dev *hdev;
+-		hdev = hci_dev_get(req->dest_amp_id);
+-		if (!hdev || hdev->dev_type != HCI_AMP ||
+-		    !test_bit(HCI_UP, &hdev->flags)) {
+-			if (hdev)
+-				hci_dev_put(hdev);
+-
+-			result = L2CAP_MR_BAD_ID;
+-			goto send_move_response;
+-		}
+-		hci_dev_put(hdev);
+-	}
+-
+-	/* Detect a move collision.  Only send a collision response
+-	 * if this side has "lost", otherwise proceed with the move.
+-	 * The winner has the larger bd_addr.
+-	 */
+-	if ((__chan_is_moving(chan) ||
+-	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
+-	    bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
+-		result = L2CAP_MR_COLLISION;
+-		goto send_move_response;
+-	}
+-
+-	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
+-	l2cap_move_setup(chan);
+-	chan->move_id = req->dest_amp_id;
+-
+-	if (req->dest_amp_id == AMP_ID_BREDR) {
+-		/* Moving to BR/EDR */
+-		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
+-			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
+-			result = L2CAP_MR_PEND;
+-		} else {
+-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
+-			result = L2CAP_MR_SUCCESS;
+-		}
+-	} else {
+-		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
+-		/* Placeholder - uncomment when amp functions are available */
+-		/*amp_accept_physical(chan, req->dest_amp_id);*/
+-		result = L2CAP_MR_PEND;
+-	}
+-
+-send_move_response:
+-	l2cap_send_move_chan_rsp(chan, result);
+-
+-	l2cap_chan_unlock(chan);
+-	l2cap_chan_put(chan);
+-
+-	return 0;
+-}
+-
+-static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
+-{
+-	struct l2cap_chan *chan;
+-	struct hci_chan *hchan = NULL;
+-
+-	chan = l2cap_get_chan_by_scid(conn, icid);
+-	if (!chan) {
+-		l2cap_send_move_chan_cfm_icid(conn, icid);
+-		return;
+-	}
+-
+-	__clear_chan_timer(chan);
+-	if (result == L2CAP_MR_PEND)
+-		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
+-
+-	switch (chan->move_state) {
+-	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
+-		/* Move confirm will be sent when logical link
+-		 * is complete.
+-		 */
+-		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
+-		break;
+-	case L2CAP_MOVE_WAIT_RSP_SUCCESS:
+-		if (result == L2CAP_MR_PEND) {
+-			break;
+-		} else if (test_bit(CONN_LOCAL_BUSY,
+-				    &chan->conn_state)) {
+-			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
+-		} else {
+-			/* Logical link is up or moving to BR/EDR,
+-			 * proceed with move
+-			 */
+-			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
+-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
+-		}
+-		break;
+-	case L2CAP_MOVE_WAIT_RSP:
+-		/* Moving to AMP */
+-		if (result == L2CAP_MR_SUCCESS) {
+-			/* Remote is ready, send confirm immediately
+-			 * after logical link is ready
+-			 */
+-			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
+-		} else {
+-			/* Both logical link and move success
+-			 * are required to confirm
+-			 */
+-			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
+-		}
+-
+-		/* Placeholder - get hci_chan for logical link */
+-		if (!hchan) {
+-			/* Logical link not available */
+-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
+-			break;
+-		}
+-
+-		/* If the logical link is not yet connected, do not
+-		 * send confirmation.
+-		 */
+-		if (hchan->state != BT_CONNECTED)
+-			break;
+-
+-		/* Logical link is already ready to go */
+-
+-		chan->hs_hcon = hchan->conn;
+-		chan->hs_hcon->l2cap_data = chan->conn;
+-
+-		if (result == L2CAP_MR_SUCCESS) {
+-			/* Can confirm now */
+-			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
+-		} else {
+-			/* Now only need move success
+-			 * to confirm
+-			 */
+-			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
+-		}
+-
+-		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
+-		break;
+-	default:
+-		/* Any other amp move state means the move failed. */
+-		chan->move_id = chan->local_amp_id;
+-		l2cap_move_done(chan);
+-		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
+-	}
+-
+-	l2cap_chan_unlock(chan);
+-	l2cap_chan_put(chan);
+-}
+-
+-static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
+-			    u16 result)
+-{
+-	struct l2cap_chan *chan;
+-
+-	chan = l2cap_get_chan_by_ident(conn, ident);
+-	if (!chan) {
+-		/* Could not locate channel, icid is best guess */
+-		l2cap_send_move_chan_cfm_icid(conn, icid);
+-		return;
+-	}
+-
+-	__clear_chan_timer(chan);
+-
+-	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
+-		if (result == L2CAP_MR_COLLISION) {
+-			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
+-		} else {
+-			/* Cleanup - cancel move */
+-			chan->move_id = chan->local_amp_id;
+-			l2cap_move_done(chan);
+-		}
+-	}
+-
+-	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
+-
+-	l2cap_chan_unlock(chan);
+-	l2cap_chan_put(chan);
+-}
+-
+-static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
+-				  struct l2cap_cmd_hdr *cmd,
+-				  u16 cmd_len, void *data)
+-{
+-	struct l2cap_move_chan_rsp *rsp = data;
+-	u16 icid, result;
+-
+-	if (cmd_len != sizeof(*rsp))
+-		return -EPROTO;
+-
+-	icid = le16_to_cpu(rsp->icid);
+-	result = le16_to_cpu(rsp->result);
+-
+-	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
+-
+-	if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
+-		l2cap_move_continue(conn, icid, result);
+-	else
+-		l2cap_move_fail(conn, cmd->ident, icid, result);
+-
+-	return 0;
+-}
+-
+-static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
+-				      struct l2cap_cmd_hdr *cmd,
+-				      u16 cmd_len, void *data)
+-{
+-	struct l2cap_move_chan_cfm *cfm = data;
+-	struct l2cap_chan *chan;
+-	u16 icid, result;
+-
+-	if (cmd_len != sizeof(*cfm))
+-		return -EPROTO;
+-
+-	icid = le16_to_cpu(cfm->icid);
+-	result = le16_to_cpu(cfm->result);
+-
+-	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
+-
+-	chan = l2cap_get_chan_by_dcid(conn, icid);
+-	if (!chan) {
+-		/* Spec requires a response even if the icid was not found */
+-		l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
+-		return 0;
+-	}
+-
+-	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
+-		if (result == L2CAP_MC_CONFIRMED) {
+-			chan->local_amp_id = chan->move_id;
+-			if (chan->local_amp_id == AMP_ID_BREDR)
+-				__release_logical_link(chan);
+-		} else {
+-			chan->move_id = chan->local_amp_id;
+-		}
+-
+-		l2cap_move_done(chan);
+-	}
+-
+-	l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
+-
+-	l2cap_chan_unlock(chan);
+-	l2cap_chan_put(chan);
+-
+-	return 0;
+-}
+-
+-static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
+-						 struct l2cap_cmd_hdr *cmd,
+-						 u16 cmd_len, void *data)
+-{
+-	struct l2cap_move_chan_cfm_rsp *rsp = data;
+-	struct l2cap_chan *chan;
+-	u16 icid;
+-
+-	if (cmd_len != sizeof(*rsp))
+-		return -EPROTO;
+-
+-	icid = le16_to_cpu(rsp->icid);
+-
+-	BT_DBG("icid 0x%4.4x", icid);
+-
+-	chan = l2cap_get_chan_by_scid(conn, icid);
+-	if (!chan)
+-		return 0;
+-
+-	__clear_chan_timer(chan);
+-
+-	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
+-		chan->local_amp_id = chan->move_id;
+-
+-		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
+-			__release_logical_link(chan);
+-
+-		l2cap_move_done(chan);
+-	}
+-
+-	l2cap_chan_unlock(chan);
+-	l2cap_chan_put(chan);
+-
+-	return 0;
+-}
+-
+ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
+ 					      struct l2cap_cmd_hdr *cmd,
+ 					      u16 cmd_len, u8 *data)
+@@ -5745,7 +4761,6 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
+ 		break;
+ 
+ 	case L2CAP_CONN_RSP:
+-	case L2CAP_CREATE_CHAN_RSP:
+ 		l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
+ 		break;
+ 
+@@ -5780,26 +4795,6 @@ static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
+ 		l2cap_information_rsp(conn, cmd, cmd_len, data);
+ 		break;
+ 
+-	case L2CAP_CREATE_CHAN_REQ:
+-		err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
+-		break;
+-
+-	case L2CAP_MOVE_CHAN_REQ:
+-		err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
+-		break;
+-
+-	case L2CAP_MOVE_CHAN_RSP:
+-		l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
+-		break;
+-
+-	case L2CAP_MOVE_CHAN_CFM:
+-		err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
+-		break;
+-
+-	case L2CAP_MOVE_CHAN_CFM_RSP:
+-		l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
+-		break;
+-
+ 	default:
+ 		BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
+ 		err = -EINVAL;
+@@ -7051,8 +6046,8 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan,
+ 		if (control->final) {
+ 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
+ 
+-			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
+-			    !__chan_is_moving(chan)) {
++			if (!test_and_clear_bit(CONN_REJ_ACT,
++						&chan->conn_state)) {
+ 				control->final = 0;
+ 				l2cap_retransmit_all(chan, control);
+ 			}
+@@ -7245,11 +6240,7 @@ static int l2cap_finish_move(struct l2cap_chan *chan)
+ 	BT_DBG("chan %p", chan);
+ 
+ 	chan->rx_state = L2CAP_RX_STATE_RECV;
+-
+-	if (chan->hs_hcon)
+-		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
+-	else
+-		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
++	chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
+ 
+ 	return l2cap_resegment(chan);
+ }
+@@ -7316,11 +6307,7 @@ static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
+ 	 */
+ 	chan->next_tx_seq = control->reqseq;
+ 	chan->unacked_frames = 0;
+-
+-	if (chan->hs_hcon)
+-		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
+-	else
+-		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
++	chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
+ 
+ 	err = l2cap_resegment(chan);
+ 
+@@ -7672,21 +6659,10 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
+ 
+ 	chan = l2cap_get_chan_by_scid(conn, cid);
+ 	if (!chan) {
+-		if (cid == L2CAP_CID_A2MP) {
+-			chan = a2mp_channel_create(conn, skb);
+-			if (!chan) {
+-				kfree_skb(skb);
+-				return;
+-			}
+-
+-			l2cap_chan_hold(chan);
+-			l2cap_chan_lock(chan);
+-		} else {
+-			BT_DBG("unknown cid 0x%4.4x", cid);
+-			/* Drop packet and return */
+-			kfree_skb(skb);
+-			return;
+-		}
++		BT_DBG("unknown cid 0x%4.4x", cid);
++		/* Drop packet and return */
++		kfree_skb(skb);
++		return;
+ 	}
+ 
+ 	BT_DBG("chan %p, len %d", chan, skb->len);
+@@ -7887,10 +6863,6 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
+ 
+ 	conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
+ 
+-	if (hcon->type == ACL_LINK &&
+-	    hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
+-		conn->local_fixed_chan |= L2CAP_FC_A2MP;
+-
+ 	if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
+ 	    (bredr_sc_enabled(hcon->hdev) ||
+ 	     hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
+@@ -8355,11 +7327,6 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
+ 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
+ 		       state_to_string(chan->state));
+ 
+-		if (chan->scid == L2CAP_CID_A2MP) {
+-			l2cap_chan_unlock(chan);
+-			continue;
+-		}
+-
+ 		if (!status && encrypt)
+ 			chan->sec_level = hcon->sec_level;
+ 
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index e50d3d102078e..ee7a41d6994fc 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1027,23 +1027,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
+ 			break;
+ 		}
+ 
+-		if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
+-			err = -EINVAL;
+-			break;
+-		}
+-
+-		if (chan->mode != L2CAP_MODE_ERTM &&
+-		    chan->mode != L2CAP_MODE_STREAMING) {
+-			err = -EOPNOTSUPP;
+-			break;
+-		}
+-
+-		chan->chan_policy = (u8) opt;
+-
+-		if (sk->sk_state == BT_CONNECTED &&
+-		    chan->move_role == L2CAP_MOVE_ROLE_NONE)
+-			l2cap_move_start(chan);
+-
++		err = -EOPNOTSUPP;
+ 		break;
+ 
+ 	case BT_SNDMTU:
+diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
+index 688890f581cba..b2a272bc4d7c5 100644
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -835,8 +835,6 @@ static u32 get_supported_settings(struct hci_dev *hdev)
+ 
+ 		if (lmp_ssp_capable(hdev)) {
+ 			settings |= MGMT_SETTING_SSP;
+-			if (IS_ENABLED(CONFIG_BT_HS))
+-				settings |= MGMT_SETTING_HS;
+ 		}
+ 
+ 		if (lmp_sc_capable(hdev))
+@@ -901,9 +899,6 @@ static u32 get_current_settings(struct hci_dev *hdev)
+ 	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
+ 		settings |= MGMT_SETTING_SSP;
+ 
+-	if (hci_dev_test_flag(hdev, HCI_HS_ENABLED))
+-		settings |= MGMT_SETTING_HS;
+-
+ 	if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
+ 		settings |= MGMT_SETTING_ADVERTISING;
+ 
+@@ -1930,7 +1925,6 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
+ 
+ 		if (enable && hci_dev_test_and_clear_flag(hdev,
+ 							  HCI_SSP_ENABLED)) {
+-			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
+ 			new_settings(hdev, NULL);
+ 		}
+ 
+@@ -1943,12 +1937,6 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
+ 		changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
+ 	} else {
+ 		changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
+-
+-		if (!changed)
+-			changed = hci_dev_test_and_clear_flag(hdev,
+-							      HCI_HS_ENABLED);
+-		else
+-			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
+ 	}
+ 
+ 	mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match);
+@@ -2012,11 +2000,6 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+ 		} else {
+ 			changed = hci_dev_test_and_clear_flag(hdev,
+ 							      HCI_SSP_ENABLED);
+-			if (!changed)
+-				changed = hci_dev_test_and_clear_flag(hdev,
+-								      HCI_HS_ENABLED);
+-			else
+-				hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
+ 		}
+ 
+ 		err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev);
+@@ -2062,63 +2045,10 @@ static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+ 
+ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+ {
+-	struct mgmt_mode *cp = data;
+-	bool changed;
+-	u8 status;
+-	int err;
+-
+ 	bt_dev_dbg(hdev, "sock %p", sk);
+ 
+-	if (!IS_ENABLED(CONFIG_BT_HS))
+-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
++	return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+ 				       MGMT_STATUS_NOT_SUPPORTED);
+-
+-	status = mgmt_bredr_support(hdev);
+-	if (status)
+-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status);
+-
+-	if (!lmp_ssp_capable(hdev))
+-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+-				       MGMT_STATUS_NOT_SUPPORTED);
+-
+-	if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
+-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+-				       MGMT_STATUS_REJECTED);
+-
+-	if (cp->val != 0x00 && cp->val != 0x01)
+-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+-				       MGMT_STATUS_INVALID_PARAMS);
+-
+-	hci_dev_lock(hdev);
+-
+-	if (pending_find(MGMT_OP_SET_SSP, hdev)) {
+-		err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+-				      MGMT_STATUS_BUSY);
+-		goto unlock;
+-	}
+-
+-	if (cp->val) {
+-		changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED);
+-	} else {
+-		if (hdev_is_powered(hdev)) {
+-			err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS,
+-					      MGMT_STATUS_REJECTED);
+-			goto unlock;
+-		}
+-
+-		changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED);
+-	}
+-
+-	err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev);
+-	if (err < 0)
+-		goto unlock;
+-
+-	if (changed)
+-		err = new_settings(hdev, sk);
+-
+-unlock:
+-	hci_dev_unlock(hdev);
+-	return err;
+ }
+ 
+ static void set_le_complete(struct hci_dev *hdev, void *data, int err)
+@@ -6766,7 +6696,6 @@ static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
+ 			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
+ 			hci_dev_clear_flag(hdev, HCI_LINK_SECURITY);
+ 			hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE);
+-			hci_dev_clear_flag(hdev, HCI_HS_ENABLED);
+ 		}
+ 
+ 		hci_dev_change_flag(hdev, HCI_BREDR_ENABLED);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-remove-hci_power_off_timeout.patch b/queue-6.8/bluetooth-remove-hci_power_off_timeout.patch
new file mode 100644
index 00000000000..842ce98baa3
--- /dev/null
+++ b/queue-6.8/bluetooth-remove-hci_power_off_timeout.patch
@@ -0,0 +1,39 @@
+From 3cb0efe274d01b1303e94155b01a667522bee784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 19:02:47 +0100
+Subject: Bluetooth: Remove HCI_POWER_OFF_TIMEOUT
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Dreßler <verdre@v0yd.nl>
+
+[ Upstream commit 968667f2e0345a67a6eea5a502f4659085666564 ]
+
+With commit cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED"),
+the power off sequence got refactored so that this timeout was no longer
+necessary, let's remove the leftover define from the header too.
+
+Fixes: cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED")
+Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
+index bdee5d649cc61..f7918c7551834 100644
+--- a/include/net/bluetooth/hci.h
++++ b/include/net/bluetooth/hci.h
+@@ -437,7 +437,6 @@ enum {
+ #define HCI_NCMD_TIMEOUT	msecs_to_jiffies(4000)	/* 4 seconds */
+ #define HCI_ACL_TX_TIMEOUT	msecs_to_jiffies(45000)	/* 45 seconds */
+ #define HCI_AUTO_OFF_TIMEOUT	msecs_to_jiffies(2000)	/* 2 seconds */
+-#define HCI_POWER_OFF_TIMEOUT	msecs_to_jiffies(5000)	/* 5 seconds */
+ #define HCI_LE_CONN_TIMEOUT	msecs_to_jiffies(20000)	/* 20 seconds */
+ #define HCI_LE_AUTOCONN_TIMEOUT	msecs_to_jiffies(4000)	/* 4 seconds */
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch b/queue-6.8/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
new file mode 100644
index 00000000000..1df30995964
--- /dev/null
+++ b/queue-6.8/bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
@@ -0,0 +1,62 @@
+From 88d2759ff5bcd15a32ee51b65d0d0229bda154a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 23:46:06 +0100
+Subject: Bluetooth: Remove superfluous call to hci_conn_check_pending()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonas Dreßler <verdre@v0yd.nl>
+
+[ Upstream commit 78e3639fc8031275010c3287ac548c0bc8de83b1 ]
+
+The "pending connections" feature was originally introduced with commit
+4c67bc74f016 ("[Bluetooth] Support concurrent connect requests") and
+6bd57416127e ("[Bluetooth] Handling pending connect attempts after
+inquiry") to handle controllers supporting only a single connection request
+at a time. Later things were extended to also cancel ongoing inquiries on
+connect() with commit 89e65975fea5 ("Bluetooth: Cancel Inquiry before
+Create Connection").
+
+With commit a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only
+opcodes"), hci_conn_check_pending() was introduced as a helper to
+consolidate a few places where we check for pending connections (indicated
+by the BT_CONNECT2 flag) and then try to connect.
+
+This refactoring commit also snuck in two more calls to
+hci_conn_check_pending():
+
+- One is in the failure callback of hci_cs_inquiry(), this one probably
+makes sense: If we send an "HCI Inquiry" command and then immediately
+after a "Create Connection" command, the "Create Connection" command might
+fail before the "HCI Inquiry" command, and then we want to retry the
+"Create Connection" on failure of the "HCI Inquiry".
+
+- The other added call to hci_conn_check_pending() is in the event handler
+for the "Remote Name" event, this seems unrelated and is possibly a
+copy-paste error, so remove that one.
+
+Fixes: a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only opcodes")
+Signed-off-by: Jonas Dreßler <verdre@v0yd.nl>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 2a5f5a7d2412b..1f63f77661dce 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3556,8 +3556,6 @@ static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
+ 
+ 	bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
+ 
+-	hci_conn_check_pending(hdev);
+-
+ 	hci_dev_lock(hdev);
+ 
+ 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-don-t-emit-warnings-intended-for-global-subprogs.patch b/queue-6.8/bpf-don-t-emit-warnings-intended-for-global-subprogs.patch
new file mode 100644
index 00000000000..4f2dc4cbaea
--- /dev/null
+++ b/queue-6.8/bpf-don-t-emit-warnings-intended-for-global-subprogs.patch
@@ -0,0 +1,60 @@
+From 1cfc35d0eb86343fb61465a176b8447301e3e92a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 11:05:29 -0800
+Subject: bpf: don't emit warnings intended for global subprogs for static
+ subprogs
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 1eb986746a67952df86eb2c50a36450ef103d01b ]
+
+When btf_prepare_func_args() was generalized to handle both static and
+global subprogs, a few warnings/errors that are meant only for global
+subprog cases started to be emitted for static subprogs, where they are
+sort of expected and irrelavant.
+
+Stop polutting verifier logs with irrelevant scary-looking messages.
+
+Fixes: e26080d0da87 ("bpf: prepare btf_prepare_func_args() for handling static subprogs")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20240202190529.2374377-4-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index dbe7a590f565a..92aa3cf0396b8 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -7009,6 +7009,8 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
+ 	args = (const struct btf_param *)(t + 1);
+ 	nargs = btf_type_vlen(t);
+ 	if (nargs > MAX_BPF_FUNC_REG_ARGS) {
++		if (!is_global)
++			return -EINVAL;
+ 		bpf_log(log, "Global function %s() with %d > %d args. Buggy compiler.\n",
+ 			tname, nargs, MAX_BPF_FUNC_REG_ARGS);
+ 		return -EINVAL;
+@@ -7018,6 +7020,8 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
+ 	while (btf_type_is_modifier(t))
+ 		t = btf_type_by_id(btf, t->type);
+ 	if (!btf_type_is_int(t) && !btf_is_any_enum(t)) {
++		if (!is_global)
++			return -EINVAL;
+ 		bpf_log(log,
+ 			"Global function %s() doesn't return scalar. Only those are supported.\n",
+ 			tname);
+@@ -7091,6 +7095,8 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
+ 			sub->args[i].arg_type = ARG_ANYTHING;
+ 			continue;
+ 		}
++		if (!is_global)
++			return -EINVAL;
+ 		bpf_log(log, "Arg#%d type %s in %s() is not supported yet.\n",
+ 			i, btf_type_str(t), tname);
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch b/queue-6.8/bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch
new file mode 100644
index 00000000000..8b58d992ea7
--- /dev/null
+++ b/queue-6.8/bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch
@@ -0,0 +1,97 @@
+From 29668686ac3ffbfd5114dac1bb2a4c52cf87dc12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 15:32:20 -0800
+Subject: bpf: don't infer PTR_TO_CTX for programs with unnamed context type
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 879bbe7aa4afa80acf72a1cad7f52416ea78c52d ]
+
+For program types that don't have named context type name (e.g., BPF
+iterator programs or tracepoint programs), ctx_tname will be a non-NULL
+empty string. For such programs it shouldn't be possible to have
+PTR_TO_CTX argument for global subprogs based on type name alone.
+arg:ctx tag is the only way to have PTR_TO_CTX passed into global
+subprog for such program types.
+
+Fix this loophole, which currently would assume PTR_TO_CTX whenever
+user uses a pointer to anonymous struct as an argument to their global
+subprogs. This happens in practice with the following (quite common, in
+practice) approach:
+
+typedef struct { /* anonymous */
+    int x;
+} my_type_t;
+
+int my_subprog(my_type_t *arg) { ... }
+
+User's intent is to have PTR_TO_MEM argument for `arg`, but verifier
+will complain about expecting PTR_TO_CTX.
+
+This fix also closes unintended s390x-specific KPROBE handling of
+PTR_TO_CTX case. Selftest change is necessary to accommodate this.
+
+Fixes: 91cc1a99740e ("bpf: Annotate context types")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20240212233221.2575350-4-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c                              |  3 +++
+ .../bpf/progs/test_global_func_ctx_args.c     | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 92aa3cf0396b8..9041848cf1a1b 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -5685,6 +5685,9 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, const struct btf *btf,
+ 		bpf_log(log, "Please fix kernel include/linux/bpf_types.h\n");
+ 		return NULL;
+ 	}
++	/* program types without named context types work only with arg:ctx tag */
++	if (ctx_tname[0] == '\0')
++		return false;
+ 	/* only compare that prog's ctx type name is the same as
+ 	 * kernel expects. No need to compare field by field.
+ 	 * It's ok for bpf prog to do:
+diff --git a/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c b/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c
+index 9a06e5eb1fbef..143c8a4852bfe 100644
+--- a/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c
++++ b/tools/testing/selftests/bpf/progs/test_global_func_ctx_args.c
+@@ -26,6 +26,23 @@ int kprobe_typedef_ctx(void *ctx)
+ 	return kprobe_typedef_ctx_subprog(ctx);
+ }
+ 
++/* s390x defines:
++ *
++ * typedef user_pt_regs bpf_user_pt_regs_t;
++ * typedef struct { ... } user_pt_regs;
++ *
++ * And so "canonical" underlying struct type is anonymous.
++ * So on s390x only valid ways to have PTR_TO_CTX argument in global subprogs
++ * are:
++ *   - bpf_user_pt_regs_t *ctx (typedef);
++ *   - struct bpf_user_pt_regs_t *ctx (backwards compatible struct hack);
++ *   - void *ctx __arg_ctx (arg:ctx tag)
++ *
++ * Other architectures also allow using underlying struct types (e.g.,
++ * `struct pt_regs *ctx` for x86-64)
++ */
++#ifndef bpf_target_s390
++
+ #define pt_regs_struct_t typeof(*(__PT_REGS_CAST((struct pt_regs *)NULL)))
+ 
+ __weak int kprobe_struct_ctx_subprog(pt_regs_struct_t *ctx)
+@@ -40,6 +57,8 @@ int kprobe_resolved_ctx(void *ctx)
+ 	return kprobe_struct_ctx_subprog(ctx);
+ }
+ 
++#endif
++
+ /* this is current hack to make this work on old kernels */
+ struct bpf_user_pt_regs_t {};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch b/queue-6.8/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
new file mode 100644
index 00000000000..197b738697d
--- /dev/null
+++ b/queue-6.8/bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
@@ -0,0 +1,66 @@
+From 31734e86346a6923101da1c70588e04827bc24f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 13:03:35 +0100
+Subject: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 281d464a34f540de166cee74b723e97ac2515ec3 ]
+
+The devmap code allocates a number hash buckets equal to the next power
+of two of the max_entries value provided when creating the map. When
+rounding up to the next power of two, the 32-bit variable storing the
+number of buckets can overflow, and the code checks for overflow by
+checking if the truncated 32-bit value is equal to 0. However, on 32-bit
+arches the rounding up itself can overflow mid-way through, because it
+ends up doing a left-shift of 32 bits on an unsigned long value. If the
+size of an unsigned long is four bytes, this is undefined behaviour, so
+there is no guarantee that we'll end up with a nice and tidy 0-value at
+the end.
+
+Syzbot managed to turn this into a crash on arm32 by creating a
+DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it.
+Fix this by moving the overflow check to before the rounding up
+operation.
+
+Fixes: 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking up devices by hashed index")
+Link: https://lore.kernel.org/r/000000000000ed666a0611af6818@google.com
+Reported-and-tested-by: syzbot+8cd36f6b65f3cafd400a@syzkaller.appspotmail.com
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Message-ID: <20240307120340.99577-2-toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/devmap.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index a936c704d4e77..4e2cdbb5629f2 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -130,13 +130,14 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
+ 	bpf_map_init_from_attr(&dtab->map, attr);
+ 
+ 	if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+-		dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
+-
+-		if (!dtab->n_buckets) /* Overflow check */
++		/* hash table size must be power of 2; roundup_pow_of_two() can
++		 * overflow into UB on 32-bit arches, so check that first
++		 */
++		if (dtab->map.max_entries > 1UL << 31)
+ 			return -EINVAL;
+-	}
+ 
+-	if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
++		dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
++
+ 		dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets,
+ 							   dtab->map.numa_node);
+ 		if (!dtab->dev_index_head)
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch b/queue-6.8/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
new file mode 100644
index 00000000000..14a04a81429
--- /dev/null
+++ b/queue-6.8/bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
@@ -0,0 +1,65 @@
+From 0d9ac17a03c8a21f959ba9b68193548f9945aa0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 13:03:36 +0100
+Subject: bpf: Fix hashtab overflow check on 32-bit arches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 6787d916c2cf9850c97a0a3f73e08c43e7d973b1 ]
+
+The hashtab code relies on roundup_pow_of_two() to compute the number of
+hash buckets, and contains an overflow check by checking if the
+resulting value is 0. However, on 32-bit arches, the roundup code itself
+can overflow by doing a 32-bit left-shift of an unsigned long value,
+which is undefined behaviour, so it is not guaranteed to truncate
+neatly. This was triggered by syzbot on the DEVMAP_HASH type, which
+contains the same check, copied from the hashtab code. So apply the same
+fix to hashtab, by moving the overflow check to before the roundup.
+
+Fixes: daaf427c6ab3 ("bpf: fix arraymap NULL deref and missing overflow and zero size checks")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Message-ID: <20240307120340.99577-3-toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/hashtab.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 03a6a2500b6ab..3a088a5349bc0 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -499,7 +499,13 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
+ 							  num_possible_cpus());
+ 	}
+ 
+-	/* hash table size must be power of 2 */
++	/* hash table size must be power of 2; roundup_pow_of_two() can overflow
++	 * into UB on 32-bit arches, so check that first
++	 */
++	err = -E2BIG;
++	if (htab->map.max_entries > 1UL << 31)
++		goto free_htab;
++
+ 	htab->n_buckets = roundup_pow_of_two(htab->map.max_entries);
+ 
+ 	htab->elem_size = sizeof(struct htab_elem) +
+@@ -509,10 +515,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
+ 	else
+ 		htab->elem_size += round_up(htab->map.value_size, 8);
+ 
+-	err = -E2BIG;
+-	/* prevent zero size kmalloc and check for u32 overflow */
+-	if (htab->n_buckets == 0 ||
+-	    htab->n_buckets > U32_MAX / sizeof(struct bucket))
++	/* check for u32 overflow */
++	if (htab->n_buckets > U32_MAX / sizeof(struct bucket))
+ 		goto free_htab;
+ 
+ 	err = bpf_map_init_elem_count(&htab->map);
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch b/queue-6.8/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
new file mode 100644
index 00000000000..1825cfaf2a3
--- /dev/null
+++ b/queue-6.8/bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
@@ -0,0 +1,61 @@
+From df3e197388810b4f063dfcbb1600a25e4de0b49c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 13:03:37 +0100
+Subject: bpf: Fix stackmap overflow check on 32-bit arches
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 7a4b21250bf79eef26543d35bd390448646c536b ]
+
+The stackmap code relies on roundup_pow_of_two() to compute the number
+of hash buckets, and contains an overflow check by checking if the
+resulting value is 0. However, on 32-bit arches, the roundup code itself
+can overflow by doing a 32-bit left-shift of an unsigned long value,
+which is undefined behaviour, so it is not guaranteed to truncate
+neatly. This was triggered by syzbot on the DEVMAP_HASH type, which
+contains the same check, copied from the hashtab code.
+
+The commit in the fixes tag actually attempted to fix this, but the fix
+did not account for the UB, so the fix only works on CPUs where an
+overflow does result in a neat truncation to zero, which is not
+guaranteed. Checking the value before rounding does not have this
+problem.
+
+Fixes: 6183f4d3a0a2 ("bpf: Check for integer overflow when using roundup_pow_of_two()")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Reviewed-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Message-ID: <20240307120340.99577-4-toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/stackmap.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index dff7ba5397015..c99f8e5234ac4 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -91,11 +91,14 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
+ 	} else if (value_size / 8 > sysctl_perf_event_max_stack)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	/* hash table size must be power of 2 */
+-	n_buckets = roundup_pow_of_two(attr->max_entries);
+-	if (!n_buckets)
++	/* hash table size must be power of 2; roundup_pow_of_two() can overflow
++	 * into UB on 32-bit arches, so check that first
++	 */
++	if (attr->max_entries > 1UL << 31)
+ 		return ERR_PTR(-E2BIG);
+ 
++	n_buckets = roundup_pow_of_two(attr->max_entries);
++
+ 	cost = n_buckets * sizeof(struct stack_map_bucket *) + sizeof(*smap);
+ 	smap = bpf_map_area_alloc(cost, bpf_map_attr_numa_node(attr));
+ 	if (!smap)
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch b/queue-6.8/bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch
new file mode 100644
index 00000000000..ed1a5965fc2
--- /dev/null
+++ b/queue-6.8/bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch
@@ -0,0 +1,53 @@
+From 400e2ee0bbf15b6e070e579284733561357daeba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 12:27:22 +0000
+Subject: bpf: hardcode BPF_PROG_PACK_SIZE to 2MB * num_possible_nodes()
+
+From: Puranjay Mohan <puranjay12@gmail.com>
+
+[ Upstream commit d6170e4aaf86424c24ce06e355b4573daa891b17 ]
+
+On some architectures like ARM64, PMD_SIZE can be really large in some
+configurations. Like with CONFIG_ARM64_64K_PAGES=y the PMD_SIZE is
+512MB.
+
+Use 2MB * num_possible_nodes() as the size for allocations done through
+the prog pack allocator. On most architectures, PMD_SIZE will be equal
+to 2MB in case of 4KB pages and will be greater than 2MB for bigger page
+sizes.
+
+Fixes: ea2babac63d4 ("bpf: Simplify bpf_prog_pack_[size|mask]")
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Closes: https://lore.kernel.org/all/7e216c88-77ee-47b8-becc-a0f780868d3c@sirena.org.uk/
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202403092219.dhgcuz2G-lkp@intel.com/
+Suggested-by: Song Liu <song@kernel.org>
+Signed-off-by: Puranjay Mohan <puranjay12@gmail.com>
+Message-ID: <20240311122722.86232-1-puranjay12@gmail.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index ea6843be2616c..026627226ec48 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -888,7 +888,12 @@ static LIST_HEAD(pack_list);
+  * CONFIG_MMU=n. Use PAGE_SIZE in these cases.
+  */
+ #ifdef PMD_SIZE
+-#define BPF_PROG_PACK_SIZE (PMD_SIZE * num_possible_nodes())
++/* PMD_SIZE is really big for some archs. It doesn't make sense to
++ * reserve too much memory in one allocation. Hardcode BPF_PROG_PACK_SIZE to
++ * 2MiB * num_possible_nodes(). On most architectures PMD_SIZE will be
++ * greater than or equal to 2MB.
++ */
++#define BPF_PROG_PACK_SIZE (SZ_2M * num_possible_nodes())
+ #else
+ #define BPF_PROG_PACK_SIZE PAGE_SIZE
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-make-sure-scalar-args-don-t-accept-__arg_nonnull.patch b/queue-6.8/bpf-make-sure-scalar-args-don-t-accept-__arg_nonnull.patch
new file mode 100644
index 00000000000..59d903c58b4
--- /dev/null
+++ b/queue-6.8/bpf-make-sure-scalar-args-don-t-accept-__arg_nonnull.patch
@@ -0,0 +1,53 @@
+From 77572d29a28df711b1feb1c0647fb816662733fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 16:09:03 -0800
+Subject: bpf: make sure scalar args don't accept __arg_nonnull tag
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 18810ad3929ff6b5d8e67e3adc40d690bd780fd6 ]
+
+Move scalar arg processing in btf_prepare_func_args() after all pointer
+arg processing is done. This makes it easier to do validation. One
+example of unintended behavior right now is ability to specify
+__arg_nonnull for integer/enum arguments. This patch fixes this.
+
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/r/20240105000909.2818934-3-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 1eb986746a67 ("bpf: don't emit warnings intended for global subprogs for static subprogs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 5964711891767..dbe7a590f565a 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -7058,10 +7058,6 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
+ 
+ 		while (btf_type_is_modifier(t))
+ 			t = btf_type_by_id(btf, t->type);
+-		if (btf_type_is_int(t) || btf_is_any_enum(t)) {
+-			sub->args[i].arg_type = ARG_ANYTHING;
+-			continue;
+-		}
+ 		if (btf_type_is_ptr(t) && btf_get_prog_ctx_type(log, btf, t, prog_type, i)) {
+ 			sub->args[i].arg_type = ARG_PTR_TO_CTX;
+ 			continue;
+@@ -7091,6 +7087,10 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
+ 			bpf_log(log, "arg#%d marked as non-null, but is not a pointer type\n", i);
+ 			return -EINVAL;
+ 		}
++		if (btf_type_is_int(t) || btf_is_any_enum(t)) {
++			sub->args[i].arg_type = ARG_ANYTHING;
++			continue;
++		}
+ 		bpf_log(log, "Arg#%d type %s in %s() is not supported yet.\n",
+ 			i, btf_type_str(t), tname);
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch b/queue-6.8/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
new file mode 100644
index 00000000000..ae331a76cd9
--- /dev/null
+++ b/queue-6.8/bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
@@ -0,0 +1,133 @@
+From f070f9994e0eb5ff62f69b26600a9e5ea90e8a22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 23:01:02 -0800
+Subject: bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 178c54666f9c4d2f49f2ea661d0c11b52f0ed190 ]
+
+Currently tracing is supposed not to allow for bpf_spin_{lock,unlock}()
+helper calls. This is to prevent deadlock for the following cases:
+  - there is a prog (prog-A) calling bpf_spin_{lock,unlock}().
+  - there is a tracing program (prog-B), e.g., fentry, attached
+    to bpf_spin_lock() and/or bpf_spin_unlock().
+  - prog-B calls bpf_spin_{lock,unlock}().
+For such a case, when prog-A calls bpf_spin_{lock,unlock}(),
+a deadlock will happen.
+
+The related source codes are below in kernel/bpf/helpers.c:
+  notrace BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
+  notrace BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
+notrace is supposed to prevent fentry prog from attaching to
+bpf_spin_{lock,unlock}().
+
+But actually this is not the case and fentry prog can successfully
+attached to bpf_spin_lock(). Siddharth Chintamaneni reported
+the issue in [1]. The following is the macro definition for
+above BPF_CALL_1:
+  #define BPF_CALL_x(x, name, ...)                                               \
+        static __always_inline                                                 \
+        u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__));   \
+        typedef u64 (*btf_##name)(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \
+        u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));         \
+        u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))          \
+        {                                                                      \
+                return ((btf_##name)____##name)(__BPF_MAP(x,__BPF_CAST,__BPF_N,__VA_ARGS__));\
+        }                                                                      \
+        static __always_inline                                                 \
+        u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__))
+
+  #define BPF_CALL_1(name, ...)   BPF_CALL_x(1, name, __VA_ARGS__)
+
+The notrace attribute is actually applied to the static always_inline function
+____bpf_spin_{lock,unlock}(). The actual callback function
+bpf_spin_{lock,unlock}() is not marked with notrace, hence
+allowing fentry prog to attach to two helpers, and this
+may cause the above mentioned deadlock. Siddharth Chintamaneni
+actually has a reproducer in [2].
+
+To fix the issue, a new macro NOTRACE_BPF_CALL_1 is introduced which
+will add notrace attribute to the original function instead of
+the hidden always_inline function and this fixed the problem.
+
+  [1] https://lore.kernel.org/bpf/CAE5sdEigPnoGrzN8WU7Tx-h-iFuMZgW06qp0KHWtpvoXxf1OAQ@mail.gmail.com/
+  [2] https://lore.kernel.org/bpf/CAE5sdEg6yUc_Jz50AnUXEEUh6O73yQ1Z6NV2srJnef0ZrQkZew@mail.gmail.com/
+
+Fixes: d83525ca62cf ("bpf: introduce bpf_spin_lock")
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20240207070102.335167-1-yonghong.song@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/filter.h | 21 ++++++++++++---------
+ kernel/bpf/helpers.c   |  4 ++--
+ 2 files changed, 14 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 68fb6c8142fec..f537a394c42d0 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -547,24 +547,27 @@ static inline bool insn_is_zext(const struct bpf_insn *insn)
+ 	__BPF_MAP(n, __BPF_DECL_ARGS, __BPF_N, u64, __ur_1, u64, __ur_2,       \
+ 		  u64, __ur_3, u64, __ur_4, u64, __ur_5)
+ 
+-#define BPF_CALL_x(x, name, ...)					       \
++#define BPF_CALL_x(x, attr, name, ...)					       \
+ 	static __always_inline						       \
+ 	u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__));   \
+ 	typedef u64 (*btf_##name)(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__)); \
+-	u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));	       \
+-	u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))	       \
++	attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__));    \
++	attr u64 name(__BPF_REG(x, __BPF_DECL_REGS, __BPF_N, __VA_ARGS__))     \
+ 	{								       \
+ 		return ((btf_##name)____##name)(__BPF_MAP(x,__BPF_CAST,__BPF_N,__VA_ARGS__));\
+ 	}								       \
+ 	static __always_inline						       \
+ 	u64 ____##name(__BPF_MAP(x, __BPF_DECL_ARGS, __BPF_V, __VA_ARGS__))
+ 
+-#define BPF_CALL_0(name, ...)	BPF_CALL_x(0, name, __VA_ARGS__)
+-#define BPF_CALL_1(name, ...)	BPF_CALL_x(1, name, __VA_ARGS__)
+-#define BPF_CALL_2(name, ...)	BPF_CALL_x(2, name, __VA_ARGS__)
+-#define BPF_CALL_3(name, ...)	BPF_CALL_x(3, name, __VA_ARGS__)
+-#define BPF_CALL_4(name, ...)	BPF_CALL_x(4, name, __VA_ARGS__)
+-#define BPF_CALL_5(name, ...)	BPF_CALL_x(5, name, __VA_ARGS__)
++#define __NOATTR
++#define BPF_CALL_0(name, ...)	BPF_CALL_x(0, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_1(name, ...)	BPF_CALL_x(1, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_2(name, ...)	BPF_CALL_x(2, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_3(name, ...)	BPF_CALL_x(3, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_4(name, ...)	BPF_CALL_x(4, __NOATTR, name, __VA_ARGS__)
++#define BPF_CALL_5(name, ...)	BPF_CALL_x(5, __NOATTR, name, __VA_ARGS__)
++
++#define NOTRACE_BPF_CALL_1(name, ...)	BPF_CALL_x(1, notrace, name, __VA_ARGS__)
+ 
+ #define bpf_ctx_range(TYPE, MEMBER)						\
+ 	offsetof(TYPE, MEMBER) ... offsetofend(TYPE, MEMBER) - 1
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index d19cd863d294e..b10092754dde3 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -334,7 +334,7 @@ static inline void __bpf_spin_lock_irqsave(struct bpf_spin_lock *lock)
+ 	__this_cpu_write(irqsave_flags, flags);
+ }
+ 
+-notrace BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
++NOTRACE_BPF_CALL_1(bpf_spin_lock, struct bpf_spin_lock *, lock)
+ {
+ 	__bpf_spin_lock_irqsave(lock);
+ 	return 0;
+@@ -357,7 +357,7 @@ static inline void __bpf_spin_unlock_irqrestore(struct bpf_spin_lock *lock)
+ 	local_irq_restore(flags);
+ }
+ 
+-notrace BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
++NOTRACE_BPF_CALL_1(bpf_spin_unlock, struct bpf_spin_lock *, lock)
+ {
+ 	__bpf_spin_unlock_irqrestore(lock);
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpftool-fix-wrong-free-call-in-do_show_link.patch b/queue-6.8/bpftool-fix-wrong-free-call-in-do_show_link.patch
new file mode 100644
index 00000000000..348f66038e6
--- /dev/null
+++ b/queue-6.8/bpftool-fix-wrong-free-call-in-do_show_link.patch
@@ -0,0 +1,39 @@
+From 0f1f19ea08865b922b21784e11410cb2126a25b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 12:05:00 +0100
+Subject: bpftool: Fix wrong free call in do_show_link
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+[ Upstream commit 2adb2e0fcdf3c6d8e28a5a9c33e458e1037ae5ad ]
+
+The error path frees wrong array, it should be ref_ctr_offsets.
+
+Acked-by: Yafang Shao <laoar.shao@gmail.com>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Fixes: a7795698f8b6 ("bpftool: Add support to display uprobe_multi links")
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20240119110505.400573-4-jolsa@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c
+index cb46667a6b2e7..35b6859dd7c3d 100644
+--- a/tools/bpf/bpftool/link.c
++++ b/tools/bpf/bpftool/link.c
+@@ -977,7 +977,7 @@ static int do_show_link(int fd)
+ 			cookies = calloc(count, sizeof(__u64));
+ 			if (!cookies) {
+ 				p_err("mem alloc failed");
+-				free(cookies);
++				free(ref_ctr_offsets);
+ 				free(offsets);
+ 				close(fd);
+ 				return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.8/bpftool-silence-build-warning-about-calloc.patch b/queue-6.8/bpftool-silence-build-warning-about-calloc.patch
new file mode 100644
index 00000000000..118aca41239
--- /dev/null
+++ b/queue-6.8/bpftool-silence-build-warning-about-calloc.patch
@@ -0,0 +1,54 @@
+From 7ed01e99f68efa1eec411649b8dda1cdb18bc7e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 14:19:20 +0800
+Subject: bpftool: Silence build warning about calloc()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit f5f30386c78105cba520e443a6a9ee945ec1d066 ]
+
+There exists the following warning when building bpftool:
+
+  CC      prog.o
+prog.c: In function ‘profile_open_perf_events’:
+prog.c:2301:24: warning: ‘calloc’ sizes specified with ‘sizeof’ in the earlier argument and not in the later argument [-Wcalloc-transposed-args]
+ 2301 |                 sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric);
+      |                        ^~~
+prog.c:2301:24: note: earlier argument should specify number of elements, later size of each element
+
+Tested with the latest upstream GCC which contains a new warning option
+-Wcalloc-transposed-args. The first argument to calloc is documented to
+be number of elements in array, while the second argument is size of each
+element, just switch the first and second arguments of calloc() to silence
+the build warning, compile tested only.
+
+Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20240116061920.31172-1-yangtiezhu@loongson.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/prog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
+index feb8e305804fc..9cb42a3366c07 100644
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -2298,7 +2298,7 @@ static int profile_open_perf_events(struct profiler_bpf *obj)
+ 	int map_fd;
+ 
+ 	profile_perf_events = calloc(
+-		sizeof(int), obj->rodata->num_cpu * obj->rodata->num_metric);
++		obj->rodata->num_cpu * obj->rodata->num_metric, sizeof(int));
+ 	if (!profile_perf_events) {
+ 		p_err("failed to allocate memory for perf_event array: %s",
+ 		      strerror(errno));
+-- 
+2.43.0
+
diff --git a/queue-6.8/btrfs-fix-race-when-detecting-delalloc-ranges-during.patch b/queue-6.8/btrfs-fix-race-when-detecting-delalloc-ranges-during.patch
new file mode 100644
index 00000000000..e0f5eb0f308
--- /dev/null
+++ b/queue-6.8/btrfs-fix-race-when-detecting-delalloc-ranges-during.patch
@@ -0,0 +1,511 @@
+From e644af5e5a5efdf88e0c693729b64357262874b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 11:37:56 +0000
+Subject: btrfs: fix race when detecting delalloc ranges during fiemap
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 978b63f7464abcfd364a6c95f734282c50f3decf ]
+
+For fiemap we recently stopped locking the target extent range for the
+whole duration of the fiemap call, in order to avoid a deadlock in a
+scenario where the fiemap buffer happens to be a memory mapped range of
+the same file. This use case is very unlikely to be useful in practice but
+it may be triggered by fuzz testing (syzbot, etc).
+
+This however introduced a race that makes us miss delalloc ranges for
+file regions that are currently holes, so the caller of fiemap will not
+be aware that there's data for some file regions. This can be quite
+serious for some use cases - for example in coreutils versions before 9.0,
+the cp program used fiemap to detect holes and data in the source file,
+copying only regions with data (extents or delalloc) from the source file
+to the destination file in order to preserve holes (see the documentation
+for its --sparse command line option). This means that if cp was used
+with a source file that had delalloc in a hole, the destination file could
+end up without that data, which is effectively a data loss issue, if it
+happened to hit the race described below.
+
+The race happens like this:
+
+1) Fiemap is called, without the FIEMAP_FLAG_SYNC flag, for a file that
+   has delalloc in the file range [64M, 65M[, which is currently a hole;
+
+2) Fiemap locks the inode in shared mode, then starts iterating the
+   inode's subvolume tree searching for file extent items, without having
+   the whole fiemap target range locked in the inode's io tree - the
+   change introduced recently by commit b0ad381fa769 ("btrfs: fix
+   deadlock with fiemap and extent locking"). It only locks ranges in
+   the io tree when it finds a hole or prealloc extent since that
+   commit;
+
+3) Note that fiemap clones each leaf before using it, and this is to
+   avoid deadlocks when locking a file range in the inode's io tree and
+   the fiemap buffer is memory mapped to some file, because writing
+   to the page with btrfs_page_mkwrite() will wait on any ordered extent
+   for the page's range and the ordered extent needs to lock the range
+   and may need to modify the same leaf, therefore leading to a deadlock
+   on the leaf;
+
+4) While iterating the file extent items in the cloned leaf before
+   finding the hole in the range [64M, 65M[, the delalloc in that range
+   is flushed and its ordered extent completes - meaning the corresponding
+   file extent item is in the inode's subvolume tree, but not present in
+   the cloned leaf that fiemap is iterating over;
+
+5) When fiemap finds the hole in the [64M, 65M[ range by seeing the gap in
+   the cloned leaf (or a file extent item with disk_bytenr == 0 in case
+   the NO_HOLES feature is not enabled), it will lock that file range in
+   the inode's io tree and then search for delalloc by checking for the
+   EXTENT_DELALLOC bit in the io tree for that range and ordered extents
+   (with btrfs_find_delalloc_in_range()). But it finds nothing since the
+   delalloc in that range was already flushed and the ordered extent
+   completed and is gone - as a result fiemap will not report that there's
+   delalloc or an extent for the range [64M, 65M[, so user space will be
+   mislead into thinking that there's a hole in that range.
+
+This could actually be sporadically triggered with test case generic/094
+from fstests, which reports a missing extent/delalloc range like this:
+
+  generic/094 2s ... - output mismatch (see /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad)
+      --- tests/generic/094.out	2020-06-10 19:29:03.830519425 +0100
+      +++ /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad	2024-02-28 11:00:00.381071525 +0000
+      @@ -1,3 +1,9 @@
+       QA output created by 094
+       fiemap run with sync
+       fiemap run without sync
+      +ERROR: couldn't find extent at 7
+      +map is 'HHDDHPPDPHPH'
+      +logical: [       5..       6] phys:   301517..  301518 flags: 0x800 tot: 2
+      +logical: [       8..       8] phys:   301520..  301520 flags: 0x800 tot: 1
+      ...
+      (Run 'diff -u /home/fdmanana/git/hub/xfstests/tests/generic/094.out /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad'  to see the entire diff)
+
+So in order to fix this, while still avoiding deadlocks in the case where
+the fiemap buffer is memory mapped to the same file, change fiemap to work
+like the following:
+
+1) Always lock the whole range in the inode's io tree before starting to
+   iterate the inode's subvolume tree searching for file extent items,
+   just like we did before commit b0ad381fa769 ("btrfs: fix deadlock with
+   fiemap and extent locking");
+
+2) Now instead of writing to the fiemap buffer every time we have an extent
+   to report, write instead to a temporary buffer (1 page), and when that
+   buffer becomes full, stop iterating the file extent items, unlock the
+   range in the io tree, release the search path, submit all the entries
+   kept in that buffer to the fiemap buffer, and then resume the search
+   for file extent items after locking again the remainder of the range in
+   the io tree.
+
+   The buffer having a size of a page, allows for 146 entries in a system
+   with 4K pages. This is a large enough value to have a good performance
+   by avoiding too many restarts of the search for file extent items.
+   In other words this preserves the huge performance gains made in the
+   last two years to fiemap, while avoiding the deadlocks in case the
+   fiemap buffer is memory mapped to the same file (useless in practice,
+   but possible and exercised by fuzz testing and syzbot).
+
+Fixes: b0ad381fa769 ("btrfs: fix deadlock with fiemap and extent locking")
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/extent_io.c | 221 +++++++++++++++++++++++++++++++------------
+ 1 file changed, 160 insertions(+), 61 deletions(-)
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 8b4bef05e2221..7761d7d93ba98 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2453,12 +2453,65 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)
+ 	return try_release_extent_state(tree, page, mask);
+ }
+ 
++struct btrfs_fiemap_entry {
++	u64 offset;
++	u64 phys;
++	u64 len;
++	u32 flags;
++};
++
+ /*
+- * To cache previous fiemap extent
++ * Indicate the caller of emit_fiemap_extent() that it needs to unlock the file
++ * range from the inode's io tree, unlock the subvolume tree search path, flush
++ * the fiemap cache and relock the file range and research the subvolume tree.
++ * The value here is something negative that can't be confused with a valid
++ * errno value and different from 1 because that's also a return value from
++ * fiemap_fill_next_extent() and also it's often used to mean some btree search
++ * did not find a key, so make it some distinct negative value.
++ */
++#define BTRFS_FIEMAP_FLUSH_CACHE (-(MAX_ERRNO + 1))
++
++/*
++ * Used to:
++ *
++ * - Cache the next entry to be emitted to the fiemap buffer, so that we can
++ *   merge extents that are contiguous and can be grouped as a single one;
+  *
+- * Will be used for merging fiemap extent
++ * - Store extents ready to be written to the fiemap buffer in an intermediary
++ *   buffer. This intermediary buffer is to ensure that in case the fiemap
++ *   buffer is memory mapped to the fiemap target file, we don't deadlock
++ *   during btrfs_page_mkwrite(). This is because during fiemap we are locking
++ *   an extent range in order to prevent races with delalloc flushing and
++ *   ordered extent completion, which is needed in order to reliably detect
++ *   delalloc in holes and prealloc extents. And this can lead to a deadlock
++ *   if the fiemap buffer is memory mapped to the file we are running fiemap
++ *   against (a silly, useless in practice scenario, but possible) because
++ *   btrfs_page_mkwrite() will try to lock the same extent range.
+  */
+ struct fiemap_cache {
++	/* An array of ready fiemap entries. */
++	struct btrfs_fiemap_entry *entries;
++	/* Number of entries in the entries array. */
++	int entries_size;
++	/* Index of the next entry in the entries array to write to. */
++	int entries_pos;
++	/*
++	 * Once the entries array is full, this indicates what's the offset for
++	 * the next file extent item we must search for in the inode's subvolume
++	 * tree after unlocking the extent range in the inode's io tree and
++	 * releasing the search path.
++	 */
++	u64 next_search_offset;
++	/*
++	 * This matches struct fiemap_extent_info::fi_mapped_extents, we use it
++	 * to count ourselves emitted extents and stop instead of relying on
++	 * fiemap_fill_next_extent() because we buffer ready fiemap entries at
++	 * the @entries array, and we want to stop as soon as we hit the max
++	 * amount of extents to map, not just to save time but also to make the
++	 * logic at extent_fiemap() simpler.
++	 */
++	unsigned int extents_mapped;
++	/* Fields for the cached extent (unsubmitted, not ready, extent). */
+ 	u64 offset;
+ 	u64 phys;
+ 	u64 len;
+@@ -2466,6 +2519,28 @@ struct fiemap_cache {
+ 	bool cached;
+ };
+ 
++static int flush_fiemap_cache(struct fiemap_extent_info *fieinfo,
++			      struct fiemap_cache *cache)
++{
++	for (int i = 0; i < cache->entries_pos; i++) {
++		struct btrfs_fiemap_entry *entry = &cache->entries[i];
++		int ret;
++
++		ret = fiemap_fill_next_extent(fieinfo, entry->offset,
++					      entry->phys, entry->len,
++					      entry->flags);
++		/*
++		 * Ignore 1 (reached max entries) because we keep track of that
++		 * ourselves in emit_fiemap_extent().
++		 */
++		if (ret < 0)
++			return ret;
++	}
++	cache->entries_pos = 0;
++
++	return 0;
++}
++
+ /*
+  * Helper to submit fiemap extent.
+  *
+@@ -2480,8 +2555,8 @@ static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,
+ 				struct fiemap_cache *cache,
+ 				u64 offset, u64 phys, u64 len, u32 flags)
+ {
++	struct btrfs_fiemap_entry *entry;
+ 	u64 cache_end;
+-	int ret = 0;
+ 
+ 	/* Set at the end of extent_fiemap(). */
+ 	ASSERT((flags & FIEMAP_EXTENT_LAST) == 0);
+@@ -2494,7 +2569,9 @@ static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,
+ 	 * find an extent that starts at an offset behind the end offset of the
+ 	 * previous extent we processed. This happens if fiemap is called
+ 	 * without FIEMAP_FLAG_SYNC and there are ordered extents completing
+-	 * while we call btrfs_next_leaf() (through fiemap_next_leaf_item()).
++	 * after we had to unlock the file range, release the search path, emit
++	 * the fiemap extents stored in the buffer (cache->entries array) and
++	 * the lock the remainder of the range and re-search the btree.
+ 	 *
+ 	 * For example we are in leaf X processing its last item, which is the
+ 	 * file extent item for file range [512K, 1M[, and after
+@@ -2607,11 +2684,35 @@ static int emit_fiemap_extent(struct fiemap_extent_info *fieinfo,
+ 
+ emit:
+ 	/* Not mergeable, need to submit cached one */
+-	ret = fiemap_fill_next_extent(fieinfo, cache->offset, cache->phys,
+-				      cache->len, cache->flags);
+-	cache->cached = false;
+-	if (ret)
+-		return ret;
++
++	if (cache->entries_pos == cache->entries_size) {
++		/*
++		 * We will need to research for the end offset of the last
++		 * stored extent and not from the current offset, because after
++		 * unlocking the range and releasing the path, if there's a hole
++		 * between that end offset and this current offset, a new extent
++		 * may have been inserted due to a new write, so we don't want
++		 * to miss it.
++		 */
++		entry = &cache->entries[cache->entries_size - 1];
++		cache->next_search_offset = entry->offset + entry->len;
++		cache->cached = false;
++
++		return BTRFS_FIEMAP_FLUSH_CACHE;
++	}
++
++	entry = &cache->entries[cache->entries_pos];
++	entry->offset = cache->offset;
++	entry->phys = cache->phys;
++	entry->len = cache->len;
++	entry->flags = cache->flags;
++	cache->entries_pos++;
++	cache->extents_mapped++;
++
++	if (cache->extents_mapped == fieinfo->fi_extents_max) {
++		cache->cached = false;
++		return 1;
++	}
+ assign:
+ 	cache->cached = true;
+ 	cache->offset = offset;
+@@ -2737,8 +2838,8 @@ static int fiemap_search_slot(struct btrfs_inode *inode, struct btrfs_path *path
+ 	 * neighbour leaf).
+ 	 * We also need the private clone because holding a read lock on an
+ 	 * extent buffer of the subvolume's b+tree will make lockdep unhappy
+-	 * when we call fiemap_fill_next_extent(), because that may cause a page
+-	 * fault when filling the user space buffer with fiemap data.
++	 * when we check if extents are shared, as backref walking may need to
++	 * lock the same leaf we are processing.
+ 	 */
+ 	clone = btrfs_clone_extent_buffer(path->nodes[0]);
+ 	if (!clone)
+@@ -2778,34 +2879,16 @@ static int fiemap_process_hole(struct btrfs_inode *inode,
+ 	 * it beyond i_size.
+ 	 */
+ 	while (cur_offset < end && cur_offset < i_size) {
+-		struct extent_state *cached_state = NULL;
+ 		u64 delalloc_start;
+ 		u64 delalloc_end;
+ 		u64 prealloc_start;
+-		u64 lockstart;
+-		u64 lockend;
+ 		u64 prealloc_len = 0;
+ 		bool delalloc;
+ 
+-		lockstart = round_down(cur_offset, inode->root->fs_info->sectorsize);
+-		lockend = round_up(end, inode->root->fs_info->sectorsize);
+-
+-		/*
+-		 * We are only locking for the delalloc range because that's the
+-		 * only thing that can change here.  With fiemap we have a lock
+-		 * on the inode, so no buffered or direct writes can happen.
+-		 *
+-		 * However mmaps and normal page writeback will cause this to
+-		 * change arbitrarily.  We have to lock the extent lock here to
+-		 * make sure that nobody messes with the tree while we're doing
+-		 * btrfs_find_delalloc_in_range.
+-		 */
+-		lock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
+ 		delalloc = btrfs_find_delalloc_in_range(inode, cur_offset, end,
+ 							delalloc_cached_state,
+ 							&delalloc_start,
+ 							&delalloc_end);
+-		unlock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
+ 		if (!delalloc)
+ 			break;
+ 
+@@ -2973,6 +3056,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 		  u64 start, u64 len)
+ {
+ 	const u64 ino = btrfs_ino(inode);
++	struct extent_state *cached_state = NULL;
+ 	struct extent_state *delalloc_cached_state = NULL;
+ 	struct btrfs_path *path;
+ 	struct fiemap_cache cache = { 0 };
+@@ -2985,26 +3069,33 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 	bool stopped = false;
+ 	int ret;
+ 
++	cache.entries_size = PAGE_SIZE / sizeof(struct btrfs_fiemap_entry);
++	cache.entries = kmalloc_array(cache.entries_size,
++				      sizeof(struct btrfs_fiemap_entry),
++				      GFP_KERNEL);
+ 	backref_ctx = btrfs_alloc_backref_share_check_ctx();
+ 	path = btrfs_alloc_path();
+-	if (!backref_ctx || !path) {
++	if (!cache.entries || !backref_ctx || !path) {
+ 		ret = -ENOMEM;
+ 		goto out;
+ 	}
+ 
++restart:
+ 	range_start = round_down(start, sectorsize);
+ 	range_end = round_up(start + len, sectorsize);
+ 	prev_extent_end = range_start;
+ 
++	lock_extent(&inode->io_tree, range_start, range_end, &cached_state);
++
+ 	ret = fiemap_find_last_extent_offset(inode, path, &last_extent_end);
+ 	if (ret < 0)
+-		goto out;
++		goto out_unlock;
+ 	btrfs_release_path(path);
+ 
+ 	path->reada = READA_FORWARD;
+ 	ret = fiemap_search_slot(inode, path, range_start);
+ 	if (ret < 0) {
+-		goto out;
++		goto out_unlock;
+ 	} else if (ret > 0) {
+ 		/*
+ 		 * No file extent item found, but we may have delalloc between
+@@ -3051,7 +3142,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 						  backref_ctx, 0, 0, 0,
+ 						  prev_extent_end, hole_end);
+ 			if (ret < 0) {
+-				goto out;
++				goto out_unlock;
+ 			} else if (ret > 0) {
+ 				/* fiemap_fill_next_extent() told us to stop. */
+ 				stopped = true;
+@@ -3107,7 +3198,7 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 								  extent_gen,
+ 								  backref_ctx);
+ 				if (ret < 0)
+-					goto out;
++					goto out_unlock;
+ 				else if (ret > 0)
+ 					flags |= FIEMAP_EXTENT_SHARED;
+ 			}
+@@ -3118,9 +3209,9 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 		}
+ 
+ 		if (ret < 0) {
+-			goto out;
++			goto out_unlock;
+ 		} else if (ret > 0) {
+-			/* fiemap_fill_next_extent() told us to stop. */
++			/* emit_fiemap_extent() told us to stop. */
+ 			stopped = true;
+ 			break;
+ 		}
+@@ -3129,12 +3220,12 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ next_item:
+ 		if (fatal_signal_pending(current)) {
+ 			ret = -EINTR;
+-			goto out;
++			goto out_unlock;
+ 		}
+ 
+ 		ret = fiemap_next_leaf_item(inode, path);
+ 		if (ret < 0) {
+-			goto out;
++			goto out_unlock;
+ 		} else if (ret > 0) {
+ 			/* No more file extent items for this inode. */
+ 			break;
+@@ -3143,22 +3234,12 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 	}
+ 
+ check_eof_delalloc:
+-	/*
+-	 * Release (and free) the path before emitting any final entries to
+-	 * fiemap_fill_next_extent() to keep lockdep happy. This is because
+-	 * once we find no more file extent items exist, we may have a
+-	 * non-cloned leaf, and fiemap_fill_next_extent() can trigger page
+-	 * faults when copying data to the user space buffer.
+-	 */
+-	btrfs_free_path(path);
+-	path = NULL;
+-
+ 	if (!stopped && prev_extent_end < range_end) {
+ 		ret = fiemap_process_hole(inode, fieinfo, &cache,
+ 					  &delalloc_cached_state, backref_ctx,
+ 					  0, 0, 0, prev_extent_end, range_end - 1);
+ 		if (ret < 0)
+-			goto out;
++			goto out_unlock;
+ 		prev_extent_end = range_end;
+ 	}
+ 
+@@ -3166,28 +3247,16 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 		const u64 i_size = i_size_read(&inode->vfs_inode);
+ 
+ 		if (prev_extent_end < i_size) {
+-			struct extent_state *cached_state = NULL;
+ 			u64 delalloc_start;
+ 			u64 delalloc_end;
+-			u64 lockstart;
+-			u64 lockend;
+ 			bool delalloc;
+ 
+-			lockstart = round_down(prev_extent_end, sectorsize);
+-			lockend = round_up(i_size, sectorsize);
+-
+-			/*
+-			 * See the comment in fiemap_process_hole as to why
+-			 * we're doing the locking here.
+-			 */
+-			lock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
+ 			delalloc = btrfs_find_delalloc_in_range(inode,
+ 								prev_extent_end,
+ 								i_size - 1,
+ 								&delalloc_cached_state,
+ 								&delalloc_start,
+ 								&delalloc_end);
+-			unlock_extent(&inode->io_tree, lockstart, lockend, &cached_state);
+ 			if (!delalloc)
+ 				cache.flags |= FIEMAP_EXTENT_LAST;
+ 		} else {
+@@ -3195,9 +3264,39 @@ int extent_fiemap(struct btrfs_inode *inode, struct fiemap_extent_info *fieinfo,
+ 		}
+ 	}
+ 
++out_unlock:
++	unlock_extent(&inode->io_tree, range_start, range_end, &cached_state);
++
++	if (ret == BTRFS_FIEMAP_FLUSH_CACHE) {
++		btrfs_release_path(path);
++		ret = flush_fiemap_cache(fieinfo, &cache);
++		if (ret)
++			goto out;
++		len -= cache.next_search_offset - start;
++		start = cache.next_search_offset;
++		goto restart;
++	} else if (ret < 0) {
++		goto out;
++	}
++
++	/*
++	 * Must free the path before emitting to the fiemap buffer because we
++	 * may have a non-cloned leaf and if the fiemap buffer is memory mapped
++	 * to a file, a write into it (through btrfs_page_mkwrite()) may trigger
++	 * waiting for an ordered extent that in order to complete needs to
++	 * modify that leaf, therefore leading to a deadlock.
++	 */
++	btrfs_free_path(path);
++	path = NULL;
++
++	ret = flush_fiemap_cache(fieinfo, &cache);
++	if (ret)
++		goto out;
++
+ 	ret = emit_last_fiemap_cache(fieinfo, &cache);
+ out:
+ 	free_extent_state(delalloc_cached_state);
++	kfree(cache.entries);
+ 	btrfs_free_backref_share_ctx(backref_ctx);
+ 	btrfs_free_path(path);
+ 	return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.8/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch b/queue-6.8/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
new file mode 100644
index 00000000000..f6812132a46
--- /dev/null
+++ b/queue-6.8/bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
@@ -0,0 +1,47 @@
+From 47301708125a40d17ceec82e36a2399a73056111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 10:02:37 +0000
+Subject: bus: tegra-aconnect: Update dependency to ARCH_TEGRA
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 4acd21a45c1446277e2abaece97d7fa7c2e692a9 ]
+
+Update the architecture dependency to be the generic Tegra
+because the driver works on the four latest Tegra generations
+not just Tegra210, if you build a kernel with a specific
+ARCH_TEGRA_xxx_SOC option that excludes Tegra210 you don't get
+this driver.
+
+Fixes: 46a88534afb59 ("bus: Add support for Tegra ACONNECT")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
+index e6742998f372c..d5e7fa9173a16 100644
+--- a/drivers/bus/Kconfig
++++ b/drivers/bus/Kconfig
+@@ -186,11 +186,12 @@ config SUNXI_RSB
+ 
+ config TEGRA_ACONNECT
+ 	tristate "Tegra ACONNECT Bus Driver"
+-	depends on ARCH_TEGRA_210_SOC
++	depends on ARCH_TEGRA
+ 	depends on OF && PM
+ 	help
+ 	  Driver for the Tegra ACONNECT bus which is used to interface with
+-	  the devices inside the Audio Processing Engine (APE) for Tegra210.
++	  the devices inside the Audio Processing Engine (APE) for
++	  Tegra210 and later.
+ 
+ config TEGRA_GMI
+ 	tristate "Tegra Generic Memory Interface bus driver"
+-- 
+2.43.0
+
diff --git a/queue-6.8/can-m_can-start-cancel-polling-timer-together-with-i.patch b/queue-6.8/can-m_can-start-cancel-polling-timer-together-with-i.patch
new file mode 100644
index 00000000000..1382ba9b367
--- /dev/null
+++ b/queue-6.8/can-m_can-start-cancel-polling-timer-together-with-i.patch
@@ -0,0 +1,82 @@
+From 3aebac51a64b812b271cec02ad61dcd691788238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 10:32:07 +0100
+Subject: can: m_can: Start/Cancel polling timer together with interrupts
+
+From: Markus Schneider-Pargmann <msp@baylibre.com>
+
+[ Upstream commit a163c5761019b94258ca655b27b46e82657fd6f5 ]
+
+Interrupts are enabled/disabled in more places than just m_can_start()
+and m_can_stop(). Couple the polling timer with enabling/disabling of
+all interrupts to achieve equivalent behavior.
+
+Cc: Judith Mendez <jm@ti.com>
+Fixes: b382380c0d2d ("can: m_can: Add hrtimer to generate software interrupt")
+Signed-off-by: Markus Schneider-Pargmann <msp@baylibre.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/all/20240207093220.2681425-2-msp@baylibre.com
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/m_can/m_can.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 16ecc11c7f62a..2395b1225cc8a 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -418,6 +418,13 @@ static void m_can_config_endisable(struct m_can_classdev *cdev, bool enable)
+ 
+ static inline void m_can_enable_all_interrupts(struct m_can_classdev *cdev)
+ {
++	if (!cdev->net->irq) {
++		dev_dbg(cdev->dev, "Start hrtimer\n");
++		hrtimer_start(&cdev->hrtimer,
++			      ms_to_ktime(HRTIMER_POLL_INTERVAL_MS),
++			      HRTIMER_MODE_REL_PINNED);
++	}
++
+ 	/* Only interrupt line 0 is used in this driver */
+ 	m_can_write(cdev, M_CAN_ILE, ILE_EINT0);
+ }
+@@ -425,6 +432,11 @@ static inline void m_can_enable_all_interrupts(struct m_can_classdev *cdev)
+ static inline void m_can_disable_all_interrupts(struct m_can_classdev *cdev)
+ {
+ 	m_can_write(cdev, M_CAN_ILE, 0x0);
++
++	if (!cdev->net->irq) {
++		dev_dbg(cdev->dev, "Stop hrtimer\n");
++		hrtimer_cancel(&cdev->hrtimer);
++	}
+ }
+ 
+ /* Retrieve internal timestamp counter from TSCV.TSC, and shift it to 32-bit
+@@ -1417,12 +1429,6 @@ static int m_can_start(struct net_device *dev)
+ 
+ 	m_can_enable_all_interrupts(cdev);
+ 
+-	if (!dev->irq) {
+-		dev_dbg(cdev->dev, "Start hrtimer\n");
+-		hrtimer_start(&cdev->hrtimer, ms_to_ktime(HRTIMER_POLL_INTERVAL_MS),
+-			      HRTIMER_MODE_REL_PINNED);
+-	}
+-
+ 	return 0;
+ }
+ 
+@@ -1577,11 +1583,6 @@ static void m_can_stop(struct net_device *dev)
+ {
+ 	struct m_can_classdev *cdev = netdev_priv(dev);
+ 
+-	if (!dev->irq) {
+-		dev_dbg(cdev->dev, "Stop hrtimer\n");
+-		hrtimer_cancel(&cdev->hrtimer);
+-	}
+-
+ 	/* disable all interrupts */
+ 	m_can_disable_all_interrupts(cdev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/cifs-fix-writeback-data-corruption.patch b/queue-6.8/cifs-fix-writeback-data-corruption.patch
new file mode 100644
index 00000000000..7c210534ed4
--- /dev/null
+++ b/queue-6.8/cifs-fix-writeback-data-corruption.patch
@@ -0,0 +1,510 @@
+From 328de8ee686d8f1cf9d84de4338f0555517d9717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 11:20:26 +0000
+Subject: cifs: Fix writeback data corruption
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit f3dc1bdb6b0b0693562c7c54a6c28bafa608ba3c ]
+
+cifs writeback doesn't correctly handle the case where
+cifs_extend_writeback() hits a point where it is considering an additional
+folio, but this would overrun the wsize - at which point it drops out of
+the xarray scanning loop and calls xas_pause().  The problem is that
+xas_pause() advances the loop counter - thereby skipping that page.
+
+What needs to happen is for xas_reset() to be called any time we decide we
+don't want to process the page we're looking at, but rather send the
+request we are building and start a new one.
+
+Fix this by copying and adapting the netfslib writepages code as a
+temporary measure, with cifs writeback intending to be offloaded to
+netfslib in the near future.
+
+This also fixes the issue with the use of filemap_get_folios_tag() causing
+retry of a bunch of pages which the extender already dealt with.
+
+This can be tested by creating, say, a 64K file somewhere not on cifs
+(otherwise copy-offload may get underfoot), mounting a cifs share with a
+wsize of 64000, copying the file to it and then comparing the original file
+and the copy:
+
+        dd if=/dev/urandom of=/tmp/64K bs=64k count=1
+        mount //192.168.6.1/test /mnt -o user=...,pass=...,wsize=64000
+        cp /tmp/64K /mnt/64K
+        cmp /tmp/64K /mnt/64K
+
+Without the fix, the cmp fails at position 64000 (or shortly thereafter).
+
+Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list")
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Steve French <sfrench@samba.org>
+cc: Paulo Alcantara <pc@manguebit.com>
+cc: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+cc: Shyam Prasad N <sprasad@microsoft.com>
+cc: Tom Talpey <tom@talpey.com>
+cc: Jeff Layton <jlayton@kernel.org>
+cc: linux-cifs@vger.kernel.org
+cc: samba-technical@lists.samba.org
+cc: netfs@lists.linux.dev
+cc: linux-fsdevel@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/client/file.c | 283 ++++++++++++++++++++++++-------------------
+ 1 file changed, 157 insertions(+), 126 deletions(-)
+
+diff --git a/fs/smb/client/file.c b/fs/smb/client/file.c
+index f391c9b803d84..98514f2f2d7b1 100644
+--- a/fs/smb/client/file.c
++++ b/fs/smb/client/file.c
+@@ -2624,20 +2624,20 @@ static int cifs_partialpagewrite(struct page *page, unsigned from, unsigned to)
+  * dirty pages if possible, but don't sleep while doing so.
+  */
+ static void cifs_extend_writeback(struct address_space *mapping,
++				  struct xa_state *xas,
+ 				  long *_count,
+ 				  loff_t start,
+ 				  int max_pages,
+-				  size_t max_len,
+-				  unsigned int *_len)
++				  loff_t max_len,
++				  size_t *_len)
+ {
+ 	struct folio_batch batch;
+ 	struct folio *folio;
+-	unsigned int psize, nr_pages;
+-	size_t len = *_len;
+-	pgoff_t index = (start + len) / PAGE_SIZE;
++	unsigned int nr_pages;
++	pgoff_t index = (start + *_len) / PAGE_SIZE;
++	size_t len;
+ 	bool stop = true;
+ 	unsigned int i;
+-	XA_STATE(xas, &mapping->i_pages, index);
+ 
+ 	folio_batch_init(&batch);
+ 
+@@ -2648,54 +2648,64 @@ static void cifs_extend_writeback(struct address_space *mapping,
+ 		 */
+ 		rcu_read_lock();
+ 
+-		xas_for_each(&xas, folio, ULONG_MAX) {
++		xas_for_each(xas, folio, ULONG_MAX) {
+ 			stop = true;
+-			if (xas_retry(&xas, folio))
++			if (xas_retry(xas, folio))
+ 				continue;
+ 			if (xa_is_value(folio))
+ 				break;
+-			if (folio->index != index)
++			if (folio->index != index) {
++				xas_reset(xas);
+ 				break;
++			}
++
+ 			if (!folio_try_get_rcu(folio)) {
+-				xas_reset(&xas);
++				xas_reset(xas);
+ 				continue;
+ 			}
+ 			nr_pages = folio_nr_pages(folio);
+-			if (nr_pages > max_pages)
++			if (nr_pages > max_pages) {
++				xas_reset(xas);
+ 				break;
++			}
+ 
+ 			/* Has the page moved or been split? */
+-			if (unlikely(folio != xas_reload(&xas))) {
++			if (unlikely(folio != xas_reload(xas))) {
+ 				folio_put(folio);
++				xas_reset(xas);
+ 				break;
+ 			}
+ 
+ 			if (!folio_trylock(folio)) {
+ 				folio_put(folio);
++				xas_reset(xas);
+ 				break;
+ 			}
+-			if (!folio_test_dirty(folio) || folio_test_writeback(folio)) {
++			if (!folio_test_dirty(folio) ||
++			    folio_test_writeback(folio)) {
+ 				folio_unlock(folio);
+ 				folio_put(folio);
++				xas_reset(xas);
+ 				break;
+ 			}
+ 
+ 			max_pages -= nr_pages;
+-			psize = folio_size(folio);
+-			len += psize;
++			len = folio_size(folio);
+ 			stop = false;
+-			if (max_pages <= 0 || len >= max_len || *_count <= 0)
+-				stop = true;
+ 
+ 			index += nr_pages;
++			*_count -= nr_pages;
++			*_len += len;
++			if (max_pages <= 0 || *_len >= max_len || *_count <= 0)
++				stop = true;
++
+ 			if (!folio_batch_add(&batch, folio))
+ 				break;
+ 			if (stop)
+ 				break;
+ 		}
+ 
+-		if (!stop)
+-			xas_pause(&xas);
++		xas_pause(xas);
+ 		rcu_read_unlock();
+ 
+ 		/* Now, if we obtained any pages, we can shift them to being
+@@ -2712,16 +2722,12 @@ static void cifs_extend_writeback(struct address_space *mapping,
+ 			if (!folio_clear_dirty_for_io(folio))
+ 				WARN_ON(1);
+ 			folio_start_writeback(folio);
+-
+-			*_count -= folio_nr_pages(folio);
+ 			folio_unlock(folio);
+ 		}
+ 
+ 		folio_batch_release(&batch);
+ 		cond_resched();
+ 	} while (!stop);
+-
+-	*_len = len;
+ }
+ 
+ /*
+@@ -2729,8 +2735,10 @@ static void cifs_extend_writeback(struct address_space *mapping,
+  */
+ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping,
+ 						 struct writeback_control *wbc,
++						 struct xa_state *xas,
+ 						 struct folio *folio,
+-						 loff_t start, loff_t end)
++						 unsigned long long start,
++						 unsigned long long end)
+ {
+ 	struct inode *inode = mapping->host;
+ 	struct TCP_Server_Info *server;
+@@ -2739,17 +2747,18 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping,
+ 	struct cifs_credits credits_on_stack;
+ 	struct cifs_credits *credits = &credits_on_stack;
+ 	struct cifsFileInfo *cfile = NULL;
+-	unsigned int xid, wsize, len;
+-	loff_t i_size = i_size_read(inode);
+-	size_t max_len;
++	unsigned long long i_size = i_size_read(inode), max_len;
++	unsigned int xid, wsize;
++	size_t len = folio_size(folio);
+ 	long count = wbc->nr_to_write;
+ 	int rc;
+ 
+ 	/* The folio should be locked, dirty and not undergoing writeback. */
++	if (!folio_clear_dirty_for_io(folio))
++		WARN_ON_ONCE(1);
+ 	folio_start_writeback(folio);
+ 
+ 	count -= folio_nr_pages(folio);
+-	len = folio_size(folio);
+ 
+ 	xid = get_xid();
+ 	server = cifs_pick_channel(cifs_sb_master_tcon(cifs_sb)->ses);
+@@ -2779,9 +2788,10 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping,
+ 	wdata->server = server;
+ 	cfile = NULL;
+ 
+-	/* Find all consecutive lockable dirty pages, stopping when we find a
+-	 * page that is not immediately lockable, is not dirty or is missing,
+-	 * or we reach the end of the range.
++	/* Find all consecutive lockable dirty pages that have contiguous
++	 * written regions, stopping when we find a page that is not
++	 * immediately lockable, is not dirty or is missing, or we reach the
++	 * end of the range.
+ 	 */
+ 	if (start < i_size) {
+ 		/* Trim the write to the EOF; the extra data is ignored.  Also
+@@ -2801,19 +2811,18 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping,
+ 			max_pages -= folio_nr_pages(folio);
+ 
+ 			if (max_pages > 0)
+-				cifs_extend_writeback(mapping, &count, start,
++				cifs_extend_writeback(mapping, xas, &count, start,
+ 						      max_pages, max_len, &len);
+ 		}
+-		len = min_t(loff_t, len, max_len);
+ 	}
+-
+-	wdata->bytes = len;
++	len = min_t(unsigned long long, len, i_size - start);
+ 
+ 	/* We now have a contiguous set of dirty pages, each with writeback
+ 	 * set; the first page is still locked at this point, but all the rest
+ 	 * have been unlocked.
+ 	 */
+ 	folio_unlock(folio);
++	wdata->bytes = len;
+ 
+ 	if (start < i_size) {
+ 		iov_iter_xarray(&wdata->iter, ITER_SOURCE, &mapping->i_pages,
+@@ -2864,102 +2873,118 @@ static ssize_t cifs_write_back_from_locked_folio(struct address_space *mapping,
+ /*
+  * write a region of pages back to the server
+  */
+-static int cifs_writepages_region(struct address_space *mapping,
+-				  struct writeback_control *wbc,
+-				  loff_t start, loff_t end, loff_t *_next)
++static ssize_t cifs_writepages_begin(struct address_space *mapping,
++				     struct writeback_control *wbc,
++				     struct xa_state *xas,
++				     unsigned long long *_start,
++				     unsigned long long end)
+ {
+-	struct folio_batch fbatch;
++	struct folio *folio;
++	unsigned long long start = *_start;
++	ssize_t ret;
+ 	int skips = 0;
+ 
+-	folio_batch_init(&fbatch);
+-	do {
+-		int nr;
+-		pgoff_t index = start / PAGE_SIZE;
++search_again:
++	/* Find the first dirty page. */
++	rcu_read_lock();
+ 
+-		nr = filemap_get_folios_tag(mapping, &index, end / PAGE_SIZE,
+-					    PAGECACHE_TAG_DIRTY, &fbatch);
+-		if (!nr)
++	for (;;) {
++		folio = xas_find_marked(xas, end / PAGE_SIZE, PAGECACHE_TAG_DIRTY);
++		if (xas_retry(xas, folio) || xa_is_value(folio))
++			continue;
++		if (!folio)
+ 			break;
+ 
+-		for (int i = 0; i < nr; i++) {
+-			ssize_t ret;
+-			struct folio *folio = fbatch.folios[i];
++		if (!folio_try_get_rcu(folio)) {
++			xas_reset(xas);
++			continue;
++		}
+ 
+-redo_folio:
+-			start = folio_pos(folio); /* May regress with THPs */
++		if (unlikely(folio != xas_reload(xas))) {
++			folio_put(folio);
++			xas_reset(xas);
++			continue;
++		}
+ 
+-			/* At this point we hold neither the i_pages lock nor the
+-			 * page lock: the page may be truncated or invalidated
+-			 * (changing page->mapping to NULL), or even swizzled
+-			 * back from swapper_space to tmpfs file mapping
+-			 */
+-			if (wbc->sync_mode != WB_SYNC_NONE) {
+-				ret = folio_lock_killable(folio);
+-				if (ret < 0)
+-					goto write_error;
+-			} else {
+-				if (!folio_trylock(folio))
+-					goto skip_write;
+-			}
++		xas_pause(xas);
++		break;
++	}
++	rcu_read_unlock();
++	if (!folio)
++		return 0;
+ 
+-			if (folio->mapping != mapping ||
+-			    !folio_test_dirty(folio)) {
+-				start += folio_size(folio);
+-				folio_unlock(folio);
+-				continue;
+-			}
++	start = folio_pos(folio); /* May regress with THPs */
+ 
+-			if (folio_test_writeback(folio) ||
+-			    folio_test_fscache(folio)) {
+-				folio_unlock(folio);
+-				if (wbc->sync_mode == WB_SYNC_NONE)
+-					goto skip_write;
++	/* At this point we hold neither the i_pages lock nor the page lock:
++	 * the page may be truncated or invalidated (changing page->mapping to
++	 * NULL), or even swizzled back from swapper_space to tmpfs file
++	 * mapping
++	 */
++lock_again:
++	if (wbc->sync_mode != WB_SYNC_NONE) {
++		ret = folio_lock_killable(folio);
++		if (ret < 0)
++			return ret;
++	} else {
++		if (!folio_trylock(folio))
++			goto search_again;
++	}
+ 
+-				folio_wait_writeback(folio);
++	if (folio->mapping != mapping ||
++	    !folio_test_dirty(folio)) {
++		start += folio_size(folio);
++		folio_unlock(folio);
++		goto search_again;
++	}
++
++	if (folio_test_writeback(folio) ||
++	    folio_test_fscache(folio)) {
++		folio_unlock(folio);
++		if (wbc->sync_mode != WB_SYNC_NONE) {
++			folio_wait_writeback(folio);
+ #ifdef CONFIG_CIFS_FSCACHE
+-				folio_wait_fscache(folio);
++			folio_wait_fscache(folio);
+ #endif
+-				goto redo_folio;
+-			}
+-
+-			if (!folio_clear_dirty_for_io(folio))
+-				/* We hold the page lock - it should've been dirty. */
+-				WARN_ON(1);
+-
+-			ret = cifs_write_back_from_locked_folio(mapping, wbc, folio, start, end);
+-			if (ret < 0)
+-				goto write_error;
+-
+-			start += ret;
+-			continue;
+-
+-write_error:
+-			folio_batch_release(&fbatch);
+-			*_next = start;
+-			return ret;
++			goto lock_again;
++		}
+ 
+-skip_write:
+-			/*
+-			 * Too many skipped writes, or need to reschedule?
+-			 * Treat it as a write error without an error code.
+-			 */
++		start += folio_size(folio);
++		if (wbc->sync_mode == WB_SYNC_NONE) {
+ 			if (skips >= 5 || need_resched()) {
+ 				ret = 0;
+-				goto write_error;
++				goto out;
+ 			}
+-
+-			/* Otherwise, just skip that folio and go on to the next */
+ 			skips++;
+-			start += folio_size(folio);
+-			continue;
+ 		}
++		goto search_again;
++	}
+ 
+-		folio_batch_release(&fbatch);		
+-		cond_resched();
+-	} while (wbc->nr_to_write > 0);
++	ret = cifs_write_back_from_locked_folio(mapping, wbc, xas, folio, start, end);
++out:
++	if (ret > 0)
++		*_start = start + ret;
++	return ret;
++}
+ 
+-	*_next = start;
+-	return 0;
++/*
++ * Write a region of pages back to the server
++ */
++static int cifs_writepages_region(struct address_space *mapping,
++				  struct writeback_control *wbc,
++				  unsigned long long *_start,
++				  unsigned long long end)
++{
++	ssize_t ret;
++
++	XA_STATE(xas, &mapping->i_pages, *_start / PAGE_SIZE);
++
++	do {
++		ret = cifs_writepages_begin(mapping, wbc, &xas, _start, end);
++		if (ret > 0 && wbc->nr_to_write > 0)
++			cond_resched();
++	} while (ret > 0 && wbc->nr_to_write > 0);
++
++	return ret > 0 ? 0 : ret;
+ }
+ 
+ /*
+@@ -2968,7 +2993,7 @@ static int cifs_writepages_region(struct address_space *mapping,
+ static int cifs_writepages(struct address_space *mapping,
+ 			   struct writeback_control *wbc)
+ {
+-	loff_t start, next;
++	loff_t start, end;
+ 	int ret;
+ 
+ 	/* We have to be careful as we can end up racing with setattr()
+@@ -2976,28 +3001,34 @@ static int cifs_writepages(struct address_space *mapping,
+ 	 * to prevent it.
+ 	 */
+ 
+-	if (wbc->range_cyclic) {
++	if (wbc->range_cyclic && mapping->writeback_index) {
+ 		start = mapping->writeback_index * PAGE_SIZE;
+-		ret = cifs_writepages_region(mapping, wbc, start, LLONG_MAX, &next);
+-		if (ret == 0) {
+-			mapping->writeback_index = next / PAGE_SIZE;
+-			if (start > 0 && wbc->nr_to_write > 0) {
+-				ret = cifs_writepages_region(mapping, wbc, 0,
+-							     start, &next);
+-				if (ret == 0)
+-					mapping->writeback_index =
+-						next / PAGE_SIZE;
+-			}
++		ret = cifs_writepages_region(mapping, wbc, &start, LLONG_MAX);
++		if (ret < 0)
++			goto out;
++
++		if (wbc->nr_to_write <= 0) {
++			mapping->writeback_index = start / PAGE_SIZE;
++			goto out;
+ 		}
++
++		start = 0;
++		end = mapping->writeback_index * PAGE_SIZE;
++		mapping->writeback_index = 0;
++		ret = cifs_writepages_region(mapping, wbc, &start, end);
++		if (ret == 0)
++			mapping->writeback_index = start / PAGE_SIZE;
+ 	} else if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) {
+-		ret = cifs_writepages_region(mapping, wbc, 0, LLONG_MAX, &next);
++		start = 0;
++		ret = cifs_writepages_region(mapping, wbc, &start, LLONG_MAX);
+ 		if (wbc->nr_to_write > 0 && ret == 0)
+-			mapping->writeback_index = next / PAGE_SIZE;
++			mapping->writeback_index = start / PAGE_SIZE;
+ 	} else {
+-		ret = cifs_writepages_region(mapping, wbc,
+-					     wbc->range_start, wbc->range_end, &next);
++		start = wbc->range_start;
++		ret = cifs_writepages_region(mapping, wbc, &start, wbc->range_end);
+ 	}
+ 
++out:
+ 	return ret;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-fix-clk_core_get-null-dereference.patch b/queue-6.8/clk-fix-clk_core_get-null-dereference.patch
new file mode 100644
index 00000000000..55c9da18b41
--- /dev/null
+++ b/queue-6.8/clk-fix-clk_core_get-null-dereference.patch
@@ -0,0 +1,56 @@
+From 10941e6e75fe130654deae0c139bf2bd97639828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Mar 2024 00:52:14 +0000
+Subject: clk: Fix clk_core_get NULL dereference
+
+From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+
+[ Upstream commit e97fe4901e0f59a0bfd524578fe3768f8ca42428 ]
+
+It is possible for clk_core_get to dereference a NULL in the following
+sequence:
+
+clk_core_get()
+    of_clk_get_hw_from_clkspec()
+        __of_clk_get_hw_from_provider()
+            __clk_get_hw()
+
+__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at
+hw->core.
+
+Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based
+clk_lookups") the check IS_ERR_OR_NULL() was performed which would have
+caught the NULL.
+
+Reading the description of this function it talks about returning NULL but
+that cannot be so at the moment.
+
+Update the function to check for hw before dereferencing it and return NULL
+if hw is NULL.
+
+Fixes: dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups")
+Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20240302-linux-next-24-03-01-simple-clock-fixes-v1-1-25f348a5982b@linaro.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 2253c154a8248..20c4b28fed061 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -418,6 +418,9 @@ static struct clk_core *clk_core_get(struct clk_core *core, u8 p_index)
+ 	if (IS_ERR(hw))
+ 		return ERR_CAST(hw);
+ 
++	if (!hw)
++		return NULL;
++
+ 	return hw->core;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch b/queue-6.8/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
new file mode 100644
index 00000000000..9e7d05b586b
--- /dev/null
+++ b/queue-6.8/clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
@@ -0,0 +1,39 @@
+From bb8d664f1a424146bed3a036bdf95321128ae12f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 19:58:21 +0100
+Subject: clk: hisilicon: hi3519: Release the correct number of gates in
+ hi3519_clk_unregister()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 74e39f526d95c0c119ada1874871ee328c59fbee ]
+
+The gates are stored in 'hi3519_gate_clks', not 'hi3519_mux_clks'.
+This is also in line with how hisi_clk_register_gate() is called in the
+probe.
+
+Fixes: 224b3b262c52 ("clk: hisilicon: hi3519: add driver remove path and fix some issues")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/c3f1877c9a0886fa35c949c8f0ef25547f284f18.1704912510.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/hisilicon/clk-hi3519.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/hisilicon/clk-hi3519.c b/drivers/clk/hisilicon/clk-hi3519.c
+index b871872d9960d..141b727ff60d6 100644
+--- a/drivers/clk/hisilicon/clk-hi3519.c
++++ b/drivers/clk/hisilicon/clk-hi3519.c
+@@ -130,7 +130,7 @@ static void hi3519_clk_unregister(struct platform_device *pdev)
+ 	of_clk_del_provider(pdev->dev.of_node);
+ 
+ 	hisi_clk_unregister_gate(hi3519_gate_clks,
+-				ARRAY_SIZE(hi3519_mux_clks),
++				ARRAY_SIZE(hi3519_gate_clks),
+ 				crg->clk_data);
+ 	hisi_clk_unregister_mux(hi3519_mux_clks,
+ 				ARRAY_SIZE(hi3519_mux_clks),
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch b/queue-6.8/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
new file mode 100644
index 00000000000..ab5ef184f0b
--- /dev/null
+++ b/queue-6.8/clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
@@ -0,0 +1,42 @@
+From 987c738a8928ac283245d8169cd958cd6904b676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jan 2024 16:16:24 +0100
+Subject: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 64c6a38136b74a2f18c42199830975edd9fbc379 ]
+
+'p_clk' is an array allocated just before the for loop for all clk that
+need to be registered.
+It is incremented at each loop iteration.
+
+If a clk_register() call fails, 'p_clk' may point to something different
+from what should be freed.
+
+The best we can do, is to avoid this wrong release of memory.
+
+Fixes: 6c81966107dc ("clk: hisilicon: Add clock driver for hi3559A SoC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/773fc8425c3b8f5b0ca7c1d89f15b65831a85ca9.1705850155.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/hisilicon/clk-hi3559a.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/clk/hisilicon/clk-hi3559a.c b/drivers/clk/hisilicon/clk-hi3559a.c
+index ff4ca0edce06a..4623befafaec4 100644
+--- a/drivers/clk/hisilicon/clk-hi3559a.c
++++ b/drivers/clk/hisilicon/clk-hi3559a.c
+@@ -491,7 +491,6 @@ static void hisi_clk_register_pll(struct hi3559av100_pll_clock *clks,
+ 
+ 		clk = clk_register(NULL, &p_clk->hw);
+ 		if (IS_ERR(clk)) {
+-			devm_kfree(dev, p_clk);
+ 			dev_err(dev, "%s: failed to register clock %s\n",
+ 			       __func__, clks[i].name);
+ 			continue;
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch b/queue-6.8/clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch
new file mode 100644
index 00000000000..ee9d38bc134
--- /dev/null
+++ b/queue-6.8/clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch
@@ -0,0 +1,62 @@
+From 0d079c69e826f05cc542f70c84a321f8e6358e98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 18:15:51 +0800
+Subject: clk: imx: imx8mp: Fix SAI_MCLK_SEL definition
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 13269dc6c70444528f0093585e3559cd2f38850a ]
+
+There is SAI1, SAI2, SAI3, SAI5, SAI6, SAI7 existing in this block
+control, the order is discontinuous. The definition of SAI_MCLK_SEL(n)
+is not match with the usage of CLK_SAIn(n).
+
+So define SAI##n##_MCLK_SEL separately to fix the issue.
+
+Fixes: 6cd95f7b151c ("clk: imx: imx8mp: Add audiomix block control")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/1708683351-8504-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx8mp-audiomix.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/imx/clk-imx8mp-audiomix.c b/drivers/clk/imx/clk-imx8mp-audiomix.c
+index e4300df88f1ac..55ed211a5e0b1 100644
+--- a/drivers/clk/imx/clk-imx8mp-audiomix.c
++++ b/drivers/clk/imx/clk-imx8mp-audiomix.c
+@@ -18,7 +18,12 @@
+ 
+ #define CLKEN0			0x000
+ #define CLKEN1			0x004
+-#define SAI_MCLK_SEL(n)		(0x300 + 4 * (n))	/* n in 0..5 */
++#define SAI1_MCLK_SEL		0x300
++#define SAI2_MCLK_SEL		0x304
++#define SAI3_MCLK_SEL		0x308
++#define SAI5_MCLK_SEL		0x30C
++#define SAI6_MCLK_SEL		0x310
++#define SAI7_MCLK_SEL		0x314
+ #define PDM_SEL			0x318
+ #define SAI_PLL_GNRL_CTL	0x400
+ 
+@@ -95,13 +100,13 @@ static const struct clk_parent_data clk_imx8mp_audiomix_pll_bypass_sels[] = {
+ 		IMX8MP_CLK_AUDIOMIX_SAI##n##_MCLK1_SEL, {},		\
+ 		clk_imx8mp_audiomix_sai##n##_mclk1_parents,		\
+ 		ARRAY_SIZE(clk_imx8mp_audiomix_sai##n##_mclk1_parents), \
+-		SAI_MCLK_SEL(n), 1, 0					\
++		SAI##n##_MCLK_SEL, 1, 0					\
+ 	}, {								\
+ 		"sai"__stringify(n)"_mclk2_sel",			\
+ 		IMX8MP_CLK_AUDIOMIX_SAI##n##_MCLK2_SEL, {},		\
+ 		clk_imx8mp_audiomix_sai_mclk2_parents,			\
+ 		ARRAY_SIZE(clk_imx8mp_audiomix_sai_mclk2_parents),	\
+-		SAI_MCLK_SEL(n), 4, 1					\
++		SAI##n##_MCLK_SEL, 4, 1					\
+ 	}, {								\
+ 		"sai"__stringify(n)"_ipg_cg",				\
+ 		IMX8MP_CLK_AUDIOMIX_SAI##n##_IPG,			\
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch b/queue-6.8/clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch
new file mode 100644
index 00000000000..ebaf7e2477f
--- /dev/null
+++ b/queue-6.8/clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch
@@ -0,0 +1,41 @@
+From ec5e359db79cefd4be0e3c33abcb5e19ea110189 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 09:29:28 +0100
+Subject: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in
+ clk_mt8135_apmixed_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit a32e88f2b20259f5fe4f8eed598bbc85dc4879ed ]
+
+'clk_data' is allocated with mtk_devm_alloc_clk_data(). So calling
+mtk_free_clk_data() explicitly in the remove function would lead to a
+double-free.
+
+Remove the redundant call.
+
+Fixes: c50e2ea6507b ("clk: mediatek: mt7622-apmixedsys: Add .remove() callback for module build")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/2c553c2a5077757e4f7af0bb895acc43881cf62c.1704616152.git.christophe.jaillet@wanadoo.fr
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt7622-apmixedsys.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt7622-apmixedsys.c b/drivers/clk/mediatek/clk-mt7622-apmixedsys.c
+index 9cffd278e9a43..1b8f859b6b6cc 100644
+--- a/drivers/clk/mediatek/clk-mt7622-apmixedsys.c
++++ b/drivers/clk/mediatek/clk-mt7622-apmixedsys.c
+@@ -127,7 +127,6 @@ static void clk_mt7622_apmixed_remove(struct platform_device *pdev)
+ 	of_clk_del_provider(node);
+ 	mtk_clk_unregister_gates(apmixed_clks, ARRAY_SIZE(apmixed_clks), clk_data);
+ 	mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data);
+-	mtk_free_clk_data(clk_data);
+ }
+ 
+ static const struct of_device_id of_match_clk_mt7622_apmixed[] = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch b/queue-6.8/clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch
new file mode 100644
index 00000000000..dd9a3549edc
--- /dev/null
+++ b/queue-6.8/clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch
@@ -0,0 +1,44 @@
+From bd478cfe46371e8fd8a2edc007e0335b1fa94af0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Feb 2024 03:11:15 +0000
+Subject: clk: mediatek: mt7981-topckgen: flag SGM_REG_SEL as critical
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit aa690050c00a251ab69e3c5204d582833d0b958c ]
+
+Without the SGM_REG_SEL clock enabled the cpu freezes if trying to
+access registers used by MT7981 clock drivers itself.
+Mark SGM_REG_SEL as critical to make sure it is always enabled to
+prevent freezes on boot even if the Ethernet driver which prepares
+and enables the clock is not loaded or probed at a later point.
+
+Fixes: 813c3b53b55b ("clk: mediatek: add MT7981 clock support")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://lore.kernel.org/r/fc157139e6b7f8dfb6430ac7191ba754027705e8.1708221995.git.daniel@makrotopia.org
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt7981-topckgen.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt7981-topckgen.c b/drivers/clk/mediatek/clk-mt7981-topckgen.c
+index 682f4ca9e89ad..493aa11d3a175 100644
+--- a/drivers/clk/mediatek/clk-mt7981-topckgen.c
++++ b/drivers/clk/mediatek/clk-mt7981-topckgen.c
+@@ -357,8 +357,9 @@ static const struct mtk_mux top_muxes[] = {
+ 	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_325M_SEL, "sgm_325m_sel",
+ 			     sgm_325m_parents, 0x050, 0x054, 0x058, 8, 1, 15,
+ 			     0x1C0, 21),
+-	MUX_GATE_CLR_SET_UPD(CLK_TOP_SGM_REG_SEL, "sgm_reg_sel", sgm_reg_parents,
+-			     0x050, 0x054, 0x058, 16, 1, 23, 0x1C0, 22),
++	MUX_GATE_CLR_SET_UPD_FLAGS(CLK_TOP_SGM_REG_SEL, "sgm_reg_sel", sgm_reg_parents,
++				   0x050, 0x054, 0x058, 16, 1, 23, 0x1C0, 22,
++				   CLK_IS_CRITICAL | CLK_SET_RATE_PARENT),
+ 	MUX_GATE_CLR_SET_UPD(CLK_TOP_EIP97B_SEL, "eip97b_sel", eip97b_parents,
+ 			     0x050, 0x054, 0x058, 24, 3, 31, 0x1C0, 23),
+ 	/* CLK_CFG_6 */
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch b/queue-6.8/clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch
new file mode 100644
index 00000000000..662e27385c0
--- /dev/null
+++ b/queue-6.8/clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch
@@ -0,0 +1,48 @@
+From 6a79b4088a76c65992c00977bf0c8520c522a3bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 09:12:17 +0100
+Subject: clk: mediatek: mt8135: Fix an error handling path in
+ clk_mt8135_apmixed_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 03c1c51eba6be49b42816af9db114553131af6c8 ]
+
+If an error occurs after mtk_alloc_clk_data(), mtk_free_clk_data() should
+be called, as already done in the remove function.
+
+Fixes: 54b7026f011e ("clk: mediatek: mt8135-apmixedsys: Convert to platform_driver and module")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/6cd6af61e5a91598068227f1f68cfcfde1507453.1704615011.git.christophe.jaillet@wanadoo.fr
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8135-apmixedsys.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8135-apmixedsys.c b/drivers/clk/mediatek/clk-mt8135-apmixedsys.c
+index d1239b4b3db74..41bb2d2e2ea74 100644
+--- a/drivers/clk/mediatek/clk-mt8135-apmixedsys.c
++++ b/drivers/clk/mediatek/clk-mt8135-apmixedsys.c
+@@ -59,7 +59,7 @@ static int clk_mt8135_apmixed_probe(struct platform_device *pdev)
+ 
+ 	ret = mtk_clk_register_plls(node, plls, ARRAY_SIZE(plls), clk_data);
+ 	if (ret)
+-		return ret;
++		goto free_clk_data;
+ 
+ 	ret = of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data);
+ 	if (ret)
+@@ -69,6 +69,8 @@ static int clk_mt8135_apmixed_probe(struct platform_device *pdev)
+ 
+ unregister_plls:
+ 	mtk_clk_unregister_plls(plls, ARRAY_SIZE(plls), clk_data);
++free_clk_data:
++	mtk_free_clk_data(clk_data);
+ 
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch b/queue-6.8/clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch
new file mode 100644
index 00000000000..5df1d7c49a1
--- /dev/null
+++ b/queue-6.8/clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch
@@ -0,0 +1,42 @@
+From 43e6c8d45467e40b333e108f163c30fc410fd31c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 18:51:24 +0800
+Subject: clk: mediatek: mt8183: Correct parent of CLK_INFRA_SSPM_32K_SELF
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit a65083fa663a335008e34f65e184041174a9dc7e ]
+
+CLK_INFRA_SSPM_32K_SELF has the "f_f26m_ck" clock assigned as its parent.
+This is inconsistent as the clock is part of a group that are all gates
+without dividers, and this makes the kernel think it runs at 26 MHz.
+
+After clarification from MediaTek engineers, the correct parent is
+actually the system 32 KHz clock.
+
+Fixes: 1eb8d61ac5c9 ("clk: mediatek: mt8183: Add back SSPM related clocks")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20240219105125.956278-1-wenst@chromium.org
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt8183.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt8183.c b/drivers/clk/mediatek/clk-mt8183.c
+index 6e23461a04559..934d5a15acfc5 100644
+--- a/drivers/clk/mediatek/clk-mt8183.c
++++ b/drivers/clk/mediatek/clk-mt8183.c
+@@ -790,7 +790,7 @@ static const struct mtk_gate infra_clks[] = {
+ 	/* infra_sspm_26m_self is main clock in co-processor, should not be closed in Linux. */
+ 	GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_26M_SELF, "infra_sspm_26m_self", "f_f26m_ck", 3, CLK_IS_CRITICAL),
+ 	/* infra_sspm_32k_self is main clock in co-processor, should not be closed in Linux. */
+-	GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_32K_SELF, "infra_sspm_32k_self", "f_f26m_ck", 4, CLK_IS_CRITICAL),
++	GATE_INFRA3_FLAGS(CLK_INFRA_SSPM_32K_SELF, "infra_sspm_32k_self", "clk32k", 4, CLK_IS_CRITICAL),
+ 	GATE_INFRA3(CLK_INFRA_UFS_AXI, "infra_ufs_axi", "axi_sel", 5),
+ 	GATE_INFRA3(CLK_INFRA_I2C6, "infra_i2c6", "i2c_sel", 6),
+ 	GATE_INFRA3(CLK_INFRA_AP_MSDC0, "infra_ap_msdc0", "msdc50_hclk_sel", 7),
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch b/queue-6.8/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
new file mode 100644
index 00000000000..27ebfd74400
--- /dev/null
+++ b/queue-6.8/clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
@@ -0,0 +1,83 @@
+From dfd5fcde01590480478c67918fe9691d5e65b1b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 17:25:48 +0300
+Subject: clk: meson: Add missing clocks to axg_clk_regmaps
+
+From: Igor Prusov <ivprusov@salutedevices.com>
+
+[ Upstream commit ba535bce57e71463a86f8b33a0ea88c26e3a6418 ]
+
+Some clocks were missing from axg_clk_regmaps, which caused kernel panic
+during cat /sys/kernel/debug/clk/clk_summary
+
+[   57.349402] Unable to handle kernel NULL pointer dereference at virtual address 00000000000001fc
+...
+[   57.430002] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[   57.436900] pc : regmap_read+0x1c/0x88
+[   57.440608] lr : clk_regmap_gate_is_enabled+0x3c/0xb0
+[   57.445611] sp : ffff800082f1b690
+[   57.448888] x29: ffff800082f1b690 x28: 0000000000000000 x27: ffff800080eb9a70
+[   57.455961] x26: 0000000000000007 x25: 0000000000000016 x24: 0000000000000000
+[   57.463033] x23: ffff800080e8b488 x22: 0000000000000015 x21: ffff00000e7e7000
+[   57.470106] x20: ffff00000400ec00 x19: 0000000000000000 x18: ffffffffffffffff
+[   57.477178] x17: 0000000000000000 x16: 0000000000000000 x15: ffff0000042a3000
+[   57.484251] x14: 0000000000000000 x13: ffff0000042a2fec x12: 0000000005f5e100
+[   57.491323] x11: abcc77118461cefd x10: 0000000000000020 x9 : ffff8000805e4b24
+[   57.498396] x8 : ffff0000028063c0 x7 : ffff800082f1b710 x6 : ffff800082f1b710
+[   57.505468] x5 : 00000000ffffffd0 x4 : ffff800082f1b6e0 x3 : 0000000000001000
+[   57.512541] x2 : ffff800082f1b6e4 x1 : 000000000000012c x0 : 0000000000000000
+[   57.519615] Call trace:
+[   57.522030]  regmap_read+0x1c/0x88
+[   57.525393]  clk_regmap_gate_is_enabled+0x3c/0xb0
+[   57.530050]  clk_core_is_enabled+0x44/0x120
+[   57.534190]  clk_summary_show_subtree+0x154/0x2f0
+[   57.538847]  clk_summary_show_subtree+0x220/0x2f0
+[   57.543505]  clk_summary_show_subtree+0x220/0x2f0
+[   57.548162]  clk_summary_show_subtree+0x220/0x2f0
+[   57.552820]  clk_summary_show_subtree+0x220/0x2f0
+[   57.557477]  clk_summary_show_subtree+0x220/0x2f0
+[   57.562135]  clk_summary_show_subtree+0x220/0x2f0
+[   57.566792]  clk_summary_show_subtree+0x220/0x2f0
+[   57.571450]  clk_summary_show+0x84/0xb8
+[   57.575245]  seq_read_iter+0x1bc/0x4b8
+[   57.578954]  seq_read+0x8c/0xd0
+[   57.582059]  full_proxy_read+0x68/0xc8
+[   57.585767]  vfs_read+0xb0/0x268
+[   57.588959]  ksys_read+0x70/0x108
+[   57.592236]  __arm64_sys_read+0x24/0x38
+[   57.596031]  invoke_syscall+0x50/0x128
+[   57.599740]  el0_svc_common.constprop.0+0x48/0xf8
+[   57.604397]  do_el0_svc+0x28/0x40
+[   57.607675]  el0_svc+0x34/0xb8
+[   57.610694]  el0t_64_sync_handler+0x13c/0x158
+[   57.615006]  el0t_64_sync+0x190/0x198
+[   57.618635] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (b941fc00)
+[   57.624668] ---[ end trace 0000000000000000 ]---
+
+[jbrunet: add missing Fixes tag]
+Signed-off-by: Igor Prusov <ivprusov@salutedevices.com>
+Link: https://lore.kernel.org/r/20240202172537.1.I64656c75d84284bc91e6126b50b33c502be7c42a@changeid
+Fixes: 14ebb3154b8f ("clk: meson: axg: add Video Clocks")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/axg.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index c12f81dfa6745..5f60f2bcca592 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -2142,7 +2142,9 @@ static struct clk_regmap *const axg_clk_regmaps[] = {
+ 	&axg_vclk_input,
+ 	&axg_vclk2_input,
+ 	&axg_vclk_div,
++	&axg_vclk_div1,
+ 	&axg_vclk2_div,
++	&axg_vclk2_div1,
+ 	&axg_vclk_div2_en,
+ 	&axg_vclk_div4_en,
+ 	&axg_vclk_div6_en,
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch b/queue-6.8/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
new file mode 100644
index 00000000000..7cc17ff3f65
--- /dev/null
+++ b/queue-6.8/clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
@@ -0,0 +1,38 @@
+From f6ca8b75938833003f7f5b2d5f78e07a543ae90a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 21:20:18 +0100
+Subject: clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 117e7dc697c2739d754db8fe0c1e2d4f1f5d5f82 ]
+
+SDM845 downstream uses non-default values for GDSC internal waits.
+Program them accordingly to avoid surprises.
+
+Fixes: 81351776c9fb ("clk: qcom: Add display clock controller driver for SDM845")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Tested-by: Caleb Connolly <caleb.connolly@linaro.org> # OnePlus 6
+Link: https://lore.kernel.org/r/20240103-topic-845gdsc-v1-1-368efbe1a61d@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sdm845.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/qcom/dispcc-sdm845.c b/drivers/clk/qcom/dispcc-sdm845.c
+index 735adfefc3798..e792e0b130d33 100644
+--- a/drivers/clk/qcom/dispcc-sdm845.c
++++ b/drivers/clk/qcom/dispcc-sdm845.c
+@@ -759,6 +759,8 @@ static struct clk_branch disp_cc_mdss_vsync_clk = {
+ 
+ static struct gdsc mdss_gdsc = {
+ 	.gdscr = 0x3000,
++	.en_few_wait_val = 0x6,
++	.en_rest_wait_val = 0x5,
+ 	.pd = {
+ 		.name = "mdss_gdsc",
+ 	},
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch b/queue-6.8/clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch
new file mode 100644
index 00000000000..9c52a602a19
--- /dev/null
+++ b/queue-6.8/clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch
@@ -0,0 +1,56 @@
+From 157cfa06cf3e6863055696a29170211e4dc11479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Feb 2024 18:32:54 +0100
+Subject: clk: qcom: gcc-ipq5018: fix 'enable_reg' offset of
+ 'gcc_gmac0_sys_clk'
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit f982adcc1b1c02a3114f68ac73c811cbfabe90fa ]
+
+The value of the 'enable_reg' field in the 'gcc_gmac0_sys_clk'
+clock definition seems wrong as it is greater than the
+'max_register' value defined in the regmap configuration.
+Additionally, all other gmac specific branch clock definitions
+within the driver uses the same value both for the 'enable_reg'
+and for the 'halt_reg' fields.
+
+Due to the lack of documentation the correct value is not known.
+Looking into the downstream driver does not help either, as that
+uses the same (presumably wrong) value [1].
+
+Nevertheless, change the 'enable_reg' field of 'gcc_gmac0_sys_clk'
+to use the value from the 'halt_reg' field so it follows the pattern
+used in other gmac clock definitions. The change is based on the
+assumption that the register layout of this clock is the same
+as the other gmac clocks.
+
+1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/blob/NHSS.QSDK.12.4.r4/drivers/clk/qcom/gcc-ipq5018.c?ref_type=heads#L1889
+
+Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
+Link: https://lore.kernel.org/r/20240225-gcc-ipq5018-register-fixes-v1-1-3c191404d9f0@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq5018.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
+index 4aba47e8700d2..cef9a1e7c9fdb 100644
+--- a/drivers/clk/qcom/gcc-ipq5018.c
++++ b/drivers/clk/qcom/gcc-ipq5018.c
+@@ -1754,7 +1754,7 @@ static struct clk_branch gcc_gmac0_sys_clk = {
+ 	.halt_check = BRANCH_HALT_DELAY,
+ 	.halt_bit = 31,
+ 	.clkr = {
+-		.enable_reg = 0x683190,
++		.enable_reg = 0x68190,
+ 		.enable_mask = BIT(0),
+ 		.hw.init = &(struct clk_init_data) {
+ 			.name = "gcc_gmac0_sys_clk",
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch b/queue-6.8/clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch
new file mode 100644
index 00000000000..df26f30cc08
--- /dev/null
+++ b/queue-6.8/clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch
@@ -0,0 +1,70 @@
+From 61e1a587d4a0f3c5948a01a02d817af3242c5b45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Feb 2024 18:32:55 +0100
+Subject: clk: qcom: gcc-ipq5018: fix 'halt_reg' offset of 'gcc_pcie1_pipe_clk'
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 11b752ac5a07cbfd95592fac5237a02f45662926 ]
+
+The following table shows the values of the 'halt_reg' and the
+'enable_reg' fields from the pcie clocks defined in the current
+driver:
+
+  clock                        halt_reg    enable_reg
+
+  gcc_pcie0_ahb_clk            0x75010     0x75010
+  gcc_pcie0_aux_clk            0x75014     0x75014
+  gcc_pcie0_axi_m_clk          0x75008     0x75008
+  gcc_pcie0_axi_s_bridge_clk   0x75048     0x75048
+  gcc_pcie0_axi_s_clk          0x7500c     0x7500c
+  gcc_pcie0_pipe_clk           0x75018     0x75018
+
+  gcc_pcie1_ahb_clk            0x76010     0x76010
+  gcc_pcie1_aux_clk            0x76014     0x76014
+  gcc_pcie1_axi_m_clk          0x76008     0x76008
+  gcc_pcie1_axi_s_bridge_clk   0x76048     0x76048
+  gcc_pcie1_axi_s_clk          0x7600c     0x7600c
+  gcc_pcie1_pipe_clk                 8*    0x76018
+
+Based on the table, it is quite likely that the pcie0 and the pci1
+clocks are using the same register layout, however it seems that
+the value of the 'halt_reg' field in the 'gcc_pcie1_pipe_clk' clock
+is wrong.
+
+In the downstream driver [1], the same '0x76018' value is used for
+both the 'halt_reg' and for the 'enable_reg' fields of the
+'gcc_pcie1_pipe_clk' clock.
+
+Update the current driver to use the same value used downstream as
+probably that is the correct value.
+
+1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/blob/NHSS.QSDK.12.4.r4/drivers/clk/qcom/gcc-ipq5018.c?ref_type=heads#L2316
+
+Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
+Link: https://lore.kernel.org/r/20240225-gcc-ipq5018-register-fixes-v1-2-3c191404d9f0@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq5018.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
+index cef9a1e7c9fdb..5e81cfa77293a 100644
+--- a/drivers/clk/qcom/gcc-ipq5018.c
++++ b/drivers/clk/qcom/gcc-ipq5018.c
+@@ -2180,7 +2180,7 @@ static struct clk_branch gcc_pcie1_axi_s_clk = {
+ };
+ 
+ static struct clk_branch gcc_pcie1_pipe_clk = {
+-	.halt_reg = 8,
++	.halt_reg = 0x76018,
+ 	.halt_check = BRANCH_HALT_DELAY,
+ 	.halt_bit = 31,
+ 	.clkr = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch b/queue-6.8/clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch
new file mode 100644
index 00000000000..4b7f6a71373
--- /dev/null
+++ b/queue-6.8/clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch
@@ -0,0 +1,47 @@
+From 13c14da9b77ad3b8247aa9b712f007284744cafe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Feb 2024 18:32:56 +0100
+Subject: clk: qcom: gcc-ipq5018: fix register offset for GCC_UBI0_AXI_ARES
+ reset
+
+From: Gabor Juhos <j4g8y7@gmail.com>
+
+[ Upstream commit 7d474b43087aa356d714d39870c90d77fc6f1186 ]
+
+The current register offset used for the GCC_UBI0_AXI_ARES reset
+seems wrong. Or at least, the downstream driver uses [1] the same
+offset which is used for other the GCC_UBI0_*_ARES resets.
+
+Change the code to use the same offset used in the downstream
+driver and also specify the reset bit explicitly to use the
+same format as the followup entries.
+
+1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/blob/NHSS.QSDK.12.4.r4/drivers/clk/qcom/gcc-ipq5018.c?ref_type=heads#L3773
+
+Fixes: e3fdbef1bab8 ("clk: qcom: Add Global Clock controller (GCC) driver for IPQ5018")
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Kathiravan Thirumoorthy <quic_kathirav@quicinc.com>
+Link: https://lore.kernel.org/r/20240225-gcc-ipq5018-register-fixes-v1-3-3c191404d9f0@gmail.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq5018.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/gcc-ipq5018.c b/drivers/clk/qcom/gcc-ipq5018.c
+index 5e81cfa77293a..e2bd54826a4ce 100644
+--- a/drivers/clk/qcom/gcc-ipq5018.c
++++ b/drivers/clk/qcom/gcc-ipq5018.c
+@@ -3632,7 +3632,7 @@ static const struct qcom_reset_map gcc_ipq5018_resets[] = {
+ 	[GCC_SYSTEM_NOC_BCR] = { 0x26000, 0 },
+ 	[GCC_TCSR_BCR] = { 0x28000, 0 },
+ 	[GCC_TLMM_BCR] = { 0x34000, 0 },
+-	[GCC_UBI0_AXI_ARES] = { 0x680},
++	[GCC_UBI0_AXI_ARES] = { 0x68010, 0 },
+ 	[GCC_UBI0_AHB_ARES] = { 0x68010, 1 },
+ 	[GCC_UBI0_NC_AXI_ARES] = { 0x68010, 2 },
+ 	[GCC_UBI0_DBG_ARES] = { 0x68010, 3 },
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-qcom-reset-commonize-the-de-assert-functions.patch b/queue-6.8/clk-qcom-reset-commonize-the-de-assert-functions.patch
new file mode 100644
index 00000000000..3849dc59283
--- /dev/null
+++ b/queue-6.8/clk-qcom-reset-commonize-the-de-assert-functions.patch
@@ -0,0 +1,69 @@
+From 2172803a0d0dc62b7e4ad5776daf02f30da3308d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 19:43:35 +0100
+Subject: clk: qcom: reset: Commonize the de/assert functions
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit eda40d9c583e95e0b6ac69d2950eec10f802e0e8 ]
+
+They do the same thing, except the last argument of the last function
+call differs. Commonize them.
+
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240105-topic-venus_reset-v2-2-c37eba13b5ce@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: 2f8cf2c3f3e3 ("clk: qcom: reset: Ensure write completion on reset de/assertion")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/reset.c | 22 +++++++++-------------
+ 1 file changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
+index e45e32804d2c7..20d1d35aaf229 100644
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -22,8 +22,8 @@ static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id)
+ 	return 0;
+ }
+ 
+-static int
+-qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
++static int qcom_reset_set_assert(struct reset_controller_dev *rcdev,
++				 unsigned long id, bool assert)
+ {
+ 	struct qcom_reset_controller *rst;
+ 	const struct qcom_reset_map *map;
+@@ -33,21 +33,17 @@ qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+ 	map = &rst->reset_map[id];
+ 	mask = map->bitmask ? map->bitmask : BIT(map->bit);
+ 
+-	return regmap_update_bits(rst->regmap, map->reg, mask, mask);
++	return regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0);
+ }
+ 
+-static int
+-qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
++static int qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+ {
+-	struct qcom_reset_controller *rst;
+-	const struct qcom_reset_map *map;
+-	u32 mask;
+-
+-	rst = to_qcom_reset_controller(rcdev);
+-	map = &rst->reset_map[id];
+-	mask = map->bitmask ? map->bitmask : BIT(map->bit);
++	return qcom_reset_set_assert(rcdev, id, true);
++}
+ 
+-	return regmap_update_bits(rst->regmap, map->reg, mask, 0);
++static int qcom_reset_deassert(struct reset_controller_dev *rcdev, unsigned long id)
++{
++	return qcom_reset_set_assert(rcdev, id, false);
+ }
+ 
+ const struct reset_control_ops qcom_reset_ops = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch b/queue-6.8/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
new file mode 100644
index 00000000000..d18e27c0b60
--- /dev/null
+++ b/queue-6.8/clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
@@ -0,0 +1,45 @@
+From 465bdfef5b3fda6d593768f6982d3fcfe9794587 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 19:43:36 +0100
+Subject: clk: qcom: reset: Ensure write completion on reset de/assertion
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 2f8cf2c3f3e3f7ef61bd19abb4b0bb797ad50aaf ]
+
+Trying to toggle the resets in a rapid fashion can lead to the changes
+not actually arriving at the clock controller block when we expect them
+to. This was observed at least on SM8250.
+
+Read back the value after regmap_update_bits to ensure write completion.
+
+Fixes: b36ba30c8ac6 ("clk: qcom: Add reset controller support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240105-topic-venus_reset-v2-3-c37eba13b5ce@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/reset.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
+index 20d1d35aaf229..d96c96a9089f4 100644
+--- a/drivers/clk/qcom/reset.c
++++ b/drivers/clk/qcom/reset.c
+@@ -33,7 +33,12 @@ static int qcom_reset_set_assert(struct reset_controller_dev *rcdev,
+ 	map = &rst->reset_map[id];
+ 	mask = map->bitmask ? map->bitmask : BIT(map->bit);
+ 
+-	return regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0);
++	regmap_update_bits(rst->regmap, map->reg, mask, assert ? mask : 0);
++
++	/* Read back the register to ensure write completion, ignore the value */
++	regmap_read(rst->regmap, map->reg, &mask);
++
++	return 0;
+ }
+ 
+ static int qcom_reset_assert(struct reset_controller_dev *rcdev, unsigned long id)
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch b/queue-6.8/clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch
new file mode 100644
index 00000000000..214ef4c58b8
--- /dev/null
+++ b/queue-6.8/clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch
@@ -0,0 +1,43 @@
+From b96524aba8b00afdf0175e7789adaa458ecc96ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 16:45:13 +0100
+Subject: clk: renesas: r8a779f0: Correct PFC/GPIO parent clock
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit d1b32a83a02d9433dbd8c5f4d6fc44aa597755bd ]
+
+According to the R-Car S4 Series Hardware User’s Manual Rev.0.81, the
+parent clock of the Pin Function (PFC/GPIO) module clock is the CP
+clock.
+
+As this clock is not documented to exist on R-Car S4, use the CPEX clock
+instead.
+
+Fixes: 73421f2a48e6bd1d ("clk: renesas: r8a779f0: Add PFC clock")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/f88ec4aede0eaf0107c8bb7b28ba719ac6cd418f.1706197415.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a779f0-cpg-mssr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/r8a779f0-cpg-mssr.c b/drivers/clk/renesas/r8a779f0-cpg-mssr.c
+index f721835c7e212..cc06127406ab5 100644
+--- a/drivers/clk/renesas/r8a779f0-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a779f0-cpg-mssr.c
+@@ -161,7 +161,7 @@ static const struct mssr_mod_clk r8a779f0_mod_clks[] __initconst = {
+ 	DEF_MOD("cmt1",		911,	R8A779F0_CLK_R),
+ 	DEF_MOD("cmt2",		912,	R8A779F0_CLK_R),
+ 	DEF_MOD("cmt3",		913,	R8A779F0_CLK_R),
+-	DEF_MOD("pfc0",		915,	R8A779F0_CLK_CL16M),
++	DEF_MOD("pfc0",		915,	R8A779F0_CLK_CPEX),
+ 	DEF_MOD("tsc",		919,	R8A779F0_CLK_CL16M),
+ 	DEF_MOD("rswitch2",	1505,	R8A779F0_CLK_RSW2),
+ 	DEF_MOD("ether-serdes",	1506,	R8A779F0_CLK_S0D2_HSC),
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch b/queue-6.8/clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch
new file mode 100644
index 00000000000..0b224bd0f08
--- /dev/null
+++ b/queue-6.8/clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch
@@ -0,0 +1,78 @@
+From 2e33e30cbf30563f711d55883593bce78c56ea00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 16:43:26 +0100
+Subject: clk: renesas: r8a779g0: Correct PFC/GPIO parent clocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit abb3fa662b8f8eaed1590b0e7a4e19eda467cdd3 ]
+
+According to the R-Car V4H Series Hardware User’s Manual Rev.1.00, the
+parent clock of the Pin Function (PFC/GPIO) module clocks is the CP
+clock.
+
+Fix this by adding the missing CP clock, and correcting the PFC parents.
+
+Fixes: f2afa78d5a0c0b0b ("dt-bindings: clock: Add r8a779g0 CPG Core Clock Definitions")
+Fixes: 36ff366033f0dde1 ("clk: renesas: r8a779g0: Add PFC/GPIO clocks")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/5401fccd204dc90b44f0013e7f53b9eff8df8214.1706197297.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a779g0-cpg-mssr.c       | 11 ++++++-----
+ include/dt-bindings/clock/r8a779g0-cpg-mssr.h |  1 +
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/renesas/r8a779g0-cpg-mssr.c b/drivers/clk/renesas/r8a779g0-cpg-mssr.c
+index 31b13c997a057..c4b1938db76b3 100644
+--- a/drivers/clk/renesas/r8a779g0-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a779g0-cpg-mssr.c
+@@ -22,7 +22,7 @@
+ 
+ enum clk_ids {
+ 	/* Core Clock Outputs exported to DT */
+-	LAST_DT_CORE_CLK = R8A779G0_CLK_R,
++	LAST_DT_CORE_CLK = R8A779G0_CLK_CP,
+ 
+ 	/* External Input Clocks */
+ 	CLK_EXTAL,
+@@ -141,6 +141,7 @@ static const struct cpg_core_clk r8a779g0_core_clks[] __initconst = {
+ 	DEF_FIXED("svd2_vip",	R8A779G0_CLK_SVD2_VIP,	CLK_SV_VIP,	2, 1),
+ 	DEF_FIXED("cbfusa",	R8A779G0_CLK_CBFUSA,	CLK_EXTAL,	2, 1),
+ 	DEF_FIXED("cpex",	R8A779G0_CLK_CPEX,	CLK_EXTAL,	2, 1),
++	DEF_FIXED("cp",		R8A779G0_CLK_CP,	CLK_EXTAL,	2, 1),
+ 	DEF_FIXED("viobus",	R8A779G0_CLK_VIOBUS,	CLK_VIO,	1, 1),
+ 	DEF_FIXED("viobusd2",	R8A779G0_CLK_VIOBUSD2,	CLK_VIO,	2, 1),
+ 	DEF_FIXED("vcbus",	R8A779G0_CLK_VCBUS,	CLK_VC,		1, 1),
+@@ -232,10 +233,10 @@ static const struct mssr_mod_clk r8a779g0_mod_clks[] __initconst = {
+ 	DEF_MOD("cmt1",		911,	R8A779G0_CLK_R),
+ 	DEF_MOD("cmt2",		912,	R8A779G0_CLK_R),
+ 	DEF_MOD("cmt3",		913,	R8A779G0_CLK_R),
+-	DEF_MOD("pfc0",		915,	R8A779G0_CLK_CL16M),
+-	DEF_MOD("pfc1",		916,	R8A779G0_CLK_CL16M),
+-	DEF_MOD("pfc2",		917,	R8A779G0_CLK_CL16M),
+-	DEF_MOD("pfc3",		918,	R8A779G0_CLK_CL16M),
++	DEF_MOD("pfc0",		915,	R8A779G0_CLK_CP),
++	DEF_MOD("pfc1",		916,	R8A779G0_CLK_CP),
++	DEF_MOD("pfc2",		917,	R8A779G0_CLK_CP),
++	DEF_MOD("pfc3",		918,	R8A779G0_CLK_CP),
+ 	DEF_MOD("tsc",		919,	R8A779G0_CLK_CL16M),
+ 	DEF_MOD("tsn",		2723,	R8A779G0_CLK_S0D4_HSC),
+ 	DEF_MOD("ssiu",		2926,	R8A779G0_CLK_S0D6_PER),
+diff --git a/include/dt-bindings/clock/r8a779g0-cpg-mssr.h b/include/dt-bindings/clock/r8a779g0-cpg-mssr.h
+index 754c54a6eb06a..7850cdc62e285 100644
+--- a/include/dt-bindings/clock/r8a779g0-cpg-mssr.h
++++ b/include/dt-bindings/clock/r8a779g0-cpg-mssr.h
+@@ -86,5 +86,6 @@
+ #define R8A779G0_CLK_CPEX		74
+ #define R8A779G0_CLK_CBFUSA		75
+ #define R8A779G0_CLK_R			76
++#define R8A779G0_CLK_CP			77
+ 
+ #endif /* __DT_BINDINGS_CLOCK_R8A779G0_CPG_MSSR_H__ */
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-renesas-r8a779g0-fix-pcie-clock-name.patch b/queue-6.8/clk-renesas-r8a779g0-fix-pcie-clock-name.patch
new file mode 100644
index 00000000000..ab88f07a989
--- /dev/null
+++ b/queue-6.8/clk-renesas-r8a779g0-fix-pcie-clock-name.patch
@@ -0,0 +1,36 @@
+From 314851a99b94ef57ab4cfeee65cbfabf1dd6a525 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 10:47:49 +0100
+Subject: clk: renesas: r8a779g0: Fix PCIe clock name
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 096311157d2a6bb8f06e28e1143e2a5de6a0183b ]
+
+Fix a typo in the name of the module clock for the second PCIe channel.
+
+Fixes: 5ab16198b431ca48 ("clk: renesas: r8a779g0: Add PCIe clocks")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/f582067564f357e2183d3db67b217084ecb51888.1706608032.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a779g0-cpg-mssr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/renesas/r8a779g0-cpg-mssr.c b/drivers/clk/renesas/r8a779g0-cpg-mssr.c
+index 5974adcef3eda..31b13c997a057 100644
+--- a/drivers/clk/renesas/r8a779g0-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a779g0-cpg-mssr.c
+@@ -193,7 +193,7 @@ static const struct mssr_mod_clk r8a779g0_mod_clks[] __initconst = {
+ 	DEF_MOD("msi4",		622,	R8A779G0_CLK_MSO),
+ 	DEF_MOD("msi5",		623,	R8A779G0_CLK_MSO),
+ 	DEF_MOD("pciec0",	624,	R8A779G0_CLK_S0D2_HSC),
+-	DEF_MOD("pscie1",	625,	R8A779G0_CLK_S0D2_HSC),
++	DEF_MOD("pciec1",	625,	R8A779G0_CLK_S0D2_HSC),
+ 	DEF_MOD("pwm",		628,	R8A779G0_CLK_SASYNCPERD4),
+ 	DEF_MOD("rpc-if",	629,	R8A779G0_CLK_RPCD2),
+ 	DEF_MOD("scif0",	702,	R8A779G0_CLK_SASYNCPERD4),
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch b/queue-6.8/clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch
new file mode 100644
index 00000000000..334cf6d9eb2
--- /dev/null
+++ b/queue-6.8/clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch
@@ -0,0 +1,53 @@
+From dd6b5c4a4580956dedc80a4a9c10d4412a8aed7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 12:29:29 +0200
+Subject: clk: renesas: r9a07g04[34]: Use SEL_SDHI1_STS status configuration
+ for SD1 mux
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 9b2a11c83859c06233049b134bd8ee974b284559 ]
+
+The status configuration for SD1 mux clock is SEL_SDHI1_STS. Fix it.
+
+Fixes: 16b86e5c03c5 ("clk: renesas: rzg2l: Refactor SD mux driver")
+Reported-by: Hien Huynh <hien.huynh.px@renesas.com>
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240131102930.1841901-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r9a07g043-cpg.c | 2 +-
+ drivers/clk/renesas/r9a07g044-cpg.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/r9a07g043-cpg.c b/drivers/clk/renesas/r9a07g043-cpg.c
+index b70bb378ab469..075ade0925d45 100644
+--- a/drivers/clk/renesas/r9a07g043-cpg.c
++++ b/drivers/clk/renesas/r9a07g043-cpg.c
+@@ -138,7 +138,7 @@ static const struct cpg_core_clk r9a07g043_core_clks[] __initconst = {
+ 	DEF_FIXED("SPI1", R9A07G043_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4),
+ 	DEF_SD_MUX("SD0", R9A07G043_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_shdi,
+ 		   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
+-	DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, SEL_SDHI0_STS, sel_shdi,
++	DEF_SD_MUX("SD1", R9A07G043_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_shdi,
+ 		   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
+ 	DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G043_CLK_SD0, 1, 4),
+ 	DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G043_CLK_SD1, 1, 4),
+diff --git a/drivers/clk/renesas/r9a07g044-cpg.c b/drivers/clk/renesas/r9a07g044-cpg.c
+index 1047278c9079a..bc822b9fd7ce6 100644
+--- a/drivers/clk/renesas/r9a07g044-cpg.c
++++ b/drivers/clk/renesas/r9a07g044-cpg.c
+@@ -178,7 +178,7 @@ static const struct {
+ 		DEF_FIXED("SPI1", R9A07G044_CLK_SPI1, CLK_DIV_PLL3_C, 1, 4),
+ 		DEF_SD_MUX("SD0", R9A07G044_CLK_SD0, SEL_SDHI0, SEL_SDHI0_STS, sel_shdi,
+ 			   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
+-		DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, SEL_SDHI0_STS, sel_shdi,
++		DEF_SD_MUX("SD1", R9A07G044_CLK_SD1, SEL_SDHI1, SEL_SDHI1_STS, sel_shdi,
+ 			   mtable_sdhi, 0, rzg2l_cpg_sd_clk_mux_notifier),
+ 		DEF_FIXED("SD0_DIV4", CLK_SD0_DIV4, R9A07G044_CLK_SD0, 1, 4),
+ 		DEF_FIXED("SD1_DIV4", CLK_SD1_DIV4, R9A07G044_CLK_SD1, 1, 4),
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch b/queue-6.8/clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch
new file mode 100644
index 00000000000..08939e5ba14
--- /dev/null
+++ b/queue-6.8/clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch
@@ -0,0 +1,173 @@
+From dccfcbfb35b330c5b91ca0f57eb48765f16c06d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 19:38:56 -0600
+Subject: clk: samsung: exynos850: Propagate SPI IPCLK rate change
+
+From: Sam Protsenko <semen.protsenko@linaro.org>
+
+[ Upstream commit 67c15187d4910ee353374676d4dddf09d8cb227e ]
+
+When SPI transfer is being prepared, the spi-s3c64xx driver will call
+clk_set_rate() to change the rate of SPI source clock (IPCLK). But IPCLK
+is a gate (leaf) clock, so it must propagate the rate change up the
+clock tree, so that corresponding DIV clocks can actually change their
+divider values. Add CLK_SET_RATE_PARENT flag to corresponding clocks for
+all SPI instances in Exynos850 (spi_0, spi_1 and spi_2) to make it
+possible. This change involves next clocks:
+
+usi_spi_0:
+
+    Clock                  Block       Div range
+    --------------------------------------------
+    gout_spi0_ipclk        CMU_PERI    -
+    dout_peri_spi0         CMU_PERI    /1..32
+    mout_peri_spi_user     CMU_PERI    -
+    dout_peri_ip           CMU_TOP     /1..16
+
+usi_cmgp0:
+
+    Clock                  Block       Div range
+    --------------------------------------------
+    gout_cmgp_usi0_ipclk   CMU_CMGP    -
+    dout_cmgp_usi0         CMU_CMGP    /1..32
+    mout_cmgp_usi0         CMU_CMGP    -
+    gout_clkcmu_cmgp_bus   CMU_APM     -
+    dout_apm_bus           CMU_APM     /1..8
+
+usi_cmgp1:
+
+    Clock                  Block       Div range
+    --------------------------------------------
+    gout_cmgp_usi1_ipclk   CMU_CMGP    -
+    dout_cmgp_usi1         CMU_CMGP    /1..32
+    mout_cmgp_usi1         CMU_CMGP    -
+    gout_clkcmu_cmgp_bus   CMU_APM     -
+    dout_apm_bus           CMU_APM     /1..8
+
+With input clock of 400 MHz, this scheme provides next IPCLK rate range,
+for each SPI block:
+
+    SPI0:   781 kHz ... 400 MHz
+    SPI1/2: 1.6 MHz ... 400 MHz
+
+Accounting for internal /4 divider in SPI blocks, and because the max
+SPI frequency is limited at 50 MHz, it gives us next SPI SCK rates:
+
+    SPI0:   200 kHz ... 49.9 MHz
+    SPI1/2: 400 kHz ... 49.9 MHz
+
+Which should cover all possible applications of SPI bus. Of course,
+setting SPI frequency to values as low as 500 kHz will also affect the
+common bus dividers (dout_apm_bus or dout_peri_ip), which in turn
+effectively lowers the rates for all leaf bus clocks derived from those
+dividers, like HSI2C and I3C clocks. But at least it gives the board
+designer a choice, whether to keep all clocks (SPI/HSI2C/I3C) at high
+frequencies, or make all those clocks have lower frequencies. Not
+propagating the rate change to those common dividers would limit this
+choice to "only high frequencies are allowed for SPI/HSI2C/I3C" option,
+making the common dividers useless. This decision follows the "Worse is
+better" approach, relying on the users/engineers to know the system
+internals when working with such low-level features, instead of trying
+to account for all possible use-cases.
+
+Fixes: 7dd05578198b ("clk: samsung: Introduce Exynos850 clock driver")
+Signed-off-by: Sam Protsenko <semen.protsenko@linaro.org>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/r/20240125013858.3986-2-semen.protsenko@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos850.c | 33 +++++++++++++++--------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/clk/samsung/clk-exynos850.c b/drivers/clk/samsung/clk-exynos850.c
+index bdc1eef7d6e54..c7b0b9751307b 100644
+--- a/drivers/clk/samsung/clk-exynos850.c
++++ b/drivers/clk/samsung/clk-exynos850.c
+@@ -605,7 +605,7 @@ static const struct samsung_div_clock apm_div_clks[] __initconst = {
+ 
+ static const struct samsung_gate_clock apm_gate_clks[] __initconst = {
+ 	GATE(CLK_GOUT_CLKCMU_CMGP_BUS, "gout_clkcmu_cmgp_bus", "dout_apm_bus",
+-	     CLK_CON_GAT_CLKCMU_CMGP_BUS, 21, 0, 0),
++	     CLK_CON_GAT_CLKCMU_CMGP_BUS, 21, CLK_SET_RATE_PARENT, 0),
+ 	GATE(CLK_GOUT_CLKCMU_CHUB_BUS, "gout_clkcmu_chub_bus",
+ 	     "mout_clkcmu_chub_bus",
+ 	     CLK_CON_GAT_GATE_CLKCMU_CHUB_BUS, 21, 0, 0),
+@@ -974,19 +974,19 @@ static const struct samsung_fixed_rate_clock cmgp_fixed_clks[] __initconst = {
+ static const struct samsung_mux_clock cmgp_mux_clks[] __initconst = {
+ 	MUX(CLK_MOUT_CMGP_ADC, "mout_cmgp_adc", mout_cmgp_adc_p,
+ 	    CLK_CON_MUX_CLK_CMGP_ADC, 0, 1),
+-	MUX(CLK_MOUT_CMGP_USI0, "mout_cmgp_usi0", mout_cmgp_usi0_p,
+-	    CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP0, 0, 1),
+-	MUX(CLK_MOUT_CMGP_USI1, "mout_cmgp_usi1", mout_cmgp_usi1_p,
+-	    CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP1, 0, 1),
++	MUX_F(CLK_MOUT_CMGP_USI0, "mout_cmgp_usi0", mout_cmgp_usi0_p,
++	      CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP0, 0, 1, CLK_SET_RATE_PARENT, 0),
++	MUX_F(CLK_MOUT_CMGP_USI1, "mout_cmgp_usi1", mout_cmgp_usi1_p,
++	      CLK_CON_MUX_MUX_CLK_CMGP_USI_CMGP1, 0, 1, CLK_SET_RATE_PARENT, 0),
+ };
+ 
+ static const struct samsung_div_clock cmgp_div_clks[] __initconst = {
+ 	DIV(CLK_DOUT_CMGP_ADC, "dout_cmgp_adc", "gout_clkcmu_cmgp_bus",
+ 	    CLK_CON_DIV_DIV_CLK_CMGP_ADC, 0, 4),
+-	DIV(CLK_DOUT_CMGP_USI0, "dout_cmgp_usi0", "mout_cmgp_usi0",
+-	    CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP0, 0, 5),
+-	DIV(CLK_DOUT_CMGP_USI1, "dout_cmgp_usi1", "mout_cmgp_usi1",
+-	    CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP1, 0, 5),
++	DIV_F(CLK_DOUT_CMGP_USI0, "dout_cmgp_usi0", "mout_cmgp_usi0",
++	      CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP0, 0, 5, CLK_SET_RATE_PARENT, 0),
++	DIV_F(CLK_DOUT_CMGP_USI1, "dout_cmgp_usi1", "mout_cmgp_usi1",
++	      CLK_CON_DIV_DIV_CLK_CMGP_USI_CMGP1, 0, 5, CLK_SET_RATE_PARENT, 0),
+ };
+ 
+ static const struct samsung_gate_clock cmgp_gate_clks[] __initconst = {
+@@ -1001,12 +1001,12 @@ static const struct samsung_gate_clock cmgp_gate_clks[] __initconst = {
+ 	     "gout_clkcmu_cmgp_bus",
+ 	     CLK_CON_GAT_GOUT_CMGP_GPIO_PCLK, 21, CLK_IGNORE_UNUSED, 0),
+ 	GATE(CLK_GOUT_CMGP_USI0_IPCLK, "gout_cmgp_usi0_ipclk", "dout_cmgp_usi0",
+-	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_IPCLK, 21, 0, 0),
++	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_IPCLK, 21, CLK_SET_RATE_PARENT, 0),
+ 	GATE(CLK_GOUT_CMGP_USI0_PCLK, "gout_cmgp_usi0_pclk",
+ 	     "gout_clkcmu_cmgp_bus",
+ 	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP0_PCLK, 21, 0, 0),
+ 	GATE(CLK_GOUT_CMGP_USI1_IPCLK, "gout_cmgp_usi1_ipclk", "dout_cmgp_usi1",
+-	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_IPCLK, 21, 0, 0),
++	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_IPCLK, 21, CLK_SET_RATE_PARENT, 0),
+ 	GATE(CLK_GOUT_CMGP_USI1_PCLK, "gout_cmgp_usi1_pclk",
+ 	     "gout_clkcmu_cmgp_bus",
+ 	     CLK_CON_GAT_GOUT_CMGP_USI_CMGP1_PCLK, 21, 0, 0),
+@@ -1557,8 +1557,9 @@ static const struct samsung_mux_clock peri_mux_clks[] __initconst = {
+ 	    mout_peri_uart_user_p, PLL_CON0_MUX_CLKCMU_PERI_UART_USER, 4, 1),
+ 	MUX(CLK_MOUT_PERI_HSI2C_USER, "mout_peri_hsi2c_user",
+ 	    mout_peri_hsi2c_user_p, PLL_CON0_MUX_CLKCMU_PERI_HSI2C_USER, 4, 1),
+-	MUX(CLK_MOUT_PERI_SPI_USER, "mout_peri_spi_user", mout_peri_spi_user_p,
+-	    PLL_CON0_MUX_CLKCMU_PERI_SPI_USER, 4, 1),
++	MUX_F(CLK_MOUT_PERI_SPI_USER, "mout_peri_spi_user",
++	      mout_peri_spi_user_p, PLL_CON0_MUX_CLKCMU_PERI_SPI_USER, 4, 1,
++	      CLK_SET_RATE_PARENT, 0),
+ };
+ 
+ static const struct samsung_div_clock peri_div_clks[] __initconst = {
+@@ -1568,8 +1569,8 @@ static const struct samsung_div_clock peri_div_clks[] __initconst = {
+ 	    CLK_CON_DIV_DIV_CLK_PERI_HSI2C_1, 0, 5),
+ 	DIV(CLK_DOUT_PERI_HSI2C2, "dout_peri_hsi2c2", "gout_peri_hsi2c2",
+ 	    CLK_CON_DIV_DIV_CLK_PERI_HSI2C_2, 0, 5),
+-	DIV(CLK_DOUT_PERI_SPI0, "dout_peri_spi0", "mout_peri_spi_user",
+-	    CLK_CON_DIV_DIV_CLK_PERI_SPI_0, 0, 5),
++	DIV_F(CLK_DOUT_PERI_SPI0, "dout_peri_spi0", "mout_peri_spi_user",
++	      CLK_CON_DIV_DIV_CLK_PERI_SPI_0, 0, 5, CLK_SET_RATE_PARENT, 0),
+ };
+ 
+ static const struct samsung_gate_clock peri_gate_clks[] __initconst = {
+@@ -1611,7 +1612,7 @@ static const struct samsung_gate_clock peri_gate_clks[] __initconst = {
+ 	     "mout_peri_bus_user",
+ 	     CLK_CON_GAT_GOUT_PERI_PWM_MOTOR_PCLK, 21, 0, 0),
+ 	GATE(CLK_GOUT_SPI0_IPCLK, "gout_spi0_ipclk", "dout_peri_spi0",
+-	     CLK_CON_GAT_GOUT_PERI_SPI_0_IPCLK, 21, 0, 0),
++	     CLK_CON_GAT_GOUT_PERI_SPI_0_IPCLK, 21, CLK_SET_RATE_PARENT, 0),
+ 	GATE(CLK_GOUT_SPI0_PCLK, "gout_spi0_pclk", "mout_peri_bus_user",
+ 	     CLK_CON_GAT_GOUT_PERI_SPI_0_PCLK, 21, 0, 0),
+ 	GATE(CLK_GOUT_SYSREG_PERI_PCLK, "gout_sysreg_peri_pclk",
+-- 
+2.43.0
+
diff --git a/queue-6.8/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch b/queue-6.8/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
new file mode 100644
index 00000000000..5c4e235a73f
--- /dev/null
+++ b/queue-6.8/clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
@@ -0,0 +1,74 @@
+From e4c8ebd6bcfeecaed414fd9e784651b321e76e93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 16:44:37 +0800
+Subject: clk: zynq: Prevent null pointer dereference caused by kmalloc failure
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 7938e9ce39d6779d2f85d822cc930f73420e54a6 ]
+
+The kmalloc() in zynq_clk_setup() will return null if the
+physical memory has run out. As a result, if we use snprintf()
+to write data to the null address, the null pointer dereference
+bug will happen.
+
+This patch uses a stack variable to replace the kmalloc().
+
+Fixes: 0ee52b157b8e ("clk: zynq: Add clock controller driver")
+Suggested-by: Michal Simek <michal.simek@amd.com>
+Suggested-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Link: https://lore.kernel.org/r/20240301084437.16084-1-duoming@zju.edu.cn
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynq/clkc.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/zynq/clkc.c b/drivers/clk/zynq/clkc.c
+index 7bdeaff2bfd68..c28d3dacf0fb2 100644
+--- a/drivers/clk/zynq/clkc.c
++++ b/drivers/clk/zynq/clkc.c
+@@ -42,6 +42,7 @@ static void __iomem *zynq_clkc_base;
+ #define SLCR_SWDT_CLK_SEL		(zynq_clkc_base + 0x204)
+ 
+ #define NUM_MIO_PINS	54
++#define CLK_NAME_LEN	16
+ 
+ #define DBG_CLK_CTRL_CLKACT_TRC		BIT(0)
+ #define DBG_CLK_CTRL_CPU_1XCLKACT	BIT(1)
+@@ -215,7 +216,7 @@ static void __init zynq_clk_setup(struct device_node *np)
+ 	int i;
+ 	u32 tmp;
+ 	int ret;
+-	char *clk_name;
++	char clk_name[CLK_NAME_LEN];
+ 	unsigned int fclk_enable = 0;
+ 	const char *clk_output_name[clk_max];
+ 	const char *cpu_parents[4];
+@@ -426,12 +427,10 @@ static void __init zynq_clk_setup(struct device_node *np)
+ 			"gem1_emio_mux", CLK_SET_RATE_PARENT,
+ 			SLCR_GEM1_CLK_CTRL, 0, 0, &gem1clk_lock);
+ 
+-	tmp = strlen("mio_clk_00x");
+-	clk_name = kmalloc(tmp, GFP_KERNEL);
+ 	for (i = 0; i < NUM_MIO_PINS; i++) {
+ 		int idx;
+ 
+-		snprintf(clk_name, tmp, "mio_clk_%2.2d", i);
++		snprintf(clk_name, CLK_NAME_LEN, "mio_clk_%2.2d", i);
+ 		idx = of_property_match_string(np, "clock-names", clk_name);
+ 		if (idx >= 0)
+ 			can_mio_mux_parents[i] = of_clk_get_parent_name(np,
+@@ -439,7 +438,6 @@ static void __init zynq_clk_setup(struct device_node *np)
+ 		else
+ 			can_mio_mux_parents[i] = dummy_nm;
+ 	}
+-	kfree(clk_name);
+ 	clk_register_mux(NULL, "can_mux", periph_parents, 4,
+ 			CLK_SET_RATE_NO_REPARENT, SLCR_CAN_CLK_CTRL, 4, 2, 0,
+ 			&canclk_lock);
+-- 
+2.43.0
+
diff --git a/queue-6.8/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch b/queue-6.8/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
new file mode 100644
index 00000000000..5439afe605d
--- /dev/null
+++ b/queue-6.8/cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
@@ -0,0 +1,39 @@
+From c13dee43fe75e2780198d476e37cbf9c61e42c3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 10:12:20 +0300
+Subject: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return
+ value
+
+From: Anastasia Belova <abelova@astralinux.ru>
+
+[ Upstream commit f661017e6d326ee187db24194cabb013d81bc2a6 ]
+
+cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it
+and return 0 in case of error.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 35fb3a559ea97..1a1857b0a6f48 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -481,6 +481,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv)
+ static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
+ {
+ 	struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
++	if (!policy)
++		return 0;
+ 	struct private_data *priv = policy->driver_data;
+ 
+ 	cpufreq_cpu_put(policy);
+-- 
+2.43.0
+
diff --git a/queue-6.8/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch b/queue-6.8/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
new file mode 100644
index 00000000000..1397b663e60
--- /dev/null
+++ b/queue-6.8/cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
@@ -0,0 +1,48 @@
+From 0d895dc524dddc7710f172abf45537a566f9f6c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 17:31:43 -0300
+Subject: cpufreq: mediatek-hw: Don't error out if supply is not found
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit eaffb10b51bf74415c9252fd8fb4dd77122501ee ]
+
+devm_regulator_get_optional() returns -ENODEV if no supply can be found.
+By introducing its usage, commit 788715b5f21c ("cpufreq: mediatek-hw:
+Wait for CPU supplies before probing") caused the driver to fail probe
+if no supply was present in any of the CPU DT nodes.
+
+Use devm_regulator_get() instead since the CPUs do require supplies
+even if not described in the DT. It will gracefully return a dummy
+regulator if none is found in the DT node, allowing probe to succeed.
+
+Fixes: 788715b5f21c ("cpufreq: mediatek-hw: Wait for CPU supplies before probing")
+Reported-by: kernelci.org bot <bot@kernelci.org>
+Closes: https://linux.kernelci.org/test/case/id/65b0b169710edea22852a3fa/
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq-hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq-hw.c b/drivers/cpufreq/mediatek-cpufreq-hw.c
+index a1aa9385980ae..8d097dcddda47 100644
+--- a/drivers/cpufreq/mediatek-cpufreq-hw.c
++++ b/drivers/cpufreq/mediatek-cpufreq-hw.c
+@@ -312,7 +312,7 @@ static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev)
+ 			return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
+ 					     "Failed to get cpu%d device\n", cpu);
+ 
+-		cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu");
++		cpu_reg = devm_regulator_get(cpu_dev, "cpu");
+ 		if (IS_ERR(cpu_reg))
+ 			return dev_err_probe(&pdev->dev, PTR_ERR(cpu_reg),
+ 					     "CPU%d regulator get failed\n", cpu);
+-- 
+2.43.0
+
diff --git a/queue-6.8/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch b/queue-6.8/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
new file mode 100644
index 00000000000..50055ac5ab1
--- /dev/null
+++ b/queue-6.8/cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
@@ -0,0 +1,72 @@
+From d5f181718703454f10c4d768e7527c454badd666 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 11:23:02 -0300
+Subject: cpufreq: mediatek-hw: Wait for CPU supplies before probing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit 788715b5f21c6455264fe00a1779e61bec407fe2 ]
+
+Before proceeding with the probe and enabling frequency scaling for the
+CPUs, make sure that all supplies feeding the CPUs have probed.
+
+This fixes an issue observed on MT8195-Tomato where if the
+mediatek-cpufreq-hw driver enabled the hardware (by writing to
+REG_FREQ_ENABLE) before the SPMI controller driver (spmi-mtk-pmif),
+behind which lies the big CPU supply, probed the platform would hang
+shortly after with "rcu: INFO: rcu_preempt detected stalls on
+CPUs/tasks" being printed in the log.
+
+Fixes: 4855e26bcf4d ("cpufreq: mediatek-hw: Add support for CPUFREQ HW")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/mediatek-cpufreq-hw.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/mediatek-cpufreq-hw.c b/drivers/cpufreq/mediatek-cpufreq-hw.c
+index d46afb3c00923..a1aa9385980ae 100644
+--- a/drivers/cpufreq/mediatek-cpufreq-hw.c
++++ b/drivers/cpufreq/mediatek-cpufreq-hw.c
+@@ -13,6 +13,7 @@
+ #include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
+ #include <linux/slab.h>
+ 
+ #define LUT_MAX_ENTRIES			32U
+@@ -300,7 +301,23 @@ static struct cpufreq_driver cpufreq_mtk_hw_driver = {
+ static int mtk_cpufreq_hw_driver_probe(struct platform_device *pdev)
+ {
+ 	const void *data;
+-	int ret;
++	int ret, cpu;
++	struct device *cpu_dev;
++	struct regulator *cpu_reg;
++
++	/* Make sure that all CPU supplies are available before proceeding. */
++	for_each_possible_cpu(cpu) {
++		cpu_dev = get_cpu_device(cpu);
++		if (!cpu_dev)
++			return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
++					     "Failed to get cpu%d device\n", cpu);
++
++		cpu_reg = devm_regulator_get_optional(cpu_dev, "cpu");
++		if (IS_ERR(cpu_reg))
++			return dev_err_probe(&pdev->dev, PTR_ERR(cpu_reg),
++					     "CPU%d regulator get failed\n", cpu);
++	}
++
+ 
+ 	data = of_device_get_match_data(&pdev->dev);
+ 	if (!data)
+-- 
+2.43.0
+
diff --git a/queue-6.8/cpufreq-qcom-hw-add-config_common_clk-dependency.patch b/queue-6.8/cpufreq-qcom-hw-add-config_common_clk-dependency.patch
new file mode 100644
index 00000000000..eb0cc9af416
--- /dev/null
+++ b/queue-6.8/cpufreq-qcom-hw-add-config_common_clk-dependency.patch
@@ -0,0 +1,47 @@
+From 698f41656f7d30592b1a343ff9b0a0c5aac9446c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 09:33:14 +0100
+Subject: cpufreq: qcom-hw: add CONFIG_COMMON_CLK dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 3093fa33539b54db77171d2919352ad4f044a1c5 ]
+
+It is still possible to compile-test a kernel without CONFIG_COMMON_CLK
+for some ancient ARM boards or other architectures, but this causes a
+link failure in the qcom-cpufreq-hw driver:
+
+ERROR: modpost: "devm_clk_hw_register" [drivers/cpufreq/qcom-cpufreq-hw.ko] undefined!
+ERROR: modpost: "devm_of_clk_add_hw_provider" [drivers/cpufreq/qcom-cpufreq-hw.ko] undefined!
+ERROR: modpost: "of_clk_hw_onecell_get" [drivers/cpufreq/qcom-cpufreq-hw.ko] undefined!
+
+Add a Kconfig dependency here to make sure this always work. Apparently
+this bug has been in the kernel for a while without me running into it
+on randconfig builds as COMMON_CLK is almost always enabled.
+
+I have cross-checked by building an allmodconfig kernel with COMMON_CLK
+disabled, which showed no other driver having this problem.
+
+Fixes: 4370232c727b ("cpufreq: qcom-hw: Add CPU clock provider support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/Kconfig.arm | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
+index f911606897b8d..a0ebad77666e3 100644
+--- a/drivers/cpufreq/Kconfig.arm
++++ b/drivers/cpufreq/Kconfig.arm
+@@ -173,6 +173,7 @@ config ARM_QCOM_CPUFREQ_NVMEM
+ config ARM_QCOM_CPUFREQ_HW
+ 	tristate "QCOM CPUFreq HW driver"
+ 	depends on ARCH_QCOM || COMPILE_TEST
++	depends on COMMON_CLK
+ 	help
+ 	  Support for the CPUFreq HW driver.
+ 	  Some QCOM chipsets have a HW engine to offload the steps
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-arm-sha-fix-function-cast-warnings.patch b/queue-6.8/crypto-arm-sha-fix-function-cast-warnings.patch
new file mode 100644
index 00000000000..8d96f3d4ee6
--- /dev/null
+++ b/queue-6.8/crypto-arm-sha-fix-function-cast-warnings.patch
@@ -0,0 +1,115 @@
+From 1eb9f76ac2c5ebaee09bb265d8759d100924440d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 14:49:46 +0100
+Subject: crypto: arm/sha - fix function cast warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 53cc9baeb9bc2a187eb9c9790d30995148852b12 ]
+
+clang-16 warns about casting between incompatible function types:
+
+arch/arm/crypto/sha256_glue.c:37:5: error: cast from 'void (*)(u32 *, const void *, unsigned int)' (aka 'void (*)(unsigned int *, const void *, unsigned int)') to 'sha256_block_fn *' (aka 'void (*)(struct sha256_state *, const unsigned char *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   37 |                                 (sha256_block_fn *)sha256_block_data_order);
+      |                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+arch/arm/crypto/sha512-glue.c:34:3: error: cast from 'void (*)(u64 *, const u8 *, int)' (aka 'void (*)(unsigned long long *, const unsigned char *, int)') to 'sha512_block_fn *' (aka 'void (*)(struct sha512_state *, const unsigned char *, int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   34 |                 (sha512_block_fn *)sha512_block_data_order);
+      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fix the prototypes for the assembler functions to match the typedef.
+The code already relies on the digest being the first part of the
+state structure, so there is no change in behavior.
+
+Fixes: c80ae7ca3726 ("crypto: arm/sha512 - accelerated SHA-512 using ARM generic ASM and NEON")
+Fixes: b59e2ae3690c ("crypto: arm/sha256 - move SHA-224/256 ASM/NEON implementation to base layer")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/crypto/sha256_glue.c | 13 +++++--------
+ arch/arm/crypto/sha512-glue.c | 12 +++++-------
+ 2 files changed, 10 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arm/crypto/sha256_glue.c b/arch/arm/crypto/sha256_glue.c
+index 433ee4ddce6c8..f85933fdec75f 100644
+--- a/arch/arm/crypto/sha256_glue.c
++++ b/arch/arm/crypto/sha256_glue.c
+@@ -24,8 +24,8 @@
+ 
+ #include "sha256_glue.h"
+ 
+-asmlinkage void sha256_block_data_order(u32 *digest, const void *data,
+-					unsigned int num_blks);
++asmlinkage void sha256_block_data_order(struct sha256_state *state,
++					const u8 *data, int num_blks);
+ 
+ int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data,
+ 			     unsigned int len)
+@@ -33,23 +33,20 @@ int crypto_sha256_arm_update(struct shash_desc *desc, const u8 *data,
+ 	/* make sure casting to sha256_block_fn() is safe */
+ 	BUILD_BUG_ON(offsetof(struct sha256_state, state) != 0);
+ 
+-	return sha256_base_do_update(desc, data, len,
+-				(sha256_block_fn *)sha256_block_data_order);
++	return sha256_base_do_update(desc, data, len, sha256_block_data_order);
+ }
+ EXPORT_SYMBOL(crypto_sha256_arm_update);
+ 
+ static int crypto_sha256_arm_final(struct shash_desc *desc, u8 *out)
+ {
+-	sha256_base_do_finalize(desc,
+-				(sha256_block_fn *)sha256_block_data_order);
++	sha256_base_do_finalize(desc, sha256_block_data_order);
+ 	return sha256_base_finish(desc, out);
+ }
+ 
+ int crypto_sha256_arm_finup(struct shash_desc *desc, const u8 *data,
+ 			    unsigned int len, u8 *out)
+ {
+-	sha256_base_do_update(desc, data, len,
+-			      (sha256_block_fn *)sha256_block_data_order);
++	sha256_base_do_update(desc, data, len, sha256_block_data_order);
+ 	return crypto_sha256_arm_final(desc, out);
+ }
+ EXPORT_SYMBOL(crypto_sha256_arm_finup);
+diff --git a/arch/arm/crypto/sha512-glue.c b/arch/arm/crypto/sha512-glue.c
+index 0635a65aa488b..1be5bd498af36 100644
+--- a/arch/arm/crypto/sha512-glue.c
++++ b/arch/arm/crypto/sha512-glue.c
+@@ -25,27 +25,25 @@ MODULE_ALIAS_CRYPTO("sha512");
+ MODULE_ALIAS_CRYPTO("sha384-arm");
+ MODULE_ALIAS_CRYPTO("sha512-arm");
+ 
+-asmlinkage void sha512_block_data_order(u64 *state, u8 const *src, int blocks);
++asmlinkage void sha512_block_data_order(struct sha512_state *state,
++					u8 const *src, int blocks);
+ 
+ int sha512_arm_update(struct shash_desc *desc, const u8 *data,
+ 		      unsigned int len)
+ {
+-	return sha512_base_do_update(desc, data, len,
+-		(sha512_block_fn *)sha512_block_data_order);
++	return sha512_base_do_update(desc, data, len, sha512_block_data_order);
+ }
+ 
+ static int sha512_arm_final(struct shash_desc *desc, u8 *out)
+ {
+-	sha512_base_do_finalize(desc,
+-		(sha512_block_fn *)sha512_block_data_order);
++	sha512_base_do_finalize(desc, sha512_block_data_order);
+ 	return sha512_base_finish(desc, out);
+ }
+ 
+ int sha512_arm_finup(struct shash_desc *desc, const u8 *data,
+ 		     unsigned int len, u8 *out)
+ {
+-	sha512_base_do_update(desc, data, len,
+-		(sha512_block_fn *)sha512_block_data_order);
++	sha512_base_do_update(desc, data, len, sha512_block_data_order);
+ 	return sha512_arm_final(desc, out);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch b/queue-6.8/crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch
new file mode 100644
index 00000000000..7cd2d7c4818
--- /dev/null
+++ b/queue-6.8/crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch
@@ -0,0 +1,56 @@
+From 3691094a0d5eda6514758469e2a08f2124c9b38d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:34:28 -0600
+Subject: crypto: ccp - Avoid discarding errors in
+ psp_send_platform_access_msg()
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 0e8fca2f12ceb77c3a6b6f210135031f264aa612 ]
+
+Errors can potentially occur in the "processing" of PSP commands or
+commands can be processed successfully but still return an error code in
+the header.
+
+This second case was being discarded because PSP communication worked but
+the command returned an error code in the payload header.
+
+Capture both cases and return them to the caller as -EIO for the caller
+to investigate. The caller can detect the latter by looking at
+`req->header->status`.
+
+Reported-and-tested-by: Tim Van Patten <timvp@google.com>
+Fixes: 7ccc4f4e2e50 ("crypto: ccp - Add support for an interface for platform features")
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/platform-access.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/ccp/platform-access.c b/drivers/crypto/ccp/platform-access.c
+index 94367bc49e35b..1b8ed33897332 100644
+--- a/drivers/crypto/ccp/platform-access.c
++++ b/drivers/crypto/ccp/platform-access.c
+@@ -118,9 +118,16 @@ int psp_send_platform_access_msg(enum psp_platform_access_msg msg,
+ 		goto unlock;
+ 	}
+ 
+-	/* Store the status in request header for caller to investigate */
++	/*
++	 * Read status from PSP. If status is non-zero, it indicates an error
++	 * occurred during "processing" of the command.
++	 * If status is zero, it indicates the command was "processed"
++	 * successfully, but the result of the command is in the payload.
++	 * Return both cases to the caller as -EIO to investigate.
++	 */
+ 	cmd_reg = ioread32(cmd);
+-	req->header.status = FIELD_GET(PSP_CMDRESP_STS, cmd_reg);
++	if (FIELD_GET(PSP_CMDRESP_STS, cmd_reg))
++		req->header.status = FIELD_GET(PSP_CMDRESP_STS, cmd_reg);
+ 	if (req->header.status) {
+ 		ret = -EIO;
+ 		goto unlock;
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-jitter-fix-crypto_jitterentropy-help-text.patch b/queue-6.8/crypto-jitter-fix-crypto_jitterentropy-help-text.patch
new file mode 100644
index 00000000000..260f10fe165
--- /dev/null
+++ b/queue-6.8/crypto-jitter-fix-crypto_jitterentropy-help-text.patch
@@ -0,0 +1,51 @@
+From 85c7c9fb46445146173515bf2cf525526b14e3f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 08:55:13 -0800
+Subject: crypto: jitter - fix CRYPTO_JITTERENTROPY help text
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit e63df1ec9a16dd9e13e9068243e64876de06f795 ]
+
+Correct various small problems in the help text:
+a. change 2 spaces to ", "
+b. finish an incomplete sentence
+c. change non-working URL to working URL
+
+Fixes: a9a98d49da52 ("crypto: Kconfig - simplify compression/RNG entries")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218458
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Bagas Sanjaya <bagasdotme@gmail.com>
+Cc: Robert Elliott <elliott@hpe.com>
+Cc: Christoph Biedl <bugzilla.kernel.bpeb@manchmal.in-ulm.de>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: linux-crypto@vger.kernel.org
+Acked-by: Bagas Sanjaya <bagasdotme@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index 7d156c75f15f2..44661c2e30ca5 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1269,10 +1269,11 @@ config CRYPTO_JITTERENTROPY
+ 
+ 	  A non-physical non-deterministic ("true") RNG (e.g., an entropy source
+ 	  compliant with NIST SP800-90B) intended to provide a seed to a
+-	  deterministic RNG (e.g.  per NIST SP800-90C).
++	  deterministic RNG (e.g., per NIST SP800-90C).
+ 	  This RNG does not perform any cryptographic whitening of the generated
++	  random numbers.
+ 
+-	  See https://www.chronox.de/jent.html
++	  See https://www.chronox.de/jent/
+ 
+ if CRYPTO_JITTERENTROPY
+ if CRYPTO_FIPS && EXPERT
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-qat-avoid-division-by-zero.patch b/queue-6.8/crypto-qat-avoid-division-by-zero.patch
new file mode 100644
index 00000000000..7f2df436f8a
--- /dev/null
+++ b/queue-6.8/crypto-qat-avoid-division-by-zero.patch
@@ -0,0 +1,45 @@
+From bf50a38ecc3f80adedac0ea4cb2e0f3d3fa32a5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 15:19:57 +0000
+Subject: crypto: qat - avoid division by zero
+
+From: Adam Guerin <adam.guerin@intel.com>
+
+[ Upstream commit f99fb7d660f7c818105803f1f1915396a14d18ad ]
+
+Check if delta_us is not zero and return -EINVAL if it is.
+delta_us is unlikely to be zero as there is a sleep between the reads of
+the two timestamps.
+
+This is to fix the following warning when compiling the QAT driver
+using clang scan-build:
+    drivers/crypto/intel/qat/qat_common/adf_clock.c:87:9: warning: Division by zero [core.DivideZero]
+       87 |         temp = DIV_ROUND_CLOSEST_ULL(temp, delta_us);
+          |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: e2980ba57e79 ("crypto: qat - add measure clock frequency")
+Signed-off-by: Adam Guerin <adam.guerin@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_clock.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_clock.c b/drivers/crypto/intel/qat/qat_common/adf_clock.c
+index 01e0a389e462b..cf89f57de2a70 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_clock.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_clock.c
+@@ -83,6 +83,9 @@ static int measure_clock(struct adf_accel_dev *accel_dev, u32 *frequency)
+ 	}
+ 
+ 	delta_us = timespec_to_us(&ts3) - timespec_to_us(&ts1);
++	if (!delta_us)
++		return -EINVAL;
++
+ 	temp = (timestamp2 - timestamp1) * ME_CLK_DIVIDER * 10;
+ 	temp = DIV_ROUND_CLOSEST_ULL(temp, delta_us);
+ 	/*
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-qat-avoid-memcpy-overflow-warning.patch b/queue-6.8/crypto-qat-avoid-memcpy-overflow-warning.patch
new file mode 100644
index 00000000000..2f00f63bbe2
--- /dev/null
+++ b/queue-6.8/crypto-qat-avoid-memcpy-overflow-warning.patch
@@ -0,0 +1,56 @@
+From 9754fa3740b68b6ecd5188171636b2f49308eec1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 17:26:02 +0100
+Subject: crypto: qat - avoid memcpy() overflow warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 23a22e831ed4e6aa0831312e8cc8b7c60a657f60 ]
+
+The use of array_size() leads gcc to assume the memcpy() can have a larger
+limit than actually possible, which triggers a string fortification warning:
+
+In file included from include/linux/string.h:296,
+                 from include/linux/bitmap.h:12,
+                 from include/linux/cpumask.h:12,
+                 from include/linux/sched.h:16,
+                 from include/linux/delay.h:23,
+                 from include/linux/iopoll.h:12,
+                 from drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c:3:
+In function 'fortify_memcpy_chk',
+    inlined from 'adf_gen4_init_thd2arb_map' at drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c:401:3:
+include/linux/fortify-string.h:579:4: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
+  579 |    __write_overflow_field(p_size_field, size);
+      |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include/linux/fortify-string.h:588:4: error: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
+  588 |    __read_overflow2_field(q_size_field, size);
+      |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Add an explicit range check to avoid this.
+
+Fixes: 5da6a2d5353e ("crypto: qat - generate dynamically arbiter mappings")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
+index 9985683056d5f..f752653ccb47e 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_hw_data.c
+@@ -398,6 +398,9 @@ int adf_gen4_init_thd2arb_map(struct adf_accel_dev *accel_dev)
+ 			 ADF_GEN4_ADMIN_ACCELENGINES;
+ 
+ 	if (srv_id == SVC_DCC) {
++		if (ae_cnt > ICP_QAT_HW_AE_DELIMITER)
++			return -EINVAL;
++
+ 		memcpy(thd2arb_map, thrd_to_arb_map_dcc,
+ 		       array_size(sizeof(*thd2arb_map), ae_cnt));
+ 		return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-420xx.patch b/queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-420xx.patch
new file mode 100644
index 00000000000..7c4301dbf55
--- /dev/null
+++ b/queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-420xx.patch
@@ -0,0 +1,56 @@
+From e466900f7ac74afab94542e768965b85785026d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 18:21:55 +0100
+Subject: crypto: qat - fix ring to service map for dcc in 420xx
+
+From: Damian Muszynski <damian.muszynski@intel.com>
+
+[ Upstream commit a20a6060e0dd57fecaf55487985aef28bd08c6bf ]
+
+If a device is configured for data compression chaining (dcc), half of the
+engines are loaded with the symmetric crypto image and the rest are loaded
+with the compression image.
+However, in such configuration all rings can handle compression requests.
+
+Fix the ring to service mapping so that when a device is configured for
+dcc, the ring to service mapping reports that all rings in a bank can
+be used for compression.
+
+Fixes: fcf60f4bcf54 ("crypto: qat - add support for 420xx devices")
+Signed-off-by: Damian Muszynski <damian.muszynski@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c
+index a87d29ae724fe..7909b51e97c30 100644
+--- a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c
++++ b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c
+@@ -372,6 +372,13 @@ static u16 get_ring_to_svc_map(struct adf_accel_dev *accel_dev)
+ 	if (!fw_config)
+ 		return 0;
+ 
++	/* If dcc, all rings handle compression requests */
++	if (adf_get_service_enabled(accel_dev) == SVC_DCC) {
++		for (i = 0; i < RP_GROUP_COUNT; i++)
++			rps[i] = COMP;
++		goto set_mask;
++	}
++
+ 	for (i = 0; i < RP_GROUP_COUNT; i++) {
+ 		switch (fw_config[i].ae_mask) {
+ 		case ADF_AE_GROUP_0:
+@@ -400,6 +407,7 @@ static u16 get_ring_to_svc_map(struct adf_accel_dev *accel_dev)
+ 		}
+ 	}
+ 
++set_mask:
+ 	ring_to_svc_map = rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_0_SHIFT |
+ 			  rps[RP_GROUP_1] << ADF_CFG_SERV_RING_PAIR_1_SHIFT |
+ 			  rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_2_SHIFT |
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch b/queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch
new file mode 100644
index 00000000000..1bd56e8b418
--- /dev/null
+++ b/queue-6.8/crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch
@@ -0,0 +1,56 @@
+From b6128bd81720567bbabfc6c561d73b8ca88b65b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 18:21:54 +0100
+Subject: crypto: qat - fix ring to service map for dcc in 4xxx
+
+From: Damian Muszynski <damian.muszynski@intel.com>
+
+[ Upstream commit df018f82002a8b4dc407bc9a6f416b9241d14415 ]
+
+If a device is configured for data compression chaining (dcc), half of the
+engines are loaded with the symmetric crypto image and the rest are loaded
+with the compression image.
+However, in such configuration all rings can handle compression requests.
+
+Fix the ring to service mapping so that when a device is configured for
+dcc, the ring to service mapping reports that all rings in a bank can
+be used for compression.
+
+Fixes: a238487f7965 ("crypto: qat - fix ring to service map for QAT GEN4")
+Signed-off-by: Damian Muszynski <damian.muszynski@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
+index 94a0ebb03d8c9..e171cddf6f025 100644
+--- a/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
++++ b/drivers/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c
+@@ -331,6 +331,13 @@ static u16 get_ring_to_svc_map(struct adf_accel_dev *accel_dev)
+ 	if (!fw_config)
+ 		return 0;
+ 
++	/* If dcc, all rings handle compression requests */
++	if (adf_get_service_enabled(accel_dev) == SVC_DCC) {
++		for (i = 0; i < RP_GROUP_COUNT; i++)
++			rps[i] = COMP;
++		goto set_mask;
++	}
++
+ 	for (i = 0; i < RP_GROUP_COUNT; i++) {
+ 		switch (fw_config[i].ae_mask) {
+ 		case ADF_AE_GROUP_0:
+@@ -359,6 +366,7 @@ static u16 get_ring_to_svc_map(struct adf_accel_dev *accel_dev)
+ 		}
+ 	}
+ 
++set_mask:
+ 	ring_to_svc_map = rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_0_SHIFT |
+ 			  rps[RP_GROUP_1] << ADF_CFG_SERV_RING_PAIR_1_SHIFT |
+ 			  rps[RP_GROUP_0] << ADF_CFG_SERV_RING_PAIR_2_SHIFT |
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-qat-remove-double-initialization-of-value.patch b/queue-6.8/crypto-qat-remove-double-initialization-of-value.patch
new file mode 100644
index 00000000000..b2a27ce33bb
--- /dev/null
+++ b/queue-6.8/crypto-qat-remove-double-initialization-of-value.patch
@@ -0,0 +1,56 @@
+From 6ec62d43fcb72a6df5d9ba0ee818620dfcf36ecf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 15:19:58 +0000
+Subject: crypto: qat - remove double initialization of value
+
+From: Adam Guerin <adam.guerin@intel.com>
+
+[ Upstream commit a66cf93ab33853f17b8cc33a99263dd0a383a1a1 ]
+
+Remove double initialization of the reg variable.
+
+This is to fix the following warning when compiling the QAT driver
+using clang scan-build:
+    drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c:1010:6: warning: Value stored to 'reg' during its initialization is never read [deadcode.DeadStores]
+     1010 |         u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SSMCPPERR);
+          |             ^~~   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c:1109:6: warning: Value stored to 'reg' during its initialization is never read [deadcode.DeadStores]
+     1109 |         u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SER_ERR_SSMSH);
+          |             ^~~   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Fixes: 99b1c9826e48 ("crypto: qat - count QAT GEN4 errors")
+Signed-off-by: Adam Guerin <adam.guerin@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c b/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c
+index 048c246079390..2dd3772bf58a6 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_ras.c
+@@ -1007,8 +1007,7 @@ static bool adf_handle_spppar_err(struct adf_accel_dev *accel_dev,
+ static bool adf_handle_ssmcpppar_err(struct adf_accel_dev *accel_dev,
+ 				     void __iomem *csr, u32 iastatssm)
+ {
+-	u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SSMCPPERR);
+-	u32 bits_num = BITS_PER_REG(reg);
++	u32 reg, bits_num = BITS_PER_REG(reg);
+ 	bool reset_required = false;
+ 	unsigned long errs_bits;
+ 	u32 bit_iterator;
+@@ -1106,8 +1105,7 @@ static bool adf_handle_rf_parr_err(struct adf_accel_dev *accel_dev,
+ static bool adf_handle_ser_err_ssmsh(struct adf_accel_dev *accel_dev,
+ 				     void __iomem *csr, u32 iastatssm)
+ {
+-	u32 reg = ADF_CSR_RD(csr, ADF_GEN4_SER_ERR_SSMSH);
+-	u32 bits_num = BITS_PER_REG(reg);
++	u32 reg, bits_num = BITS_PER_REG(reg);
+ 	bool reset_required = false;
+ 	unsigned long errs_bits;
+ 	u32 bit_iterator;
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch b/queue-6.8/crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch
new file mode 100644
index 00000000000..3b17116ecd1
--- /dev/null
+++ b/queue-6.8/crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch
@@ -0,0 +1,71 @@
+From 0cd0d04b6149a7ed511d19d7555960855898ed9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 15:19:55 +0000
+Subject: crypto: qat - remove unused macros in qat_comp_alg.c
+
+From: Adam Guerin <adam.guerin@intel.com>
+
+[ Upstream commit dfff0e35fa5dd84ae75052ba129b0219d83e46dc ]
+
+As a result of the removal of qat_zlib_deflate, some defines where not
+removed. Remove them.
+
+This is to fix the following warning when compiling the QAT driver
+using the clang compiler with CC=clang W=2:
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:21:9: warning: macro is not used [-Wunused-macros]
+       21 | #define QAT_RFC_1950_CM_OFFSET 4
+          |         ^
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:16:9: warning: macro is not used [-Wunused-macros]
+       16 | #define QAT_RFC_1950_HDR_SIZE 2
+          |         ^
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:17:9: warning: macro is not used [-Wunused-macros]
+       17 | #define QAT_RFC_1950_FOOTER_SIZE 4
+          |         ^
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:22:9: warning: macro is not used [-Wunused-macros]
+       22 | #define QAT_RFC_1950_DICT_MASK 0x20
+          |         ^
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:18:9: warning: macro is not used [-Wunused-macros]
+       18 | #define QAT_RFC_1950_CM_DEFLATE 8
+          |         ^
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:20:9: warning: macro is not used [-Wunused-macros]
+       20 | #define QAT_RFC_1950_CM_MASK 0x0f
+          |         ^
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:23:9: warning: macro is not used [-Wunused-macros]
+       23 | #define QAT_RFC_1950_COMP_HDR 0x785e
+          |         ^
+    drivers/crypto/intel/qat/qat_common/qat_comp_algs.c:19:9: warning: macro is not used [-Wunused-macros]
+       19 | #define QAT_RFC_1950_CM_DEFLATE_CINFO_32K 7
+          |         ^
+
+Fixes: e9dd20e0e5f6 ("crypto: qat - Remove zlib-deflate")
+Signed-off-by: Adam Guerin <adam.guerin@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/qat_comp_algs.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c b/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c
+index bf8c0ee629175..2ba4aa22e0927 100644
+--- a/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c
++++ b/drivers/crypto/intel/qat/qat_common/qat_comp_algs.c
+@@ -13,15 +13,6 @@
+ #include "qat_compression.h"
+ #include "qat_algs_send.h"
+ 
+-#define QAT_RFC_1950_HDR_SIZE 2
+-#define QAT_RFC_1950_FOOTER_SIZE 4
+-#define QAT_RFC_1950_CM_DEFLATE 8
+-#define QAT_RFC_1950_CM_DEFLATE_CINFO_32K 7
+-#define QAT_RFC_1950_CM_MASK 0x0f
+-#define QAT_RFC_1950_CM_OFFSET 4
+-#define QAT_RFC_1950_DICT_MASK 0x20
+-#define QAT_RFC_1950_COMP_HDR 0x785e
+-
+ static DEFINE_MUTEX(algs_lock);
+ static unsigned int active_devs;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch b/queue-6.8/crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch
new file mode 100644
index 00000000000..2266a045553
--- /dev/null
+++ b/queue-6.8/crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch
@@ -0,0 +1,41 @@
+From 16640b8329ae5eccbe974d481597bcbbf11a1da4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 15:19:56 +0000
+Subject: crypto: qat - removed unused macro in adf_cnv_dbgfs.c
+
+From: Adam Guerin <adam.guerin@intel.com>
+
+[ Upstream commit 9a5dcada14d5e027856a1bc38443e54111438da6 ]
+
+This macro was added but never used, remove it.
+
+This is to fix the following warning when compiling the QAT driver
+using the clang compiler with CC=clang W=2:
+    drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c:19:9: warning: macro is not used [-Wunused-macros]
+       19 | #define CNV_SLICE_ERR_MASK              GENMASK(7, 0)
+          |         ^
+
+Fixes: d807f0240c71 ("crypto: qat - add cnv_errors debugfs file")
+Signed-off-by: Adam Guerin <adam.guerin@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c b/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c
+index 07119c487da01..627953a72d478 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_cnv_dbgfs.c
+@@ -16,7 +16,6 @@
+ 
+ #define CNV_ERR_INFO_MASK		GENMASK(11, 0)
+ #define CNV_ERR_TYPE_MASK		GENMASK(15, 12)
+-#define CNV_SLICE_ERR_MASK		GENMASK(7, 0)
+ #define CNV_SLICE_ERR_SIGN_BIT_INDEX	7
+ #define CNV_DELTA_ERR_SIGN_BIT_INDEX	11
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/crypto-xilinx-call-finalize-with-bh-disabled.patch b/queue-6.8/crypto-xilinx-call-finalize-with-bh-disabled.patch
new file mode 100644
index 00000000000..4ad129e85b3
--- /dev/null
+++ b/queue-6.8/crypto-xilinx-call-finalize-with-bh-disabled.patch
@@ -0,0 +1,72 @@
+From 613f589bc2523d5764cd390ac3cdc72dbcf383ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 12:29:06 +0800
+Subject: crypto: xilinx - call finalize with bh disabled
+
+From: Quanyang Wang <quanyang.wang@windriver.com>
+
+[ Upstream commit a853450bf4c752e664abab0b2fad395b7ad7701c ]
+
+When calling crypto_finalize_request, BH should be disabled to avoid
+triggering the following calltrace:
+
+    ------------[ cut here ]------------
+    WARNING: CPU: 2 PID: 74 at crypto/crypto_engine.c:58 crypto_finalize_request+0xa0/0x118
+    Modules linked in: cryptodev(O)
+    CPU: 2 PID: 74 Comm: firmware:zynqmp Tainted: G           O       6.8.0-rc1-yocto-standard #323
+    Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
+    pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+    pc : crypto_finalize_request+0xa0/0x118
+    lr : crypto_finalize_request+0x104/0x118
+    sp : ffffffc085353ce0
+    x29: ffffffc085353ce0 x28: 0000000000000000 x27: ffffff8808ea8688
+    x26: ffffffc081715038 x25: 0000000000000000 x24: ffffff880100db00
+    x23: ffffff880100da80 x22: 0000000000000000 x21: 0000000000000000
+    x20: ffffff8805b14000 x19: ffffff880100da80 x18: 0000000000010450
+    x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
+    x14: 0000000000000003 x13: 0000000000000000 x12: ffffff880100dad0
+    x11: 0000000000000000 x10: ffffffc0832dcd08 x9 : ffffffc0812416d8
+    x8 : 00000000000001f4 x7 : ffffffc0830d2830 x6 : 0000000000000001
+    x5 : ffffffc082091000 x4 : ffffffc082091658 x3 : 0000000000000000
+    x2 : ffffffc7f9653000 x1 : 0000000000000000 x0 : ffffff8802d20000
+    Call trace:
+     crypto_finalize_request+0xa0/0x118
+     crypto_finalize_aead_request+0x18/0x30
+     zynqmp_handle_aes_req+0xcc/0x388
+     crypto_pump_work+0x168/0x2d8
+     kthread_worker_fn+0xfc/0x3a0
+     kthread+0x118/0x138
+     ret_from_fork+0x10/0x20
+    irq event stamp: 40
+    hardirqs last  enabled at (39): [<ffffffc0812416f8>] _raw_spin_unlock_irqrestore+0x70/0xb0
+    hardirqs last disabled at (40): [<ffffffc08122d208>] el1_dbg+0x28/0x90
+    softirqs last  enabled at (36): [<ffffffc080017dec>] kernel_neon_begin+0x8c/0xf0
+    softirqs last disabled at (34): [<ffffffc080017dc0>] kernel_neon_begin+0x60/0xf0
+    ---[ end trace 0000000000000000 ]---
+
+Fixes: 4d96f7d48131 ("crypto: xilinx - Add Xilinx AES driver")
+Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/xilinx/zynqmp-aes-gcm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/xilinx/zynqmp-aes-gcm.c b/drivers/crypto/xilinx/zynqmp-aes-gcm.c
+index 3c205324b22b6..e614057188409 100644
+--- a/drivers/crypto/xilinx/zynqmp-aes-gcm.c
++++ b/drivers/crypto/xilinx/zynqmp-aes-gcm.c
+@@ -231,7 +231,10 @@ static int zynqmp_handle_aes_req(struct crypto_engine *engine,
+ 		err = zynqmp_aes_aead_cipher(areq);
+ 	}
+ 
++	local_bh_disable();
+ 	crypto_finalize_aead_request(engine, areq, err);
++	local_bh_enable();
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/cxl-fix-the-incorrect-assignment-of-sslbis-entry-poi.patch b/queue-6.8/cxl-fix-the-incorrect-assignment-of-sslbis-entry-poi.patch
new file mode 100644
index 00000000000..40d1904f7cd
--- /dev/null
+++ b/queue-6.8/cxl-fix-the-incorrect-assignment-of-sslbis-entry-poi.patch
@@ -0,0 +1,112 @@
+From 96d125d11d0c61e3ce63257ca8a3dec50f28b3c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 14:09:48 -0700
+Subject: cxl: Fix the incorrect assignment of SSLBIS entry pointer initial
+ location
+
+From: Dave Jiang <dave.jiang@intel.com>
+
+[ Upstream commit 99b52aac2d40203d0f6468325018f68e2c494c24 ]
+
+The 'entry' pointer in cdat_sslbis_handler() is set to header +
+sizeof(common header). However, the math missed the addition of the SSLBIS
+main header. It should be header + sizeof(common header) + sizeof(*sslbis).
+Use a defined struct for all the SSLBIS parts in order to avoid pointer
+math errors.
+
+The bug causes incorrect parsing of the SSLBIS table and introduces incorrect
+performance values to the access_coordinates during the CXL access_coordinate
+calculation path if there are CXL switches present in the topology.
+
+The issue was found during testing of new code being added to add additional
+checks for invalid CDAT values during CXL access_coordinate calculation. The
+testing was done on qemu with a CXL topology including a CXL switch.
+
+Fixes: 80aa780dda20 ("cxl: Add callback to parse the SSLBIS subtable from CDAT")
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Fan Ni <fan.ni@samsung.com>
+Link: https://lore.kernel.org/r/20240301210948.1298075-1-dave.jiang@intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cxl/core/cdat.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/cxl/core/cdat.c b/drivers/cxl/core/cdat.c
+index 08fd0baea7a0e..0363ca434ef45 100644
+--- a/drivers/cxl/core/cdat.c
++++ b/drivers/cxl/core/cdat.c
+@@ -389,36 +389,38 @@ EXPORT_SYMBOL_NS_GPL(cxl_endpoint_parse_cdat, CXL);
+ static int cdat_sslbis_handler(union acpi_subtable_headers *header, void *arg,
+ 			       const unsigned long end)
+ {
++	struct acpi_cdat_sslbis_table {
++		struct acpi_cdat_header header;
++		struct acpi_cdat_sslbis sslbis_header;
++		struct acpi_cdat_sslbe entries[];
++	} *tbl = (struct acpi_cdat_sslbis_table *)header;
++	int size = sizeof(header->cdat) + sizeof(tbl->sslbis_header);
+ 	struct acpi_cdat_sslbis *sslbis;
+-	int size = sizeof(header->cdat) + sizeof(*sslbis);
+ 	struct cxl_port *port = arg;
+ 	struct device *dev = &port->dev;
+-	struct acpi_cdat_sslbe *entry;
+ 	int remain, entries, i;
+ 	u16 len;
+ 
+ 	len = le16_to_cpu((__force __le16)header->cdat.length);
+ 	remain = len - size;
+-	if (!remain || remain % sizeof(*entry) ||
++	if (!remain || remain % sizeof(tbl->entries[0]) ||
+ 	    (unsigned long)header + len > end) {
+ 		dev_warn(dev, "Malformed SSLBIS table length: (%u)\n", len);
+ 		return -EINVAL;
+ 	}
+ 
+-	/* Skip common header */
+-	sslbis = (struct acpi_cdat_sslbis *)((unsigned long)header +
+-					     sizeof(header->cdat));
+-
++	sslbis = &tbl->sslbis_header;
+ 	/* Unrecognized data type, we can skip */
+ 	if (sslbis->data_type > ACPI_HMAT_WRITE_BANDWIDTH)
+ 		return 0;
+ 
+-	entries = remain / sizeof(*entry);
+-	entry = (struct acpi_cdat_sslbe *)((unsigned long)header + sizeof(*sslbis));
++	entries = remain / sizeof(tbl->entries[0]);
++	if (struct_size(tbl, entries, entries) != len)
++		return -EINVAL;
+ 
+ 	for (i = 0; i < entries; i++) {
+-		u16 x = le16_to_cpu((__force __le16)entry->portx_id);
+-		u16 y = le16_to_cpu((__force __le16)entry->porty_id);
++		u16 x = le16_to_cpu((__force __le16)tbl->entries[i].portx_id);
++		u16 y = le16_to_cpu((__force __le16)tbl->entries[i].porty_id);
+ 		__le64 le_base;
+ 		__le16 le_val;
+ 		struct cxl_dport *dport;
+@@ -448,8 +450,8 @@ static int cdat_sslbis_handler(union acpi_subtable_headers *header, void *arg,
+ 			break;
+ 		}
+ 
+-		le_base = (__force __le64)sslbis->entry_base_unit;
+-		le_val = (__force __le16)entry->latency_or_bandwidth;
++		le_base = (__force __le64)tbl->sslbis_header.entry_base_unit;
++		le_val = (__force __le16)tbl->entries[i].latency_or_bandwidth;
+ 
+ 		if (check_mul_overflow(le64_to_cpu(le_base),
+ 				       le16_to_cpu(le_val), &val))
+@@ -462,8 +464,6 @@ static int cdat_sslbis_handler(union acpi_subtable_headers *header, void *arg,
+ 							  sslbis->data_type,
+ 							  val);
+ 		}
+-
+-		entry++;
+ 	}
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/devlink-fix-length-of-eswitch-inline-mode.patch b/queue-6.8/devlink-fix-length-of-eswitch-inline-mode.patch
new file mode 100644
index 00000000000..a833601c342
--- /dev/null
+++ b/queue-6.8/devlink-fix-length-of-eswitch-inline-mode.patch
@@ -0,0 +1,58 @@
+From f0803e4ce0d884cb903aad8a370b9f30284d6eb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Mar 2024 18:45:47 +0200
+Subject: devlink: Fix length of eswitch inline-mode
+
+From: William Tu <witu@nvidia.com>
+
+[ Upstream commit 8f4cd89bf10607de08231d6d91a73dd63336808e ]
+
+Set eswitch inline-mode to be u8, not u16. Otherwise, errors below
+
+$ devlink dev eswitch set pci/0000:08:00.0 mode switchdev \
+  inline-mode network
+    Error: Attribute failed policy validation.
+    kernel answers: Numerical result out of rang
+    netlink: 'devlink': attribute type 26 has an invalid length.
+
+Fixes: f2f9dd164db0 ("netlink: specs: devlink: add the remaining command to generate complete split_ops")
+Signed-off-by: William Tu <witu@nvidia.com>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240310164547.35219-1-witu@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/devlink.yaml | 2 +-
+ net/devlink/netlink_gen.c                | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/netlink/specs/devlink.yaml b/Documentation/netlink/specs/devlink.yaml
+index cf6eaa0da821b..09fbb4c03fc8d 100644
+--- a/Documentation/netlink/specs/devlink.yaml
++++ b/Documentation/netlink/specs/devlink.yaml
+@@ -290,7 +290,7 @@ attribute-sets:
+         enum: eswitch-mode
+       -
+         name: eswitch-inline-mode
+-        type: u16
++        type: u8
+         enum: eswitch-inline-mode
+       -
+         name: dpipe-tables
+diff --git a/net/devlink/netlink_gen.c b/net/devlink/netlink_gen.c
+index c81cf2dd154f3..f9786d51f68f9 100644
+--- a/net/devlink/netlink_gen.c
++++ b/net/devlink/netlink_gen.c
+@@ -198,7 +198,7 @@ static const struct nla_policy devlink_eswitch_set_nl_policy[DEVLINK_ATTR_ESWITC
+ 	[DEVLINK_ATTR_BUS_NAME] = { .type = NLA_NUL_STRING, },
+ 	[DEVLINK_ATTR_DEV_NAME] = { .type = NLA_NUL_STRING, },
+ 	[DEVLINK_ATTR_ESWITCH_MODE] = NLA_POLICY_MAX(NLA_U16, 1),
+-	[DEVLINK_ATTR_ESWITCH_INLINE_MODE] = NLA_POLICY_MAX(NLA_U16, 3),
++	[DEVLINK_ATTR_ESWITCH_INLINE_MODE] = NLA_POLICY_MAX(NLA_U8, 3),
+ 	[DEVLINK_ATTR_ESWITCH_ENCAP_MODE] = NLA_POLICY_MAX(NLA_U8, 1),
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/dm-call-the-resume-method-on-internal-suspend.patch b/queue-6.8/dm-call-the-resume-method-on-internal-suspend.patch
new file mode 100644
index 00000000000..ddbc8479c55
--- /dev/null
+++ b/queue-6.8/dm-call-the-resume-method-on-internal-suspend.patch
@@ -0,0 +1,123 @@
+From 2842d62307162235aeee176d3d467869a331c3ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 15:06:39 +0100
+Subject: dm: call the resume method on internal suspend
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 65e8fbde64520001abf1c8d0e573561b4746ef38 ]
+
+There is this reported crash when experimenting with the lvm2 testsuite.
+The list corruption is caused by the fact that the postsuspend and resume
+methods were not paired correctly; there were two consecutive calls to the
+origin_postsuspend function. The second call attempts to remove the
+"hash_list" entry from a list, while it was already removed by the first
+call.
+
+Fix __dm_internal_resume so that it calls the preresume and resume
+methods of the table's targets.
+
+If a preresume method of some target fails, we are in a tricky situation.
+We can't return an error because dm_internal_resume isn't supposed to
+return errors. We can't return success, because then the "resume" and
+"postsuspend" methods would not be paired correctly. So, we set the
+DMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace
+tools, but it won't cause a kernel crash.
+
+------------[ cut here ]------------
+kernel BUG at lib/list_debug.c:56!
+invalid opcode: 0000 [#1] PREEMPT SMP
+CPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
+RIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0
+<snip>
+RSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282
+RAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000
+RDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff
+RBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058
+R10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001
+R13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0
+FS:  00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000
+CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
+CR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0
+Call Trace:
+ <TASK>
+ ? die+0x2d/0x80
+ ? do_trap+0xeb/0xf0
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ ? do_error_trap+0x60/0x80
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ ? exc_invalid_op+0x49/0x60
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ ? asm_exc_invalid_op+0x16/0x20
+ ? table_deps+0x1b0/0x1b0 [dm_mod]
+ ? __list_del_entry_valid_or_report+0x77/0xc0
+ origin_postsuspend+0x1a/0x50 [dm_snapshot]
+ dm_table_postsuspend_targets+0x34/0x50 [dm_mod]
+ dm_suspend+0xd8/0xf0 [dm_mod]
+ dev_suspend+0x1f2/0x2f0 [dm_mod]
+ ? table_deps+0x1b0/0x1b0 [dm_mod]
+ ctl_ioctl+0x300/0x5f0 [dm_mod]
+ dm_compat_ctl_ioctl+0x7/0x10 [dm_mod]
+ __x64_compat_sys_ioctl+0x104/0x170
+ do_syscall_64+0x184/0x1b0
+ entry_SYSCALL_64_after_hwframe+0x46/0x4e
+RIP: 0033:0xf7e6aead
+<snip>
+---[ end trace 0000000000000000 ]---
+
+Fixes: ffcc39364160 ("dm: enhance internal suspend and resume interface")
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm.c | 26 ++++++++++++++++++++------
+ 1 file changed, 20 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 8dcabf84d866e..0dc3650c7f4ca 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2945,6 +2945,9 @@ static void __dm_internal_suspend(struct mapped_device *md, unsigned int suspend
+ 
+ static void __dm_internal_resume(struct mapped_device *md)
+ {
++	int r;
++	struct dm_table *map;
++
+ 	BUG_ON(!md->internal_suspend_count);
+ 
+ 	if (--md->internal_suspend_count)
+@@ -2953,12 +2956,23 @@ static void __dm_internal_resume(struct mapped_device *md)
+ 	if (dm_suspended_md(md))
+ 		goto done; /* resume from nested suspend */
+ 
+-	/*
+-	 * NOTE: existing callers don't need to call dm_table_resume_targets
+-	 * (which may fail -- so best to avoid it for now by passing NULL map)
+-	 */
+-	(void) __dm_resume(md, NULL);
+-
++	map = rcu_dereference_protected(md->map, lockdep_is_held(&md->suspend_lock));
++	r = __dm_resume(md, map);
++	if (r) {
++		/*
++		 * If a preresume method of some target failed, we are in a
++		 * tricky situation. We can't return an error to the caller. We
++		 * can't fake success because then the "resume" and
++		 * "postsuspend" methods would not be paired correctly, and it
++		 * would break various targets, for example it would cause list
++		 * corruption in the "origin" target.
++		 *
++		 * So, we fake normal suspend here, to make sure that the
++		 * "resume" and "postsuspend" methods will be paired correctly.
++		 */
++		DMERR("Preresume method failed: %d", r);
++		set_bit(DMF_SUSPENDED, &md->flags);
++	}
+ done:
+ 	clear_bit(DMF_SUSPENDED_INTERNALLY, &md->flags);
+ 	smp_mb__after_atomic();
+-- 
+2.43.0
+
diff --git a/queue-6.8/dm-raid-fix-false-positive-for-requeue-needed-during.patch b/queue-6.8/dm-raid-fix-false-positive-for-requeue-needed-during.patch
new file mode 100644
index 00000000000..8826e47c649
--- /dev/null
+++ b/queue-6.8/dm-raid-fix-false-positive-for-requeue-needed-during.patch
@@ -0,0 +1,46 @@
+From 43fb8b0d11a9824e4179eb1966a821cd276cecd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 13:42:55 -0400
+Subject: dm raid: fix false positive for requeue needed during reshape
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit b25b8f4b8ecef0f48c05f0c3572daeabefe16526 ]
+
+An empty flush doesn't have a payload, so it should never be looked at
+when considering to possibly requeue a bio for the case when a reshape
+is in progress.
+
+Fixes: 9dbd1aa3a81c ("dm raid: add reshaping support to the target")
+Reported-by: Patrick Plenefisch <simonpatp@gmail.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-raid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index eb009d6bb03a1..13eb47b997f94 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3329,14 +3329,14 @@ static int raid_map(struct dm_target *ti, struct bio *bio)
+ 	struct mddev *mddev = &rs->md;
+ 
+ 	/*
+-	 * If we're reshaping to add disk(s)), ti->len and
++	 * If we're reshaping to add disk(s), ti->len and
+ 	 * mddev->array_sectors will differ during the process
+ 	 * (ti->len > mddev->array_sectors), so we have to requeue
+ 	 * bios with addresses > mddev->array_sectors here or
+ 	 * there will occur accesses past EOD of the component
+ 	 * data images thus erroring the raid set.
+ 	 */
+-	if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
++	if (unlikely(bio_has_data(bio) && bio_end_sector(bio) > mddev->array_sectors))
+ 		return DM_MAPIO_REQUEUE;
+ 
+ 	md_handle_request(mddev, bio);
+-- 
+2.43.0
+
diff --git a/queue-6.8/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch b/queue-6.8/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
new file mode 100644
index 00000000000..e1ddefa4663
--- /dev/null
+++ b/queue-6.8/dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
@@ -0,0 +1,60 @@
+From c0c576e0b7fecf8f037dfa5fab8c32c0e8499824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 09:32:56 +0000
+Subject: dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 33b7db45533af240fe44e809f9dc4d604cf82d07 ]
+
+Update the architecture dependency to be the generic Tegra
+because the driver works on the four latest Tegra generations
+not just T210, if you build a kernel with a specific
+ARCH_TEGRA_xxx_SOC option that excludes 210 you don't get
+this driver.
+
+Fixes: 433de642a76c9 ("dmaengine: tegra210-adma: add support for Tegra186/Tegra194")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Cc: Jon Hunter <jonathanh@nvidia.com>
+Cc: Thierry Reding <treding@nvidia.com>
+Cc: Sameer Pujar <spujar@nvidia.com>
+Cc: Laxman Dewangan <ldewangan@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20240112093310.329642-2-pbrobinson@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/Kconfig | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
+index e928f2ca0f1e9..002a5ec806207 100644
+--- a/drivers/dma/Kconfig
++++ b/drivers/dma/Kconfig
+@@ -643,16 +643,16 @@ config TEGRA20_APB_DMA
+ 
+ config TEGRA210_ADMA
+ 	tristate "NVIDIA Tegra210 ADMA support"
+-	depends on (ARCH_TEGRA_210_SOC || COMPILE_TEST)
++	depends on (ARCH_TEGRA || COMPILE_TEST)
+ 	select DMA_ENGINE
+ 	select DMA_VIRTUAL_CHANNELS
+ 	help
+-	  Support for the NVIDIA Tegra210 ADMA controller driver. The
+-	  DMA controller has multiple DMA channels and is used to service
+-	  various audio clients in the Tegra210 audio processing engine
+-	  (APE). This DMA controller transfers data from memory to
+-	  peripheral and vice versa. It does not support memory to
+-	  memory data transfer.
++	  Support for the NVIDIA Tegra210/Tegra186/Tegra194/Tegra234 ADMA
++	  controller driver. The DMA controller has multiple DMA channels
++	  and is used to service various audio clients in the Tegra210
++	  audio processing engine (APE). This DMA controller transfers
++	  data from memory to peripheral and vice versa. It does not
++	  support memory to memory data transfer.
+ 
+ config TIMB_DMA
+ 	tristate "Timberdale FPGA DMA support"
+-- 
+2.43.0
+
diff --git a/queue-6.8/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch b/queue-6.8/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
new file mode 100644
index 00000000000..2ffa8922fa2
--- /dev/null
+++ b/queue-6.8/do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
@@ -0,0 +1,72 @@
+From 1abeb6f00936dad1cea929fc81affc9132d05504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 07:39:06 -0800
+Subject: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 3948abaa4e2be938ccdfc289385a27342fb13d43 ]
+
+syzbot identified a kernel information leak vulnerability in
+do_sys_name_to_handle() and issued the following report [1].
+
+[1]
+"BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline]
+BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40
+ instrument_copy_to_user include/linux/instrumented.h:114 [inline]
+ _copy_to_user+0xbc/0x100 lib/usercopy.c:40
+ copy_to_user include/linux/uaccess.h:191 [inline]
+ do_sys_name_to_handle fs/fhandle.c:73 [inline]
+ __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]
+ __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94
+ __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94
+ ...
+
+Uninit was created at:
+ slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
+ slab_alloc_node mm/slub.c:3478 [inline]
+ __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517
+ __do_kmalloc_node mm/slab_common.c:1006 [inline]
+ __kmalloc+0x121/0x3c0 mm/slab_common.c:1020
+ kmalloc include/linux/slab.h:604 [inline]
+ do_sys_name_to_handle fs/fhandle.c:39 [inline]
+ __do_sys_name_to_handle_at fs/fhandle.c:112 [inline]
+ __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94
+ __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94
+ ...
+
+Bytes 18-19 of 20 are uninitialized
+Memory access of size 20 starts at ffff888128a46380
+Data copied to user address 0000000020000240"
+
+Per Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to
+solve the problem.
+
+Fixes: 990d6c2d7aee ("vfs: Add name to file handle conversion support")
+Suggested-by: Chuck Lever III <chuck.lever@oracle.com>
+Reported-and-tested-by: <syzbot+09b349b3066c2e0b1e96@syzkaller.appspotmail.com>
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Link: https://lore.kernel.org/r/20240119153906.4367-1-n.zhandarovich@fintech.ru
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fhandle.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index 18b3ba8dc8ead..57a12614addfd 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -36,7 +36,7 @@ static long do_sys_name_to_handle(const struct path *path,
+ 	if (f_handle.handle_bytes > MAX_HANDLE_SZ)
+ 		return -EINVAL;
+ 
+-	handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
++	handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes,
+ 			 GFP_KERNEL);
+ 	if (!handle)
+ 		return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.8/dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch b/queue-6.8/dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch
new file mode 100644
index 00000000000..2a060cf04a0
--- /dev/null
+++ b/queue-6.8/dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch
@@ -0,0 +1,63 @@
+From a8280457ffa4aa327593afb0164c09f90296b80e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 16:12:40 +0100
+Subject: dpll: fix dpll_xa_ref_*_del() for multiple registrations
+
+From: Jiri Pirko <jiri@nvidia.com>
+
+[ Upstream commit b446631f355ece73b13c311dd712c47381a23172 ]
+
+Currently, if there are multiple registrations of the same pin on the
+same dpll device, following warnings are observed:
+WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230
+WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0
+
+The problem is, that in both dpll_xa_ref_dpll_del() and
+dpll_xa_ref_pin_del() registration is only removed from list in case the
+reference count drops to zero. That is wrong, the registration has to
+be removed always.
+
+To fix this, remove the registration from the list and free
+it unconditionally, instead of doing it only when the ref reference
+counter reaches zero.
+
+Fixes: 9431063ad323 ("dpll: core: Add DPLL framework base functions")
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dpll/dpll_core.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c
+index 7f686d179fc93..c751a87c7a8e6 100644
+--- a/drivers/dpll/dpll_core.c
++++ b/drivers/dpll/dpll_core.c
+@@ -129,9 +129,9 @@ static int dpll_xa_ref_pin_del(struct xarray *xa_pins, struct dpll_pin *pin,
+ 		reg = dpll_pin_registration_find(ref, ops, priv);
+ 		if (WARN_ON(!reg))
+ 			return -EINVAL;
++		list_del(&reg->list);
++		kfree(reg);
+ 		if (refcount_dec_and_test(&ref->refcount)) {
+-			list_del(&reg->list);
+-			kfree(reg);
+ 			xa_erase(xa_pins, i);
+ 			WARN_ON(!list_empty(&ref->registration_list));
+ 			kfree(ref);
+@@ -209,9 +209,9 @@ dpll_xa_ref_dpll_del(struct xarray *xa_dplls, struct dpll_device *dpll,
+ 		reg = dpll_pin_registration_find(ref, ops, priv);
+ 		if (WARN_ON(!reg))
+ 			return;
++		list_del(&reg->list);
++		kfree(reg);
+ 		if (refcount_dec_and_test(&ref->refcount)) {
+-			list_del(&reg->list);
+-			kfree(reg);
+ 			xa_erase(xa_dplls, i);
+ 			WARN_ON(!list_empty(&ref->registration_list));
+ 			kfree(ref);
+-- 
+2.43.0
+
diff --git a/queue-6.8/dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch b/queue-6.8/dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch
new file mode 100644
index 00000000000..500c3c829de
--- /dev/null
+++ b/queue-6.8/dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch
@@ -0,0 +1,48 @@
+From 89be98beae594bcaf8a7c3c44708e160dd0c6817 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 13:07:39 +0100
+Subject: dpll: spec: use proper enum for pin capabilities attribute
+
+From: Jiri Pirko <jiri@nvidia.com>
+
+[ Upstream commit 5c497a64820ef9f10962a9c37607df45d6395fa5 ]
+
+The enum is defined, however the pin capabilities attribute does
+refer to it. Add this missing enum field.
+
+This fixes ynl cli output:
+
+Example current output:
+$ sudo ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/dpll.yaml --do pin-get --json '{"id": 0}'
+{'capabilities': 4,
+ ...
+Example new output:
+$ sudo ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/dpll.yaml --do pin-get --json '{"id": 0}'
+{'capabilities': {'state-can-change'},
+ ...
+
+Fixes: 3badff3a25d8 ("dpll: spec: Add Netlink spec in YAML")
+Signed-off-by: Jiri Pirko <jiri@nvidia.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Link: https://lore.kernel.org/r/20240306120739.1447621-1-jiri@resnulli.us
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/netlink/specs/dpll.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml
+index 3dcc9ece272aa..d0c821c202036 100644
+--- a/Documentation/netlink/specs/dpll.yaml
++++ b/Documentation/netlink/specs/dpll.yaml
+@@ -274,6 +274,7 @@ attribute-sets:
+       -
+         name: capabilities
+         type: u32
++        enum: pin-capabilities
+       -
+         name: parent-device
+         type: nest
+-- 
+2.43.0
+
diff --git a/queue-6.8/drivers-ps3-select-video-to-provide-cmdline-function.patch b/queue-6.8/drivers-ps3-select-video-to-provide-cmdline-function.patch
new file mode 100644
index 00000000000..4b5dc243fe6
--- /dev/null
+++ b/queue-6.8/drivers-ps3-select-video-to-provide-cmdline-function.patch
@@ -0,0 +1,52 @@
+From 2e7739c5f8c1400d12af27575226ec5649a070df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 08:13:22 -0800
+Subject: drivers/ps3: select VIDEO to provide cmdline functions
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7edd06233958d9086a9e3eb723a8768d3c5a9ce1 ]
+
+When VIDEO is not set, there is a build error. Fix that by selecting
+VIDEO for PS3_PS3AV.
+
+ERROR: modpost: ".video_get_options" [drivers/ps3/ps3av_mod.ko] undefined!
+
+Fixes: dae7fbf43fd0 ("driver/ps3: Include <video/cmdline.h> for mode parsing")
+Fixes: a3b6792e990d ("video/cmdline: Introduce CONFIG_VIDEO for video= parameter")
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Aneesh Kumar K.V <aneesh.kumar@kernel.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.ibm.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Geoff Levand <geoff@infradead.org>
+Acked-by: Geoff Levand <geoff@infradead.org>
+Cc: linux-fbdev@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240207161322.8073-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/ps3/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/ps3/Kconfig b/arch/powerpc/platforms/ps3/Kconfig
+index e9c1087dd42ec..706194e5f0b46 100644
+--- a/arch/powerpc/platforms/ps3/Kconfig
++++ b/arch/powerpc/platforms/ps3/Kconfig
+@@ -67,6 +67,7 @@ config PS3_VUART
+ config PS3_PS3AV
+ 	depends on PPC_PS3
+ 	tristate "PS3 AV settings driver" if PS3_ADVANCED
++	select VIDEO
+ 	select PS3_VUART
+ 	default y
+ 	help
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amd-display-add-replay-null-check-in-edp_set_rep.patch b/queue-6.8/drm-amd-display-add-replay-null-check-in-edp_set_rep.patch
new file mode 100644
index 00000000000..5f3b8cf0600
--- /dev/null
+++ b/queue-6.8/drm-amd-display-add-replay-null-check-in-edp_set_rep.patch
@@ -0,0 +1,62 @@
+From 978dc6378fec7f9b80b16f500b5e12ee6d5ee2e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 18:38:16 +0530
+Subject: drm/amd/display: Add 'replay' NULL check in
+ 'edp_set_replay_allow_active()'
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit f6aed043ee5d75b3d1bfc452b1a9584b63c8f76b ]
+
+In the first if statement, we're checking if 'replay' is NULL. But in
+the second if statement, we're not checking if 'replay' is NULL again
+before calling replay->funcs->replay_set_power_opt().
+
+if (replay == NULL && force_static)
+    return false;
+
+...
+
+if (link->replay_settings.replay_feature_enabled &&
+    replay->funcs->replay_set_power_opt) {
+	replay->funcs->replay_set_power_opt(replay, *power_opts, panel_inst);
+	link->replay_settings.replay_power_opt_active = *power_opts;
+}
+
+If 'replay' is NULL, this will cause a null pointer dereference.
+
+Fixes the below found by smatch:
+drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:895 edp_set_replay_allow_active() error: we previously assumed 'replay' could be null (see line 887)
+
+Fixes: c7ddc0a800bc ("drm/amd/display: Add Functions to enable Freesync Panel Replay")
+Cc: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Cc: Roman Li <roman.li@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Tom Chung <chiahsuan.chung@amd.com>
+Suggested-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/amd/display/dc/link/protocols/link_edp_panel_control.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+index 046d3e2054153..f1489f4a40c12 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_edp_panel_control.c
+@@ -892,7 +892,8 @@ bool edp_set_replay_allow_active(struct dc_link *link, const bool *allow_active,
+ 
+ 	/* Set power optimization flag */
+ 	if (power_opts && link->replay_settings.replay_power_opt_active != *power_opts) {
+-		if (link->replay_settings.replay_feature_enabled && replay->funcs->replay_set_power_opt) {
++		if (replay != NULL && link->replay_settings.replay_feature_enabled &&
++		    replay->funcs->replay_set_power_opt) {
+ 			replay->funcs->replay_set_power_opt(replay, *power_opts, panel_inst);
+ 			link->replay_settings.replay_power_opt_active = *power_opts;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch b/queue-6.8/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
new file mode 100644
index 00000000000..549f89d1ae0
--- /dev/null
+++ b/queue-6.8/drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
@@ -0,0 +1,46 @@
+From 23268eab9b096ef21e76349d37321b6ac75f216c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 20:18:07 +0530
+Subject: drm/amd/display: Fix a potential buffer overflow in
+ 'dp_dsc_clock_en_read()'
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 4b09715f1504f1b6e8dff0e9643630610bc05141 ]
+
+Tell snprintf() to store at most 10 bytes in the output buffer
+instead of 30.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1508 dp_dsc_clock_en_read() error: snprintf() is printing too much 30 vs 10
+
+Fixes: c06e09b76639 ("drm/amd/display: Add DSC parameters logging to debugfs")
+Cc: Alex Hung <alex.hung@amd.com>
+Cc: Qingqing Zhuo <qingqing.zhuo@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+index 68a8463239127..85fc6181303bb 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -1483,7 +1483,7 @@ static ssize_t dp_dsc_clock_en_read(struct file *f, char __user *buf,
+ 	const uint32_t rd_buf_size = 10;
+ 	struct pipe_ctx *pipe_ctx;
+ 	ssize_t result = 0;
+-	int i, r, str_len = 30;
++	int i, r, str_len = 10;
+ 
+ 	rd_buf = kcalloc(rd_buf_size, sizeof(char), GFP_KERNEL);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amd-display-fix-null-checks-for-adev-dm.dc-in-am.patch b/queue-6.8/drm-amd-display-fix-null-checks-for-adev-dm.dc-in-am.patch
new file mode 100644
index 00000000000..b67da824f82
--- /dev/null
+++ b/queue-6.8/drm-amd-display-fix-null-checks-for-adev-dm.dc-in-am.patch
@@ -0,0 +1,62 @@
+From 3fca0b15cf83a359917a11f318c5c5a4e7a8cc29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:50:56 -0800
+Subject: drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 2a3cfb9a24a28da9cc13d2c525a76548865e182c ]
+
+Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL
+before the call to dc_enable_dmub_notifications(), check
+beforehand to ensure there will not be a possible NULL-ptr-deref
+there.
+
+Also, since commit 1e88eb1b2c25 ("drm/amd/display: Drop
+CONFIG_DRM_AMD_DC_HDCP") there are two separate checks for NULL in
+'adev->dm.dc' before dc_deinit_callbacks() and dc_dmub_srv_destroy().
+Clean up by combining them all under one 'if'.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 81927e2808be ("drm/amd/display: Support for DMUB AUX")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c    | 16 +++++++---------
+ 1 file changed, 7 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 1a9bbb04bd5e2..8083e7156afcf 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1929,17 +1929,15 @@ static void amdgpu_dm_fini(struct amdgpu_device *adev)
+ 		adev->dm.hdcp_workqueue = NULL;
+ 	}
+ 
+-	if (adev->dm.dc)
++	if (adev->dm.dc) {
+ 		dc_deinit_callbacks(adev->dm.dc);
+-
+-	if (adev->dm.dc)
+ 		dc_dmub_srv_destroy(&adev->dm.dc->ctx->dmub_srv);
+-
+-	if (dc_enable_dmub_notifications(adev->dm.dc)) {
+-		kfree(adev->dm.dmub_notify);
+-		adev->dm.dmub_notify = NULL;
+-		destroy_workqueue(adev->dm.delayed_hpd_wq);
+-		adev->dm.delayed_hpd_wq = NULL;
++		if (dc_enable_dmub_notifications(adev->dm.dc)) {
++			kfree(adev->dm.dmub_notify);
++			adev->dm.dmub_notify = NULL;
++			destroy_workqueue(adev->dm.delayed_hpd_wq);
++			adev->dm.delayed_hpd_wq = NULL;
++		}
+ 	}
+ 
+ 	if (adev->dm.dmub_bo)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amd-display-fix-potential-null-pointer-dereferen.patch b/queue-6.8/drm-amd-display-fix-potential-null-pointer-dereferen.patch
new file mode 100644
index 00000000000..4c5bdd5487e
--- /dev/null
+++ b/queue-6.8/drm-amd-display-fix-potential-null-pointer-dereferen.patch
@@ -0,0 +1,57 @@
+From f7cc5503ccef576403ef85e5915f89f29f3d16bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 21:16:04 +0530
+Subject: drm/amd/display: Fix potential NULL pointer dereferences in
+ 'dcn10_set_output_transfer_func()'
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 9ccfe80d022df7c595f1925afb31de2232900656 ]
+
+The 'stream' pointer is used in dcn10_set_output_transfer_func() before
+the check if 'stream' is NULL.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875)
+
+Fixes: ddef02de0d71 ("drm/amd/display: add null checks before logging")
+Cc: Wyatt Wood <wyatt.wood@amd.com>
+Cc: Anthony Koo <Anthony.Koo@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+index 6dd479e8a3485..f614bc2806d86 100644
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+@@ -1840,6 +1840,9 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,
+ {
+ 	struct dpp *dpp = pipe_ctx->plane_res.dpp;
+ 
++	if (!stream)
++		return false;
++
+ 	if (dpp == NULL)
+ 		return false;
+ 
+@@ -1862,8 +1865,8 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx,
+ 	} else
+ 		dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, OPP_REGAMMA_BYPASS);
+ 
+-	if (stream != NULL && stream->ctx != NULL &&
+-			stream->out_transfer_func != NULL) {
++	if (stream->ctx &&
++	    stream->out_transfer_func) {
+ 		log_tf(stream->ctx,
+ 				stream->out_transfer_func,
+ 				dpp->regamma_params.hw_points_num);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amd-pm-fix-esm-reg-mask-use-to-get-pcie-speed.patch b/queue-6.8/drm-amd-pm-fix-esm-reg-mask-use-to-get-pcie-speed.patch
new file mode 100644
index 00000000000..cfe8208f1be
--- /dev/null
+++ b/queue-6.8/drm-amd-pm-fix-esm-reg-mask-use-to-get-pcie-speed.patch
@@ -0,0 +1,74 @@
+From dc8353ffa852328c5dd1a443d7faf028790f5146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 12:24:15 +0800
+Subject: drm/amd/pm: Fix esm reg mask use to get pcie speed
+
+From: Asad Kamal <asad.kamal@amd.com>
+
+[ Upstream commit b485b899e5b8f83723833feca30a1a1e3df778df ]
+
+Fix mask used for esm ctrl register to get pcie link
+speed on smu_v11_0_3, smu_v13_0_2 & smu_v13_0_6
+
+Fixes: 511a95552ec8 ("drm/amd/pm: Add SMU 13.0.6 support")
+Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)")
+Fixes: f1c378593153 ("drm/amd/powerplay: add Arcturus support for gpu metrics export")
+Signed-off-by: Asad Kamal <asad.kamal@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Le Ma <le.ma@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c    | 4 ++--
+ drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c   | 4 ++--
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+index bcad42534da46..1d96eb274d72d 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+@@ -2272,8 +2272,8 @@ static uint16_t arcturus_get_current_pcie_link_speed(struct smu_context *smu)
+ 
+ 	/* TODO: confirm this on real target */
+ 	esm_ctrl = RREG32_PCIE(smnPCIE_ESM_CTRL);
+-	if ((esm_ctrl >> 15) & 0x1FFFF)
+-		return (uint16_t)(((esm_ctrl >> 8) & 0x3F) + 128);
++	if ((esm_ctrl >> 15) & 0x1)
++		return (uint16_t)(((esm_ctrl >> 8) & 0x7F) + 128);
+ 
+ 	return smu_v11_0_get_current_pcie_link_speed(smu);
+ }
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+index dd9bcbd630a1f..ca0d5a5b204ad 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c
+@@ -1682,8 +1682,8 @@ static int aldebaran_get_current_pcie_link_speed(struct smu_context *smu)
+ 
+ 	/* TODO: confirm this on real target */
+ 	esm_ctrl = RREG32_PCIE(smnPCIE_ESM_CTRL);
+-	if ((esm_ctrl >> 15) & 0x1FFFF)
+-		return (((esm_ctrl >> 8) & 0x3F) + 128);
++	if ((esm_ctrl >> 15) & 0x1)
++		return (((esm_ctrl >> 8) & 0x7F) + 128);
+ 
+ 	return smu_v13_0_get_current_pcie_link_speed(smu);
+ }
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c
+index 7e1941cf17964..78491b04df108 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_6_ppt.c
+@@ -2060,8 +2060,8 @@ static int smu_v13_0_6_get_current_pcie_link_speed(struct smu_context *smu)
+ 
+ 	/* TODO: confirm this on real target */
+ 	esm_ctrl = RREG32_PCIE(smnPCIE_ESM_CTRL);
+-	if ((esm_ctrl >> 15) & 0x1FFFF)
+-		return (((esm_ctrl >> 8) & 0x3F) + 128);
++	if ((esm_ctrl >> 15) & 0x1)
++		return (((esm_ctrl >> 8) & 0x7F) + 128);
+ 
+ 	speed_level = (RREG32_PCIE(smnPCIE_LC_SPEED_CNTL) &
+ 		PCIE_LC_SPEED_CNTL__LC_CURRENT_DATA_RATE_MASK)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch b/queue-6.8/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
new file mode 100644
index 00000000000..d750e025030
--- /dev/null
+++ b/queue-6.8/drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
@@ -0,0 +1,48 @@
+From 4d9fbc57232dc3f9cd87e0d440b18d6aa70c0ddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 07:48:52 +0530
+Subject: drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of
+ atom_get_src_int()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 7cf1ad2fe10634238b38442a851d89514cb14ea2 ]
+
+Missing break statement in the ATOM_ARG_IMM case of a switch statement,
+adds the missing break statement, ensuring that the program's control
+flow is as intended.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/atom.c:323 atom_get_src_int() warn: ignoring unreachable code.
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Cc: Jammy Zhou <Jammy.Zhou@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/atom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
+index a33e890c70d90..ac51d19b518ca 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atom.c
++++ b/drivers/gpu/drm/amd/amdgpu/atom.c
+@@ -313,7 +313,7 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
+ 				DEBUG("IMM 0x%02X\n", val);
+ 			return val;
+ 		}
+-		return 0;
++		break;
+ 	case ATOM_ARG_PLL:
+ 		idx = U8(*ptr);
+ 		(*ptr)++;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-amdgpu-fix-potential-out-of-bounds-access-in-amd.patch b/queue-6.8/drm-amdgpu-fix-potential-out-of-bounds-access-in-amd.patch
new file mode 100644
index 00000000000..3ac3d03583c
--- /dev/null
+++ b/queue-6.8/drm-amdgpu-fix-potential-out-of-bounds-access-in-amd.patch
@@ -0,0 +1,64 @@
+From 788daaa68c541f6a41c00f21c9d646ea47cbbdfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 22:47:15 +0530
+Subject: drm/amdgpu: Fix potential out-of-bounds access in
+ 'amdgpu_discovery_reg_base_init()'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit cdb637d339572398821204a1142d8d615668f1e9 ]
+
+The issue arises when the array 'adev->vcn.vcn_config' is accessed
+before checking if the index 'adev->vcn.num_vcn_inst' is within the
+bounds of the array.
+
+The fix involves moving the bounds check before the array access. This
+ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array
+before it is used as an index.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289 amdgpu_discovery_reg_base_init() error: testing array offset 'adev->vcn.num_vcn_inst' after use.
+
+Fixes: a0ccc717c4ab ("drm/amdgpu/discovery: validate VCN and SDMA instances")
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+index c7d60dd0fb975..4f9900779ef9e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c
+@@ -1278,11 +1278,10 @@ static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
+ 				 *     0b10 : encode is disabled
+ 				 *     0b01 : decode is disabled
+ 				 */
+-				adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
+-					ip->revision & 0xc0;
+-				ip->revision &= ~0xc0;
+ 				if (adev->vcn.num_vcn_inst <
+ 				    AMDGPU_MAX_VCN_INSTANCES) {
++					adev->vcn.vcn_config[adev->vcn.num_vcn_inst] =
++						ip->revision & 0xc0;
+ 					adev->vcn.num_vcn_inst++;
+ 					adev->vcn.inst_mask |=
+ 						(1U << ip->instance_number);
+@@ -1293,6 +1292,7 @@ static int amdgpu_discovery_reg_base_init(struct amdgpu_device *adev)
+ 						adev->vcn.num_vcn_inst + 1,
+ 						AMDGPU_MAX_VCN_INSTANCES);
+ 				}
++				ip->revision &= ~0xc0;
+ 			}
+ 			if (le16_to_cpu(ip->hw_id) == SDMA0_HWID ||
+ 			    le16_to_cpu(ip->hw_id) == SDMA1_HWID ||
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-bridge-adv7511-fix-crash-on-irq-during-probe.patch b/queue-6.8/drm-bridge-adv7511-fix-crash-on-irq-during-probe.patch
new file mode 100644
index 00000000000..a6412bb9424
--- /dev/null
+++ b/queue-6.8/drm-bridge-adv7511-fix-crash-on-irq-during-probe.patch
@@ -0,0 +1,83 @@
+From 919a7691bf1164c2bc279052c56ee201480fb1ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 21:21:47 +0100
+Subject: drm/bridge: adv7511: fix crash on irq during probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
+
+[ Upstream commit aeedaee5ef5468caf59e2bb1265c2116e0c9a924 ]
+
+Moved IRQ registration down to end of adv7511_probe().
+
+If an IRQ already is pending during adv7511_probe
+(before adv7511_cec_init) then cec_received_msg_ts
+could crash using uninitialized data:
+
+    Unable to handle kernel read from unreadable memory at virtual address 00000000000003d5
+    Internal error: Oops: 96000004 [#1] PREEMPT_RT SMP
+    Call trace:
+     cec_received_msg_ts+0x48/0x990 [cec]
+     adv7511_cec_irq_process+0x1cc/0x308 [adv7511]
+     adv7511_irq_process+0xd8/0x120 [adv7511]
+     adv7511_irq_handler+0x1c/0x30 [adv7511]
+     irq_thread_fn+0x30/0xa0
+     irq_thread+0x14c/0x238
+     kthread+0x190/0x1a8
+
+Fixes: 3b1b975003e4 ("drm: adv7511/33: add HDMI CEC support")
+Signed-off-by: Mads Bligaard Nielsen <bli@bang-olufsen.dk>
+Signed-off-by: Alvin Å ipraga <alsi@bang-olufsen.dk>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240219-adv7511-cec-irq-crash-fix-v2-1-245e53c4b96f@bang-olufsen.dk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 22 ++++++++++----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 8be235144f6d9..6fc292393c674 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1277,17 +1277,6 @@ static int adv7511_probe(struct i2c_client *i2c)
+ 
+ 	INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work);
+ 
+-	if (i2c->irq) {
+-		init_waitqueue_head(&adv7511->wq);
+-
+-		ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
+-						adv7511_irq_handler,
+-						IRQF_ONESHOT, dev_name(dev),
+-						adv7511);
+-		if (ret)
+-			goto err_unregister_cec;
+-	}
+-
+ 	adv7511_power_off(adv7511);
+ 
+ 	i2c_set_clientdata(i2c, adv7511);
+@@ -1311,6 +1300,17 @@ static int adv7511_probe(struct i2c_client *i2c)
+ 
+ 	adv7511_audio_init(dev, adv7511);
+ 
++	if (i2c->irq) {
++		init_waitqueue_head(&adv7511->wq);
++
++		ret = devm_request_threaded_irq(dev, i2c->irq, NULL,
++						adv7511_irq_handler,
++						IRQF_ONESHOT, dev_name(dev),
++						adv7511);
++		if (ret)
++			goto err_unregister_audio;
++	}
++
+ 	if (adv7511->info->has_dsi) {
+ 		ret = adv7533_attach_dsi(adv7511);
+ 		if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-ci-use-clk_ignore_unused-for-apq8016.patch b/queue-6.8/drm-ci-use-clk_ignore_unused-for-apq8016.patch
new file mode 100644
index 00000000000..34ccb281aa3
--- /dev/null
+++ b/queue-6.8/drm-ci-use-clk_ignore_unused-for-apq8016.patch
@@ -0,0 +1,49 @@
+From 23bf1499c9830d81dc7fdb9b93ec895e8ef38036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 10:37:08 +0200
+Subject: drm: ci: use clk_ignore_unused for apq8016
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit aa1267e673fe5307cf00d02add4017d2878598b6 ]
+
+If the ADV7511 bridge driver is compiled as a module, while DRM_MSM is
+built-in, the clk_disable_unused congests with the runtime PM handling
+of the DSI PHY for the clk_prepare_lock(). This causes apq8016 runner to
+fail without completing any jobs ([1]). Drop the BM_CMDLINE which
+duplicate the command line from the .baremetal-igt-arm64 clause and
+enforce the clk_ignore_unused kernelarg instead to make apq8016 runner
+work.
+
+[1] https://gitlab.freedesktop.org/drm/msm/-/jobs/54990475
+
+Fixes: 0119c894ab0d ("drm: Add initial ci/ subdirectory")
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Helen Koike <helen.koike@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240214083708.2323967-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ci/test.yml | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/ci/test.yml b/drivers/gpu/drm/ci/test.yml
+index 2c9a1838e7284..5e1c727640c40 100644
+--- a/drivers/gpu/drm/ci/test.yml
++++ b/drivers/gpu/drm/ci/test.yml
+@@ -104,7 +104,10 @@ msm:apq8016:
+     DRIVER_NAME: msm
+     BM_DTB: https://${PIPELINE_ARTIFACTS_BASE}/arm64/apq8016-sbc-usb-host.dtb
+     GPU_VERSION: apq8016
+-    BM_CMDLINE: "ip=dhcp console=ttyMSM0,115200n8 $BM_KERNEL_EXTRA_ARGS root=/dev/nfs rw nfsrootdebug nfsroot=,tcp,nfsvers=4.2 init=/init $BM_KERNELARGS"
++    # disabling unused clocks congests with the MDSS runtime PM trying to
++    # disable those clocks and causes boot to fail.
++    # Reproducer: DRM_MSM=y, DRM_I2C_ADV7511=m
++    BM_KERNEL_EXTRA_ARGS: clk_ignore_unused
+     RUNNER_TAG: google-freedreno-db410c
+   script:
+     - ./install/bare-metal/fastboot.sh
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch b/queue-6.8/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
new file mode 100644
index 00000000000..f1d93e34dee
--- /dev/null
+++ b/queue-6.8/drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
@@ -0,0 +1,41 @@
+From 5e2b7a47cc967d003fcc627bf60ff57a130416e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 11:36:20 -0500
+Subject: drm: Don't treat 0 as -1 in drm_fixp2int_ceil
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit cf8837d7204481026335461629b84ac7f4538fa5 ]
+
+Unit testing this in VKMS shows that passing 0 into
+this function returns -1, which is highly counter-
+intuitive. Fix it by checking whether the input is
+>= 0 instead of > 0.
+
+Fixes: 64566b5e767f ("drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil")
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Reviewed-by: Simon Ser <contact@emersion.fr>
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231108163647.106853-2-harry.wentland@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_fixed.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/drm/drm_fixed.h b/include/drm/drm_fixed.h
+index 6ea339d5de088..0c9f917a4d4be 100644
+--- a/include/drm/drm_fixed.h
++++ b/include/drm/drm_fixed.h
+@@ -95,7 +95,7 @@ static inline int drm_fixp2int_round(s64 a)
+ 
+ static inline int drm_fixp2int_ceil(s64 a)
+ {
+-	if (a > 0)
++	if (a >= 0)
+ 		return drm_fixp2int(a + DRM_FIXED_ALMOST_ONE);
+ 	else
+ 		return drm_fixp2int(a - DRM_FIXED_ALMOST_ONE);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch b/queue-6.8/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
new file mode 100644
index 00000000000..57b8b49d53d
--- /dev/null
+++ b/queue-6.8/drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
@@ -0,0 +1,72 @@
+From 7e77f24b09e7abc6bcad81376274e8ece2d269f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 15:13:28 +0800
+Subject: drm/lima: fix a memleak in lima_heap_alloc
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 04ae3eb470e52a3c41babe85ff8cee195e4dcbea ]
+
+When lima_vm_map_bo fails, the resources need to be deallocated, or
+there will be memleaks.
+
+Fixes: 6aebc51d7aef ("drm/lima: support heap buffer creation")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Qiang Yu <yuq825@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240117071328.3811480-1-alexious@zju.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/lima/lima_gem.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/lima/lima_gem.c b/drivers/gpu/drm/lima/lima_gem.c
+index 4f9736e5f929b..7ea244d876ca6 100644
+--- a/drivers/gpu/drm/lima/lima_gem.c
++++ b/drivers/gpu/drm/lima/lima_gem.c
+@@ -75,29 +75,34 @@ int lima_heap_alloc(struct lima_bo *bo, struct lima_vm *vm)
+ 	} else {
+ 		bo->base.sgt = kmalloc(sizeof(*bo->base.sgt), GFP_KERNEL);
+ 		if (!bo->base.sgt) {
+-			sg_free_table(&sgt);
+-			return -ENOMEM;
++			ret = -ENOMEM;
++			goto err_out0;
+ 		}
+ 	}
+ 
+ 	ret = dma_map_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
+-	if (ret) {
+-		sg_free_table(&sgt);
+-		kfree(bo->base.sgt);
+-		bo->base.sgt = NULL;
+-		return ret;
+-	}
++	if (ret)
++		goto err_out1;
+ 
+ 	*bo->base.sgt = sgt;
+ 
+ 	if (vm) {
+ 		ret = lima_vm_map_bo(vm, bo, old_size >> PAGE_SHIFT);
+ 		if (ret)
+-			return ret;
++			goto err_out2;
+ 	}
+ 
+ 	bo->heap_size = new_size;
+ 	return 0;
++
++err_out2:
++	dma_unmap_sgtable(dev, &sgt, DMA_BIDIRECTIONAL, 0);
++err_out1:
++	kfree(bo->base.sgt);
++	bo->base.sgt = NULL;
++err_out0:
++	sg_free_table(&sgt);
++	return ret;
+ }
+ 
+ int lima_gem_create_handle(struct drm_device *dev, struct drm_file *file,
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch b/queue-6.8/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
new file mode 100644
index 00000000000..94a0cc0e02e
--- /dev/null
+++ b/queue-6.8/drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
@@ -0,0 +1,78 @@
+From 128f20daff5dbcdfdd9bb001686ed70128b3e8ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 09:53:09 +0100
+Subject: drm/mediatek: dsi: Fix DSI RGB666 formats and definitions
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit fae6f815505301b92d9113764f4d76d0bfe45607 ]
+
+The register bits definitions for RGB666 formats are wrong in multiple
+ways: first, in the DSI_PS_SEL bits region, the Packed 18-bits RGB666
+format is selected with bit 1, while the Loosely Packed one is bit 2,
+and second - the definition name "LOOSELY_PS_18BIT_RGB666" is wrong
+because the loosely packed format is 24 bits instead!
+
+Either way, functions mtk_dsi_ps_control_vact() and mtk_dsi_ps_control()
+do not even agree on the DSI_PS_SEL bit to set in DSI_PSCTRL: one sets
+loosely packed (24) on RGB666, the other sets packed (18), and the other
+way around for RGB666_PACKED.
+
+Fixing this entire stack of issues is done in one go:
+ - Use the correct bit for the Loosely Packed RGB666 definition
+ - Rename LOOSELY_PS_18BIT_RGB666 to LOOSELY_PS_24BIT_RGB666
+ - Change ps_bpp_mode in mtk_dsi_ps_control_vact() to set:
+    - Loosely Packed, 24-bits for MIPI_DSI_FMT_RGB666
+    - Packed, 18-bits for MIPI_DSI_FMT_RGB666_PACKED
+
+Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver")
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240215085316.56835-3-angelogioacchino.delregno@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dsi.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c
+index a2fdfc8ddb153..cd19885ee017f 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dsi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c
+@@ -71,8 +71,8 @@
+ #define DSI_PS_WC			0x3fff
+ #define DSI_PS_SEL			(3 << 16)
+ #define PACKED_PS_16BIT_RGB565		(0 << 16)
+-#define LOOSELY_PS_18BIT_RGB666		(1 << 16)
+-#define PACKED_PS_18BIT_RGB666		(2 << 16)
++#define PACKED_PS_18BIT_RGB666		(1 << 16)
++#define LOOSELY_PS_24BIT_RGB666		(2 << 16)
+ #define PACKED_PS_24BIT_RGB888		(3 << 16)
+ 
+ #define DSI_VSA_NL		0x20
+@@ -369,10 +369,10 @@ static void mtk_dsi_ps_control_vact(struct mtk_dsi *dsi)
+ 		ps_bpp_mode |= PACKED_PS_24BIT_RGB888;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666:
+-		ps_bpp_mode |= PACKED_PS_18BIT_RGB666;
++		ps_bpp_mode |= LOOSELY_PS_24BIT_RGB666;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666_PACKED:
+-		ps_bpp_mode |= LOOSELY_PS_18BIT_RGB666;
++		ps_bpp_mode |= PACKED_PS_18BIT_RGB666;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB565:
+ 		ps_bpp_mode |= PACKED_PS_16BIT_RGB565;
+@@ -426,7 +426,7 @@ static void mtk_dsi_ps_control(struct mtk_dsi *dsi)
+ 		dsi_tmp_buf_bpp = 3;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666:
+-		tmp_reg = LOOSELY_PS_18BIT_RGB666;
++		tmp_reg = LOOSELY_PS_24BIT_RGB666;
+ 		dsi_tmp_buf_bpp = 3;
+ 		break;
+ 	case MIPI_DSI_FMT_RGB666_PACKED:
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch b/queue-6.8/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
new file mode 100644
index 00000000000..882b14d5336
--- /dev/null
+++ b/queue-6.8/drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
@@ -0,0 +1,81 @@
+From 37c61888aa75e8d1d5dca484912eb10e58dad21a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 13:23:29 -0800
+Subject: drm/mediatek: Fix a null pointer crash in
+ mtk_drm_crtc_finish_page_flip
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit c958e86e9cc1b48cac004a6e245154dfba8e163b ]
+
+It's possible that mtk_crtc->event is NULL in
+mtk_drm_crtc_finish_page_flip().
+
+pending_needs_vblank value is set by mtk_crtc->event, but in
+mtk_drm_crtc_atomic_flush(), it's is not guarded by the same
+lock in mtk_drm_finish_page_flip(), thus a race condition happens.
+
+Consider the following case:
+
+CPU1                              CPU2
+step 1:
+mtk_drm_crtc_atomic_begin()
+mtk_crtc->event is not null,
+                                  step 1:
+                                  mtk_drm_crtc_atomic_flush:
+                                  mtk_drm_crtc_update_config(
+                                      !!mtk_crtc->event)
+step 2:
+mtk_crtc_ddp_irq ->
+mtk_drm_finish_page_flip:
+lock
+mtk_crtc->event set to null,
+pending_needs_vblank set to false
+unlock
+                                  pending_needs_vblank set to true,
+
+                                  step 2:
+                                  mtk_crtc_ddp_irq ->
+                                  mtk_drm_finish_page_flip called again,
+                                  pending_needs_vblank is still true
+                                  //null pointer
+
+Instead of guarding the entire mtk_drm_crtc_atomic_flush(), it's more
+efficient to just check if mtk_crtc->event is null before use.
+
+Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240223212404.3709690-1-hsinyi@chromium.org/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index c729af3b98224..3d17de34d72bd 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -95,11 +95,13 @@ static void mtk_drm_crtc_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
+ 	struct drm_crtc *crtc = &mtk_crtc->base;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&crtc->dev->event_lock, flags);
+-	drm_crtc_send_vblank_event(crtc, mtk_crtc->event);
+-	drm_crtc_vblank_put(crtc);
+-	mtk_crtc->event = NULL;
+-	spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
++	if (mtk_crtc->event) {
++		spin_lock_irqsave(&crtc->dev->event_lock, flags);
++		drm_crtc_send_vblank_event(crtc, mtk_crtc->event);
++		drm_crtc_vblank_put(crtc);
++		mtk_crtc->event = NULL;
++		spin_unlock_irqrestore(&crtc->dev->event_lock, flags);
++	}
+ }
+ 
+ static void mtk_drm_finish_page_flip(struct mtk_drm_crtc *mtk_crtc)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-msm-a6xx-specify-ubwc-config-for-sc7180.patch b/queue-6.8/drm-msm-a6xx-specify-ubwc-config-for-sc7180.patch
new file mode 100644
index 00000000000..7398c79db5e
--- /dev/null
+++ b/queue-6.8/drm-msm-a6xx-specify-ubwc-config-for-sc7180.patch
@@ -0,0 +1,52 @@
+From 10cd7b2a546768248a91526a6682c1f4fc35b2db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 19:12:10 +0200
+Subject: drm/msm/a6xx: specify UBWC config for sc7180
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 0d7dfc79fb9b4b81f642f84796111f2bae8427e2 ]
+
+Historically the Adreno driver has not been updating memory
+configuration registers on a618 (SC7180 platform) implying that the
+default configuration is fine. After the rework performed in the commit
+8814455a0e54 ("drm/msm: Refactor UBWC config setting") the function
+a6xx_calc_ubwc_config() still contained this shortcut and did not
+calculate UBWC configuration. However the function which now actually
+updates hardware registers, a6xx_set_ubwc_config(), doesn't contain such
+check.
+
+Rather than adding the check to a6xx_set_ubwc_config(), fill in the
+UBWC config for a618 (based on readings from SC7180).
+
+Reported-by: Leonard Lausen <leonard@lausen.nl>
+Link: https://gitlab.freedesktop.org/drm/msm/-/issues/49
+Fixes: 8814455a0e54 ("drm/msm: Refactor UBWC config setting")
+Cc: Connor Abbott <cwabbott0@gmail.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Connor Abbott <cwabbott0@gmail.com>
+Patchwork: https://patchwork.freedesktop.org/patch/579113/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index c9c55e2ea5849..dc80e5940f51e 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -1292,9 +1292,8 @@ static void a6xx_calc_ubwc_config(struct adreno_gpu *gpu)
+ 		gpu->ubwc_config.ubwc_mode = 1;
+ 	}
+ 
+-	/* a618 is using the hw default values */
+ 	if (adreno_is_a618(gpu))
+-		return;
++		gpu->ubwc_config.highest_bank_bit = 14;
+ 
+ 	if (adreno_is_a619_holi(gpu))
+ 		gpu->ubwc_config.highest_bank_bit = 13;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-msm-a7xx-fix-llc-typo.patch b/queue-6.8/drm-msm-a7xx-fix-llc-typo.patch
new file mode 100644
index 00000000000..5d841282250
--- /dev/null
+++ b/queue-6.8/drm-msm-a7xx-fix-llc-typo.patch
@@ -0,0 +1,36 @@
+From 70074c672719d580e8b420ea2f0aaf42fda357ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 11:33:45 -0800
+Subject: drm/msm/a7xx: Fix LLC typo
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 0776ad9274d96d132131af66a5941df45b9d46b4 ]
+
+We'd miss actually activating LLC.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Fixes: af66706accdf ("drm/msm/a6xx: Add skeleton A7xx support")
+Patchwork: https://patchwork.freedesktop.org/patch/573043/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index dc80e5940f51e..fd60e49b8ec4d 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -2426,7 +2426,7 @@ static int a6xx_gmu_pm_resume(struct msm_gpu *gpu)
+ 
+ 	msm_devfreq_resume(gpu);
+ 
+-	adreno_is_a7xx(adreno_gpu) ? a7xx_llc_activate : a6xx_llc_activate(a6xx_gpu);
++	adreno_is_a7xx(adreno_gpu) ? a7xx_llc_activate(a6xx_gpu) : a6xx_llc_activate(a6xx_gpu);
+ 
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch b/queue-6.8/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
new file mode 100644
index 00000000000..d9622a10935
--- /dev/null
+++ b/queue-6.8/drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
@@ -0,0 +1,49 @@
+From 8c5a6408dcbdfcf3fa4d2c0960335ed814872bae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 11:39:47 -0800
+Subject: drm/msm/dpu: add division of drm_display_mode's hskew parameter
+
+From: Paloma Arellano <quic_parellan@quicinc.com>
+
+[ Upstream commit 551ee0f210991d25f336bc27262353bfe99d3eed ]
+
+Setting up the timing engine when the physical encoder has a split role
+neglects dividing the drm_display_mode's hskew parameter. Let's fix this
+since this must also be done in preparation for implementing YUV420 over
+DP.
+
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Paloma Arellano <quic_parellan@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/579605/
+Link: https://lore.kernel.org/r/20240222194025.25329-3-quic_parellan@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+index f562beb6f7971..f02411b062c4c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+@@ -260,12 +260,14 @@ static void dpu_encoder_phys_vid_setup_timing_engine(
+ 		mode.htotal >>= 1;
+ 		mode.hsync_start >>= 1;
+ 		mode.hsync_end >>= 1;
++		mode.hskew >>= 1;
+ 
+ 		DPU_DEBUG_VIDENC(phys_enc,
+-			"split_role %d, halve horizontal %d %d %d %d\n",
++			"split_role %d, halve horizontal %d %d %d %d %d\n",
+ 			phys_enc->split_role,
+ 			mode.hdisplay, mode.htotal,
+-			mode.hsync_start, mode.hsync_end);
++			mode.hsync_start, mode.hsync_end,
++			mode.hskew);
+ 	}
+ 
+ 	drm_mode_to_intf_timing_params(phys_enc, &mode, &timing_params);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-msm-dpu-allow-certain-formats-for-cdm-for-dp.patch b/queue-6.8/drm-msm-dpu-allow-certain-formats-for-cdm-for-dp.patch
new file mode 100644
index 00000000000..cf5b98e0248
--- /dev/null
+++ b/queue-6.8/drm-msm-dpu-allow-certain-formats-for-cdm-for-dp.patch
@@ -0,0 +1,44 @@
+From 9233c6bdae7a5574de5a158f6f55a68c42ae5404 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 11:39:46 -0800
+Subject: drm/msm/dpu: allow certain formats for CDM for DP
+
+From: Paloma Arellano <quic_parellan@quicinc.com>
+
+[ Upstream commit 32b6ff95b91240e632f55be35c6ccd4bbe7434e4 ]
+
+CDM block supports formats other than H1V2 for DP. Since we are now
+adding support for CDM over DP, relax the checks to allow all other
+formats for DP other than H1V2.
+
+Changes in v2:
+	- Add fixes tag
+	- Move patch to top of series
+
+Fixes: 0afac0ba6024 ("drm/msm/dpu: add dpu_hw_cdm abstraction for CDM block")
+Signed-off-by: Paloma Arellano <quic_parellan@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/579606/
+Link: https://lore.kernel.org/r/20240222194025.25329-2-quic_parellan@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.c
+index e9cdc7934a499..9016b3ade6bc3 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_cdm.c
+@@ -186,7 +186,7 @@ static int dpu_hw_cdm_enable(struct dpu_hw_cdm *ctx, struct dpu_hw_cdm_cfg *cdm)
+ 	dpu_hw_cdm_setup_cdwn(ctx, cdm);
+ 
+ 	if (cdm->output_type == CDM_CDWN_OUTPUT_HDMI) {
+-		if (fmt->chroma_sample != DPU_CHROMA_H1V2)
++		if (fmt->chroma_sample == DPU_CHROMA_H1V2)
+ 			return -EINVAL; /*unsupported format */
+ 		opmode = CDM_HDMI_PACK_OP_MODE_EN;
+ 		opmode |= (fmt->chroma_sample << 1);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-msm-dpu-finalise-global-state-object.patch b/queue-6.8/drm-msm-dpu-finalise-global-state-object.patch
new file mode 100644
index 00000000000..9749ae1d52b
--- /dev/null
+++ b/queue-6.8/drm-msm-dpu-finalise-global-state-object.patch
@@ -0,0 +1,50 @@
+From 63f251eb7a3d504c10b35ba04e62df3d897979fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Dec 2023 03:05:29 +0300
+Subject: drm/msm/dpu: finalise global state object
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 49e27d3c9cd67fd5851f8b5518645b9bf3d2c6c0 ]
+
+Add calls to finalise global state object and corresponding lock.
+
+Fixes: de3916c70a24 ("drm/msm/dpu: Track resources in global state")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/570175/
+Link: https://lore.kernel.org/r/20231203000532.1290480-3-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+index 723cc1d821431..2330eb2a4e9c8 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c
+@@ -374,6 +374,12 @@ static int dpu_kms_global_obj_init(struct dpu_kms *dpu_kms)
+ 	return 0;
+ }
+ 
++static void dpu_kms_global_obj_fini(struct dpu_kms *dpu_kms)
++{
++	drm_atomic_private_obj_fini(&dpu_kms->global_state);
++	drm_modeset_lock_fini(&dpu_kms->global_state_lock);
++}
++
+ static int dpu_kms_parse_data_bus_icc_path(struct dpu_kms *dpu_kms)
+ {
+ 	struct icc_path *path0;
+@@ -801,6 +807,8 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms)
+ 		dpu_kms->hw_vbif[i] = NULL;
+ 	}
+ 
++	dpu_kms_global_obj_fini(dpu_kms);
++
+ 	dpu_kms->catalog = NULL;
+ 
+ 	dpu_kms->hw_mdp = NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-msm-dpu-fix-the-programming-of-intf_cfg2_data_hc.patch b/queue-6.8/drm-msm-dpu-fix-the-programming-of-intf_cfg2_data_hc.patch
new file mode 100644
index 00000000000..847edb5e12c
--- /dev/null
+++ b/queue-6.8/drm-msm-dpu-fix-the-programming-of-intf_cfg2_data_hc.patch
@@ -0,0 +1,130 @@
+From 345b3f10240a726a46d353bbfbe96f04e7308ff7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 16:47:36 -0800
+Subject: drm/msm/dpu: fix the programming of INTF_CFG2_DATA_HCTL_EN
+
+From: Abhinav Kumar <quic_abhinavk@quicinc.com>
+
+[ Upstream commit 2f4a67a3894e15c135125cb54edc5b43abc1b70e ]
+
+Currently INTF_CFG2_DATA_HCTL_EN is coupled with the enablement
+of widebus but this is incorrect because we should be enabling
+this bit independent of widebus except for cases where compression
+is enabled in one pixel per clock mode.
+
+Fix this by making the condition checks more explicit and enabling
+INTF_CFG2_DATA_HCTL_EN for all other cases when supported by DPU.
+
+Fixes: 3309a7563971 ("drm/msm/dpu: revise timing engine programming to support widebus feature")
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/576722/
+Link: https://lore.kernel.org/r/20240201004737.2478-1-quic_abhinavk@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c       |  7 +++++++
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h       |  7 +++++++
+ .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c  |  1 +
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c       | 15 +++++++++------
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h       |  1 +
+ 5 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 6a4b489d44e51..8932f38a41b2d 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -226,6 +226,13 @@ bool dpu_encoder_is_widebus_enabled(const struct drm_encoder *drm_enc)
+ 	return dpu_enc->wide_bus_en;
+ }
+ 
++bool dpu_encoder_is_dsc_enabled(const struct drm_encoder *drm_enc)
++{
++	const struct dpu_encoder_virt *dpu_enc = to_dpu_encoder_virt(drm_enc);
++
++	return dpu_enc->dsc ? true : false;
++}
++
+ int dpu_encoder_get_crc_values_cnt(const struct drm_encoder *drm_enc)
+ {
+ 	struct dpu_encoder_virt *dpu_enc;
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
+index 4c05fd5e9ed18..fe6b1d312a742 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.h
+@@ -158,6 +158,13 @@ int dpu_encoder_get_vsync_count(struct drm_encoder *drm_enc);
+ 
+ bool dpu_encoder_is_widebus_enabled(const struct drm_encoder *drm_enc);
+ 
++/**
++ * dpu_encoder_is_dsc_enabled - indicate whether dsc is enabled
++ *				for the encoder.
++ * @drm_enc:    Pointer to previously created drm encoder structure
++ */
++bool dpu_encoder_is_dsc_enabled(const struct drm_encoder *drm_enc);
++
+ /**
+  * dpu_encoder_get_crc_values_cnt - get number of physical encoders contained
+  *	in virtual encoder that can collect CRC values
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+index d0f56c5c4cce9..f562beb6f7971 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c
+@@ -102,6 +102,7 @@ static void drm_mode_to_intf_timing_params(
+ 	}
+ 
+ 	timing->wide_bus_en = dpu_encoder_is_widebus_enabled(phys_enc->parent);
++	timing->compression_en = dpu_encoder_is_dsc_enabled(phys_enc->parent);
+ 
+ 	/*
+ 	 * for DP, divide the horizonal parameters by 2 when
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+index 6bba531d6dc41..965692ef7892c 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+@@ -163,13 +163,8 @@ static void dpu_hw_intf_setup_timing_engine(struct dpu_hw_intf *ctx,
+ 	hsync_ctl = (hsync_period << 16) | p->hsync_pulse_width;
+ 	display_hctl = (hsync_end_x << 16) | hsync_start_x;
+ 
+-	/*
+-	 * DATA_HCTL_EN controls data timing which can be different from
+-	 * video timing. It is recommended to enable it for all cases, except
+-	 * if compression is enabled in 1 pixel per clock mode
+-	 */
+ 	if (p->wide_bus_en)
+-		intf_cfg2 |= INTF_CFG2_DATABUS_WIDEN | INTF_CFG2_DATA_HCTL_EN;
++		intf_cfg2 |= INTF_CFG2_DATABUS_WIDEN;
+ 
+ 	data_width = p->width;
+ 
+@@ -229,6 +224,14 @@ static void dpu_hw_intf_setup_timing_engine(struct dpu_hw_intf *ctx,
+ 	DPU_REG_WRITE(c, INTF_CONFIG, intf_cfg);
+ 	DPU_REG_WRITE(c, INTF_PANEL_FORMAT, panel_format);
+ 	if (ctx->cap->features & BIT(DPU_DATA_HCTL_EN)) {
++		/*
++		 * DATA_HCTL_EN controls data timing which can be different from
++		 * video timing. It is recommended to enable it for all cases, except
++		 * if compression is enabled in 1 pixel per clock mode
++		 */
++		if (!(p->compression_en && !p->wide_bus_en))
++			intf_cfg2 |= INTF_CFG2_DATA_HCTL_EN;
++
+ 		DPU_REG_WRITE(c, INTF_CONFIG2, intf_cfg2);
+ 		DPU_REG_WRITE(c, INTF_DISPLAY_DATA_HCTL, display_data_hctl);
+ 		DPU_REG_WRITE(c, INTF_ACTIVE_DATA_HCTL, active_data_hctl);
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
+index 0bd57a32144a6..6f4c87244f944 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
+@@ -33,6 +33,7 @@ struct dpu_hw_intf_timing_params {
+ 	u32 hsync_skew;
+ 
+ 	bool wide_bus_en;
++	bool compression_en;
+ };
+ 
+ struct dpu_hw_intf_prog_fetch {
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-msm-dpu-only-enable-dsc_mode_multiplex-if-dsc_me.patch b/queue-6.8/drm-msm-dpu-only-enable-dsc_mode_multiplex-if-dsc_me.patch
new file mode 100644
index 00000000000..bf94680f0d8
--- /dev/null
+++ b/queue-6.8/drm-msm-dpu-only-enable-dsc_mode_multiplex-if-dsc_me.patch
@@ -0,0 +1,46 @@
+From 47ab56c5d29cfaf91833beea94ca09eb309f69fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Feb 2024 18:45:27 +0100
+Subject: drm/msm/dpu: Only enable DSC_MODE_MULTIPLEX if dsc_merge is enabled
+
+From: Marijn Suijten <marijn.suijten@somainline.org>
+
+[ Upstream commit 06267d22f9ee6fd34150b6dcdb2fa6983e1a85bc ]
+
+When the topology calls for two interfaces on the current fixed topology
+of 2 DSC blocks, or uses 1 DSC block for a single interface (e.g. SC7280
+with only one DSC block), there should be no merging of DSC output.
+
+This is already represented by the return value of
+dpu_encoder_use_dsc_merge(), but not yet used to correctly configure
+this flag.
+
+Fixes: 58dca9810749 ("drm/msm/disp/dpu1: Add support for DSC in encoder")
+Signed-off-by: Marijn Suijten <marijn.suijten@somainline.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/577067/
+Link: https://lore.kernel.org/r/20240204-dpu-dsc-multiplex-v1-1-080963233c52@somainline.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 8932f38a41b2d..aca689314ccea 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -1860,7 +1860,9 @@ static void dpu_encoder_prep_dsc(struct dpu_encoder_virt *dpu_enc,
+ 	dsc_common_mode = 0;
+ 	pic_width = dsc->pic_width;
+ 
+-	dsc_common_mode = DSC_MODE_MULTIPLEX | DSC_MODE_SPLIT_PANEL;
++	dsc_common_mode = DSC_MODE_SPLIT_PANEL;
++	if (dpu_encoder_use_dsc_merge(enc_master->parent))
++		dsc_common_mode |= DSC_MODE_MULTIPLEX;
+ 	if (enc_master->intf_mode == INTF_MODE_VIDEO)
+ 		dsc_common_mode |= DSC_MODE_VIDEO;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-panel-boe-tv101wum-nl6-make-use-of-prepare_prev_.patch b/queue-6.8/drm-panel-boe-tv101wum-nl6-make-use-of-prepare_prev_.patch
new file mode 100644
index 00000000000..2bff63b4904
--- /dev/null
+++ b/queue-6.8/drm-panel-boe-tv101wum-nl6-make-use-of-prepare_prev_.patch
@@ -0,0 +1,42 @@
+From 5bf7b9a3a70af6ce7a1fc971097980bc68de2c4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 12:31:12 -0800
+Subject: drm/panel: boe-tv101wum-nl6: make use of prepare_prev_first
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 42a7a16bedc991190310a02dd202e29cfac52525 ]
+
+The panel on sc7180-trogdor-wormdingler and
+sc7180-trogdor-quackingstick hasn't been coming up since commit
+9e15123eca79 ("drm/msm/dsi: Stop unconditionally powering up DSI hosts
+at modeset"). Let's add "prepare_prev_first" as has been done for many
+other DSI panels.
+
+Fixes: 9e15123eca79 ("drm/msm/dsi: Stop unconditionally powering up DSI hosts at modeset")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Link: https://lore.kernel.org/r/20240216123111.1.I71c103720909790e1ec5a3f5bd96b18ab7b596fa@changeid
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240216123111.1.I71c103720909790e1ec5a3f5bd96b18ab7b596fa@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+index 4945a1e787eb3..0ffe8f8c01de8 100644
+--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+@@ -1871,6 +1871,8 @@ static int boe_panel_add(struct boe_panel *boe)
+ 
+ 	gpiod_set_value(boe->enable_gpio, 0);
+ 
++	boe->base.prepare_prev_first = true;
++
+ 	drm_panel_init(&boe->base, dev, &boe_panel_funcs,
+ 		       DRM_MODE_CONNECTOR_DSI);
+ 	err = of_drm_get_panel_orientation(dev->of_node, &boe->orientation);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-panel-edp-use-put_sync-in-unprepare.patch b/queue-6.8/drm-panel-edp-use-put_sync-in-unprepare.patch
new file mode 100644
index 00000000000..edd1935bd2a
--- /dev/null
+++ b/queue-6.8/drm-panel-edp-use-put_sync-in-unprepare.patch
@@ -0,0 +1,44 @@
+From 7a9b34a7d8338100eef3383072a90df4a051290a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 14:13:11 -0800
+Subject: drm/panel-edp: use put_sync in unprepare
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit 49ddab089611ae5ddd0201ddbbf633da75bfcc25 ]
+
+Some edp panel requires T10 (Delay from end of valid video data transmitted
+by the Source device to power-off) less than 500ms. Using autosuspend with
+delay set as 1000 violates this requirement.
+
+Use put_sync_suspend in unprepare to meet the spec. For other cases (such
+as getting EDID), it still uses autosuspend.
+
+Suggested-by: Douglas Anderson <dianders@chromium.org>
+Fixes: 3235b0f20a0a ("drm/panel: panel-simple: Use runtime pm to avoid excessive unprepare / prepare")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231220221418.2610185-1-hsinyi@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-edp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-edp.c b/drivers/gpu/drm/panel/panel-edp.c
+index a0b6f69b916f9..e5e3f0b9ca61d 100644
+--- a/drivers/gpu/drm/panel/panel-edp.c
++++ b/drivers/gpu/drm/panel/panel-edp.c
+@@ -413,8 +413,7 @@ static int panel_edp_unprepare(struct drm_panel *panel)
+ 	if (!p->prepared)
+ 		return 0;
+ 
+-	pm_runtime_mark_last_busy(panel->dev);
+-	ret = pm_runtime_put_autosuspend(panel->dev);
++	ret = pm_runtime_put_sync_suspend(panel->dev);
+ 	if (ret < 0)
+ 		return ret;
+ 	p->prepared = false;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch b/queue-6.8/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
new file mode 100644
index 00000000000..b2f5da5b817
--- /dev/null
+++ b/queue-6.8/drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
@@ -0,0 +1,39 @@
+From 760c11af9f60158fe16739cce73d059a803ac6b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:48:14 -0800
+Subject: drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit c4891d979c7668b195a0a75787967ec95a24ecef ]
+
+Clean up a typo in pr_err() erroneously printing NI MC 'rdev->mc_fw->size'
+during SMC firmware load. Log 'rdev->smc_fw->size' instead.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 6596afd48af4 ("drm/radeon/kms: add dpm support for btc (v3)")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/ni.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 927e5f42e97d0..3e48cbb522a1c 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -813,7 +813,7 @@ int ni_init_microcode(struct radeon_device *rdev)
+ 			err = 0;
+ 		} else if (rdev->smc_fw->size != smc_req_size) {
+ 			pr_err("ni_mc: Bogus length %zu in firmware \"%s\"\n",
+-			       rdev->mc_fw->size, fw_name);
++			       rdev->smc_fw->size, fw_name);
+ 			err = -EINVAL;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-rockchip-inno_hdmi-fix-video-timing.patch b/queue-6.8/drm-rockchip-inno_hdmi-fix-video-timing.patch
new file mode 100644
index 00000000000..f771c3b1f91
--- /dev/null
+++ b/queue-6.8/drm-rockchip-inno_hdmi-fix-video-timing.patch
@@ -0,0 +1,51 @@
+From b737ba0d5a23c3e87670225f76452e9cad6dea10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Dec 2023 18:41:54 +0100
+Subject: drm/rockchip: inno_hdmi: Fix video timing
+
+From: Alex Bee <knaerzche@gmail.com>
+
+[ Upstream commit 47a145c03484d33e65d773169d5ca1b9fe2a492e ]
+
+The controller wants the difference between *total and *sync_start in the
+HDMI_VIDEO_EXT_*DELAY registers. Otherwise the signal is very unstable for
+certain non-VIC modes. See downstream commit [0].
+
+[0] https://github.com/rockchip-linux/kernel/commit/8eb559f2502c
+
+Fixes: 412d4ae6b7a5 ("drm/rockchip: hdmi: add Innosilicon HDMI support")
+Co-developed-by: Zheng Yang <zhengyang@rock-chips.com>
+Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
+Signed-off-by: Alex Bee <knaerzche@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231222174220.55249-4-knaerzche@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/inno_hdmi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/inno_hdmi.c b/drivers/gpu/drm/rockchip/inno_hdmi.c
+index e6fbe040ccf6a..b66c1ef5838fd 100644
+--- a/drivers/gpu/drm/rockchip/inno_hdmi.c
++++ b/drivers/gpu/drm/rockchip/inno_hdmi.c
+@@ -411,7 +411,7 @@ static int inno_hdmi_config_video_timing(struct inno_hdmi *hdmi,
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HBLANK_L, value & 0xFF);
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HBLANK_H, (value >> 8) & 0xFF);
+ 
+-	value = mode->hsync_start - mode->hdisplay;
++	value = mode->htotal - mode->hsync_start;
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HDELAY_L, value & 0xFF);
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_HDELAY_H, (value >> 8) & 0xFF);
+ 
+@@ -426,7 +426,7 @@ static int inno_hdmi_config_video_timing(struct inno_hdmi *hdmi,
+ 	value = mode->vtotal - mode->vdisplay;
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_VBLANK, value & 0xFF);
+ 
+-	value = mode->vsync_start - mode->vdisplay;
++	value = mode->vtotal - mode->vsync_start;
+ 	hdmi_writeb(hdmi, HDMI_VIDEO_EXT_VDELAY, value & 0xFF);
+ 
+ 	value = mode->vsync_end - mode->vsync_start;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-rockchip-lvds-do-not-overwrite-error-code.patch b/queue-6.8/drm-rockchip-lvds-do-not-overwrite-error-code.patch
new file mode 100644
index 00000000000..f2b813f4329
--- /dev/null
+++ b/queue-6.8/drm-rockchip-lvds-do-not-overwrite-error-code.patch
@@ -0,0 +1,38 @@
+From b8cd7b01bb8056c267dbffeb711ad45e3412155f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:29:48 +0100
+Subject: drm/rockchip: lvds: do not overwrite error code
+
+From: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+
+[ Upstream commit 79b09453c4e369ca81cfb670d0136d089e3b92f0 ]
+
+ret variable stores the return value of drm_of_find_panel_or_bridge
+which can return error codes different from EPROBE_DEFER. Therefore,
+let's just return that error code instead of forcing it to EPROBE_DEFER.
+
+Fixes: 34cc0aa25456 ("drm/rockchip: Add support for Rockchip Soc LVDS")
+Cc: Quentin Schulz <foss+kernel@0leil.net>
+Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231120-rk-lvds-defer-msg-v2-1-9c59a5779cf9@theobroma-systems.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_lvds.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+index 59341654ec32b..6ecb6b8a1dcde 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c
++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+@@ -577,7 +577,6 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master,
+ 		goto err_put_port;
+ 	} else if (ret) {
+ 		DRM_DEV_ERROR(dev, "failed to find panel and bridge node\n");
+-		ret = -EPROBE_DEFER;
+ 		goto err_put_port;
+ 	}
+ 	if (lvds->panel)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch b/queue-6.8/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
new file mode 100644
index 00000000000..62face77b12
--- /dev/null
+++ b/queue-6.8/drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
@@ -0,0 +1,41 @@
+From 3b8515f1470ef0a734104f00c0a0d0ce2b33429e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:29:49 +0100
+Subject: drm/rockchip: lvds: do not print scary message when probing defer
+
+From: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+
+[ Upstream commit 52d11c863ac92e36a0365249f7f6d27ac48c78bc ]
+
+This scary message can misled the user into thinking something bad has
+happened and needs to be fixed, however it could simply be part of a
+normal boot process where EPROBE_DEFER is taken into account. Therefore,
+let's use dev_err_probe so that this message doesn't get shown (by
+default) when the return code is EPROBE_DEFER.
+
+Fixes: 34cc0aa25456 ("drm/rockchip: Add support for Rockchip Soc LVDS")
+Cc: Quentin Schulz <foss+kernel@0leil.net>
+Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231120-rk-lvds-defer-msg-v2-2-9c59a5779cf9@theobroma-systems.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_lvds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+index 6ecb6b8a1dcde..77b76cff1adb9 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c
++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c
+@@ -576,7 +576,7 @@ static int rockchip_lvds_bind(struct device *dev, struct device *master,
+ 		ret = -EINVAL;
+ 		goto err_put_port;
+ 	} else if (ret) {
+-		DRM_DEV_ERROR(dev, "failed to find panel and bridge node\n");
++		dev_err_probe(dev, ret, "failed to find panel and bridge node\n");
+ 		goto err_put_port;
+ 	}
+ 	if (lvds->panel)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch b/queue-6.8/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
new file mode 100644
index 00000000000..2d3f107796f
--- /dev/null
+++ b/queue-6.8/drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
@@ -0,0 +1,77 @@
+From 4280bb534c8849c1bebb6b3f1c1e8f20cd6067c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Oct 2023 22:10:55 +0800
+Subject: drm/tegra: dpaux: Fix PM disable depth imbalance in tegra_dpaux_probe
+
+From: Zhang Shurong <zhang_shurong@foxmail.com>
+
+[ Upstream commit 0800880f4eb789b7d299db40f2e86e056bd33a4e ]
+
+The pm_runtime_enable function increases the power disable depth,
+which means that we must perform a matching decrement on the error
+handling path to maintain balance within the given context.
+Additionally, we need to address the same issue for pm_runtime_get_sync.
+We fix this by invoking pm_runtime_disable and pm_runtime_put_sync
+when error returns.
+
+Fixes: 82b81b3ec1a7 ("drm/tegra: dpaux: Implement runtime PM")
+Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/tencent_B13DB7F6C0023C46157250A524966F326A09@qq.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dpaux.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
+index ef02d530f78d7..ae12d001a04bf 100644
+--- a/drivers/gpu/drm/tegra/dpaux.c
++++ b/drivers/gpu/drm/tegra/dpaux.c
+@@ -522,7 +522,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	if (err < 0) {
+ 		dev_err(dpaux->dev, "failed to request IRQ#%u: %d\n",
+ 			dpaux->irq, err);
+-		return err;
++		goto err_pm_disable;
+ 	}
+ 
+ 	disable_irq(dpaux->irq);
+@@ -542,7 +542,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	 */
+ 	err = tegra_dpaux_pad_config(dpaux, DPAUX_PADCTL_FUNC_I2C);
+ 	if (err < 0)
+-		return err;
++		goto err_pm_disable;
+ 
+ #ifdef CONFIG_GENERIC_PINCONF
+ 	dpaux->desc.name = dev_name(&pdev->dev);
+@@ -555,7 +555,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	dpaux->pinctrl = devm_pinctrl_register(&pdev->dev, &dpaux->desc, dpaux);
+ 	if (IS_ERR(dpaux->pinctrl)) {
+ 		dev_err(&pdev->dev, "failed to register pincontrol\n");
+-		return PTR_ERR(dpaux->pinctrl);
++		err = PTR_ERR(dpaux->pinctrl);
++		goto err_pm_disable;
+ 	}
+ #endif
+ 	/* enable and clear all interrupts */
+@@ -571,10 +572,15 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
+ 	err = devm_of_dp_aux_populate_ep_devices(&dpaux->aux);
+ 	if (err < 0) {
+ 		dev_err(dpaux->dev, "failed to populate AUX bus: %d\n", err);
+-		return err;
++		goto err_pm_disable;
+ 	}
+ 
+ 	return 0;
++
++err_pm_disable:
++	pm_runtime_put_sync(&pdev->dev);
++	pm_runtime_disable(&pdev->dev);
++	return err;
+ }
+ 
+ static void tegra_dpaux_remove(struct platform_device *pdev)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch b/queue-6.8/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
new file mode 100644
index 00000000000..30f73bbddde
--- /dev/null
+++ b/queue-6.8/drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
@@ -0,0 +1,41 @@
+From 7f7c13c230275317f0a82193478b58d39b738bff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 08:07:38 +0000
+Subject: drm/tegra: dsi: Add missing check for of_find_device_by_node
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit afe6fcb9775882230cd29b529203eabd5d2a638d ]
+
+Add check for the return value of of_find_device_by_node() and return
+the error if it fails in order to avoid NULL pointer dereference.
+
+Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231024080738.825553-1-nichen@iscas.ac.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index fbfe92a816d4b..e419b76e57d3e 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1544,9 +1544,11 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi)
+ 	np = of_parse_phandle(dsi->dev->of_node, "nvidia,ganged-mode", 0);
+ 	if (np) {
+ 		struct platform_device *gangster = of_find_device_by_node(np);
++		of_node_put(np);
++		if (!gangster)
++			return -EPROBE_DEFER;
+ 
+ 		dsi->slave = platform_get_drvdata(gangster);
+-		of_node_put(np);
+ 
+ 		if (!dsi->slave) {
+ 			put_device(&gangster->dev);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch b/queue-6.8/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
new file mode 100644
index 00000000000..6cd6f31204d
--- /dev/null
+++ b/queue-6.8/drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
@@ -0,0 +1,37 @@
+From bfc76f7a97d9fbb3ec60b35af0e18747057c94d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:09 +0200
+Subject: drm/tegra: dsi: Fix missing pm_runtime_disable() in the error
+ handling path of tegra_dsi_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5286a9fc280c45b6b307ee1b07f7a997e042252c ]
+
+If an error occurs after calling pm_runtime_enable(), pm_runtime_disable()
+should be called as already done in the remove function.
+
+Fixes: ef8187d75265 ("drm/tegra: dsi: Implement runtime PM")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/ee4a15c9cd4b574a55cd67c30d2411239ba2cee9.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index 0c8ad8ee5009a..db606e151afc8 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1675,6 +1675,7 @@ static int tegra_dsi_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ unregister:
++	pm_runtime_disable(&pdev->dev);
+ 	mipi_dsi_host_unregister(&dsi->host);
+ mipi_free:
+ 	tegra_mipi_free(dsi->mipi);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch b/queue-6.8/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
new file mode 100644
index 00000000000..e40fa513307
--- /dev/null
+++ b/queue-6.8/drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
@@ -0,0 +1,116 @@
+From 6ebff29c8f9497f85e6b8d83680b6965993174b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:08 +0200
+Subject: drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 830c1ded356369cd1303e8bb87ce3fea6e744de8 ]
+
+If an error occurs after calling tegra_output_probe(),
+tegra_output_remove() should be called as already done in the remove
+function.
+
+Fixes: dec727399a4b ("drm/tegra: Add DSI support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/16820073278d031f6c474a08d5f22a255158585e.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/dsi.c | 54 ++++++++++++++++++++++++-------------
+ 1 file changed, 35 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
+index e419b76e57d3e..0c8ad8ee5009a 100644
+--- a/drivers/gpu/drm/tegra/dsi.c
++++ b/drivers/gpu/drm/tegra/dsi.c
+@@ -1596,44 +1596,58 @@ static int tegra_dsi_probe(struct platform_device *pdev)
+ 
+ 	if (!pdev->dev.pm_domain) {
+ 		dsi->rst = devm_reset_control_get(&pdev->dev, "dsi");
+-		if (IS_ERR(dsi->rst))
+-			return PTR_ERR(dsi->rst);
++		if (IS_ERR(dsi->rst)) {
++			err = PTR_ERR(dsi->rst);
++			goto remove;
++		}
+ 	}
+ 
+ 	dsi->clk = devm_clk_get(&pdev->dev, NULL);
+-	if (IS_ERR(dsi->clk))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk),
+-				     "cannot get DSI clock\n");
++	if (IS_ERR(dsi->clk)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk),
++				    "cannot get DSI clock\n");
++		goto remove;
++	}
+ 
+ 	dsi->clk_lp = devm_clk_get(&pdev->dev, "lp");
+-	if (IS_ERR(dsi->clk_lp))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_lp),
+-				     "cannot get low-power clock\n");
++	if (IS_ERR(dsi->clk_lp)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_lp),
++				    "cannot get low-power clock\n");
++		goto remove;
++	}
+ 
+ 	dsi->clk_parent = devm_clk_get(&pdev->dev, "parent");
+-	if (IS_ERR(dsi->clk_parent))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_parent),
+-				     "cannot get parent clock\n");
++	if (IS_ERR(dsi->clk_parent)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->clk_parent),
++				    "cannot get parent clock\n");
++		goto remove;
++	}
+ 
+ 	dsi->vdd = devm_regulator_get(&pdev->dev, "avdd-dsi-csi");
+-	if (IS_ERR(dsi->vdd))
+-		return dev_err_probe(&pdev->dev, PTR_ERR(dsi->vdd),
+-				     "cannot get VDD supply\n");
++	if (IS_ERR(dsi->vdd)) {
++		err = dev_err_probe(&pdev->dev, PTR_ERR(dsi->vdd),
++				    "cannot get VDD supply\n");
++		goto remove;
++	}
+ 
+ 	err = tegra_dsi_setup_clocks(dsi);
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "cannot setup clocks\n");
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	dsi->regs = devm_ioremap_resource(&pdev->dev, regs);
+-	if (IS_ERR(dsi->regs))
+-		return PTR_ERR(dsi->regs);
++	if (IS_ERR(dsi->regs)) {
++		err = PTR_ERR(dsi->regs);
++		goto remove;
++	}
+ 
+ 	dsi->mipi = tegra_mipi_request(&pdev->dev, pdev->dev.of_node);
+-	if (IS_ERR(dsi->mipi))
+-		return PTR_ERR(dsi->mipi);
++	if (IS_ERR(dsi->mipi)) {
++		err = PTR_ERR(dsi->mipi);
++		goto remove;
++	}
+ 
+ 	dsi->host.ops = &tegra_dsi_host_ops;
+ 	dsi->host.dev = &pdev->dev;
+@@ -1664,6 +1678,8 @@ static int tegra_dsi_probe(struct platform_device *pdev)
+ 	mipi_dsi_host_unregister(&dsi->host);
+ mipi_free:
+ 	tegra_mipi_free(dsi->mipi);
++remove:
++	tegra_output_remove(&dsi->output);
+ 	return err;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-hdmi-fix-some-error-handling-paths-in-tegr.patch b/queue-6.8/drm-tegra-hdmi-fix-some-error-handling-paths-in-tegr.patch
new file mode 100644
index 00000000000..e6bcb2313d7
--- /dev/null
+++ b/queue-6.8/drm-tegra-hdmi-fix-some-error-handling-paths-in-tegr.patch
@@ -0,0 +1,85 @@
+From c8cef28090a72eecea8caa018b92f07dbd85bc35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:10 +0200
+Subject: drm/tegra: hdmi: Fix some error handling paths in tegra_hdmi_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 643ae131b8598fb2940c92c7d23fe62823a119c8 ]
+
+If an error occurs after calling tegra_output_probe(),
+tegra_output_remove() should be called as already done in the remove
+function.
+
+Fixes: 59d29c0ec93f ("drm/tegra: Allocate resources at probe time")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/9b7c564eb71977678b20abd73ee52001a51cf327.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/hdmi.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
+index a1fcee665023b..417fb884240a6 100644
+--- a/drivers/gpu/drm/tegra/hdmi.c
++++ b/drivers/gpu/drm/tegra/hdmi.c
+@@ -1856,12 +1856,14 @@ static int tegra_hdmi_probe(struct platform_device *pdev)
+ 		return err;
+ 
+ 	hdmi->regs = devm_platform_ioremap_resource(pdev, 0);
+-	if (IS_ERR(hdmi->regs))
+-		return PTR_ERR(hdmi->regs);
++	if (IS_ERR(hdmi->regs)) {
++		err = PTR_ERR(hdmi->regs);
++		goto remove;
++	}
+ 
+ 	err = platform_get_irq(pdev, 0);
+ 	if (err < 0)
+-		return err;
++		goto remove;
+ 
+ 	hdmi->irq = err;
+ 
+@@ -1870,18 +1872,18 @@ static int tegra_hdmi_probe(struct platform_device *pdev)
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "failed to request IRQ#%u: %d\n",
+ 			hdmi->irq, err);
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	platform_set_drvdata(pdev, hdmi);
+ 
+ 	err = devm_pm_runtime_enable(&pdev->dev);
+ 	if (err)
+-		return err;
++		goto remove;
+ 
+ 	err = devm_tegra_core_dev_init_opp_table_common(&pdev->dev);
+ 	if (err)
+-		return err;
++		goto remove;
+ 
+ 	INIT_LIST_HEAD(&hdmi->client.list);
+ 	hdmi->client.ops = &hdmi_client_ops;
+@@ -1891,10 +1893,14 @@ static int tegra_hdmi_probe(struct platform_device *pdev)
+ 	if (err < 0) {
+ 		dev_err(&pdev->dev, "failed to register host1x client: %d\n",
+ 			err);
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	return 0;
++
++remove:
++	tegra_output_remove(&hdmi->output);
++	return err;
+ }
+ 
+ static void tegra_hdmi_remove(struct platform_device *pdev)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch b/queue-6.8/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
new file mode 100644
index 00000000000..1fbb207a213
--- /dev/null
+++ b/queue-6.8/drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
@@ -0,0 +1,75 @@
+From 78bf951a0e0fa195c1e66965e816d0a1d21d3fef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:13 +0200
+Subject: drm/tegra: output: Fix missing i2c_put_adapter() in the error
+ handling paths of tegra_output_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 2db4578ef6ffb2b52115ca0ebf897b60ec559556 ]
+
+If an error occurs after a successful of_get_i2c_adapter_by_node() call, it
+should be undone by a corresponding i2c_put_adapter().
+
+Add the missing i2c_put_adapter() call.
+
+Fixes: 9be7d864cf07 ("drm/tegra: Implement panel support")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/b38604178991e1f08b2cda219103be266be2d680.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/output.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/output.c b/drivers/gpu/drm/tegra/output.c
+index dc2dcb5ca1c89..d7d2389ac2f5a 100644
+--- a/drivers/gpu/drm/tegra/output.c
++++ b/drivers/gpu/drm/tegra/output.c
+@@ -142,8 +142,10 @@ int tegra_output_probe(struct tegra_output *output)
+ 					GPIOD_IN,
+ 					"HDMI hotplug detect");
+ 	if (IS_ERR(output->hpd_gpio)) {
+-		if (PTR_ERR(output->hpd_gpio) != -ENOENT)
+-			return PTR_ERR(output->hpd_gpio);
++		if (PTR_ERR(output->hpd_gpio) != -ENOENT) {
++			err = PTR_ERR(output->hpd_gpio);
++			goto put_i2c;
++		}
+ 
+ 		output->hpd_gpio = NULL;
+ 	}
+@@ -152,7 +154,7 @@ int tegra_output_probe(struct tegra_output *output)
+ 		err = gpiod_to_irq(output->hpd_gpio);
+ 		if (err < 0) {
+ 			dev_err(output->dev, "gpiod_to_irq(): %d\n", err);
+-			return err;
++			goto put_i2c;
+ 		}
+ 
+ 		output->hpd_irq = err;
+@@ -165,7 +167,7 @@ int tegra_output_probe(struct tegra_output *output)
+ 		if (err < 0) {
+ 			dev_err(output->dev, "failed to request IRQ#%u: %d\n",
+ 				output->hpd_irq, err);
+-			return err;
++			goto put_i2c;
+ 		}
+ 
+ 		output->connector.polled = DRM_CONNECTOR_POLL_HPD;
+@@ -179,6 +181,12 @@ int tegra_output_probe(struct tegra_output *output)
+ 	}
+ 
+ 	return 0;
++
++put_i2c:
++	if (output->ddc)
++		i2c_put_adapter(output->ddc);
++
++	return err;
+ }
+ 
+ void tegra_output_remove(struct tegra_output *output)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch b/queue-6.8/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
new file mode 100644
index 00000000000..5cbf0c6826f
--- /dev/null
+++ b/queue-6.8/drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
@@ -0,0 +1,40 @@
+From 252f8b7ee42260c1f2a9dba2cf46223a76465eca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 12:33:55 +0300
+Subject: drm/tegra: put drm_gem_object ref on error in tegra_fb_create
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 32e5a120a5105bce01561978ee55aee8e40ac0dc ]
+
+Inside tegra_fb_create(), drm_gem_object_lookup() increments ref count of
+the found object. But if the following size check fails then the last
+found object's ref count should be put there as the unreferencing loop
+can't detect this situation.
+
+Found by Linux Verification Center (linuxtesting.org).
+
+Fixes: de2ba664c30f ("gpu: host1x: drm: Add memory manager and fb")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231215093356.12067-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/tegra/fb.c b/drivers/gpu/drm/tegra/fb.c
+index a719af1dc9a57..46170753699dc 100644
+--- a/drivers/gpu/drm/tegra/fb.c
++++ b/drivers/gpu/drm/tegra/fb.c
+@@ -159,6 +159,7 @@ struct drm_framebuffer *tegra_fb_create(struct drm_device *drm,
+ 
+ 		if (gem->size < size) {
+ 			err = -EINVAL;
++			drm_gem_object_put(gem);
+ 			goto unreference;
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch b/queue-6.8/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
new file mode 100644
index 00000000000..5427cd3012f
--- /dev/null
+++ b/queue-6.8/drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
@@ -0,0 +1,50 @@
+From 8364bc30b60528b1188343ffdbf7b6093a79d63f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:12 +0200
+Subject: drm/tegra: rgb: Fix missing clk_put() in the error handling paths of
+ tegra_dc_rgb_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 45c8034db47842b25a3ab6139d71e13b4e67b9b3 ]
+
+If clk_get_sys(..., "pll_d2_out0") fails, the clk_get_sys() call must be
+undone.
+
+Add the missing clk_put and a new 'put_pll_d_out0' label in the error
+handling path, and use it.
+
+Fixes: 0c921b6d4ba0 ("drm/tegra: dc: rgb: Allow changing PLLD rate on Tegra30+")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/0182895ead4e4730426616b0d9995954c960b634.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/rgb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
+index 53c492b13d129..1e8ec50b759e4 100644
+--- a/drivers/gpu/drm/tegra/rgb.c
++++ b/drivers/gpu/drm/tegra/rgb.c
+@@ -254,7 +254,7 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 		if (IS_ERR(rgb->pll_d2_out0)) {
+ 			err = PTR_ERR(rgb->pll_d2_out0);
+ 			dev_err(dc->dev, "failed to get pll_d2_out0: %d\n", err);
+-			goto remove;
++			goto put_pll;
+ 		}
+ 	}
+ 
+@@ -262,6 +262,8 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 
+ 	return 0;
+ 
++put_pll:
++	clk_put(rgb->pll_d_out0);
+ remove:
+ 	tegra_output_remove(&rgb->output);
+ 	return err;
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch b/queue-6.8/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
new file mode 100644
index 00000000000..7d6cfeecd1d
--- /dev/null
+++ b/queue-6.8/drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
@@ -0,0 +1,81 @@
+From 7f4a17bfc245ab99d591953858e0905be2250fea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Sep 2023 17:22:11 +0200
+Subject: drm/tegra: rgb: Fix some error handling paths in tegra_dc_rgb_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit bc456b5d93dbfdbd89f2a036f4f3d8026595f9e4 ]
+
+If an error occurs after calling tegra_output_probe(),
+tegra_output_remove() should be called as already done in the remove
+function.
+
+Fixes: 59d29c0ec93f ("drm/tegra: Allocate resources at probe time")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/0001f61eb89048bc36241629b564195689cf54b6.1693667005.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tegra/rgb.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/rgb.c b/drivers/gpu/drm/tegra/rgb.c
+index fc66bbd913b24..53c492b13d129 100644
+--- a/drivers/gpu/drm/tegra/rgb.c
++++ b/drivers/gpu/drm/tegra/rgb.c
+@@ -225,26 +225,28 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 	rgb->clk = devm_clk_get(dc->dev, NULL);
+ 	if (IS_ERR(rgb->clk)) {
+ 		dev_err(dc->dev, "failed to get clock\n");
+-		return PTR_ERR(rgb->clk);
++		err = PTR_ERR(rgb->clk);
++		goto remove;
+ 	}
+ 
+ 	rgb->clk_parent = devm_clk_get(dc->dev, "parent");
+ 	if (IS_ERR(rgb->clk_parent)) {
+ 		dev_err(dc->dev, "failed to get parent clock\n");
+-		return PTR_ERR(rgb->clk_parent);
++		err = PTR_ERR(rgb->clk_parent);
++		goto remove;
+ 	}
+ 
+ 	err = clk_set_parent(rgb->clk, rgb->clk_parent);
+ 	if (err < 0) {
+ 		dev_err(dc->dev, "failed to set parent clock: %d\n", err);
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	rgb->pll_d_out0 = clk_get_sys(NULL, "pll_d_out0");
+ 	if (IS_ERR(rgb->pll_d_out0)) {
+ 		err = PTR_ERR(rgb->pll_d_out0);
+ 		dev_err(dc->dev, "failed to get pll_d_out0: %d\n", err);
+-		return err;
++		goto remove;
+ 	}
+ 
+ 	if (dc->soc->has_pll_d2_out0) {
+@@ -252,13 +254,17 @@ int tegra_dc_rgb_probe(struct tegra_dc *dc)
+ 		if (IS_ERR(rgb->pll_d2_out0)) {
+ 			err = PTR_ERR(rgb->pll_d2_out0);
+ 			dev_err(dc->dev, "failed to get pll_d2_out0: %d\n", err);
+-			return err;
++			goto remove;
+ 		}
+ 	}
+ 
+ 	dc->rgb = &rgb->output;
+ 
+ 	return 0;
++
++remove:
++	tegra_output_remove(&rgb->output);
++	return err;
+ }
+ 
+ void tegra_dc_rgb_remove(struct tegra_dc *dc)
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tests-fix-invalid-printf-format-specifiers-in-ku.patch b/queue-6.8/drm-tests-fix-invalid-printf-format-specifiers-in-ku.patch
new file mode 100644
index 00000000000..e78288bbcdb
--- /dev/null
+++ b/queue-6.8/drm-tests-fix-invalid-printf-format-specifiers-in-ku.patch
@@ -0,0 +1,130 @@
+From e6432ea48b0794686880b72756d92cec7cedb473 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 13:27:20 +0800
+Subject: drm: tests: Fix invalid printf format specifiers in KUnit tests
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit fc9a615200d48e076af58f4309f507e500ed900d ]
+
+The drm_buddy_test's alloc_contiguous test used a u64 for the page size,
+which was then updated to be an 'unsigned long' to avoid 64-bit
+multiplication division helpers.
+
+However, the variable is logged by some KUNIT_ASSERT_EQ_MSG() using the
+'%d' or '%llu' format specifiers, the former of which is always wrong,
+and the latter is no longer correct now that ps is no longer a u64. Fix
+these to all use '%lu'.
+
+Also, drm_mm_test calls KUNIT_FAIL() with an empty string as the
+message. gcc and clang warns if a printf format string is empty, so
+give these some more detailed error messages, which should be more
+useful anyway.
+
+Fixes: a64056bb5a32 ("drm/tests/drm_buddy: add alloc_contiguous test")
+Fixes: fca7526b7d89 ("drm/tests/drm_buddy: fix build failure on 32-bit targets")
+Fixes: fc8d29e298cf ("drm: selftest: convert drm_mm selftest to KUnit")
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tests/drm_buddy_test.c | 14 +++++++-------
+ drivers/gpu/drm/tests/drm_mm_test.c    |  6 +++---
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/tests/drm_buddy_test.c b/drivers/gpu/drm/tests/drm_buddy_test.c
+index 484360c7e1f65..e48863a445564 100644
+--- a/drivers/gpu/drm/tests/drm_buddy_test.c
++++ b/drivers/gpu/drm/tests/drm_buddy_test.c
+@@ -260,30 +260,30 @@ static void drm_test_buddy_alloc_contiguous(struct kunit *test)
+ 		KUNIT_ASSERT_FALSE_MSG(test,
+ 				       drm_buddy_alloc_blocks(&mm, 0, mm_size,
+ 							      ps, ps, list, 0),
+-				       "buddy_alloc hit an error size=%u\n",
++				       "buddy_alloc hit an error size=%lu\n",
+ 				       ps);
+ 	} while (++i < n_pages);
+ 
+ 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
+ 							   3 * ps, ps, &allocated,
+ 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
+-			       "buddy_alloc didn't error size=%u\n", 3 * ps);
++			       "buddy_alloc didn't error size=%lu\n", 3 * ps);
+ 
+ 	drm_buddy_free_list(&mm, &middle);
+ 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
+ 							   3 * ps, ps, &allocated,
+ 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
+-			       "buddy_alloc didn't error size=%u\n", 3 * ps);
++			       "buddy_alloc didn't error size=%lu\n", 3 * ps);
+ 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
+ 							   2 * ps, ps, &allocated,
+ 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
+-			       "buddy_alloc didn't error size=%u\n", 2 * ps);
++			       "buddy_alloc didn't error size=%lu\n", 2 * ps);
+ 
+ 	drm_buddy_free_list(&mm, &right);
+ 	KUNIT_ASSERT_TRUE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
+ 							   3 * ps, ps, &allocated,
+ 							   DRM_BUDDY_CONTIGUOUS_ALLOCATION),
+-			       "buddy_alloc didn't error size=%u\n", 3 * ps);
++			       "buddy_alloc didn't error size=%lu\n", 3 * ps);
+ 	/*
+ 	 * At this point we should have enough contiguous space for 2 blocks,
+ 	 * however they are never buddies (since we freed middle and right) so
+@@ -292,13 +292,13 @@ static void drm_test_buddy_alloc_contiguous(struct kunit *test)
+ 	KUNIT_ASSERT_FALSE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
+ 							    2 * ps, ps, &allocated,
+ 							    DRM_BUDDY_CONTIGUOUS_ALLOCATION),
+-			       "buddy_alloc hit an error size=%u\n", 2 * ps);
++			       "buddy_alloc hit an error size=%lu\n", 2 * ps);
+ 
+ 	drm_buddy_free_list(&mm, &left);
+ 	KUNIT_ASSERT_FALSE_MSG(test, drm_buddy_alloc_blocks(&mm, 0, mm_size,
+ 							    3 * ps, ps, &allocated,
+ 							    DRM_BUDDY_CONTIGUOUS_ALLOCATION),
+-			       "buddy_alloc hit an error size=%u\n", 3 * ps);
++			       "buddy_alloc hit an error size=%lu\n", 3 * ps);
+ 
+ 	total = 0;
+ 	list_for_each_entry(block, &allocated, link)
+diff --git a/drivers/gpu/drm/tests/drm_mm_test.c b/drivers/gpu/drm/tests/drm_mm_test.c
+index 1eb0c304f9607..f37c0d7658656 100644
+--- a/drivers/gpu/drm/tests/drm_mm_test.c
++++ b/drivers/gpu/drm/tests/drm_mm_test.c
+@@ -157,7 +157,7 @@ static void drm_test_mm_init(struct kunit *test)
+ 
+ 	/* After creation, it should all be one massive hole */
+ 	if (!assert_one_hole(test, &mm, 0, size)) {
+-		KUNIT_FAIL(test, "");
++		KUNIT_FAIL(test, "mm not one hole on creation");
+ 		goto out;
+ 	}
+ 
+@@ -171,14 +171,14 @@ static void drm_test_mm_init(struct kunit *test)
+ 
+ 	/* After filling the range entirely, there should be no holes */
+ 	if (!assert_no_holes(test, &mm)) {
+-		KUNIT_FAIL(test, "");
++		KUNIT_FAIL(test, "mm has holes when filled");
+ 		goto out;
+ 	}
+ 
+ 	/* And then after emptying it again, the massive hole should be back */
+ 	drm_mm_remove_node(&tmp);
+ 	if (!assert_one_hole(test, &mm, 0, size)) {
+-		KUNIT_FAIL(test, "");
++		KUNIT_FAIL(test, "mm does not have single hole after emptying");
+ 		goto out;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tests-helpers-include-missing-drm_drv-header.patch b/queue-6.8/drm-tests-helpers-include-missing-drm_drv-header.patch
new file mode 100644
index 00000000000..728593be8cd
--- /dev/null
+++ b/queue-6.8/drm-tests-helpers-include-missing-drm_drv-header.patch
@@ -0,0 +1,44 @@
+From 6351ae11c1ea54365bfbd3d7379f43a42021d133 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 19:13:47 +0100
+Subject: drm/tests: helpers: Include missing drm_drv header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maxime Ripard <mripard@kernel.org>
+
+[ Upstream commit 73984daf07a1a89ace8f0db6dd2d640654ebbbee ]
+
+We have a few functions declared in our kunit helpers header, some of
+them dereferencing the struct drm_driver.
+
+However, we don't include the drm_drv.h header file defining that
+structure, leading to compilation errors if we don't include both
+headers.
+
+Fixes: d98780310719 ("drm/tests: helpers: Allow to pass a custom drm_driver")
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240222-kms-hdmi-connector-state-v7-1-8f4af575fce2@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_kunit_helpers.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/drm/drm_kunit_helpers.h b/include/drm/drm_kunit_helpers.h
+index ba483c87f0e7b..3ae19892229db 100644
+--- a/include/drm/drm_kunit_helpers.h
++++ b/include/drm/drm_kunit_helpers.h
+@@ -3,6 +3,8 @@
+ #ifndef DRM_KUNIT_HELPERS_H_
+ #define DRM_KUNIT_HELPERS_H_
+ 
++#include <drm/drm_drv.h>
++
+ #include <linux/device.h>
+ 
+ #include <kunit/test.h>
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tidss-fix-initial-plane-zpos-values.patch b/queue-6.8/drm-tidss-fix-initial-plane-zpos-values.patch
new file mode 100644
index 00000000000..576ec67bd27
--- /dev/null
+++ b/queue-6.8/drm-tidss-fix-initial-plane-zpos-values.patch
@@ -0,0 +1,56 @@
+From 706aa8ffde7463134c8987be5f34710562af01e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 10:16:36 +0200
+Subject: drm/tidss: Fix initial plane zpos values
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 3ec948ccb2c4b99e8fbfdd950adbe92ea577b395 ]
+
+When the driver sets up the zpos property it sets the default zpos value
+to the HW id of the plane. That is fine as such, but as on many DSS
+versions the driver arranges the DRM planes in a different order than
+the HW planes (to keep the non-scalable planes first), this leads to odd
+initial zpos values. An example is J721e, where the initial zpos values
+for DRM planes are 1, 3, 0, 2.
+
+In theory the userspace should configure the zpos values properly when
+using multiple planes, and in that sense the initial zpos values
+shouldn't matter, but there's really no reason not to fix this and help
+the userspace apps which don't handle zpos perfectly. In particular,
+some versions of Weston seem to have issues dealing with the planes
+with the current default zpos values.
+
+So let's change the zpos values for the DRM planes to 0, 1, 2, 3.
+
+Another option would be to configure the planes marked as primary planes
+to zpos 0. On a two display system this would give us plane zpos values
+of 0, 0, 1, 2. The end result and behavior would be very similar in this
+option, and I'm not aware that this would actually help us in any way.
+So, to keep the code simple, I opted for the 0, 1, 2, 3 values.
+
+Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240213-tidss-fixes-v1-1-d709e8dfa505@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_plane.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_plane.c b/drivers/gpu/drm/tidss/tidss_plane.c
+index e1c0ef0c3894c..68fed531f6a7f 100644
+--- a/drivers/gpu/drm/tidss/tidss_plane.c
++++ b/drivers/gpu/drm/tidss/tidss_plane.c
+@@ -213,7 +213,7 @@ struct tidss_plane *tidss_plane_create(struct tidss_device *tidss,
+ 
+ 	drm_plane_helper_add(&tplane->plane, &tidss_plane_helper_funcs);
+ 
+-	drm_plane_create_zpos_property(&tplane->plane, hw_plane_id, 0,
++	drm_plane_create_zpos_property(&tplane->plane, tidss->num_planes, 0,
+ 				       num_planes - 1);
+ 
+ 	ret = drm_plane_create_color_properties(&tplane->plane,
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-tidss-fix-sync-lost-issue-with-two-displays.patch b/queue-6.8/drm-tidss-fix-sync-lost-issue-with-two-displays.patch
new file mode 100644
index 00000000000..a277af88176
--- /dev/null
+++ b/queue-6.8/drm-tidss-fix-sync-lost-issue-with-two-displays.patch
@@ -0,0 +1,64 @@
+From 1eaf276ba8c3b710a6cb6864edc4d4b49266738a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 10:16:37 +0200
+Subject: drm/tidss: Fix sync-lost issue with two displays
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit c079e2e113f2ec2803ba859bbb442a6ab82c96bd ]
+
+A sync lost issue can be observed with two displays, when moving a plane
+from one disabled display to an another disabled display, and then
+enabling the display to which the plane was moved to. The exact
+requirements for this to trigger are not clear.
+
+It looks like the issue is that the layers are left enabled in the first
+display's OVR registers. Even if the corresponding VP is disabled, it
+still causes an issue, as if the disabled VP and its OVR would still be
+in use, leading to the same VID being used by two OVRs. However, this is
+just speculation based on testing the DSS behavior.
+
+Experimentation shows that as a workaround, we can disable all the
+layers in the OVR when disabling a VP. There should be no downside to
+this, as the OVR is anyway effectively disabled if its VP is disabled,
+and it seems to solve the sync lost issue.
+
+However, there may be a bigger issue in play here, related to J721e
+erratum i2097 ("DSS: Disabling a Layer Connected to Overlay May Result
+in Synclost During the Next Frame"). Experimentation also shows that the
+OVR's CHANNELIN field has similar issue. So we may need to revisit this
+when we find out more about the core issue.
+
+Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240213-tidss-fixes-v1-2-d709e8dfa505@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_crtc.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
+index 5f838980c7a11..94f8e3178df58 100644
+--- a/drivers/gpu/drm/tidss/tidss_crtc.c
++++ b/drivers/gpu/drm/tidss/tidss_crtc.c
+@@ -265,6 +265,16 @@ static void tidss_crtc_atomic_disable(struct drm_crtc *crtc,
+ 
+ 	reinit_completion(&tcrtc->framedone_completion);
+ 
++	/*
++	 * If a layer is left enabled when the videoport is disabled, and the
++	 * vid pipeline that was used for the layer is taken into use on
++	 * another videoport, the DSS will report sync lost issues. Disable all
++	 * the layers here as a work-around.
++	 */
++	for (u32 layer = 0; layer < tidss->feat->num_planes; layer++)
++		dispc_ovr_enable_layer(tidss->dispc, tcrtc->hw_videoport, layer,
++				       false);
++
+ 	dispc_vp_disable(tidss->dispc, tcrtc->hw_videoport);
+ 
+ 	if (!wait_for_completion_timeout(&tcrtc->framedone_completion,
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-vkms-avoid-reading-beyond-lut-array.patch b/queue-6.8/drm-vkms-avoid-reading-beyond-lut-array.patch
new file mode 100644
index 00000000000..71caab39a09
--- /dev/null
+++ b/queue-6.8/drm-vkms-avoid-reading-beyond-lut-array.patch
@@ -0,0 +1,66 @@
+From 51f664c47c78e37f0bcfe59c794553d6bd9232f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 11:36:24 -0500
+Subject: drm/vkms: Avoid reading beyond LUT array
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit 2fee84030d12d9fddfa874e4562d71761a129277 ]
+
+When the floor LUT index (drm_fixp2int(lut_index) is the last
+index of the array the ceil LUT index will point to an entry
+beyond the array. Make sure we guard against it and use the
+value of the floor LUT index.
+
+v3:
+ - Drop bits from commit description that didn't contribute
+   anything of value
+
+Fixes: db1f254f2cfa ("drm/vkms: Add support to 1D gamma LUT")
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Cc: Arthur Grillo <arthurgrillo@riseup.net>
+Reviewed-by: Arthur Grillo <arthurgrillo@riseup.net>
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231108163647.106853-6-harry.wentland@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vkms/vkms_composer.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c
+index 3c99fb8b54e2d..e7441b227b3ce 100644
+--- a/drivers/gpu/drm/vkms/vkms_composer.c
++++ b/drivers/gpu/drm/vkms/vkms_composer.c
+@@ -123,6 +123,8 @@ static u16 apply_lut_to_channel_value(const struct vkms_color_lut *lut, u16 chan
+ 				      enum lut_channel channel)
+ {
+ 	s64 lut_index = get_lut_index(lut, channel_value);
++	u16 *floor_lut_value, *ceil_lut_value;
++	u16 floor_channel_value, ceil_channel_value;
+ 
+ 	/*
+ 	 * This checks if `struct drm_color_lut` has any gap added by the compiler
+@@ -130,11 +132,15 @@ static u16 apply_lut_to_channel_value(const struct vkms_color_lut *lut, u16 chan
+ 	 */
+ 	static_assert(sizeof(struct drm_color_lut) == sizeof(__u16) * 4);
+ 
+-	u16 *floor_lut_value = (__u16 *)&lut->base[drm_fixp2int(lut_index)];
+-	u16 *ceil_lut_value = (__u16 *)&lut->base[drm_fixp2int_ceil(lut_index)];
++	floor_lut_value = (__u16 *)&lut->base[drm_fixp2int(lut_index)];
++	if (drm_fixp2int(lut_index) == (lut->lut_length - 1))
++		/* We're at the end of the LUT array, use same value for ceil and floor */
++		ceil_lut_value = floor_lut_value;
++	else
++		ceil_lut_value = (__u16 *)&lut->base[drm_fixp2int_ceil(lut_index)];
+ 
+-	u16 floor_channel_value = floor_lut_value[channel];
+-	u16 ceil_channel_value = ceil_lut_value[channel];
++	floor_channel_value = floor_lut_value[channel];
++	ceil_channel_value = ceil_lut_value[channel];
+ 
+ 	return lerp_u16(floor_channel_value, ceil_channel_value,
+ 			lut_index & DRM_FIXED_DECIMAL_MASK);
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch b/queue-6.8/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
new file mode 100644
index 00000000000..c60a7d70927
--- /dev/null
+++ b/queue-6.8/drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
@@ -0,0 +1,41 @@
+From db4451162c3c2e4e5034c899349bd5f8ce15329e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 17:14:16 +0800
+Subject: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 89709105a6091948ffb6ec2427954cbfe45358ce ]
+
+When ida_alloc_max fails, resources allocated before should be freed,
+including *res allocated by kmalloc and ttm_resource_init.
+
+Fixes: d3bcb4b02fe9 ("drm/vmwgfx: switch the TTM backends to self alloc")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231204091416.3308430-1-alexious@zju.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+index ceb4d3d3b965a..a0b47c9b33f55 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
+@@ -64,8 +64,11 @@ static int vmw_gmrid_man_get_node(struct ttm_resource_manager *man,
+ 	ttm_resource_init(bo, place, *res);
+ 
+ 	id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL);
+-	if (id < 0)
++	if (id < 0) {
++		ttm_resource_fini(man, *res);
++		kfree(*res);
+ 		return id;
++	}
+ 
+ 	spin_lock(&gman->lock);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-vmwgfx-fix-vmw_du_get_cursor_mob-fencing-of-newl.patch b/queue-6.8/drm-vmwgfx-fix-vmw_du_get_cursor_mob-fencing-of-newl.patch
new file mode 100644
index 00000000000..532f4bbb45b
--- /dev/null
+++ b/queue-6.8/drm-vmwgfx-fix-vmw_du_get_cursor_mob-fencing-of-newl.patch
@@ -0,0 +1,57 @@
+From 362624ecf232fda5e22dbcf311ec2caae35547ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 15:08:03 -0500
+Subject: drm/vmwgfx: Fix vmw_du_get_cursor_mob fencing of newly-created MOBs
+
+From: Martin Krastev <martin.krastev@broadcom.com>
+
+[ Upstream commit ed96cf7ad590989b009d6da5cd26387d995dac13 ]
+
+The fencing of MOB creation used in vmw_du_get_cursor_mob was incompatible
+with register-based device communication employed by this routine. As a
+result cursor MOB creation was racy, leading to potentially broken/missing
+mouse cursor on desktops using CursorMob device feature.
+
+Fixes: 53bc3f6fb6b3 ("drm/vmwgfx: Clean up cursor mobs")
+Signed-off-by: Martin Krastev <martin.krastev@broadcom.com>
+Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
+Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240126200804.732454-5-zack.rusin@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index 5fd0ccaa0b41b..b6f40781b907a 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -272,6 +272,7 @@ static int vmw_du_get_cursor_mob(struct vmw_cursor_plane *vcp,
+ 	u32 size = vmw_du_cursor_mob_size(vps->base.crtc_w, vps->base.crtc_h);
+ 	u32 i;
+ 	u32 cursor_max_dim, mob_max_size;
++	struct vmw_fence_obj *fence = NULL;
+ 	int ret;
+ 
+ 	if (!dev_priv->has_mob ||
+@@ -313,7 +314,15 @@ static int vmw_du_get_cursor_mob(struct vmw_cursor_plane *vcp,
+ 	if (ret != 0)
+ 		goto teardown;
+ 
+-	vmw_bo_fence_single(&vps->cursor.bo->tbo, NULL);
++	ret = vmw_execbuf_fence_commands(NULL, dev_priv, &fence, NULL);
++	if (ret != 0) {
++		ttm_bo_unreserve(&vps->cursor.bo->tbo);
++		goto teardown;
++	}
++
++	dma_fence_wait(&fence->base, false);
++	dma_fence_put(&fence->base);
++
+ 	ttm_bo_unreserve(&vps->cursor.bo->tbo);
+ 	return 0;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-fix-ref-counting-leak-on-page-fault.patch b/queue-6.8/drm-xe-fix-ref-counting-leak-on-page-fault.patch
new file mode 100644
index 00000000000..31dcad4a622
--- /dev/null
+++ b/queue-6.8/drm-xe-fix-ref-counting-leak-on-page-fault.patch
@@ -0,0 +1,44 @@
+From 0d2787720de8f3b02a0d0b66679fc8e1ecc76337 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 20:10:36 -0800
+Subject: drm/xe: Fix ref counting leak on page fault
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit f7da398935f7ddabf1a098714593e032c875cd74 ]
+
+If a page fault occurs on VM not in fault a ref can be leaked. Fix this.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240301041036.238471-1-matthew.brost@intel.com
+(cherry picked from commit 27b5a3f237fe66dbf2288c2b50973aee8a427e41)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/xe_gt_pagefault.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_gt_pagefault.c b/drivers/gpu/drm/xe/xe_gt_pagefault.c
+index 73f08f1924df2..e2cf1759527c6 100644
+--- a/drivers/gpu/drm/xe/xe_gt_pagefault.c
++++ b/drivers/gpu/drm/xe/xe_gt_pagefault.c
+@@ -146,10 +146,12 @@ static int handle_pagefault(struct xe_gt *gt, struct pagefault *pf)
+ 	/* ASID to VM */
+ 	mutex_lock(&xe->usm.lock);
+ 	vm = xa_load(&xe->usm.asid_to_vm, pf->asid);
+-	if (vm)
++	if (vm && xe_vm_in_fault_mode(vm))
+ 		xe_vm_get(vm);
++	else
++		vm = NULL;
+ 	mutex_unlock(&xe->usm.lock);
+-	if (!vm || !xe_vm_in_fault_mode(vm))
++	if (!vm)
+ 		return -EINVAL;
+ 
+ retry_userptr:
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-replace-grouped-target-in-makefile-with-patte.patch b/queue-6.8/drm-xe-replace-grouped-target-in-makefile-with-patte.patch
new file mode 100644
index 00000000000..dc87e9656f7
--- /dev/null
+++ b/queue-6.8/drm-xe-replace-grouped-target-in-makefile-with-patte.patch
@@ -0,0 +1,43 @@
+From 8729aea5c28d4bd28c120b87156fd882ea997087 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Mar 2024 17:39:28 +0200
+Subject: drm/xe: Replace 'grouped target' in Makefile with pattern rule
+
+From: Dafna Hirschfeld <dhirschfeld@habana.ai>
+
+[ Upstream commit e62d2e00780b4a465c77d2229837495fcbc480d3 ]
+
+Since 'grouped target' is used only in 'make' 4.3, it should
+be avoided. Replace it with 'multi-target pattern rule' which
+has the same behavior.
+
+Fixes: 9616e74b796c ("drm/xe: Add support for OOB workarounds")
+Signed-off-by: Dafna Hirschfeld <dhirschfeld@habana.ai>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240302153927.2602241-1-dhirschfeld@habana.ai
+[ reword commit message ]
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+(cherry picked from commit 5224ed586ba7f9bba956655a1bfe5b75df7394d4)
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/xe/Makefile b/drivers/gpu/drm/xe/Makefile
+index efcf0ab7a1a69..802c807c782cc 100644
+--- a/drivers/gpu/drm/xe/Makefile
++++ b/drivers/gpu/drm/xe/Makefile
+@@ -42,7 +42,8 @@ generated_oob := $(obj)/generated/xe_wa_oob.c $(obj)/generated/xe_wa_oob.h
+ quiet_cmd_wa_oob = GEN     $(notdir $(generated_oob))
+       cmd_wa_oob = mkdir -p $(@D); $^ $(generated_oob)
+ 
+-$(generated_oob) &: $(obj)/xe_gen_wa_oob $(srctree)/$(src)/xe_wa_oob.rules
++$(obj)/generated/%_wa_oob.c $(obj)/generated/%_wa_oob.h: $(obj)/xe_gen_wa_oob \
++		 $(srctree)/$(src)/xe_wa_oob.rules
+ 	$(call cmd,wa_oob)
+ 
+ uses_generated_oob := \
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-xe-tests-fix-printf-format-specifiers-in-xe_migr.patch b/queue-6.8/drm-xe-tests-fix-printf-format-specifiers-in-xe_migr.patch
new file mode 100644
index 00000000000..6609264c81a
--- /dev/null
+++ b/queue-6.8/drm-xe-tests-fix-printf-format-specifiers-in-xe_migr.patch
@@ -0,0 +1,65 @@
+From 3ca3b1a6662f503ff565fe9a1e5f3f5fd9e57a2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:21 +0800
+Subject: drm/xe/tests: Fix printf format specifiers in xe_migrate test
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 689a930b93c5c20294df5da0407df361c5412eac ]
+
+KUNIT_FAIL() is used to fail the xe_migrate test when an error occurs.
+However, there's a mismatch in the format specifier: '%li' is used to
+log 'err', which is an 'int'.
+
+Use '%i' instead of '%li', and for the case where we're printing an
+error pointer, just use '%pe', instead of extracting the error code
+manually with PTR_ERR(). (This also results in a nicer output when the
+error code is known.)
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Acked-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/xe/tests/xe_migrate.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/tests/xe_migrate.c b/drivers/gpu/drm/xe/tests/xe_migrate.c
+index a6523df0f1d39..c347e2c29f81f 100644
+--- a/drivers/gpu/drm/xe/tests/xe_migrate.c
++++ b/drivers/gpu/drm/xe/tests/xe_migrate.c
+@@ -114,21 +114,21 @@ static void test_copy(struct xe_migrate *m, struct xe_bo *bo,
+ 						   region |
+ 						   XE_BO_NEEDS_CPU_ACCESS);
+ 	if (IS_ERR(remote)) {
+-		KUNIT_FAIL(test, "Failed to allocate remote bo for %s: %li\n",
+-			   str, PTR_ERR(remote));
++		KUNIT_FAIL(test, "Failed to allocate remote bo for %s: %pe\n",
++			   str, remote);
+ 		return;
+ 	}
+ 
+ 	err = xe_bo_validate(remote, NULL, false);
+ 	if (err) {
+-		KUNIT_FAIL(test, "Failed to validate system bo for %s: %li\n",
++		KUNIT_FAIL(test, "Failed to validate system bo for %s: %i\n",
+ 			   str, err);
+ 		goto out_unlock;
+ 	}
+ 
+ 	err = xe_bo_vmap(remote);
+ 	if (err) {
+-		KUNIT_FAIL(test, "Failed to vmap system bo for %s: %li\n",
++		KUNIT_FAIL(test, "Failed to vmap system bo for %s: %i\n",
+ 			   str, err);
+ 		goto out_unlock;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/dt-bindings-arm-smmu-fix-sm8-45-50-gpu-smmu-if-condi.patch b/queue-6.8/dt-bindings-arm-smmu-fix-sm8-45-50-gpu-smmu-if-condi.patch
new file mode 100644
index 00000000000..5ca79ae0c00
--- /dev/null
+++ b/queue-6.8/dt-bindings-arm-smmu-fix-sm8-45-50-gpu-smmu-if-condi.patch
@@ -0,0 +1,58 @@
+From 9fc96ddb43202e5673a264aa2c8f56c7ceda5105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 12:03:49 +0100
+Subject: dt-bindings: arm-smmu: fix SM8[45]50 GPU SMMU if condition
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit dc94d0cc718329a39ea2e986a123421a9203b471 ]
+
+The if condition for the SM8[45]50 GPU SMMU is too large,
+add the other compatible strings to the condition to only
+allow the clocks for the GPU SMMU nodes.
+
+Fixes: 4fff78dc2490 ("dt-bindings: arm-smmu: Document SM8[45]50 GPU SMMU")
+Suggested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/578686/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/iommu/arm,smmu.yaml         | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml
+index a4042ae247702..38c48131e6e7b 100644
+--- a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml
++++ b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml
+@@ -484,7 +484,12 @@ allOf:
+   - if:
+       properties:
+         compatible:
+-          const: qcom,sm8450-smmu-500
++          items:
++            - const: qcom,sm8450-smmu-500
++            - const: qcom,adreno-smmu
++            - const: qcom,smmu-500
++            - const: arm,mmu-500
++
+     then:
+       properties:
+         clock-names:
+@@ -508,7 +513,11 @@ allOf:
+   - if:
+       properties:
+         compatible:
+-          const: qcom,sm8550-smmu-500
++          items:
++            - const: qcom,sm8550-smmu-500
++            - const: qcom,adreno-smmu
++            - const: qcom,smmu-500
++            - const: arm,mmu-500
+     then:
+       properties:
+         clock-names:
+-- 
+2.43.0
+
diff --git a/queue-6.8/dt-bindings-msm-qcom-mdss-include-ommited-fam-b-comp.patch b/queue-6.8/dt-bindings-msm-qcom-mdss-include-ommited-fam-b-comp.patch
new file mode 100644
index 00000000000..6c0857e23cf
--- /dev/null
+++ b/queue-6.8/dt-bindings-msm-qcom-mdss-include-ommited-fam-b-comp.patch
@@ -0,0 +1,37 @@
+From 2918acdec553ef61202727ee3a6c57a1263ad5f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Jan 2024 20:41:01 +0100
+Subject: dt-bindings: msm: qcom, mdss: Include ommited fam-b compatible
+
+From: Adam Skladowski <a39.skl@gmail.com>
+
+[ Upstream commit 3b63880de42bd3cb79c2a99949135a8f2441c088 ]
+
+During conversion 28nm-hpm-fam-b compat got lost, add it.
+
+Signed-off-by: Adam Skladowski <a39.skl@gmail.com>
+Fixes: f7d46c5efee2 ("dt-bindings: display/msm: split qcom, mdss bindings")
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/575290/
+Link: https://lore.kernel.org/r/20240121194221.13513-4-a39.skl@gmail.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/display/msm/qcom,mdss.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Documentation/devicetree/bindings/display/msm/qcom,mdss.yaml b/Documentation/devicetree/bindings/display/msm/qcom,mdss.yaml
+index 0999ea07f47bb..e4576546bf0db 100644
+--- a/Documentation/devicetree/bindings/display/msm/qcom,mdss.yaml
++++ b/Documentation/devicetree/bindings/display/msm/qcom,mdss.yaml
+@@ -127,6 +127,7 @@ patternProperties:
+           - qcom,dsi-phy-20nm
+           - qcom,dsi-phy-28nm-8226
+           - qcom,dsi-phy-28nm-hpm
++          - qcom,dsi-phy-28nm-hpm-fam-b
+           - qcom,dsi-phy-28nm-lp
+           - qcom,hdmi-phy-8084
+           - qcom,hdmi-phy-8660
+-- 
+2.43.0
+
diff --git a/queue-6.8/erofs-fix-lockdep-false-positives-on-initializing-er.patch b/queue-6.8/erofs-fix-lockdep-false-positives-on-initializing-er.patch
new file mode 100644
index 00000000000..32f229119bf
--- /dev/null
+++ b/queue-6.8/erofs-fix-lockdep-false-positives-on-initializing-er.patch
@@ -0,0 +1,215 @@
+From 613a44eebfbb012460c5560aeb8342fb0967e149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 18:10:18 +0800
+Subject: erofs: fix lockdep false positives on initializing erofs_pseudo_mnt
+
+From: Baokun Li <libaokun1@huawei.com>
+
+[ Upstream commit 0f28be64d132aaf95d06375c8002ad9ecea69d71 ]
+
+Lockdep reported the following issue when mounting erofs with a domain_id:
+
+============================================
+WARNING: possible recursive locking detected
+6.8.0-rc7-xfstests #521 Not tainted
+--------------------------------------------
+mount/396 is trying to acquire lock:
+ffff907a8aaaa0e0 (&type->s_umount_key#50/1){+.+.}-{3:3},
+						at: alloc_super+0xe3/0x3d0
+
+but task is already holding lock:
+ffff907a8aaa90e0 (&type->s_umount_key#50/1){+.+.}-{3:3},
+						at: alloc_super+0xe3/0x3d0
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+       CPU0
+       ----
+  lock(&type->s_umount_key#50/1);
+  lock(&type->s_umount_key#50/1);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+2 locks held by mount/396:
+ #0: ffff907a8aaa90e0 (&type->s_umount_key#50/1){+.+.}-{3:3},
+			at: alloc_super+0xe3/0x3d0
+ #1: ffffffffc00e6f28 (erofs_domain_list_lock){+.+.}-{3:3},
+			at: erofs_fscache_register_fs+0x3d/0x270 [erofs]
+
+stack backtrace:
+CPU: 1 PID: 396 Comm: mount Not tainted 6.8.0-rc7-xfstests #521
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x64/0xb0
+ validate_chain+0x5c4/0xa00
+ __lock_acquire+0x6a9/0xd50
+ lock_acquire+0xcd/0x2b0
+ down_write_nested+0x45/0xd0
+ alloc_super+0xe3/0x3d0
+ sget_fc+0x62/0x2f0
+ vfs_get_super+0x21/0x90
+ vfs_get_tree+0x2c/0xf0
+ fc_mount+0x12/0x40
+ vfs_kern_mount.part.0+0x75/0x90
+ kern_mount+0x24/0x40
+ erofs_fscache_register_fs+0x1ef/0x270 [erofs]
+ erofs_fc_fill_super+0x213/0x380 [erofs]
+
+This is because the file_system_type of both erofs and the pseudo-mount
+point of domain_id is erofs_fs_type, so two successive calls to
+alloc_super() are considered to be using the same lock and trigger the
+warning above.
+
+Therefore add a nodev file_system_type called erofs_anon_fs_type in
+fscache.c to silence this complaint. Because kern_mount() takes a
+pointer to struct file_system_type, not its (string) name. So we don't
+need to call register_filesystem(). In addition, call init_pseudo() in
+erofs_anon_init_fs_context() as suggested by Al Viro, so that we can
+remove erofs_fc_fill_pseudo_super(), erofs_fc_anon_get_tree(), and
+erofs_anon_context_ops.
+
+Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
+Fixes: a9849560c55e ("erofs: introduce a pseudo mnt to manage shared cookies")
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-and-tested-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Yang Erkun <yangerkun@huawei.com>
+Link: https://lore.kernel.org/r/20240307101018.2021925-1-libaokun1@huawei.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/fscache.c  | 15 ++++++++++++++-
+ fs/erofs/internal.h |  1 -
+ fs/erofs/super.c    | 30 +-----------------------------
+ 3 files changed, 15 insertions(+), 31 deletions(-)
+
+diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c
+index 89a7c2453aae6..122a4753ecea4 100644
+--- a/fs/erofs/fscache.c
++++ b/fs/erofs/fscache.c
+@@ -3,6 +3,7 @@
+  * Copyright (C) 2022, Alibaba Cloud
+  * Copyright (C) 2022, Bytedance Inc. All rights reserved.
+  */
++#include <linux/pseudo_fs.h>
+ #include <linux/fscache.h>
+ #include "internal.h"
+ 
+@@ -12,6 +13,18 @@ static LIST_HEAD(erofs_domain_list);
+ static LIST_HEAD(erofs_domain_cookies_list);
+ static struct vfsmount *erofs_pseudo_mnt;
+ 
++static int erofs_anon_init_fs_context(struct fs_context *fc)
++{
++	return init_pseudo(fc, EROFS_SUPER_MAGIC) ? 0 : -ENOMEM;
++}
++
++static struct file_system_type erofs_anon_fs_type = {
++	.owner		= THIS_MODULE,
++	.name           = "pseudo_erofs",
++	.init_fs_context = erofs_anon_init_fs_context,
++	.kill_sb        = kill_anon_super,
++};
++
+ struct erofs_fscache_request {
+ 	struct erofs_fscache_request *primary;
+ 	struct netfs_cache_resources cache_resources;
+@@ -381,7 +394,7 @@ static int erofs_fscache_init_domain(struct super_block *sb)
+ 		goto out;
+ 
+ 	if (!erofs_pseudo_mnt) {
+-		struct vfsmount *mnt = kern_mount(&erofs_fs_type);
++		struct vfsmount *mnt = kern_mount(&erofs_anon_fs_type);
+ 		if (IS_ERR(mnt)) {
+ 			err = PTR_ERR(mnt);
+ 			goto out;
+diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
+index b0409badb0172..410f5af623540 100644
+--- a/fs/erofs/internal.h
++++ b/fs/erofs/internal.h
+@@ -385,7 +385,6 @@ struct erofs_map_dev {
+ 	unsigned int m_deviceid;
+ };
+ 
+-extern struct file_system_type erofs_fs_type;
+ extern const struct super_operations erofs_sops;
+ 
+ extern const struct address_space_operations erofs_raw_access_aops;
+diff --git a/fs/erofs/super.c b/fs/erofs/super.c
+index 5f60f163bd56e..24788c230b494 100644
+--- a/fs/erofs/super.c
++++ b/fs/erofs/super.c
+@@ -579,13 +579,6 @@ static const struct export_operations erofs_export_ops = {
+ 	.get_parent = erofs_get_parent,
+ };
+ 
+-static int erofs_fc_fill_pseudo_super(struct super_block *sb, struct fs_context *fc)
+-{
+-	static const struct tree_descr empty_descr = {""};
+-
+-	return simple_fill_super(sb, EROFS_SUPER_MAGIC, &empty_descr);
+-}
+-
+ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
+ {
+ 	struct inode *inode;
+@@ -712,11 +705,6 @@ static int erofs_fc_fill_super(struct super_block *sb, struct fs_context *fc)
+ 	return 0;
+ }
+ 
+-static int erofs_fc_anon_get_tree(struct fs_context *fc)
+-{
+-	return get_tree_nodev(fc, erofs_fc_fill_pseudo_super);
+-}
+-
+ static int erofs_fc_get_tree(struct fs_context *fc)
+ {
+ 	struct erofs_fs_context *ctx = fc->fs_private;
+@@ -789,20 +777,10 @@ static const struct fs_context_operations erofs_context_ops = {
+ 	.free		= erofs_fc_free,
+ };
+ 
+-static const struct fs_context_operations erofs_anon_context_ops = {
+-	.get_tree       = erofs_fc_anon_get_tree,
+-};
+-
+ static int erofs_init_fs_context(struct fs_context *fc)
+ {
+ 	struct erofs_fs_context *ctx;
+ 
+-	/* pseudo mount for anon inodes */
+-	if (fc->sb_flags & SB_KERNMOUNT) {
+-		fc->ops = &erofs_anon_context_ops;
+-		return 0;
+-	}
+-
+ 	ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ 	if (!ctx)
+ 		return -ENOMEM;
+@@ -824,12 +802,6 @@ static void erofs_kill_sb(struct super_block *sb)
+ {
+ 	struct erofs_sb_info *sbi;
+ 
+-	/* pseudo mount for anon inodes */
+-	if (sb->s_flags & SB_KERNMOUNT) {
+-		kill_anon_super(sb);
+-		return;
+-	}
+-
+ 	if (erofs_is_fscache_mode(sb))
+ 		kill_anon_super(sb);
+ 	else
+@@ -868,7 +840,7 @@ static void erofs_put_super(struct super_block *sb)
+ 	erofs_fscache_unregister_fs(sb);
+ }
+ 
+-struct file_system_type erofs_fs_type = {
++static struct file_system_type erofs_fs_type = {
+ 	.owner          = THIS_MODULE,
+ 	.name           = "erofs",
+ 	.init_fs_context = erofs_init_fs_context,
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-check-number-of-blocks-in-a-current-section.patch b/queue-6.8/f2fs-check-number-of-blocks-in-a-current-section.patch
new file mode 100644
index 00000000000..8225d56461a
--- /dev/null
+++ b/queue-6.8/f2fs-check-number-of-blocks-in-a-current-section.patch
@@ -0,0 +1,67 @@
+From 8e2ef32a50e066c1f755ffa245630ad4e524a431 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 12:32:05 -0800
+Subject: f2fs: check number of blocks in a current section
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 7af2df0f67a1469762e59be3726a803882d83f6f ]
+
+In cfd66bb715fd ("f2fs: fix deadloop in foreground GC"), we needed to check
+the number of blocks in a section instead of the segment.
+
+Fixes: cfd66bb715fd ("f2fs: fix deadloop in foreground GC")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.h | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index 8129be788bd56..c77a562831493 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -573,23 +573,22 @@ static inline bool has_curseg_enough_space(struct f2fs_sb_info *sbi,
+ 			unsigned int node_blocks, unsigned int dent_blocks)
+ {
+ 
+-	unsigned int segno, left_blocks;
++	unsigned segno, left_blocks;
+ 	int i;
+ 
+-	/* check current node segment */
++	/* check current node sections in the worst case. */
+ 	for (i = CURSEG_HOT_NODE; i <= CURSEG_COLD_NODE; i++) {
+ 		segno = CURSEG_I(sbi, i)->segno;
+-		left_blocks = f2fs_usable_blks_in_seg(sbi, segno) -
+-				get_seg_entry(sbi, segno)->ckpt_valid_blocks;
+-
++		left_blocks = CAP_BLKS_PER_SEC(sbi) -
++				get_ckpt_valid_blocks(sbi, segno, true);
+ 		if (node_blocks > left_blocks)
+ 			return false;
+ 	}
+ 
+-	/* check current data segment */
++	/* check current data section for dentry blocks. */
+ 	segno = CURSEG_I(sbi, CURSEG_HOT_DATA)->segno;
+-	left_blocks = f2fs_usable_blks_in_seg(sbi, segno) -
+-			get_seg_entry(sbi, segno)->ckpt_valid_blocks;
++	left_blocks = CAP_BLKS_PER_SEC(sbi) -
++			get_ckpt_valid_blocks(sbi, segno, true);
+ 	if (dent_blocks > left_blocks)
+ 		return false;
+ 	return true;
+@@ -638,7 +637,7 @@ static inline bool has_not_enough_free_secs(struct f2fs_sb_info *sbi,
+ 
+ 	if (free_secs > upper_secs)
+ 		return false;
+-	else if (free_secs <= lower_secs)
++	if (free_secs <= lower_secs)
+ 		return true;
+ 	return !curseg_space;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch b/queue-6.8/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
new file mode 100644
index 00000000000..9895811f19d
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
@@ -0,0 +1,132 @@
+From f5a52917b88860e58c8674eb7518961ef676f7b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 11:47:46 +0800
+Subject: f2fs: compress: fix reserve_cblocks counting error when out of space
+
+From: Xiuhong Wang <xiuhong.wang@unisoc.com>
+
+[ Upstream commit 2f6d721e14b69d6e1251f69fa238b48e8374e25f ]
+
+When a file only needs one direct_node, performing the following
+operations will cause the file to be unrepairable:
+
+unisoc # ./f2fs_io compress test.apk
+unisoc #df -h | grep dm-48
+/dev/block/dm-48 112G 112G 1.2M 100% /data
+
+unisoc # ./f2fs_io release_cblocks test.apk
+924
+unisoc # df -h | grep dm-48
+/dev/block/dm-48 112G 112G 4.8M 100% /data
+
+unisoc # dd if=/dev/random of=file4 bs=1M count=3
+3145728 bytes (3.0 M) copied, 0.025 s, 120 M/s
+unisoc # df -h | grep dm-48
+/dev/block/dm-48 112G 112G 1.8M 100% /data
+
+unisoc # ./f2fs_io reserve_cblocks test.apk
+F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device
+
+adb reboot
+unisoc # df -h  | grep dm-48
+/dev/block/dm-48             112G 112G   11M 100% /data
+unisoc # ./f2fs_io reserve_cblocks test.apk
+0
+
+This is because the file has only one direct_node. After returning
+to -ENOSPC, reserved_blocks += ret will not be executed. As a result,
+the reserved_blocks at this time is still 0, which is not the real
+number of reserved blocks. Therefore, fsck cannot be set to repair
+the file.
+
+After this patch, the fsck flag will be set to fix this problem.
+
+unisoc # df -h | grep dm-48
+/dev/block/dm-48             112G 112G  1.8M 100% /data
+unisoc # ./f2fs_io reserve_cblocks test.apk
+F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device
+
+adb reboot then fsck will be executed
+unisoc # df -h  | grep dm-48
+/dev/block/dm-48             112G 112G   11M 100% /data
+unisoc # ./f2fs_io reserve_cblocks test.apk
+924
+
+Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS")
+Signed-off-by: Xiuhong Wang <xiuhong.wang@unisoc.com>
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 3da9a298c50a7..ffe7fca39a8e8 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3588,10 +3588,10 @@ static int f2fs_release_compress_blocks(struct file *filp, unsigned long arg)
+ 	return ret;
+ }
+ 
+-static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
++static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count,
++		unsigned int *reserved_blocks)
+ {
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(dn->inode);
+-	unsigned int reserved_blocks = 0;
+ 	int cluster_size = F2FS_I(dn->inode)->i_cluster_size;
+ 	block_t blkaddr;
+ 	int i;
+@@ -3655,12 +3655,12 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 
+ 		f2fs_i_compr_blocks_update(dn->inode, compr_blocks, true);
+ 
+-		reserved_blocks += reserved;
++		*reserved_blocks += reserved;
+ next:
+ 		count -= cluster_size;
+ 	}
+ 
+-	return reserved_blocks;
++	return 0;
+ }
+ 
+ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+@@ -3721,7 +3721,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 		count = min(end_offset - dn.ofs_in_node, last_idx - page_idx);
+ 		count = round_up(count, F2FS_I(inode)->i_cluster_size);
+ 
+-		ret = reserve_compress_blocks(&dn, count);
++		ret = reserve_compress_blocks(&dn, count, &reserved_blocks);
+ 
+ 		f2fs_put_dnode(&dn);
+ 
+@@ -3729,13 +3729,12 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 			break;
+ 
+ 		page_idx += count;
+-		reserved_blocks += ret;
+ 	}
+ 
+ 	filemap_invalidate_unlock(inode->i_mapping);
+ 	f2fs_up_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ 
+-	if (ret >= 0) {
++	if (!ret) {
+ 		clear_inode_flag(inode, FI_COMPRESS_RELEASED);
+ 		inode_set_ctime_current(inode);
+ 		f2fs_mark_inode_dirty_sync(inode, true);
+@@ -3744,7 +3743,7 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 	inode_unlock(inode);
+ 	mnt_drop_write_file(filp);
+ 
+-	if (ret >= 0) {
++	if (!ret) {
+ 		ret = put_user(reserved_blocks, (u64 __user *)arg);
+ 	} else if (reserved_blocks &&
+ 			atomic_read(&F2FS_I(inode)->i_compr_blocks)) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-to-avoid-inconsistence-bewteen-i_b.patch b/queue-6.8/f2fs-compress-fix-to-avoid-inconsistence-bewteen-i_b.patch
new file mode 100644
index 00000000000..5bf1ac0f448
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-to-avoid-inconsistence-bewteen-i_b.patch
@@ -0,0 +1,146 @@
+From 150f3502c40f1896fbade9f00a51ee56a1aa7679 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 03:41:30 +0800
+Subject: f2fs: compress: fix to avoid inconsistence bewteen i_blocks and dnode
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 54607494875edd636aff3c21ace3ad9a7da758a9 ]
+
+In reserve_compress_blocks(), we update blkaddrs of dnode in prior to
+inc_valid_block_count(), it may cause inconsistent status bewteen
+i_blocks and blkaddrs once inc_valid_block_count() fails.
+
+To fix this issue, it needs to reverse their invoking order.
+
+Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS")
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c    |  5 +++--
+ fs/f2fs/f2fs.h    |  7 ++++++-
+ fs/f2fs/file.c    | 26 ++++++++++++++------------
+ fs/f2fs/segment.c |  2 +-
+ 4 files changed, 24 insertions(+), 16 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 7a93a99fbd04b..65fe48bb17d16 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1219,7 +1219,8 @@ int f2fs_reserve_new_blocks(struct dnode_of_data *dn, blkcnt_t count)
+ 
+ 	if (unlikely(is_inode_flag_set(dn->inode, FI_NO_ALLOC)))
+ 		return -EPERM;
+-	if (unlikely((err = inc_valid_block_count(sbi, dn->inode, &count))))
++	err = inc_valid_block_count(sbi, dn->inode, &count, true);
++	if (unlikely(err))
+ 		return err;
+ 
+ 	trace_f2fs_reserve_new_blocks(dn->inode, dn->nid,
+@@ -1476,7 +1477,7 @@ static int __allocate_data_block(struct dnode_of_data *dn, int seg_type)
+ 
+ 	dn->data_blkaddr = f2fs_data_blkaddr(dn);
+ 	if (dn->data_blkaddr == NULL_ADDR) {
+-		err = inc_valid_block_count(sbi, dn->inode, &count);
++		err = inc_valid_block_count(sbi, dn->inode, &count, true);
+ 		if (unlikely(err))
+ 			return err;
+ 	}
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 99511d9a92c0c..9fd2143378952 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -2252,7 +2252,7 @@ static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi,
+ 
+ static inline void f2fs_i_blocks_write(struct inode *, block_t, bool, bool);
+ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
+-				 struct inode *inode, blkcnt_t *count)
++				 struct inode *inode, blkcnt_t *count, bool partial)
+ {
+ 	blkcnt_t diff = 0, release = 0;
+ 	block_t avail_user_block_count;
+@@ -2292,6 +2292,11 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi,
+ 			avail_user_block_count = 0;
+ 	}
+ 	if (unlikely(sbi->total_valid_block_count > avail_user_block_count)) {
++		if (!partial) {
++			spin_unlock(&sbi->stat_lock);
++			goto enospc;
++		}
++
+ 		diff = sbi->total_valid_block_count - avail_user_block_count;
+ 		if (diff > *count)
+ 			diff = *count;
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 941e02c0953cc..1ff1c45e19271 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3614,14 +3614,16 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 		blkcnt_t reserved;
+ 		int ret;
+ 
+-		for (i = 0; i < cluster_size; i++, dn->ofs_in_node++) {
+-			blkaddr = f2fs_data_blkaddr(dn);
++		for (i = 0; i < cluster_size; i++) {
++			blkaddr = data_blkaddr(dn->inode, dn->node_page,
++						dn->ofs_in_node + i);
+ 
+ 			if (i == 0) {
+-				if (blkaddr == COMPRESS_ADDR)
+-					continue;
+-				dn->ofs_in_node += cluster_size;
+-				goto next;
++				if (blkaddr != COMPRESS_ADDR) {
++					dn->ofs_in_node += cluster_size;
++					goto next;
++				}
++				continue;
+ 			}
+ 
+ 			/*
+@@ -3634,8 +3636,6 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 				compr_blocks++;
+ 				continue;
+ 			}
+-
+-			f2fs_set_data_blkaddr(dn, NEW_ADDR);
+ 		}
+ 
+ 		reserved = cluster_size - compr_blocks;
+@@ -3644,12 +3644,14 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 		if (reserved == 1)
+ 			goto next;
+ 
+-		ret = inc_valid_block_count(sbi, dn->inode, &reserved);
+-		if (ret)
++		ret = inc_valid_block_count(sbi, dn->inode, &reserved, false);
++		if (unlikely(ret))
+ 			return ret;
+ 
+-		if (reserved != cluster_size - compr_blocks)
+-			return -ENOSPC;
++		for (i = 0; i < cluster_size; i++, dn->ofs_in_node++) {
++			if (f2fs_data_blkaddr(dn) == NULL_ADDR)
++				f2fs_set_data_blkaddr(dn, NEW_ADDR);
++		}
+ 
+ 		f2fs_i_compr_blocks_update(dn->inode, compr_blocks, true);
+ 
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 4c8836ded90fc..ef5b3848426b0 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -248,7 +248,7 @@ static int __replace_atomic_write_block(struct inode *inode, pgoff_t index,
+ 	} else {
+ 		blkcnt_t count = 1;
+ 
+-		err = inc_valid_block_count(sbi, inode, &count);
++		err = inc_valid_block_count(sbi, inode, &count, true);
+ 		if (err) {
+ 			f2fs_put_dnode(&dn);
+ 			return err;
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-to-check-compress-flag-w-.i_sem-lo.patch b/queue-6.8/f2fs-compress-fix-to-check-compress-flag-w-.i_sem-lo.patch
new file mode 100644
index 00000000000..58c1ee64e35
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-to-check-compress-flag-w-.i_sem-lo.patch
@@ -0,0 +1,53 @@
+From 05d4df5995a9191544e9b8348874201e960eb15e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 10:28:44 +0800
+Subject: f2fs: compress: fix to check compress flag w/ .i_sem lock
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit ea59b12ac69774c08aa95cd5b6100700ea0cce97 ]
+
+It needs to check compress flag w/ .i_sem lock, otherwise, compressed
+inode may be disabled after the check condition, it's not needed to
+set compress option on non-compress inode.
+
+Fixes: e1e8debec656 ("f2fs: add F2FS_IOC_SET_COMPRESS_OPTION ioctl")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 1ff1c45e19271..caab20648b951 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3994,16 +3994,20 @@ static int f2fs_ioc_set_compress_option(struct file *filp, unsigned long arg)
+ 				sizeof(option)))
+ 		return -EFAULT;
+ 
+-	if (!f2fs_compressed_file(inode) ||
+-			option.log_cluster_size < MIN_COMPRESS_LOG_SIZE ||
+-			option.log_cluster_size > MAX_COMPRESS_LOG_SIZE ||
+-			option.algorithm >= COMPRESS_MAX)
++	if (option.log_cluster_size < MIN_COMPRESS_LOG_SIZE ||
++		option.log_cluster_size > MAX_COMPRESS_LOG_SIZE ||
++		option.algorithm >= COMPRESS_MAX)
+ 		return -EINVAL;
+ 
+ 	file_start_write(filp);
+ 	inode_lock(inode);
+ 
+ 	f2fs_down_write(&F2FS_I(inode)->i_sem);
++	if (!f2fs_compressed_file(inode)) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	if (f2fs_is_mmap_file(inode) || get_dirty_pages(inode)) {
+ 		ret = -EBUSY;
+ 		goto out;
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch b/queue-6.8/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
new file mode 100644
index 00000000000..6691e62e588
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
@@ -0,0 +1,56 @@
+From 07605e451d299bd819e9ca659eff2787ec1a8a53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 03:41:29 +0800
+Subject: f2fs: compress: fix to check unreleased compressed cluster
+
+From: Sheng Yong <shengyong@oppo.com>
+
+[ Upstream commit eb8fbaa53374e0a2d4381190abfe708481517bbb ]
+
+Compressed cluster may not be released due to we can fail in
+release_compress_blocks(), fix to handle reserved compressed
+cluster correctly in reserve_compress_blocks().
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Sheng Yong <shengyong@oppo.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index b58ab1157b7ef..941e02c0953cc 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3624,7 +3624,13 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 				goto next;
+ 			}
+ 
+-			if (__is_valid_data_blkaddr(blkaddr)) {
++			/*
++			 * compressed cluster was not released due to it
++			 * fails in release_compress_blocks(), so NEW_ADDR
++			 * is a possible case.
++			 */
++			if (blkaddr == NEW_ADDR ||
++				__is_valid_data_blkaddr(blkaddr)) {
+ 				compr_blocks++;
+ 				continue;
+ 			}
+@@ -3633,6 +3639,11 @@ static int reserve_compress_blocks(struct dnode_of_data *dn, pgoff_t count)
+ 		}
+ 
+ 		reserved = cluster_size - compr_blocks;
++
++		/* for the case all blocks in cluster were reserved */
++		if (reserved == 1)
++			goto next;
++
+ 		ret = inc_valid_block_count(sbi, dn->inode, &reserved);
+ 		if (ret)
+ 			return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-to-check-zstd-compress-level-corre.patch b/queue-6.8/f2fs-compress-fix-to-check-zstd-compress-level-corre.patch
new file mode 100644
index 00000000000..a25e9d8983f
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-to-check-zstd-compress-level-corre.patch
@@ -0,0 +1,60 @@
+From 0190125aeb13c4d7c1a10c66dcb5a1a004be0a96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 00:08:18 +0800
+Subject: f2fs: compress: fix to check zstd compress level correctly in mount
+ option
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit e39602da752cd1d0462e3fa04074146f6f2803f6 ]
+
+f2fs only support to config zstd compress level w/ a positive number due
+to layout design, but since commit e0c1b49f5b67 ("lib: zstd: Upgrade to
+latest upstream zstd version 1.4.10"), zstd supports negative compress
+level, so that zstd_min_clevel() may return a negative number, then w/
+below mount option, .compress_level can be configed w/ a negative number,
+which is not allowed to f2fs, let's add check condition to avoid it.
+
+mount -o compress_algorithm=zstd:4294967295 /dev/sdx /mnt/f2fs
+
+Fixes: 00e120b5e4b5 ("f2fs: assign default compression level")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 18cc4829f7e82..e64ce5abcdf44 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -663,7 +663,7 @@ static int f2fs_set_lz4hc_level(struct f2fs_sb_info *sbi, const char *str)
+ #ifdef CONFIG_F2FS_FS_ZSTD
+ static int f2fs_set_zstd_level(struct f2fs_sb_info *sbi, const char *str)
+ {
+-	unsigned int level;
++	int level;
+ 	int len = 4;
+ 
+ 	if (strlen(str) == len) {
+@@ -677,9 +677,15 @@ static int f2fs_set_zstd_level(struct f2fs_sb_info *sbi, const char *str)
+ 		f2fs_info(sbi, "wrong format, e.g. <alg_name>:<compr_level>");
+ 		return -EINVAL;
+ 	}
+-	if (kstrtouint(str + 1, 10, &level))
++	if (kstrtoint(str + 1, 10, &level))
+ 		return -EINVAL;
+ 
++	/* f2fs does not support negative compress level now */
++	if (level < 0) {
++		f2fs_info(sbi, "do not support negative compress level: %d", level);
++		return -ERANGE;
++	}
++
+ 	if (!f2fs_is_compress_level_valid(COMPRESS_ZSTD, level)) {
+ 		f2fs_info(sbi, "invalid zstd compress level: %d", level);
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-to-cover-f2fs_disable_compressed_f.patch b/queue-6.8/f2fs-compress-fix-to-cover-f2fs_disable_compressed_f.patch
new file mode 100644
index 00000000000..ea3ed192ebc
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-to-cover-f2fs_disable_compressed_f.patch
@@ -0,0 +1,63 @@
+From 38d87f77a0446e071b91fa670b6e911e4eb45fde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 10:23:13 +0800
+Subject: f2fs: compress: fix to cover f2fs_disable_compressed_file() w/ i_sem
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 2f9420d3a94aeebd92db88f00f4f2f1a3bd3f6cf ]
+
+- f2fs_disable_compressed_file
+  - check inode_has_data
+					- f2fs_file_mmap
+					- mkwrite
+					 - f2fs_get_block_locked
+					 : update metadata in compressed
+					   inode's disk layout
+  - fi->i_flags &= ~F2FS_COMPR_FL
+  - clear_inode_flag(inode, FI_COMPRESSED_FILE);
+
+we should use i_sem lock to prevent above race case.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index e4e249dd4c712..03c0d2e996fff 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -4406,15 +4406,24 @@ static inline bool f2fs_disable_compressed_file(struct inode *inode)
+ {
+ 	struct f2fs_inode_info *fi = F2FS_I(inode);
+ 
+-	if (!f2fs_compressed_file(inode))
++	f2fs_down_write(&F2FS_I(inode)->i_sem);
++
++	if (!f2fs_compressed_file(inode)) {
++		f2fs_up_write(&F2FS_I(inode)->i_sem);
+ 		return true;
+-	if (S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode))
++	}
++	if (f2fs_is_mmap_file(inode) ||
++		(S_ISREG(inode->i_mode) && F2FS_HAS_BLOCKS(inode))) {
++		f2fs_up_write(&F2FS_I(inode)->i_sem);
+ 		return false;
++	}
+ 
+ 	fi->i_flags &= ~F2FS_COMPR_FL;
+ 	stat_dec_compr_inode(inode);
+ 	clear_inode_flag(inode, FI_COMPRESSED_FILE);
+ 	f2fs_mark_inode_dirty_sync(inode, true);
++
++	f2fs_up_write(&F2FS_I(inode)->i_sem);
+ 	return true;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch b/queue-6.8/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
new file mode 100644
index 00000000000..4688e79540d
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
@@ -0,0 +1,125 @@
+From 3922c81592d7ac5f0c773fbf400bfd976e3474a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 03:41:28 +0800
+Subject: f2fs: compress: fix to cover normal cluster write with cp_rwsem
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit fd244524c2cf07b5f4c3fe8abd6a99225c76544b ]
+
+When we overwrite compressed cluster w/ normal cluster, we should
+not unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data
+will be corrupted if partial blocks were persisted before CP & SPOR,
+due to cluster metadata wasn't updated atomically.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 27 ++++++++++++++++++---------
+ fs/f2fs/data.c     |  3 ++-
+ 2 files changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 3a8d8a213b406..ff26b49c0d71f 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1443,12 +1443,14 @@ void f2fs_compress_write_end_io(struct bio *bio, struct page *page)
+ }
+ 
+ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+-					int *submitted,
++					int *submitted_p,
+ 					struct writeback_control *wbc,
+ 					enum iostat_type io_type)
+ {
+ 	struct address_space *mapping = cc->inode->i_mapping;
+-	int _submitted, compr_blocks, ret, i;
++	struct f2fs_sb_info *sbi = F2FS_M_SB(mapping);
++	int submitted, compr_blocks, i;
++	int ret = 0;
+ 
+ 	compr_blocks = f2fs_compressed_blocks(cc);
+ 
+@@ -1463,6 +1465,10 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 	if (compr_blocks < 0)
+ 		return compr_blocks;
+ 
++	/* overwrite compressed cluster w/ normal cluster */
++	if (compr_blocks > 0)
++		f2fs_lock_op(sbi);
++
+ 	for (i = 0; i < cc->cluster_size; i++) {
+ 		if (!cc->rpages[i])
+ 			continue;
+@@ -1487,7 +1493,7 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 		if (!clear_page_dirty_for_io(cc->rpages[i]))
+ 			goto continue_unlock;
+ 
+-		ret = f2fs_write_single_data_page(cc->rpages[i], &_submitted,
++		ret = f2fs_write_single_data_page(cc->rpages[i], &submitted,
+ 						NULL, NULL, wbc, io_type,
+ 						compr_blocks, false);
+ 		if (ret) {
+@@ -1495,26 +1501,29 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc,
+ 				unlock_page(cc->rpages[i]);
+ 				ret = 0;
+ 			} else if (ret == -EAGAIN) {
++				ret = 0;
+ 				/*
+ 				 * for quota file, just redirty left pages to
+ 				 * avoid deadlock caused by cluster update race
+ 				 * from foreground operation.
+ 				 */
+ 				if (IS_NOQUOTA(cc->inode))
+-					return 0;
+-				ret = 0;
++					goto out;
+ 				f2fs_io_schedule_timeout(DEFAULT_IO_TIMEOUT);
+ 				goto retry_write;
+ 			}
+-			return ret;
++			goto out;
+ 		}
+ 
+-		*submitted += _submitted;
++		*submitted_p += submitted;
+ 	}
+ 
+-	f2fs_balance_fs(F2FS_M_SB(mapping), true);
++out:
++	if (compr_blocks > 0)
++		f2fs_unlock_op(sbi);
+ 
+-	return 0;
++	f2fs_balance_fs(sbi, true);
++	return ret;
+ }
+ 
+ int f2fs_write_multi_pages(struct compress_ctx *cc,
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index d00e92b6c9025..7a93a99fbd04b 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2839,7 +2839,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 		.encrypted_page = NULL,
+ 		.submitted = 0,
+ 		.compr_blocks = compr_blocks,
+-		.need_lock = LOCK_RETRY,
++		.need_lock = compr_blocks ? LOCK_DONE : LOCK_RETRY,
+ 		.post_read = f2fs_post_read_required(inode) ? 1 : 0,
+ 		.io_type = io_type,
+ 		.io_wbc = wbc,
+@@ -2920,6 +2920,7 @@ int f2fs_write_single_data_page(struct page *page, int *submitted,
+ 	if (err == -EAGAIN) {
+ 		err = f2fs_do_write_data_page(&fio);
+ 		if (err == -EAGAIN) {
++			f2fs_bug_on(sbi, compr_blocks);
+ 			fio.need_lock = LOCK_REQ;
+ 			err = f2fs_do_write_data_page(&fio);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-fix-to-guarantee-persisting-compressed.patch b/queue-6.8/f2fs-compress-fix-to-guarantee-persisting-compressed.patch
new file mode 100644
index 00000000000..91f20c7c762
--- /dev/null
+++ b/queue-6.8/f2fs-compress-fix-to-guarantee-persisting-compressed.patch
@@ -0,0 +1,148 @@
+From cca9c299505244acf002016e850bac9207243870 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 03:41:27 +0800
+Subject: f2fs: compress: fix to guarantee persisting compressed blocks by CP
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 8a430dd49e9cb021372b0ad91e60aeef9c6ced00 ]
+
+If data block in compressed cluster is not persisted with metadata
+during checkpoint, after SPOR, the data may be corrupted, let's
+guarantee to write compressed page by checkpoint.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c |  4 +++-
+ fs/f2fs/data.c     | 17 +++++++++--------
+ fs/f2fs/f2fs.h     |  4 +++-
+ 3 files changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index 531517dac0796..3a8d8a213b406 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1418,6 +1418,8 @@ void f2fs_compress_write_end_io(struct bio *bio, struct page *page)
+ 	struct f2fs_sb_info *sbi = bio->bi_private;
+ 	struct compress_io_ctx *cic =
+ 			(struct compress_io_ctx *)page_private(page);
++	enum count_type type = WB_DATA_TYPE(page,
++				f2fs_is_compressed_page(page));
+ 	int i;
+ 
+ 	if (unlikely(bio->bi_status))
+@@ -1425,7 +1427,7 @@ void f2fs_compress_write_end_io(struct bio *bio, struct page *page)
+ 
+ 	f2fs_compress_free_page(page);
+ 
+-	dec_page_count(sbi, F2FS_WB_DATA);
++	dec_page_count(sbi, type);
+ 
+ 	if (atomic_dec_return(&cic->pending_pages))
+ 		return;
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 26e317696b338..d00e92b6c9025 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -48,7 +48,7 @@ void f2fs_destroy_bioset(void)
+ 	bioset_exit(&f2fs_bioset);
+ }
+ 
+-static bool __is_cp_guaranteed(struct page *page)
++bool f2fs_is_cp_guaranteed(struct page *page)
+ {
+ 	struct address_space *mapping = page->mapping;
+ 	struct inode *inode;
+@@ -65,8 +65,6 @@ static bool __is_cp_guaranteed(struct page *page)
+ 			S_ISDIR(inode->i_mode))
+ 		return true;
+ 
+-	if (f2fs_is_compressed_page(page))
+-		return false;
+ 	if ((S_ISREG(inode->i_mode) && IS_NOQUOTA(inode)) ||
+ 			page_private_gcing(page))
+ 		return true;
+@@ -338,7 +336,7 @@ static void f2fs_write_end_io(struct bio *bio)
+ 
+ 	bio_for_each_segment_all(bvec, bio, iter_all) {
+ 		struct page *page = bvec->bv_page;
+-		enum count_type type = WB_DATA_TYPE(page);
++		enum count_type type = WB_DATA_TYPE(page, false);
+ 
+ 		if (page_private_dummy(page)) {
+ 			clear_page_private_dummy(page);
+@@ -762,7 +760,7 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio)
+ 		wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
+ 
+ 	inc_page_count(fio->sbi, is_read_io(fio->op) ?
+-			__read_io_type(page) : WB_DATA_TYPE(fio->page));
++			__read_io_type(page) : WB_DATA_TYPE(fio->page, false));
+ 
+ 	if (is_read_io(bio_op(bio)))
+ 		f2fs_submit_read_bio(fio->sbi, bio, fio->type);
+@@ -973,7 +971,7 @@ int f2fs_merge_page_bio(struct f2fs_io_info *fio)
+ 	if (fio->io_wbc)
+ 		wbc_account_cgroup_owner(fio->io_wbc, fio->page, PAGE_SIZE);
+ 
+-	inc_page_count(fio->sbi, WB_DATA_TYPE(page));
++	inc_page_count(fio->sbi, WB_DATA_TYPE(page, false));
+ 
+ 	*fio->last_block = fio->new_blkaddr;
+ 	*fio->bio = bio;
+@@ -1007,6 +1005,7 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 	enum page_type btype = PAGE_TYPE_OF_BIO(fio->type);
+ 	struct f2fs_bio_info *io = sbi->write_io[btype] + fio->temp;
+ 	struct page *bio_page;
++	enum count_type type;
+ 
+ 	f2fs_bug_on(sbi, is_read_io(fio->op));
+ 
+@@ -1046,7 +1045,8 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 	/* set submitted = true as a return value */
+ 	fio->submitted = 1;
+ 
+-	inc_page_count(sbi, WB_DATA_TYPE(bio_page));
++	type = WB_DATA_TYPE(bio_page, fio->compressed_page);
++	inc_page_count(sbi, type);
+ 
+ 	if (io->bio &&
+ 	    (!io_is_mergeable(sbi, io->bio, io, fio, io->last_block_in_bio,
+@@ -1059,7 +1059,8 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 		if (F2FS_IO_ALIGNED(sbi) &&
+ 				(fio->type == DATA || fio->type == NODE) &&
+ 				fio->new_blkaddr & F2FS_IO_SIZE_MASK(sbi)) {
+-			dec_page_count(sbi, WB_DATA_TYPE(bio_page));
++			dec_page_count(sbi, WB_DATA_TYPE(bio_page,
++						fio->compressed_page));
+ 			fio->retry = 1;
+ 			goto skip;
+ 		}
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 31554e2a0a320..99511d9a92c0c 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -1080,7 +1080,8 @@ struct f2fs_sm_info {
+  * f2fs monitors the number of several block types such as on-writeback,
+  * dirty dentry blocks, dirty node blocks, and dirty meta blocks.
+  */
+-#define WB_DATA_TYPE(p)	(__is_cp_guaranteed(p) ? F2FS_WB_CP_DATA : F2FS_WB_DATA)
++#define WB_DATA_TYPE(p, f)			\
++	(f || f2fs_is_cp_guaranteed(p) ? F2FS_WB_CP_DATA : F2FS_WB_DATA)
+ enum count_type {
+ 	F2FS_DIRTY_DENTS,
+ 	F2FS_DIRTY_DATA,
+@@ -3804,6 +3805,7 @@ void f2fs_init_ckpt_req_control(struct f2fs_sb_info *sbi);
+  */
+ int __init f2fs_init_bioset(void);
+ void f2fs_destroy_bioset(void);
++bool f2fs_is_cp_guaranteed(struct page *page);
+ int f2fs_init_bio_entry_cache(void);
+ void f2fs_destroy_bio_entry_cache(void);
+ void f2fs_submit_read_bio(struct f2fs_sb_info *sbi, struct bio *bio,
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-compress-relocate-some-judgments-in-f2fs_reserv.patch b/queue-6.8/f2fs-compress-relocate-some-judgments-in-f2fs_reserv.patch
new file mode 100644
index 00000000000..68e2d66e3ec
--- /dev/null
+++ b/queue-6.8/f2fs-compress-relocate-some-judgments-in-f2fs_reserv.patch
@@ -0,0 +1,63 @@
+From 4221ea495da9a4ec489827b62a6e5d6aa5fd476a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 11:47:45 +0800
+Subject: f2fs: compress: relocate some judgments in
+ f2fs_reserve_compress_blocks
+
+From: Xiuhong Wang <xiuhong.wang@unisoc.com>
+
+[ Upstream commit b7d797d241c154d73ec5523f87f3b06d4f299da1 ]
+
+The following f2fs_io test will get a "0" result instead of -EINVAL,
+unisoc # ./f2fs_io compress file
+unisoc # ./f2fs_io reserve_cblocks file
+ 0
+it's not reasonable, so the judgement of
+atomic_read(&F2FS_I(inode)->i_compr_blocks) should be placed after
+the judgement of is_inode_flag_set(inode, FI_COMPRESS_RELEASED).
+
+Fixes: c75488fb4d82 ("f2fs: introduce F2FS_IOC_RESERVE_COMPRESS_BLOCKS")
+Signed-off-by: Xiuhong Wang <xiuhong.wang@unisoc.com>
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index caab20648b951..3da9a298c50a7 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3684,9 +3684,6 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (atomic_read(&F2FS_I(inode)->i_compr_blocks))
+-		goto out;
+-
+ 	f2fs_balance_fs(sbi, true);
+ 
+ 	inode_lock(inode);
+@@ -3696,6 +3693,9 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 		goto unlock_inode;
+ 	}
+ 
++	if (atomic_read(&F2FS_I(inode)->i_compr_blocks))
++		goto unlock_inode;
++
+ 	f2fs_down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]);
+ 	filemap_invalidate_lock(inode->i_mapping);
+ 
+@@ -3742,7 +3742,6 @@ static int f2fs_reserve_compress_blocks(struct file *filp, unsigned long arg)
+ 	}
+ unlock_inode:
+ 	inode_unlock(inode);
+-out:
+ 	mnt_drop_write_file(filp);
+ 
+ 	if (ret >= 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-fix-null-pointer-dereference-in-f2fs_submit_pag.patch b/queue-6.8/f2fs-fix-null-pointer-dereference-in-f2fs_submit_pag.patch
new file mode 100644
index 00000000000..1cb32a7c22d
--- /dev/null
+++ b/queue-6.8/f2fs-fix-null-pointer-dereference-in-f2fs_submit_pag.patch
@@ -0,0 +1,77 @@
+From 0af4c1be6f6f958660e9b9fc59be0bb7d3ea353e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 22:11:38 +0800
+Subject: f2fs: fix NULL pointer dereference in f2fs_submit_page_write()
+
+From: Wenjie Qi <qwjhust@gmail.com>
+
+[ Upstream commit c2034ef6192a65a986a45c2aa2ed05824fdc0e9f ]
+
+BUG: kernel NULL pointer dereference, address: 0000000000000014
+RIP: 0010:f2fs_submit_page_write+0x6cf/0x780 [f2fs]
+Call Trace:
+<TASK>
+? show_regs+0x6e/0x80
+? __die+0x29/0x70
+? page_fault_oops+0x154/0x4a0
+? prb_read_valid+0x20/0x30
+? __irq_work_queue_local+0x39/0xd0
+? irq_work_queue+0x36/0x70
+? do_user_addr_fault+0x314/0x6c0
+? exc_page_fault+0x7d/0x190
+? asm_exc_page_fault+0x2b/0x30
+? f2fs_submit_page_write+0x6cf/0x780 [f2fs]
+? f2fs_submit_page_write+0x736/0x780 [f2fs]
+do_write_page+0x50/0x170 [f2fs]
+f2fs_outplace_write_data+0x61/0xb0 [f2fs]
+f2fs_do_write_data_page+0x3f8/0x660 [f2fs]
+f2fs_write_single_data_page+0x5bb/0x7a0 [f2fs]
+f2fs_write_cache_pages+0x3da/0xbe0 [f2fs]
+...
+It is possible that other threads have added this fio to io->bio
+and submitted the io->bio before entering f2fs_submit_page_write().
+At this point io->bio = NULL.
+If is_end_zone_blkaddr(sbi, fio->new_blkaddr) of this fio is true,
+then an NULL pointer dereference error occurs at bio_get(io->bio).
+The original code for determining zone end was after "out:",
+which would have missed some fio who is zone end. I've moved
+ this code before "skip:" to make sure it's done for each fio.
+
+Fixes: e067dc3c6b9c ("f2fs: maintain six open zones for zoned devices")
+Signed-off-by: Wenjie Qi <qwjhust@gmail.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index ac82e69a9f5fd..05158f89ef32d 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1080,10 +1080,6 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 	io->last_block_in_bio = fio->new_blkaddr;
+ 
+ 	trace_f2fs_submit_page_write(fio->page, fio);
+-skip:
+-	if (fio->in_list)
+-		goto next;
+-out:
+ #ifdef CONFIG_BLK_DEV_ZONED
+ 	if (f2fs_sb_has_blkzoned(sbi) && btype < META &&
+ 			is_end_zone_blkaddr(sbi, fio->new_blkaddr)) {
+@@ -1096,6 +1092,10 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 		__submit_merged_bio(io);
+ 	}
+ #endif
++skip:
++	if (fio->in_list)
++		goto next;
++out:
+ 	if (is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN) ||
+ 				!f2fs_is_checkpoint_ready(sbi))
+ 		__submit_merged_bio(io);
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-fix-to-avoid-potential-panic-during-recovery.patch b/queue-6.8/f2fs-fix-to-avoid-potential-panic-during-recovery.patch
new file mode 100644
index 00000000000..d2593d11934
--- /dev/null
+++ b/queue-6.8/f2fs-fix-to-avoid-potential-panic-during-recovery.patch
@@ -0,0 +1,109 @@
+From 86a36be770a4e4e70dc468254122777e57b45a3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 22:49:15 +0800
+Subject: f2fs: fix to avoid potential panic during recovery
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 21ec68234826b1b54ab980a8df6e33c74cfbee58 ]
+
+During recovery, if FAULT_BLOCK is on, it is possible that
+f2fs_reserve_new_block() will return -ENOSPC during recovery,
+then it may trigger panic.
+
+Also, if fault injection rate is 1 and only FAULT_BLOCK fault
+type is on, it may encounter deadloop in loop of block reservation.
+
+Let's change as below to fix these issues:
+- remove bug_on() to avoid panic.
+- limit the loop count of block reservation to avoid potential
+deadloop.
+
+Fixes: 956fa1ddc132 ("f2fs: fix to check return value of f2fs_reserve_new_block()")
+Reported-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h     |  5 +++++
+ fs/f2fs/recovery.c | 33 ++++++++++++++++-----------------
+ 2 files changed, 21 insertions(+), 17 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 03c0d2e996fff..cadda74e06f61 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -75,6 +75,11 @@ struct f2fs_fault_info {
+ 
+ extern const char *f2fs_fault_name[FAULT_MAX];
+ #define IS_FAULT_SET(fi, type) ((fi)->inject_type & BIT(type))
++
++/* maximum retry count for injected failure */
++#define DEFAULT_FAILURE_RETRY_COUNT		8
++#else
++#define DEFAULT_FAILURE_RETRY_COUNT		1
+ #endif
+ 
+ /*
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index d0f24ccbd1ac6..aad1d1a9b3d64 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -611,6 +611,19 @@ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi,
+ 	return 0;
+ }
+ 
++static int f2fs_reserve_new_block_retry(struct dnode_of_data *dn)
++{
++	int i, err = 0;
++
++	for (i = DEFAULT_FAILURE_RETRY_COUNT; i > 0; i--) {
++		err = f2fs_reserve_new_block(dn);
++		if (!err)
++			break;
++	}
++
++	return err;
++}
++
+ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+ 					struct page *page)
+ {
+@@ -712,14 +725,8 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+ 		 */
+ 		if (dest == NEW_ADDR) {
+ 			f2fs_truncate_data_blocks_range(&dn, 1);
+-			do {
+-				err = f2fs_reserve_new_block(&dn);
+-				if (err == -ENOSPC) {
+-					f2fs_bug_on(sbi, 1);
+-					break;
+-				}
+-			} while (err &&
+-				IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION));
++
++			err = f2fs_reserve_new_block_retry(&dn);
+ 			if (err)
+ 				goto err;
+ 			continue;
+@@ -727,16 +734,8 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode,
+ 
+ 		/* dest is valid block, try to recover from src to dest */
+ 		if (f2fs_is_valid_blkaddr(sbi, dest, META_POR)) {
+-
+ 			if (src == NULL_ADDR) {
+-				do {
+-					err = f2fs_reserve_new_block(&dn);
+-					if (err == -ENOSPC) {
+-						f2fs_bug_on(sbi, 1);
+-						break;
+-					}
+-				} while (err &&
+-					IS_ENABLED(CONFIG_F2FS_FAULT_INJECTION));
++				err = f2fs_reserve_new_block_retry(&dn);
+ 				if (err)
+ 					goto err;
+ 			}
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filem.patch b/queue-6.8/f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filem.patch
new file mode 100644
index 00000000000..347a7ffbf23
--- /dev/null
+++ b/queue-6.8/f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filem.patch
@@ -0,0 +1,77 @@
+From ac0e7bc3de483be5109a7a005e4d481904450390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2024 10:05:28 +0800
+Subject: f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit eb70d5a6c932d9d23f4bb3e7b83782c21ac4b064 ]
+
+syzbot reports a f2fs bug as below:
+
+BUG: KASAN: slab-use-after-free in f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49
+Read of size 8 at addr ffff88807bb22680 by task syz-executor184/5058
+
+CPU: 0 PID: 5058 Comm: syz-executor184 Not tainted 6.7.0-syzkaller-09928-g052d534373b7 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:377 [inline]
+ print_report+0x163/0x540 mm/kasan/report.c:488
+ kasan_report+0x142/0x170 mm/kasan/report.c:601
+ f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49
+ __do_fault+0x131/0x450 mm/memory.c:4376
+ do_shared_fault mm/memory.c:4798 [inline]
+ do_fault mm/memory.c:4872 [inline]
+ do_pte_missing mm/memory.c:3745 [inline]
+ handle_pte_fault mm/memory.c:5144 [inline]
+ __handle_mm_fault+0x23b7/0x72b0 mm/memory.c:5285
+ handle_mm_fault+0x27e/0x770 mm/memory.c:5450
+ do_user_addr_fault arch/x86/mm/fault.c:1364 [inline]
+ handle_page_fault arch/x86/mm/fault.c:1507 [inline]
+ exc_page_fault+0x456/0x870 arch/x86/mm/fault.c:1563
+ asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
+
+The root cause is: in f2fs_filemap_fault(), vmf->vma may be not alive after
+filemap_fault(), so it may cause use-after-free issue when accessing
+vmf->vma->vm_flags in trace_f2fs_filemap_fault(). So it needs to keep vm_flags
+in separated temporary variable for tracepoint use.
+
+Fixes: 87f3afd366f7 ("f2fs: add tracepoint for f2fs_vm_page_mkwrite()")
+Reported-and-tested-by: syzbot+763afad57075d3f862f2@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/lkml/000000000000e8222b060f00db3b@google.com
+Cc: Ed Tsai <Ed.Tsai@mediatek.com>
+Suggested-by: Hillf Danton <hdanton@sina.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index ffe7fca39a8e8..51970b345eeee 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -39,6 +39,7 @@
+ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+ {
+ 	struct inode *inode = file_inode(vmf->vma->vm_file);
++	vm_flags_t flags = vmf->vma->vm_flags;
+ 	vm_fault_t ret;
+ 
+ 	ret = filemap_fault(vmf);
+@@ -46,7 +47,7 @@ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+ 		f2fs_update_iostat(F2FS_I_SB(inode), inode,
+ 					APP_MAPPED_READ_IO, F2FS_BLKSIZE);
+ 
+-	trace_f2fs_filemap_fault(inode, vmf->pgoff, vmf->vma->vm_flags, ret);
++	trace_f2fs_filemap_fault(inode, vmf->pgoff, flags, ret);
+ 
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-fix-to-create-selinux-label-during-whiteout-ini.patch b/queue-6.8/f2fs-fix-to-create-selinux-label-during-whiteout-ini.patch
new file mode 100644
index 00000000000..cc59546961c
--- /dev/null
+++ b/queue-6.8/f2fs-fix-to-create-selinux-label-during-whiteout-ini.patch
@@ -0,0 +1,142 @@
+From 6259e545de3055273cf4966e4da3c870dcfc4a33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 15:05:48 +0800
+Subject: f2fs: fix to create selinux label during whiteout initialization
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 40b2d55e045222dd6de2a54a299f682e0f954b03 ]
+
+generic/700       - output mismatch (see /media/fstests/results//generic/700.out.bad)
+    --- tests/generic/700.out	2023-03-28 10:40:42.735529223 +0000
+    +++ /media/fstests/results//generic/700.out.bad	2024-02-06 04:37:56.000000000 +0000
+    @@ -1,2 +1,4 @@
+     QA output created by 700
+    +/mnt/scratch_f2fs/f1: security.selinux: No such attribute
+    +/mnt/scratch_f2fs/f2: security.selinux: No such attribute
+     Silence is golden
+    ...
+    (Run 'diff -u /media/fstests/tests/generic/700.out /media/fstests/results//generic/700.out.bad'  to see the entire diff)
+
+HINT: You _MAY_ be missing kernel fix:
+      70b589a37e1a xfs: add selinux labels to whiteout inodes
+
+Previously, it missed to create selinux labels during whiteout inode
+initialization, fix this issue.
+
+Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/dir.c   |  5 +++--
+ fs/f2fs/f2fs.h  |  3 ++-
+ fs/f2fs/namei.c | 25 +++++++++++++++++--------
+ 3 files changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c
+index 042593aed1ec0..1b937f7d0414f 100644
+--- a/fs/f2fs/dir.c
++++ b/fs/f2fs/dir.c
+@@ -830,13 +830,14 @@ int f2fs_do_add_link(struct inode *dir, const struct qstr *name,
+ 	return err;
+ }
+ 
+-int f2fs_do_tmpfile(struct inode *inode, struct inode *dir)
++int f2fs_do_tmpfile(struct inode *inode, struct inode *dir,
++					struct f2fs_filename *fname)
+ {
+ 	struct page *page;
+ 	int err = 0;
+ 
+ 	f2fs_down_write(&F2FS_I(inode)->i_sem);
+-	page = f2fs_init_inode_metadata(inode, dir, NULL, NULL);
++	page = f2fs_init_inode_metadata(inode, dir, fname, NULL);
+ 	if (IS_ERR(page)) {
+ 		err = PTR_ERR(page);
+ 		goto fail;
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index cadda74e06f61..eb12d1f6cd96f 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3579,7 +3579,8 @@ int f2fs_do_add_link(struct inode *dir, const struct qstr *name,
+ 			struct inode *inode, nid_t ino, umode_t mode);
+ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,
+ 			struct inode *dir, struct inode *inode);
+-int f2fs_do_tmpfile(struct inode *inode, struct inode *dir);
++int f2fs_do_tmpfile(struct inode *inode, struct inode *dir,
++					struct f2fs_filename *fname);
+ bool f2fs_empty_dir(struct inode *dir);
+ 
+ static inline int f2fs_add_link(struct dentry *dentry, struct inode *inode)
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index b3bb815fc6aa4..550cc811e008a 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -852,7 +852,7 @@ static int f2fs_mknod(struct mnt_idmap *idmap, struct inode *dir,
+ 
+ static int __f2fs_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
+ 			  struct file *file, umode_t mode, bool is_whiteout,
+-			  struct inode **new_inode)
++			  struct inode **new_inode, struct f2fs_filename *fname)
+ {
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(dir);
+ 	struct inode *inode;
+@@ -880,7 +880,7 @@ static int __f2fs_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
+ 	if (err)
+ 		goto out;
+ 
+-	err = f2fs_do_tmpfile(inode, dir);
++	err = f2fs_do_tmpfile(inode, dir, fname);
+ 	if (err)
+ 		goto release_out;
+ 
+@@ -931,22 +931,24 @@ static int f2fs_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
+ 	if (!f2fs_is_checkpoint_ready(sbi))
+ 		return -ENOSPC;
+ 
+-	err = __f2fs_tmpfile(idmap, dir, file, mode, false, NULL);
++	err = __f2fs_tmpfile(idmap, dir, file, mode, false, NULL, NULL);
+ 
+ 	return finish_open_simple(file, err);
+ }
+ 
+ static int f2fs_create_whiteout(struct mnt_idmap *idmap,
+-				struct inode *dir, struct inode **whiteout)
++				struct inode *dir, struct inode **whiteout,
++				struct f2fs_filename *fname)
+ {
+-	return __f2fs_tmpfile(idmap, dir, NULL,
+-				S_IFCHR | WHITEOUT_MODE, true, whiteout);
++	return __f2fs_tmpfile(idmap, dir, NULL, S_IFCHR | WHITEOUT_MODE,
++						true, whiteout, fname);
+ }
+ 
+ int f2fs_get_tmpfile(struct mnt_idmap *idmap, struct inode *dir,
+ 		     struct inode **new_inode)
+ {
+-	return __f2fs_tmpfile(idmap, dir, NULL, S_IFREG, false, new_inode);
++	return __f2fs_tmpfile(idmap, dir, NULL, S_IFREG,
++				false, new_inode, NULL);
+ }
+ 
+ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+@@ -990,7 +992,14 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ 	}
+ 
+ 	if (flags & RENAME_WHITEOUT) {
+-		err = f2fs_create_whiteout(idmap, old_dir, &whiteout);
++		struct f2fs_filename fname;
++
++		err = f2fs_setup_filename(old_dir, &old_dentry->d_name,
++							0, &fname);
++		if (err)
++			return err;
++
++		err = f2fs_create_whiteout(idmap, old_dir, &whiteout, &fname);
+ 		if (err)
+ 			return err;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-fix-to-remove-unnecessary-f2fs_bug_on-to-avoid-.patch b/queue-6.8/f2fs-fix-to-remove-unnecessary-f2fs_bug_on-to-avoid-.patch
new file mode 100644
index 00000000000..358f0a92ce5
--- /dev/null
+++ b/queue-6.8/f2fs-fix-to-remove-unnecessary-f2fs_bug_on-to-avoid-.patch
@@ -0,0 +1,41 @@
+From dbe836e79faea3fd8bd1f8902d9bfe1d18d7f339 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 03:41:31 +0800
+Subject: f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit b896e302f79678451a94769ddd9e52e954c64fbb ]
+
+verify_blkaddr() will trigger panic once we inject fault into
+f2fs_is_valid_blkaddr(), fix to remove this unnecessary f2fs_bug_on().
+
+Fixes: 18792e64c86d ("f2fs: support fault injection for f2fs_is_valid_blkaddr()")
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 9fd2143378952..e4e249dd4c712 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -3470,11 +3470,9 @@ bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
+ static inline void verify_blkaddr(struct f2fs_sb_info *sbi,
+ 					block_t blkaddr, int type)
+ {
+-	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, type)) {
++	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, type))
+ 		f2fs_err(sbi, "invalid blkaddr: %u, type: %d, run fsck to fix.",
+ 			 blkaddr, type);
+-		f2fs_bug_on(sbi, 1);
+-	}
+ }
+ 
+ static inline bool __is_valid_data_blkaddr(block_t blkaddr)
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-fix-to-truncate-meta-inode-pages-forcely.patch b/queue-6.8/f2fs-fix-to-truncate-meta-inode-pages-forcely.patch
new file mode 100644
index 00000000000..67fabbbd53a
--- /dev/null
+++ b/queue-6.8/f2fs-fix-to-truncate-meta-inode-pages-forcely.patch
@@ -0,0 +1,140 @@
+From d03b8fc67c10279eca80e9dada064e0b3b1ffffb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 09:08:34 +0800
+Subject: f2fs: fix to truncate meta inode pages forcely
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 9f0c4a46be1fe9b97dbe66d49204c1371e3ece65 ]
+
+Below race case can cause data corruption:
+
+Thread A				GC thread
+					- gc_data_segment
+					 - ra_data_block
+					  - locked meta_inode page
+- f2fs_inplace_write_data
+ - invalidate_mapping_pages
+ : fail to invalidate meta_inode page
+   due to lock failure or dirty|writeback
+   status
+ - f2fs_submit_page_bio
+ : write last dirty data to old blkaddr
+					 - move_data_block
+					  - load old data from meta_inode page
+					  - f2fs_submit_page_write
+					  : write old data to new blkaddr
+
+Because invalidate_mapping_pages() will skip invalidating page which
+has unclear status including locked, dirty, writeback and so on, so
+we need to use truncate_inode_pages_range() instead of
+invalidate_mapping_pages() to make sure meta_inode page will be dropped.
+
+Fixes: 6aa58d8ad20a ("f2fs: readahead encrypted block during GC")
+Fixes: e3b49ea36802 ("f2fs: invalidate META_MAPPING before IPU/DIO write")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/checkpoint.c    |  5 +++--
+ fs/f2fs/f2fs.h          | 28 +++++++++++++++++++++++++++-
+ fs/f2fs/segment.c       |  5 ++---
+ include/linux/f2fs_fs.h |  1 +
+ 4 files changed, 33 insertions(+), 6 deletions(-)
+
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index b0597a539fc54..9afc8d24dc369 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -1587,8 +1587,9 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
+ 	 */
+ 	if (f2fs_sb_has_encrypt(sbi) || f2fs_sb_has_verity(sbi) ||
+ 		f2fs_sb_has_compression(sbi))
+-		invalidate_mapping_pages(META_MAPPING(sbi),
+-				MAIN_BLKADDR(sbi), MAX_BLKADDR(sbi) - 1);
++		f2fs_bug_on(sbi,
++			invalidate_inode_pages2_range(META_MAPPING(sbi),
++				MAIN_BLKADDR(sbi), MAX_BLKADDR(sbi) - 1));
+ 
+ 	f2fs_release_ino_entry(sbi, false);
+ 
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 585559ea71557..5a6c35d70c7ad 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -4635,10 +4635,36 @@ static inline bool f2fs_is_readonly(struct f2fs_sb_info *sbi)
+ 	return f2fs_sb_has_readonly(sbi) || f2fs_readonly(sbi->sb);
+ }
+ 
++static inline void f2fs_truncate_meta_inode_pages(struct f2fs_sb_info *sbi,
++					block_t blkaddr, unsigned int cnt)
++{
++	bool need_submit = false;
++	int i = 0;
++
++	do {
++		struct page *page;
++
++		page = find_get_page(META_MAPPING(sbi), blkaddr + i);
++		if (page) {
++			if (PageWriteback(page))
++				need_submit = true;
++			f2fs_put_page(page, 0);
++		}
++	} while (++i < cnt && !need_submit);
++
++	if (need_submit)
++		f2fs_submit_merged_write_cond(sbi, sbi->meta_inode,
++							NULL, 0, DATA);
++
++	truncate_inode_pages_range(META_MAPPING(sbi),
++			F2FS_BLK_TO_BYTES((loff_t)blkaddr),
++			F2FS_BLK_END_BYTES((loff_t)(blkaddr + cnt - 1)));
++}
++
+ static inline void f2fs_invalidate_internal_cache(struct f2fs_sb_info *sbi,
+ 								block_t blkaddr)
+ {
+-	invalidate_mapping_pages(META_MAPPING(sbi), blkaddr, blkaddr);
++	f2fs_truncate_meta_inode_pages(sbi, blkaddr, 1);
+ 	f2fs_invalidate_compress_page(sbi, blkaddr);
+ }
+ 
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 77409e3665954..60531f50f37fe 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3653,8 +3653,7 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
+ 	}
+ 
+ 	if (fio->post_read)
+-		invalidate_mapping_pages(META_MAPPING(sbi),
+-				fio->new_blkaddr, fio->new_blkaddr);
++		f2fs_truncate_meta_inode_pages(sbi, fio->new_blkaddr, 1);
+ 
+ 	stat_inc_inplace_blocks(fio->sbi);
+ 
+@@ -3844,7 +3843,7 @@ void f2fs_wait_on_block_writeback_range(struct inode *inode, block_t blkaddr,
+ 	for (i = 0; i < len; i++)
+ 		f2fs_wait_on_block_writeback(inode, blkaddr + i);
+ 
+-	invalidate_mapping_pages(META_MAPPING(sbi), blkaddr, blkaddr + len - 1);
++	f2fs_truncate_meta_inode_pages(sbi, blkaddr, len);
+ }
+ 
+ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
+diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h
+index 053137a0fe456..3f016d3c1ec4f 100644
+--- a/include/linux/f2fs_fs.h
++++ b/include/linux/f2fs_fs.h
+@@ -27,6 +27,7 @@
+ 
+ #define F2FS_BYTES_TO_BLK(bytes)	((bytes) >> F2FS_BLKSIZE_BITS)
+ #define F2FS_BLK_TO_BYTES(blk)		((blk) << F2FS_BLKSIZE_BITS)
++#define F2FS_BLK_END_BYTES(blk)		(F2FS_BLK_TO_BYTES(blk + 1) - 1)
+ 
+ /* 0, 1(node nid), 2(meta nid) are reserved node id */
+ #define F2FS_RESERVED_NODE_NUM		3
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-fix-to-use-correct-segment-type-in-f2fs_allocat.patch b/queue-6.8/f2fs-fix-to-use-correct-segment-type-in-f2fs_allocat.patch
new file mode 100644
index 00000000000..14cc88cd0a9
--- /dev/null
+++ b/queue-6.8/f2fs-fix-to-use-correct-segment-type-in-f2fs_allocat.patch
@@ -0,0 +1,44 @@
+From 02f86f7461335e1480d9856a985a58ffdaa58808 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Feb 2024 14:36:28 +0800
+Subject: f2fs: fix to use correct segment type in f2fs_allocate_data_block()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 7324858237829733dec9c670170df2377c5ca6e2 ]
+
+@type in f2fs_allocate_data_block() indicates log header's type, it
+can be CURSEG_COLD_DATA_PINNED or CURSEG_ALL_DATA_ATGC, rather than
+type of data/node, however IS_DATASEG()/IS_NODESEG() only accept later
+one, fix it.
+
+Fixes: 093749e296e2 ("f2fs: support age threshold based garbage collection")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index ef5b3848426b0..77409e3665954 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -3491,12 +3491,12 @@ void f2fs_allocate_data_block(struct f2fs_sb_info *sbi, struct page *page,
+ 	locate_dirty_segment(sbi, GET_SEGNO(sbi, old_blkaddr));
+ 	locate_dirty_segment(sbi, GET_SEGNO(sbi, *new_blkaddr));
+ 
+-	if (IS_DATASEG(type))
++	if (IS_DATASEG(curseg->seg_type))
+ 		atomic64_inc(&sbi->allocated_data_blocks);
+ 
+ 	up_write(&sit_i->sentry_lock);
+ 
+-	if (page && IS_NODESEG(type)) {
++	if (page && IS_NODESEG(curseg->seg_type)) {
+ 		fill_node_footer_blkaddr(page, NEXT_FREE_BLKADDR(sbi, curseg));
+ 
+ 		f2fs_inode_chksum_set(sbi, page);
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-ro-compress-fix-to-avoid-caching-unaligned-exte.patch b/queue-6.8/f2fs-ro-compress-fix-to-avoid-caching-unaligned-exte.patch
new file mode 100644
index 00000000000..77c60f6a955
--- /dev/null
+++ b/queue-6.8/f2fs-ro-compress-fix-to-avoid-caching-unaligned-exte.patch
@@ -0,0 +1,130 @@
+From baef418a9d222d3e4f6e8bb39205c53922196bea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 15:35:38 +0800
+Subject: f2fs: ro: compress: fix to avoid caching unaligned extent
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 4b99ecd304290c4ef55666a62c89dfb2dbf0b2cd ]
+
+Mapping info from dump.f2fs:
+i_addr[0x2d] cluster flag    		[0xfffffffe : 4294967294]
+i_addr[0x2e]                 		[0x   10428 : 66600]
+i_addr[0x2f]                 		[0x   10429 : 66601]
+i_addr[0x30]                 		[0x   1042a : 66602]
+
+f2fs_io fiemap 37 1 /mnt/f2fs/disk-58390c8c.raw
+
+Previsouly, it missed to align fofs and ofs_in_node to cluster_size,
+result in adding incorrect read extent cache, fix it.
+
+Before:
+f2fs_update_read_extent_tree_range: dev = (253,48), ino = 5, pgofs = 37, len = 4, blkaddr = 66600, c_len = 3
+
+After:
+f2fs_update_read_extent_tree_range: dev = (253,48), ino = 5, pgofs = 36, len = 4, blkaddr = 66600, c_len = 3
+
+Fixes: 94afd6d6e525 ("f2fs: extent cache: support unaligned extent")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/compress.c | 10 ++++++----
+ fs/f2fs/f2fs.h     |  6 ++++--
+ fs/f2fs/node.c     | 20 ++++++++++++++------
+ 3 files changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
+index ff26b49c0d71f..15f330d8fdb93 100644
+--- a/fs/f2fs/compress.c
++++ b/fs/f2fs/compress.c
+@@ -1817,16 +1817,18 @@ void f2fs_put_page_dic(struct page *page, bool in_task)
+  * check whether cluster blocks are contiguous, and add extent cache entry
+  * only if cluster blocks are logically and physically contiguous.
+  */
+-unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn)
++unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn,
++						unsigned int ofs_in_node)
+ {
+-	bool compressed = f2fs_data_blkaddr(dn) == COMPRESS_ADDR;
++	bool compressed = data_blkaddr(dn->inode, dn->node_page,
++					ofs_in_node) == COMPRESS_ADDR;
+ 	int i = compressed ? 1 : 0;
+ 	block_t first_blkaddr = data_blkaddr(dn->inode, dn->node_page,
+-						dn->ofs_in_node + i);
++							ofs_in_node + i);
+ 
+ 	for (i += 1; i < F2FS_I(dn->inode)->i_cluster_size; i++) {
+ 		block_t blkaddr = data_blkaddr(dn->inode, dn->node_page,
+-						dn->ofs_in_node + i);
++							ofs_in_node + i);
+ 
+ 		if (!__is_valid_data_blkaddr(blkaddr))
+ 			break;
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index eb12d1f6cd96f..585559ea71557 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -4298,7 +4298,8 @@ struct decompress_io_ctx *f2fs_alloc_dic(struct compress_ctx *cc);
+ void f2fs_decompress_end_io(struct decompress_io_ctx *dic, bool failed,
+ 				bool in_task);
+ void f2fs_put_page_dic(struct page *page, bool in_task);
+-unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn);
++unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn,
++						unsigned int ofs_in_node);
+ int f2fs_init_compress_ctx(struct compress_ctx *cc);
+ void f2fs_destroy_compress_ctx(struct compress_ctx *cc, bool reuse);
+ void f2fs_init_compress_info(struct f2fs_sb_info *sbi);
+@@ -4355,7 +4356,8 @@ static inline void f2fs_put_page_dic(struct page *page, bool in_task)
+ {
+ 	WARN_ON_ONCE(1);
+ }
+-static inline unsigned int f2fs_cluster_blocks_are_contiguous(struct dnode_of_data *dn) { return 0; }
++static inline unsigned int f2fs_cluster_blocks_are_contiguous(
++			struct dnode_of_data *dn, unsigned int ofs_in_node) { return 0; }
+ static inline bool f2fs_sanity_check_cluster(struct dnode_of_data *dn) { return false; }
+ static inline int f2fs_init_compress_inode(struct f2fs_sb_info *sbi) { return 0; }
+ static inline void f2fs_destroy_compress_inode(struct f2fs_sb_info *sbi) { }
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 9b546fd210100..2ea9c99e7dcb7 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -852,21 +852,29 @@ int f2fs_get_dnode_of_data(struct dnode_of_data *dn, pgoff_t index, int mode)
+ 
+ 	if (is_inode_flag_set(dn->inode, FI_COMPRESSED_FILE) &&
+ 					f2fs_sb_has_readonly(sbi)) {
+-		unsigned int c_len = f2fs_cluster_blocks_are_contiguous(dn);
++		unsigned int cluster_size = F2FS_I(dn->inode)->i_cluster_size;
++		unsigned int ofs_in_node = dn->ofs_in_node;
++		pgoff_t fofs = index;
++		unsigned int c_len;
+ 		block_t blkaddr;
+ 
++		/* should align fofs and ofs_in_node to cluster_size */
++		if (fofs % cluster_size) {
++			fofs = round_down(fofs, cluster_size);
++			ofs_in_node = round_down(ofs_in_node, cluster_size);
++		}
++
++		c_len = f2fs_cluster_blocks_are_contiguous(dn, ofs_in_node);
+ 		if (!c_len)
+ 			goto out;
+ 
+-		blkaddr = f2fs_data_blkaddr(dn);
++		blkaddr = data_blkaddr(dn->inode, dn->node_page, ofs_in_node);
+ 		if (blkaddr == COMPRESS_ADDR)
+ 			blkaddr = data_blkaddr(dn->inode, dn->node_page,
+-						dn->ofs_in_node + 1);
++						ofs_in_node + 1);
+ 
+ 		f2fs_update_read_extent_tree_range_compressed(dn->inode,
+-					index, blkaddr,
+-					F2FS_I(dn->inode)->i_cluster_size,
+-					c_len);
++					fofs, blkaddr, cluster_size, c_len);
+ 	}
+ out:
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-zone-fix-to-remove-pow2-check-condition-for-zon.patch b/queue-6.8/f2fs-zone-fix-to-remove-pow2-check-condition-for-zon.patch
new file mode 100644
index 00000000000..d8238807314
--- /dev/null
+++ b/queue-6.8/f2fs-zone-fix-to-remove-pow2-check-condition-for-zon.patch
@@ -0,0 +1,42 @@
+From de828e6a337b6ec982596048687edf51c74a0d53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 11:50:57 +0800
+Subject: f2fs: zone: fix to remove pow2 check condition for zoned block device
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 11bec96afbfbc4679863db55258de440d786821e ]
+
+Commit 2e2c6e9b72ce ("f2fs: remove power-of-two limitation of zoned
+device") missed to remove pow2 check condition in init_blkz_info(),
+fix it.
+
+Fixes: 2e2c6e9b72ce ("f2fs: remove power-of-two limitation of zoned device")
+Signed-off-by: Feng Song <songfeng@oppo.com>
+Signed-off-by: Yongpeng Yang <yangyongpeng1@oppo.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index e64ce5abcdf44..4ba613ed3a179 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3936,11 +3936,6 @@ static int init_blkz_info(struct f2fs_sb_info *sbi, int devi)
+ 		return 0;
+ 
+ 	zone_sectors = bdev_zone_sectors(bdev);
+-	if (!is_power_of_2(zone_sectors)) {
+-		f2fs_err(sbi, "F2FS does not support non power of 2 zone sizes\n");
+-		return -EINVAL;
+-	}
+-
+ 	if (sbi->blocks_per_blkz && sbi->blocks_per_blkz !=
+ 				SECTOR_TO_BLOCK(zone_sectors))
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.8/f2fs-zone-fix-to-wait-completion-of-last-bio-in-zone.patch b/queue-6.8/f2fs-zone-fix-to-wait-completion-of-last-bio-in-zone.patch
new file mode 100644
index 00000000000..6cb16cd171d
--- /dev/null
+++ b/queue-6.8/f2fs-zone-fix-to-wait-completion-of-last-bio-in-zone.patch
@@ -0,0 +1,47 @@
+From 000b5c7825ced002328ebd61ea93c2e51f9a0537 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 19:27:40 +0800
+Subject: f2fs: zone: fix to wait completion of last bio in zone correctly
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 536af8211586af09c5bea1c15ad28ddec5f66a97 ]
+
+It needs to check last zone_pending_bio and wait IO completion before
+traverse next fio in io->io_list, otherwise, bio in next zone may be
+submitted before all IO completion in current zone.
+
+Fixes: e067dc3c6b9c ("f2fs: maintain six open zones for zoned devices")
+Cc: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Daeho Jeong <daehojeong@google.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 65fe48bb17d16..ac82e69a9f5fd 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1010,7 +1010,7 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 	f2fs_bug_on(sbi, is_read_io(fio->op));
+ 
+ 	f2fs_down_write(&io->io_rwsem);
+-
++next:
+ #ifdef CONFIG_BLK_DEV_ZONED
+ 	if (f2fs_sb_has_blkzoned(sbi) && btype < META && io->zone_pending_bio) {
+ 		wait_for_completion_io(&io->zone_wait);
+@@ -1020,7 +1020,6 @@ void f2fs_submit_page_write(struct f2fs_io_info *fio)
+ 	}
+ #endif
+ 
+-next:
+ 	if (fio->in_list) {
+ 		spin_lock(&io->io_lock);
+ 		if (list_empty(&io->io_list)) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/fbdev-simplefb-change-loglevel-when-the-power-domain.patch b/queue-6.8/fbdev-simplefb-change-loglevel-when-the-power-domain.patch
new file mode 100644
index 00000000000..ed16c93e622
--- /dev/null
+++ b/queue-6.8/fbdev-simplefb-change-loglevel-when-the-power-domain.patch
@@ -0,0 +1,42 @@
+From 1e119ba30d3172bf58af6b8c0efb4859de28c247 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 14:57:54 -0500
+Subject: fbdev/simplefb: change loglevel when the power domains cannot be
+ parsed
+
+From: Brian Masney <bmasney@redhat.com>
+
+[ Upstream commit 4350aa21cca48a5d951ba108290bad703fbc0630 ]
+
+When the power domains cannot be parsed, the message is incorrectly
+logged as an info message. Let's change this to an error since an error
+is returned.
+
+Fixes: 92a511a568e4 ("fbdev/simplefb: Add support for generic power-domains")
+Signed-off-by: Brian Masney <bmasney@redhat.com>
+Acked-by: Andrew Halaney <ahalaney@redhat.com>
+Acked-by: Javier Martinez Canillas <javierm@redhat.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231212195754.232303-1-bmasney@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/simplefb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/simplefb.c b/drivers/video/fbdev/simplefb.c
+index 6f58ee276ad1b..028a565250476 100644
+--- a/drivers/video/fbdev/simplefb.c
++++ b/drivers/video/fbdev/simplefb.c
+@@ -470,7 +470,7 @@ static int simplefb_attach_genpds(struct simplefb_par *par,
+ 		if (err == -ENOENT)
+ 			return 0;
+ 
+-		dev_info(dev, "failed to parse power-domains: %d\n", err);
++		dev_err(dev, "failed to parse power-domains: %d\n", err);
+ 		return err;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/firmware-arm_scmi-fix-double-free-in-smc-transport-c.patch b/queue-6.8/firmware-arm_scmi-fix-double-free-in-smc-transport-c.patch
new file mode 100644
index 00000000000..af00c2307ca
--- /dev/null
+++ b/queue-6.8/firmware-arm_scmi-fix-double-free-in-smc-transport-c.patch
@@ -0,0 +1,99 @@
+From 342867982f17ede01bb56c2c62de76f6cb2a4c13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 12:23:25 +0000
+Subject: firmware: arm_scmi: Fix double free in SMC transport cleanup path
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit f1d71576d2c9ec8fdb822173fa7f3de79475e9bd ]
+
+When the generic SCMI code tears down a channel, it calls the chan_free
+callback function, defined by each transport. Since multiple protocols
+might share the same transport_info member, chan_free() might want to
+clean up the same member multiple times within the given SCMI transport
+implementation. In this case, it is SMC transport. This will lead to a NULL
+pointer dereference at the second time:
+
+    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16
+    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.
+    | arm-scmi firmware:scmi: unable to communicate with SCMI
+    | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+    | Mem abort info:
+    |   ESR = 0x0000000096000004
+    |   EC = 0x25: DABT (current EL), IL = 32 bits
+    |   SET = 0, FnV = 0
+    |   EA = 0, S1PTW = 0
+    |   FSC = 0x04: level 0 translation fault
+    | Data abort info:
+    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
+    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
+    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
+    | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881ef8000
+    | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
+    | Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
+    | Modules linked in:
+    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793
+    | Hardware name: FVP Base RevC (DT)
+    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
+    | pc : smc_chan_free+0x3c/0x6c
+    | lr : smc_chan_free+0x3c/0x6c
+    | Call trace:
+    |  smc_chan_free+0x3c/0x6c
+    |  idr_for_each+0x68/0xf8
+    |  scmi_cleanup_channels.isra.0+0x2c/0x58
+    |  scmi_probe+0x434/0x734
+    |  platform_probe+0x68/0xd8
+    |  really_probe+0x110/0x27c
+    |  __driver_probe_device+0x78/0x12c
+    |  driver_probe_device+0x3c/0x118
+    |  __driver_attach+0x74/0x128
+    |  bus_for_each_dev+0x78/0xe0
+    |  driver_attach+0x24/0x30
+    |  bus_add_driver+0xe4/0x1e8
+    |  driver_register+0x60/0x128
+    |  __platform_driver_register+0x28/0x34
+    |  scmi_driver_init+0x84/0xc0
+    |  do_one_initcall+0x78/0x33c
+    |  kernel_init_freeable+0x2b8/0x51c
+    |  kernel_init+0x24/0x130
+    |  ret_from_fork+0x10/0x20
+    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)
+    | ---[ end trace 0000000000000000 ]---
+
+Simply check for the struct pointer being NULL before trying to access
+its members, to avoid this situation.
+
+This was found when a transport doesn't really work (for instance no SMC
+service), the probe routines then tries to clean up, and triggers a crash.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Fixes: 1dc6558062da ("firmware: arm_scmi: Add smc/hvc transport")
+Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
+Link: https://lore.kernel.org/r/20240126122325.2039669-1-andre.przywara@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/smc.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/smc.c b/drivers/firmware/arm_scmi/smc.c
+index 7611e9665038d..39936e1dd30e9 100644
+--- a/drivers/firmware/arm_scmi/smc.c
++++ b/drivers/firmware/arm_scmi/smc.c
+@@ -214,6 +214,13 @@ static int smc_chan_free(int id, void *p, void *data)
+ 	struct scmi_chan_info *cinfo = p;
+ 	struct scmi_smc *scmi_info = cinfo->transport_info;
+ 
++	/*
++	 * Different protocols might share the same chan info, so a previous
++	 * smc_chan_free call might have already freed the structure.
++	 */
++	if (!scmi_info)
++		return 0;
++
+ 	/* Ignore any possible further reception on the IRQ path */
+ 	if (scmi_info->irq > 0)
+ 		free_irq(scmi_info->irq, scmi_info);
+-- 
+2.43.0
+
diff --git a/queue-6.8/fs-fix-rw_hint-validation.patch b/queue-6.8/fs-fix-rw_hint-validation.patch
new file mode 100644
index 00000000000..4016e816e8e
--- /dev/null
+++ b/queue-6.8/fs-fix-rw_hint-validation.patch
@@ -0,0 +1,67 @@
+From fd80030b30f910cd9573b5fcc2c99ffbbb535ae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 12:39:20 -0800
+Subject: fs: Fix rw_hint validation
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit ec16b147a55bfa14e858234eb7b1a7c8e7cd5021 ]
+
+Reject values that are valid rw_hints after truncation but not before
+truncation by passing an untruncated value to rw_hint_valid().
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
+Cc: Jeff Layton <jlayton@kernel.org>
+Cc: Chuck Lever <chuck.lever@oracle.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Stephen Rothwell <sfr@canb.auug.org.au>
+Fixes: 5657cb0797c4 ("fs/fcntl: use copy_to/from_user() for u64 types")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20240202203926.2478590-2-bvanassche@acm.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fcntl.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index c80a6acad742f..3ff707bf2743a 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -268,7 +268,7 @@ static int f_getowner_uids(struct file *filp, unsigned long arg)
+ }
+ #endif
+ 
+-static bool rw_hint_valid(enum rw_hint hint)
++static bool rw_hint_valid(u64 hint)
+ {
+ 	switch (hint) {
+ 	case RWH_WRITE_LIFE_NOT_SET:
+@@ -288,19 +288,17 @@ static long fcntl_rw_hint(struct file *file, unsigned int cmd,
+ {
+ 	struct inode *inode = file_inode(file);
+ 	u64 __user *argp = (u64 __user *)arg;
+-	enum rw_hint hint;
+-	u64 h;
++	u64 hint;
+ 
+ 	switch (cmd) {
+ 	case F_GET_RW_HINT:
+-		h = inode->i_write_hint;
+-		if (copy_to_user(argp, &h, sizeof(*argp)))
++		hint = inode->i_write_hint;
++		if (copy_to_user(argp, &hint, sizeof(*argp)))
+ 			return -EFAULT;
+ 		return 0;
+ 	case F_SET_RW_HINT:
+-		if (copy_from_user(&h, argp, sizeof(h)))
++		if (copy_from_user(&hint, argp, sizeof(hint)))
+ 			return -EFAULT;
+-		hint = (enum rw_hint) h;
+ 		if (!rw_hint_valid(hint))
+ 			return -EINVAL;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/fs-hfsplus-use-better-opf-description.patch b/queue-6.8/fs-hfsplus-use-better-opf-description.patch
new file mode 100644
index 00000000000..5d30c2f619e
--- /dev/null
+++ b/queue-6.8/fs-hfsplus-use-better-opf-description.patch
@@ -0,0 +1,42 @@
+From 806ecb4588b9148f759f27a9b1ee0badaed38a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 21:06:06 -0800
+Subject: fs/hfsplus: use better @opf description
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit cf12445daec01aaa2d27bb34bd7c796a53442c42 ]
+
+Use a more descriptive explanation of the @opf function parameter,
+more in line with <linux/blk_types.h>.
+
+Fixes: 02105f18a26c ("fs/hfsplus: wrapper.c: fix kernel-doc warnings")
+Suggested-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lore.kernel.org/r/20240210050606.9182-1-rdunlap@infradead.org
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/hfsplus/wrapper.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
+index b0cb704009963..ce9346099c72d 100644
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -30,7 +30,7 @@ struct hfsplus_wd {
+  * @sector: block to read or write, for blocks of HFSPLUS_SECTOR_SIZE bytes
+  * @buf: buffer for I/O
+  * @data: output pointer for location of requested data
+- * @opf: request op flags
++ * @opf: I/O operation type and flags
+  *
+  * The unit of I/O is hfsplus_min_io_size(sb), which may be bigger than
+  * HFSPLUS_SECTOR_SIZE, and @buf must be sized accordingly. On reads
+-- 
+2.43.0
+
diff --git a/queue-6.8/fs-select-rework-stack-allocation-hack-for-clang.patch b/queue-6.8/fs-select-rework-stack-allocation-hack-for-clang.patch
new file mode 100644
index 00000000000..31e53f27eeb
--- /dev/null
+++ b/queue-6.8/fs-select-rework-stack-allocation-hack-for-clang.patch
@@ -0,0 +1,67 @@
+From b0bac510cd0e623ee5531a8328e069a636aa00f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 21:23:34 +0100
+Subject: fs/select: rework stack allocation hack for clang
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit ddb9fd7a544088ed70eccbb9f85e9cc9952131c1 ]
+
+A while ago, we changed the way that select() and poll() preallocate
+a temporary buffer just under the size of the static warning limit of
+1024 bytes, as clang was frequently going slightly above that limit.
+
+The warnings have recently returned and I took another look. As it turns
+out, clang is not actually inherently worse at reserving stack space,
+it just happens to inline do_select() into core_sys_select(), while gcc
+never inlines it.
+
+Annotate do_select() to never be inlined and in turn remove the special
+case for the allocation size. This should give the same behavior for
+both clang and gcc all the time and once more avoids those warnings.
+
+Fixes: ad312f95d41c ("fs/select: avoid clang stack usage warning")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240216202352.2492798-1-arnd@kernel.org
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Andi Kleen <ak@linux.intel.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/select.c          | 2 +-
+ include/linux/poll.h | 4 ----
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/fs/select.c b/fs/select.c
+index 0ee55af1a55c2..d4d881d439dcd 100644
+--- a/fs/select.c
++++ b/fs/select.c
+@@ -476,7 +476,7 @@ static inline void wait_key_set(poll_table *wait, unsigned long in,
+ 		wait->_key |= POLLOUT_SET;
+ }
+ 
+-static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
++static noinline_for_stack int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time)
+ {
+ 	ktime_t expire, *to = NULL;
+ 	struct poll_wqueues table;
+diff --git a/include/linux/poll.h b/include/linux/poll.h
+index a9e0e1c2d1f2f..d1ea4f3714a84 100644
+--- a/include/linux/poll.h
++++ b/include/linux/poll.h
+@@ -14,11 +14,7 @@
+ 
+ /* ~832 bytes of stack space used max in sys_select/sys_poll before allocating
+    additional memory. */
+-#ifdef __clang__
+-#define MAX_STACK_ALLOC 768
+-#else
+ #define MAX_STACK_ALLOC 832
+-#endif
+ #define FRONTEND_STACK_ALLOC	256
+ #define SELECT_STACK_ALLOC	FRONTEND_STACK_ALLOC
+ #define POLL_STACK_ALLOC	FRONTEND_STACK_ALLOC
+-- 
+2.43.0
+
diff --git a/queue-6.8/gpio-nomadik-fix-offset-bug-in-nmk_pmx_set.patch b/queue-6.8/gpio-nomadik-fix-offset-bug-in-nmk_pmx_set.patch
new file mode 100644
index 00000000000..45578f1b391
--- /dev/null
+++ b/queue-6.8/gpio-nomadik-fix-offset-bug-in-nmk_pmx_set.patch
@@ -0,0 +1,57 @@
+From 9fe4158246f1e53ea31f59c3e12875504ccb040c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 12:28:03 +0100
+Subject: gpio: nomadik: fix offset bug in nmk_pmx_set()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit 53cf6b72e074864b94ade97dcb6f30b5ac1a82dc ]
+
+Previously, the statement looked like:
+
+    slpm[x] &= ~BIT(g->grp.pins[i]);
+
+Where:
+ - slpm is a unsigned int pointer;
+ - g->grp.pins[i] is a pin number. It can grow to more than 32.
+
+The expected shift amount is a pin bank offset.
+
+This bug does not occur on every group or pin: the altsetting must be
+NMK_GPIO_ALT_C and the pin must be 32 or above. It might have occured.
+For example, in pinctrl-nomadik-db8500.c, pin group i2c3_c_2 has the
+right altsetting and pins 229 and 230.
+
+Fixes: dbfe8ca259e1 ("pinctrl/nomadik: implement pin multiplexing")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Link: https://lore.kernel.org/r/20240228-mbly-gpio-v2-5-3ba757474006@bootlin.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/nomadik/pinctrl-nomadik.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+index 7911353ac97d5..4f7c4af4f93cb 100644
+--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+@@ -1579,8 +1579,10 @@ static int nmk_pmx_set(struct pinctrl_dev *pctldev, unsigned function,
+ 		 * Then mask the pins that need to be sleeping now when we're
+ 		 * switching to the ALT C function.
+ 		 */
+-		for (i = 0; i < g->grp.npins; i++)
+-			slpm[g->grp.pins[i] / NMK_GPIO_PER_CHIP] &= ~BIT(g->grp.pins[i]);
++		for (i = 0; i < g->grp.npins; i++) {
++			unsigned int bit = g->grp.pins[i] % NMK_GPIO_PER_CHIP;
++			slpm[g->grp.pins[i] / NMK_GPIO_PER_CHIP] &= ~BIT(bit);
++		}
+ 		nmk_gpio_glitch_slpm_init(slpm);
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/gpio-vf610-allow-disabling-the-vf610-driver.patch b/queue-6.8/gpio-vf610-allow-disabling-the-vf610-driver.patch
new file mode 100644
index 00000000000..b03b5def4fa
--- /dev/null
+++ b/queue-6.8/gpio-vf610-allow-disabling-the-vf610-driver.patch
@@ -0,0 +1,43 @@
+From 0c64abef2e6e0e2126b6ee6752c1bd4add1b2cd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 21:58:57 +0100
+Subject: gpio: vf610: allow disabling the vf610 driver
+
+From: Martin Kaiser <martin@kaiser.cx>
+
+[ Upstream commit f57595788244a838deec2d3be375291327cbc035 ]
+
+The vf610 gpio driver is enabled by default for all i.MX machines,
+without any option to disable it in a board-specific config file.
+
+Most i.MX chipsets have no hardware for this driver. Change the default
+to enable GPIO_VF610 for SOC_VF610 and disable it otherwise.
+
+Add a text description after the bool type, this makes the driver
+selectable by make config etc.
+
+Fixes: 30a35c07d9e9 ("gpio: vf610: drop the SOC_VF610 dependency for GPIO_VF610")
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
+index 1301cec94f128..353af1a4d0ace 100644
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -711,7 +711,8 @@ config GPIO_UNIPHIER
+ 	  Say yes here to support UniPhier GPIOs.
+ 
+ config GPIO_VF610
+-	def_bool y
++	bool "VF610 GPIO support"
++	default y if SOC_VF610
+ 	depends on ARCH_MXC
+ 	select GPIOLIB_IRQCHIP
+ 	help
+-- 
+2.43.0
+
diff --git a/queue-6.8/gpiolib-pass-consumer-device-through-to-core-in-devm.patch b/queue-6.8/gpiolib-pass-consumer-device-through-to-core-in-devm.patch
new file mode 100644
index 00000000000..4e95a47fcaa
--- /dev/null
+++ b/queue-6.8/gpiolib-pass-consumer-device-through-to-core-in-devm.patch
@@ -0,0 +1,97 @@
+From 50d5dac879308affebbde84428bcfbd56d14e656 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 22:52:53 -0800
+Subject: gpiolib: Pass consumer device through to core in
+ devm_fwnode_gpiod_get_index()
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 0d776cfd5e5b559fdf2e38285c2aea4b7048acbd ]
+
+This devm API takes a consumer device as an argument to setup the devm
+action, but throws it away when calling further into gpiolib. This leads
+to odd debug messages like this:
+
+ (NULL device *): using DT '/gpio-keys/switch-pen-insert' for '(null)' GPIO lookup
+
+Let's pass the consumer device down, by directly calling what
+fwnode_gpiod_get_index() calls but pass the device used for devm. This
+changes the message to look like this instead:
+
+ gpio-keys gpio-keys: using DT '/gpio-keys/switch-pen-insert' for '(null)' GPIO lookup
+
+Note that callers of fwnode_gpiod_get_index() will still see the NULL
+device pointer debug message, but there's not much we can do about that
+because the API doesn't take a struct device.
+
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Fixes: 8eb1f71e7acc ("gpiolib: consolidate GPIO lookups")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-devres.c |  2 +-
+ drivers/gpio/gpiolib.c        | 14 +++++++-------
+ drivers/gpio/gpiolib.h        |  8 ++++++++
+ 3 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-devres.c b/drivers/gpio/gpiolib-devres.c
+index fe9ce6b19f15c..4987e62dcb3d1 100644
+--- a/drivers/gpio/gpiolib-devres.c
++++ b/drivers/gpio/gpiolib-devres.c
+@@ -158,7 +158,7 @@ struct gpio_desc *devm_fwnode_gpiod_get_index(struct device *dev,
+ 	if (!dr)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	desc = fwnode_gpiod_get_index(fwnode, con_id, index, flags, label);
++	desc = gpiod_find_and_request(dev, fwnode, con_id, index, flags, label, false);
+ 	if (IS_ERR(desc)) {
+ 		devres_free(dr);
+ 		return desc;
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 75be4a3ca7f84..3ad09d2193330 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -4138,13 +4138,13 @@ static struct gpio_desc *gpiod_find_by_fwnode(struct fwnode_handle *fwnode,
+ 	return desc;
+ }
+ 
+-static struct gpio_desc *gpiod_find_and_request(struct device *consumer,
+-						struct fwnode_handle *fwnode,
+-						const char *con_id,
+-						unsigned int idx,
+-						enum gpiod_flags flags,
+-						const char *label,
+-						bool platform_lookup_allowed)
++struct gpio_desc *gpiod_find_and_request(struct device *consumer,
++					 struct fwnode_handle *fwnode,
++					 const char *con_id,
++					 unsigned int idx,
++					 enum gpiod_flags flags,
++					 const char *label,
++					 bool platform_lookup_allowed)
+ {
+ 	unsigned long lookupflags = GPIO_LOOKUP_FLAGS_DEFAULT;
+ 	struct gpio_desc *desc;
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index a4a2520b5f31c..c6e5fb9aa2122 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -202,6 +202,14 @@ static inline int gpiod_request_user(struct gpio_desc *desc, const char *label)
+ 	return ret;
+ }
+ 
++struct gpio_desc *gpiod_find_and_request(struct device *consumer,
++					 struct fwnode_handle *fwnode,
++					 const char *con_id,
++					 unsigned int idx,
++					 enum gpiod_flags flags,
++					 const char *label,
++					 bool platform_lookup_allowed);
++
+ int gpiod_configure_flags(struct gpio_desc *desc, const char *con_id,
+ 		unsigned long lflags, enum gpiod_flags dflags);
+ int gpio_set_debounce_timeout(struct gpio_desc *desc, unsigned int debounce);
+-- 
+2.43.0
+
diff --git a/queue-6.8/hid-amd_sfh-avoid-disabling-the-interrupt.patch b/queue-6.8/hid-amd_sfh-avoid-disabling-the-interrupt.patch
new file mode 100644
index 00000000000..a52eebb1040
--- /dev/null
+++ b/queue-6.8/hid-amd_sfh-avoid-disabling-the-interrupt.patch
@@ -0,0 +1,103 @@
+From 3fddfc5f554cfb4a2ca6cff5bcb56f9120baa403 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 20:11:42 +0530
+Subject: HID: amd_sfh: Avoid disabling the interrupt
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit c1db0073212ef39d5a46c2aea5e49bf884375ce4 ]
+
+HP ProBook x360 435 G7 using older version of firmware which doesn't
+support disabling the interrupt for all commands. Hence avoid disabling
+the interrupt for that particular model.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=218104
+Fixes: b300667b33b2 ("HID: amd_sfh: Disable the interrupt for all command")
+Co-developed-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
+Signed-off-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 30 +++++++++++++++++++++++---
+ 1 file changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+index 2530fa98b568b..ce449da08e9ba 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+@@ -35,6 +35,8 @@ static int sensor_mask_override = -1;
+ module_param_named(sensor_mask, sensor_mask_override, int, 0444);
+ MODULE_PARM_DESC(sensor_mask, "override the detected sensors mask");
+ 
++static bool intr_disable = true;
++
+ static int amd_sfh_wait_response_v2(struct amd_mp2_dev *mp2, u8 sid, u32 sensor_sts)
+ {
+ 	union cmd_response cmd_resp;
+@@ -55,7 +57,7 @@ static void amd_start_sensor_v2(struct amd_mp2_dev *privdata, struct amd_mp2_sen
+ 
+ 	cmd_base.ul = 0;
+ 	cmd_base.cmd_v2.cmd_id = ENABLE_SENSOR;
+-	cmd_base.cmd_v2.intr_disable = 1;
++	cmd_base.cmd_v2.intr_disable = intr_disable;
+ 	cmd_base.cmd_v2.period = info.period;
+ 	cmd_base.cmd_v2.sensor_id = info.sensor_idx;
+ 	cmd_base.cmd_v2.length = 16;
+@@ -73,7 +75,7 @@ static void amd_stop_sensor_v2(struct amd_mp2_dev *privdata, u16 sensor_idx)
+ 
+ 	cmd_base.ul = 0;
+ 	cmd_base.cmd_v2.cmd_id = DISABLE_SENSOR;
+-	cmd_base.cmd_v2.intr_disable = 1;
++	cmd_base.cmd_v2.intr_disable = intr_disable;
+ 	cmd_base.cmd_v2.period = 0;
+ 	cmd_base.cmd_v2.sensor_id = sensor_idx;
+ 	cmd_base.cmd_v2.length  = 16;
+@@ -87,7 +89,7 @@ static void amd_stop_all_sensor_v2(struct amd_mp2_dev *privdata)
+ 	union sfh_cmd_base cmd_base;
+ 
+ 	cmd_base.cmd_v2.cmd_id = STOP_ALL_SENSORS;
+-	cmd_base.cmd_v2.intr_disable = 1;
++	cmd_base.cmd_v2.intr_disable = intr_disable;
+ 	cmd_base.cmd_v2.period = 0;
+ 	cmd_base.cmd_v2.sensor_id = 0;
+ 
+@@ -292,6 +294,26 @@ int amd_sfh_irq_init(struct amd_mp2_dev *privdata)
+ 	return 0;
+ }
+ 
++static int mp2_disable_intr(const struct dmi_system_id *id)
++{
++	intr_disable = false;
++	return 0;
++}
++
++static const struct dmi_system_id dmi_sfh_table[] = {
++	{
++		/*
++		 * https://bugzilla.kernel.org/show_bug.cgi?id=218104
++		 */
++		.callback = mp2_disable_intr,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook x360 435 G7"),
++		},
++	},
++	{}
++};
++
+ static const struct dmi_system_id dmi_nodevs[] = {
+ 	{
+ 		/*
+@@ -315,6 +337,8 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
+ 	if (dmi_first_match(dmi_nodevs))
+ 		return -ENODEV;
+ 
++	dmi_check_system(dmi_sfh_table);
++
+ 	privdata = devm_kzalloc(&pdev->dev, sizeof(*privdata), GFP_KERNEL);
+ 	if (!privdata)
+ 		return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.8/hid-amd_sfh-update-hpd-sensor-structure-elements.patch b/queue-6.8/hid-amd_sfh-update-hpd-sensor-structure-elements.patch
new file mode 100644
index 00000000000..f959421b99a
--- /dev/null
+++ b/queue-6.8/hid-amd_sfh-update-hpd-sensor-structure-elements.patch
@@ -0,0 +1,44 @@
+From f7e5bc2cf83ffc779d96235a3a19537636473876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Feb 2024 20:11:41 +0530
+Subject: HID: amd_sfh: Update HPD sensor structure elements
+
+From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+
+[ Upstream commit bbf0dec30696638b8bdc28cb2f5bf23f8d760b52 ]
+
+HPD sensor data is not populating properly because of wrong order of HPD
+sensor structure elements. So update the order of structure elements to
+match the HPD sensor data received from the firmware.
+
+Fixes: 24a31ea94922 ("HID: amd_sfh: Add initial support for HPD sensor")
+Co-developed-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
+Signed-off-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
+Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/amd-sfh-hid/amd_sfh_pcie.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
+index 70add75fc5066..05e400a4a83e4 100644
+--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h
+@@ -90,10 +90,10 @@ enum mem_use_type {
+ struct hpd_status {
+ 	union {
+ 		struct {
+-			u32 human_presence_report : 4;
+-			u32 human_presence_actual : 4;
+-			u32 probablity		  : 8;
+ 			u32 object_distance       : 16;
++			u32 probablity		  : 8;
++			u32 human_presence_actual : 4;
++			u32 human_presence_report : 4;
+ 		} shpd;
+ 		u32 val;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.8/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch b/queue-6.8/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
new file mode 100644
index 00000000000..3810f7ff364
--- /dev/null
+++ b/queue-6.8/hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
@@ -0,0 +1,134 @@
+From baad894521136f9f4ce1b6bf80149a0f40bd2c84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Dec 2023 21:12:13 +0200
+Subject: HID: lenovo: Add middleclick_workaround sysfs knob for cptkbd
+
+From: Mikhail Khvainitski <me@khvoinitsky.org>
+
+[ Upstream commit 2814646f76f8518326964f12ff20aaee70ba154d ]
+
+Previous attempt to autodetect well-behaving patched firmware
+introduced in commit 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw
+on cptkbd and stop applying workaround") has shown that there are
+false-positives on original firmware (on both 1st gen and 2nd gen
+keyboards) which causes the middle button click workaround to be
+mistakenly disabled.
+
+This commit adds explicit parameter to sysfs to control this
+workaround.
+
+Fixes: 46a0a2c96f0f ("HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround")
+Fixes: 43527a0094c1 ("HID: lenovo: Restrict detection of patched firmware only to USB cptkbd")
+Signed-off-by: Mikhail Khvainitski <me@khvoinitsky.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-lenovo.c | 57 +++++++++++++++++++++++++++-------------
+ 1 file changed, 39 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c
+index 149a3c74346b4..f86c1ea83a037 100644
+--- a/drivers/hid/hid-lenovo.c
++++ b/drivers/hid/hid-lenovo.c
+@@ -54,10 +54,10 @@ struct lenovo_drvdata {
+ 	/* 0: Up
+ 	 * 1: Down (undecided)
+ 	 * 2: Scrolling
+-	 * 3: Patched firmware, disable workaround
+ 	 */
+ 	u8 middlebutton_state;
+ 	bool fn_lock;
++	bool middleclick_workaround_cptkbd;
+ };
+ 
+ #define map_key_clear(c) hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c))
+@@ -621,6 +621,36 @@ static ssize_t attr_sensitivity_store_cptkbd(struct device *dev,
+ 	return count;
+ }
+ 
++static ssize_t attr_middleclick_workaround_show_cptkbd(struct device *dev,
++		struct device_attribute *attr,
++		char *buf)
++{
++	struct hid_device *hdev = to_hid_device(dev);
++	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
++
++	return snprintf(buf, PAGE_SIZE, "%u\n",
++		cptkbd_data->middleclick_workaround_cptkbd);
++}
++
++static ssize_t attr_middleclick_workaround_store_cptkbd(struct device *dev,
++		struct device_attribute *attr,
++		const char *buf,
++		size_t count)
++{
++	struct hid_device *hdev = to_hid_device(dev);
++	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
++	int value;
++
++	if (kstrtoint(buf, 10, &value))
++		return -EINVAL;
++	if (value < 0 || value > 1)
++		return -EINVAL;
++
++	cptkbd_data->middleclick_workaround_cptkbd = !!value;
++
++	return count;
++}
++
+ 
+ static struct device_attribute dev_attr_fn_lock =
+ 	__ATTR(fn_lock, S_IWUSR | S_IRUGO,
+@@ -632,10 +662,16 @@ static struct device_attribute dev_attr_sensitivity_cptkbd =
+ 			attr_sensitivity_show_cptkbd,
+ 			attr_sensitivity_store_cptkbd);
+ 
++static struct device_attribute dev_attr_middleclick_workaround_cptkbd =
++	__ATTR(middleclick_workaround, S_IWUSR | S_IRUGO,
++			attr_middleclick_workaround_show_cptkbd,
++			attr_middleclick_workaround_store_cptkbd);
++
+ 
+ static struct attribute *lenovo_attributes_cptkbd[] = {
+ 	&dev_attr_fn_lock.attr,
+ 	&dev_attr_sensitivity_cptkbd.attr,
++	&dev_attr_middleclick_workaround_cptkbd.attr,
+ 	NULL
+ };
+ 
+@@ -686,23 +722,7 @@ static int lenovo_event_cptkbd(struct hid_device *hdev,
+ {
+ 	struct lenovo_drvdata *cptkbd_data = hid_get_drvdata(hdev);
+ 
+-	if (cptkbd_data->middlebutton_state != 3) {
+-		/* REL_X and REL_Y events during middle button pressed
+-		 * are only possible on patched, bug-free firmware
+-		 * so set middlebutton_state to 3
+-		 * to never apply workaround anymore
+-		 */
+-		if (hdev->product == USB_DEVICE_ID_LENOVO_CUSBKBD &&
+-				cptkbd_data->middlebutton_state == 1 &&
+-				usage->type == EV_REL &&
+-				(usage->code == REL_X || usage->code == REL_Y)) {
+-			cptkbd_data->middlebutton_state = 3;
+-			/* send middle button press which was hold before */
+-			input_event(field->hidinput->input,
+-				EV_KEY, BTN_MIDDLE, 1);
+-			input_sync(field->hidinput->input);
+-		}
+-
++	if (cptkbd_data->middleclick_workaround_cptkbd) {
+ 		/* "wheel" scroll events */
+ 		if (usage->type == EV_REL && (usage->code == REL_WHEEL ||
+ 				usage->code == REL_HWHEEL)) {
+@@ -1166,6 +1186,7 @@ static int lenovo_probe_cptkbd(struct hid_device *hdev)
+ 	cptkbd_data->middlebutton_state = 0;
+ 	cptkbd_data->fn_lock = true;
+ 	cptkbd_data->sensitivity = 0x05;
++	cptkbd_data->middleclick_workaround_cptkbd = true;
+ 	lenovo_features_set_cptkbd(hdev);
+ 
+ 	ret = sysfs_create_group(&hdev->dev.kobj, &lenovo_attr_group_cptkbd);
+-- 
+2.43.0
+
diff --git a/queue-6.8/i3c-dw-disable-ibi-irq-depends-on-hot-join-and-sir-e.patch b/queue-6.8/i3c-dw-disable-ibi-irq-depends-on-hot-join-and-sir-e.patch
new file mode 100644
index 00000000000..29fda05da33
--- /dev/null
+++ b/queue-6.8/i3c-dw-disable-ibi-irq-depends-on-hot-join-and-sir-e.patch
@@ -0,0 +1,41 @@
+From 03a7246448089c8a3c4b6bdaa569932a9c21e6bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 13:45:47 +0800
+Subject: i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling
+
+From: Dylan Hung <dylan_hung@aspeedtech.com>
+
+[ Upstream commit 10201396ef6455a68ac671fa0163205d327ebb70 ]
+
+Disable IBI IRQ signal and status only when hot-join and SIR enabling of
+all target devices attached to the bus are disabled.
+
+Fixes: e389b1d72a62 ("i3c: dw: Add support for in-band interrupts")
+
+Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
+Link: https://lore.kernel.org/r/20240119054547.983693-1-dylan_hung@aspeedtech.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i3c/master/dw-i3c-master.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i3c/master/dw-i3c-master.c b/drivers/i3c/master/dw-i3c-master.c
+index ef5751e91cc9e..276153e10f5a4 100644
+--- a/drivers/i3c/master/dw-i3c-master.c
++++ b/drivers/i3c/master/dw-i3c-master.c
+@@ -1163,8 +1163,10 @@ static void dw_i3c_master_set_sir_enabled(struct dw_i3c_master *master,
+ 		global = reg == 0xffffffff;
+ 		reg &= ~BIT(idx);
+ 	} else {
+-		global = reg == 0;
++		bool hj_rejected = !!(readl(master->regs + DEVICE_CTRL) & DEV_CTRL_HOT_JOIN_NACK);
++
+ 		reg |= BIT(idx);
++		global = (reg == 0xffffffff) && hj_rejected;
+ 	}
+ 	writel(reg, master->regs + IBI_SIR_REQ_REJECT);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/ice-fix-stats-being-updated-by-way-too-large-values.patch b/queue-6.8/ice-fix-stats-being-updated-by-way-too-large-values.patch
new file mode 100644
index 00000000000..dd4d7cb856b
--- /dev/null
+++ b/queue-6.8/ice-fix-stats-being-updated-by-way-too-large-values.patch
@@ -0,0 +1,90 @@
+From bd53969610218cd00f61e0706e0b32e59370613a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 15:31:06 +0100
+Subject: ice: fix stats being updated by way too large values
+
+From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+
+[ Upstream commit 257310e998700e60382fbd3f4fd275fdbd9b2aaf ]
+
+Simplify stats accumulation logic to fix the case where we don't take
+previous stat value into account, we should always respect it.
+
+Main netdev stats of our PF (Tx/Rx packets/bytes) were reported orders of
+magnitude too big during OpenStack reconfiguration events, possibly other
+reconfiguration cases too.
+
+The regression was reported to be between 6.1 and 6.2, so I was almost
+certain that on of the two "preserve stats over reset" commits were the
+culprit. While reading the code, it was found that in some cases we will
+increase the stats by arbitrarily large number (thanks to ignoring "-prev"
+part of condition, after zeroing it).
+
+Note that this fixes also the case where we were around limits of u64, but
+that was not the regression reported.
+
+Full disclosure: I remember suggesting this particular piece of code to
+Ben a few years ago, so blame on me.
+
+Fixes: 2fd5e433cd26 ("ice: Accumulate HW and Netdev statistics over reset")
+Reported-by: Nebojsa Stevanovic <nebojsa.stevanovic@gcore.com>
+Link: https://lore.kernel.org/intel-wired-lan/VI1PR02MB439744DEDAA7B59B9A2833FE912EA@VI1PR02MB4397.eurprd02.prod.outlook.com
+Reported-by: Christian Rohmann <christian.rohmann@inovex.de>
+Link: https://lore.kernel.org/intel-wired-lan/f38a6ca4-af05-48b1-a3e6-17ef2054e525@inovex.de
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_main.c | 24 +++++++++++------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
+index df6a68ab747ee..6d256dbcb77d0 100644
+--- a/drivers/net/ethernet/intel/ice/ice_main.c
++++ b/drivers/net/ethernet/intel/ice/ice_main.c
+@@ -6737,6 +6737,7 @@ static void ice_update_vsi_ring_stats(struct ice_vsi *vsi)
+ {
+ 	struct rtnl_link_stats64 *net_stats, *stats_prev;
+ 	struct rtnl_link_stats64 *vsi_stats;
++	struct ice_pf *pf = vsi->back;
+ 	u64 pkts, bytes;
+ 	int i;
+ 
+@@ -6782,21 +6783,18 @@ static void ice_update_vsi_ring_stats(struct ice_vsi *vsi)
+ 	net_stats = &vsi->net_stats;
+ 	stats_prev = &vsi->net_stats_prev;
+ 
+-	/* clear prev counters after reset */
+-	if (vsi_stats->tx_packets < stats_prev->tx_packets ||
+-	    vsi_stats->rx_packets < stats_prev->rx_packets) {
+-		stats_prev->tx_packets = 0;
+-		stats_prev->tx_bytes = 0;
+-		stats_prev->rx_packets = 0;
+-		stats_prev->rx_bytes = 0;
++	/* Update netdev counters, but keep in mind that values could start at
++	 * random value after PF reset. And as we increase the reported stat by
++	 * diff of Prev-Cur, we need to be sure that Prev is valid. If it's not,
++	 * let's skip this round.
++	 */
++	if (likely(pf->stat_prev_loaded)) {
++		net_stats->tx_packets += vsi_stats->tx_packets - stats_prev->tx_packets;
++		net_stats->tx_bytes += vsi_stats->tx_bytes - stats_prev->tx_bytes;
++		net_stats->rx_packets += vsi_stats->rx_packets - stats_prev->rx_packets;
++		net_stats->rx_bytes += vsi_stats->rx_bytes - stats_prev->rx_bytes;
+ 	}
+ 
+-	/* update netdev counters */
+-	net_stats->tx_packets += vsi_stats->tx_packets - stats_prev->tx_packets;
+-	net_stats->tx_bytes += vsi_stats->tx_bytes - stats_prev->tx_bytes;
+-	net_stats->rx_packets += vsi_stats->rx_packets - stats_prev->rx_packets;
+-	net_stats->rx_bytes += vsi_stats->rx_bytes - stats_prev->rx_bytes;
+-
+ 	stats_prev->tx_packets = vsi_stats->tx_packets;
+ 	stats_prev->tx_bytes = vsi_stats->tx_bytes;
+ 	stats_prev->rx_packets = vsi_stats->rx_packets;
+-- 
+2.43.0
+
diff --git a/queue-6.8/igb-fix-missing-time-sync-events.patch b/queue-6.8/igb-fix-missing-time-sync-events.patch
new file mode 100644
index 00000000000..48656861076
--- /dev/null
+++ b/queue-6.8/igb-fix-missing-time-sync-events.patch
@@ -0,0 +1,94 @@
+From c412a62ec6f7679f757bd97904e5d310fc336161 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:57:11 -0800
+Subject: igb: Fix missing time sync events
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit ee14cc9ea19ba9678177e2224a9c58cce5937c73 ]
+
+Fix "double" clearing of interrupts, which can cause external events
+or timestamps to be missed.
+
+The E1000_TSIRC Time Sync Interrupt Cause register can be cleared in two
+ways, by either reading it or by writing '1' into the specific cause
+bit. This is documented in section 8.16.1.
+
+The following flow was used:
+    1. read E1000_TSIRC into 'tsicr';
+    2. handle the interrupts present into 'tsirc' and mark them in 'ack';
+    3. write 'ack' into E1000_TSICR;
+
+As both (1) and (3) will clear the interrupt cause, if the same
+interrupt happens again between (1) and (3) it will be ignored,
+causing events to be missed.
+
+Remove the extra clear in (3).
+
+Fixes: 00c65578b47b ("igb: enable internal PPS for the i210")
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/igb_main.c | 23 +++++------------------
+ 1 file changed, 5 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index cebb44f51d5f5..7662c42e35c11 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -6985,44 +6985,31 @@ static void igb_extts(struct igb_adapter *adapter, int tsintr_tt)
+ static void igb_tsync_interrupt(struct igb_adapter *adapter)
+ {
+ 	struct e1000_hw *hw = &adapter->hw;
+-	u32 ack = 0, tsicr = rd32(E1000_TSICR);
++	u32 tsicr = rd32(E1000_TSICR);
+ 	struct ptp_clock_event event;
+ 
+ 	if (tsicr & TSINTR_SYS_WRAP) {
+ 		event.type = PTP_CLOCK_PPS;
+ 		if (adapter->ptp_caps.pps)
+ 			ptp_clock_event(adapter->ptp_clock, &event);
+-		ack |= TSINTR_SYS_WRAP;
+ 	}
+ 
+ 	if (tsicr & E1000_TSICR_TXTS) {
+ 		/* retrieve hardware timestamp */
+ 		schedule_work(&adapter->ptp_tx_work);
+-		ack |= E1000_TSICR_TXTS;
+ 	}
+ 
+-	if (tsicr & TSINTR_TT0) {
++	if (tsicr & TSINTR_TT0)
+ 		igb_perout(adapter, 0);
+-		ack |= TSINTR_TT0;
+-	}
+ 
+-	if (tsicr & TSINTR_TT1) {
++	if (tsicr & TSINTR_TT1)
+ 		igb_perout(adapter, 1);
+-		ack |= TSINTR_TT1;
+-	}
+ 
+-	if (tsicr & TSINTR_AUTT0) {
++	if (tsicr & TSINTR_AUTT0)
+ 		igb_extts(adapter, 0);
+-		ack |= TSINTR_AUTT0;
+-	}
+ 
+-	if (tsicr & TSINTR_AUTT1) {
++	if (tsicr & TSINTR_AUTT1)
+ 		igb_extts(adapter, 1);
+-		ack |= TSINTR_AUTT1;
+-	}
+-
+-	/* acknowledge the interrupts */
+-	wr32(E1000_TSICR, ack);
+ }
+ 
+ static irqreturn_t igb_msix_other(int irq, void *data)
+-- 
+2.43.0
+
diff --git a/queue-6.8/igc-fix-missing-time-sync-events.patch b/queue-6.8/igc-fix-missing-time-sync-events.patch
new file mode 100644
index 00000000000..da0683ef405
--- /dev/null
+++ b/queue-6.8/igc-fix-missing-time-sync-events.patch
@@ -0,0 +1,108 @@
+From b83d6b16a250bc1ac60713e386ee7e9e20c74a54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 15:57:10 -0800
+Subject: igc: Fix missing time sync events
+
+From: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+
+[ Upstream commit 244ae992e3e80e5c9c272c77324c831148457f95 ]
+
+Fix "double" clearing of interrupts, which can cause external events
+or timestamps to be missed.
+
+The IGC_TSIRC Time Sync Interrupt Cause register can be cleared in two
+ways, by either reading it or by writing '1' into the specific cause
+bit. This is documented in section 8.16.1.
+
+The following flow was used:
+ 1. read IGC_TSIRC into 'tsicr';
+ 2. handle the interrupts present in 'tsirc' and mark them in 'ack';
+ 3. write 'ack' into IGC_TSICR;
+
+As both (1) and (3) will clear the interrupt cause, if the same
+interrupt happens again between (1) and (3) it will be ignored,
+causing events to be missed.
+
+Remove the extra clear in (3).
+
+Fixes: 2c344ae24501 ("igc: Add support for TX timestamping")
+Reviewed-by: Kurt Kanzenbach <kurt@linutronix.de>
+Tested-by: Kurt Kanzenbach <kurt@linutronix.de> # Intel i225
+Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
+Tested-by: Naama Meir <naamax.meir@linux.intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
+index 81c21a893ede9..e447ba0370568 100644
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -5302,25 +5302,22 @@ igc_features_check(struct sk_buff *skb, struct net_device *dev,
+ 
+ static void igc_tsync_interrupt(struct igc_adapter *adapter)
+ {
+-	u32 ack, tsauxc, sec, nsec, tsicr;
+ 	struct igc_hw *hw = &adapter->hw;
++	u32 tsauxc, sec, nsec, tsicr;
+ 	struct ptp_clock_event event;
+ 	struct timespec64 ts;
+ 
+ 	tsicr = rd32(IGC_TSICR);
+-	ack = 0;
+ 
+ 	if (tsicr & IGC_TSICR_SYS_WRAP) {
+ 		event.type = PTP_CLOCK_PPS;
+ 		if (adapter->ptp_caps.pps)
+ 			ptp_clock_event(adapter->ptp_clock, &event);
+-		ack |= IGC_TSICR_SYS_WRAP;
+ 	}
+ 
+ 	if (tsicr & IGC_TSICR_TXTS) {
+ 		/* retrieve hardware timestamp */
+ 		igc_ptp_tx_tstamp_event(adapter);
+-		ack |= IGC_TSICR_TXTS;
+ 	}
+ 
+ 	if (tsicr & IGC_TSICR_TT0) {
+@@ -5334,7 +5331,6 @@ static void igc_tsync_interrupt(struct igc_adapter *adapter)
+ 		wr32(IGC_TSAUXC, tsauxc);
+ 		adapter->perout[0].start = ts;
+ 		spin_unlock(&adapter->tmreg_lock);
+-		ack |= IGC_TSICR_TT0;
+ 	}
+ 
+ 	if (tsicr & IGC_TSICR_TT1) {
+@@ -5348,7 +5344,6 @@ static void igc_tsync_interrupt(struct igc_adapter *adapter)
+ 		wr32(IGC_TSAUXC, tsauxc);
+ 		adapter->perout[1].start = ts;
+ 		spin_unlock(&adapter->tmreg_lock);
+-		ack |= IGC_TSICR_TT1;
+ 	}
+ 
+ 	if (tsicr & IGC_TSICR_AUTT0) {
+@@ -5358,7 +5353,6 @@ static void igc_tsync_interrupt(struct igc_adapter *adapter)
+ 		event.index = 0;
+ 		event.timestamp = sec * NSEC_PER_SEC + nsec;
+ 		ptp_clock_event(adapter->ptp_clock, &event);
+-		ack |= IGC_TSICR_AUTT0;
+ 	}
+ 
+ 	if (tsicr & IGC_TSICR_AUTT1) {
+@@ -5368,11 +5362,7 @@ static void igc_tsync_interrupt(struct igc_adapter *adapter)
+ 		event.index = 1;
+ 		event.timestamp = sec * NSEC_PER_SEC + nsec;
+ 		ptp_clock_event(adapter->ptp_clock, &event);
+-		ack |= IGC_TSICR_AUTT1;
+ 	}
+-
+-	/* acknowledge the interrupts */
+-	wr32(IGC_TSICR, ack);
+ }
+ 
+ /**
+-- 
+2.43.0
+
diff --git a/queue-6.8/inet_diag-annotate-data-races-around-inet_diag_table.patch b/queue-6.8/inet_diag-annotate-data-races-around-inet_diag_table.patch
new file mode 100644
index 00000000000..9be55296ad9
--- /dev/null
+++ b/queue-6.8/inet_diag-annotate-data-races-around-inet_diag_table.patch
@@ -0,0 +1,58 @@
+From 0f2410a3a7b5dc7edd3e7d0b86951b45f85020eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 11:25:56 +0000
+Subject: inet_diag: annotate data-races around inet_diag_table[]
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit e50e10ae5d81ddb41547114bfdc5edc04422f082 ]
+
+inet_diag_lock_handler() reads inet_diag_table[proto] locklessly.
+
+Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.
+
+Fixes: d523a328fb02 ("[INET]: Fix inet_diag dead-lock regression")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/inet_diag.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 8e6b6aa0579e1..9804e9608a5a0 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -57,7 +57,7 @@ static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
+ 		return ERR_PTR(-ENOENT);
+ 	}
+ 
+-	if (!inet_diag_table[proto])
++	if (!READ_ONCE(inet_diag_table[proto]))
+ 		sock_load_diag_module(AF_INET, proto);
+ 
+ 	mutex_lock(&inet_diag_table_mutex);
+@@ -1503,7 +1503,7 @@ int inet_diag_register(const struct inet_diag_handler *h)
+ 	mutex_lock(&inet_diag_table_mutex);
+ 	err = -EEXIST;
+ 	if (!inet_diag_table[type]) {
+-		inet_diag_table[type] = h;
++		WRITE_ONCE(inet_diag_table[type], h);
+ 		err = 0;
+ 	}
+ 	mutex_unlock(&inet_diag_table_mutex);
+@@ -1520,7 +1520,7 @@ void inet_diag_unregister(const struct inet_diag_handler *h)
+ 		return;
+ 
+ 	mutex_lock(&inet_diag_table_mutex);
+-	inet_diag_table[type] = NULL;
++	WRITE_ONCE(inet_diag_table[type], NULL);
+ 	mutex_unlock(&inet_diag_table_mutex);
+ }
+ EXPORT_SYMBOL_GPL(inet_diag_unregister);
+-- 
+2.43.0
+
diff --git a/queue-6.8/input-iqs7222-add-support-for-iqs7222d-v1.1-and-v1.2.patch b/queue-6.8/input-iqs7222-add-support-for-iqs7222d-v1.1-and-v1.2.patch
new file mode 100644
index 00000000000..8885a6ae395
--- /dev/null
+++ b/queue-6.8/input-iqs7222-add-support-for-iqs7222d-v1.1-and-v1.2.patch
@@ -0,0 +1,147 @@
+From b5f3a041d025db7969b2c99054c99bc4304fc77f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 23:40:21 -0600
+Subject: Input: iqs7222 - add support for IQS7222D v1.1 and v1.2
+
+From: Jeff LaBundy <jeff@labundy.com>
+
+[ Upstream commit 992cf65674778e22436807796b2df927de21bb75 ]
+
+The vendor has introduced two new revisions with slightly different
+memory maps; update the driver to support them.
+
+Fixes: dd24e202ac72 ("Input: iqs7222 - add support for Azoteq IQS7222D")
+Signed-off-by: Jeff LaBundy <jeff@labundy.com>
+Link: https://lore.kernel.org/r/ZelTRYX3fenMQuhF@nixie71
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/iqs7222.c | 112 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 112 insertions(+)
+
+diff --git a/drivers/input/misc/iqs7222.c b/drivers/input/misc/iqs7222.c
+index 36aeeae776110..9ca5a743f19fe 100644
+--- a/drivers/input/misc/iqs7222.c
++++ b/drivers/input/misc/iqs7222.c
+@@ -620,6 +620,118 @@ static const struct iqs7222_dev_desc iqs7222_devs[] = {
+ 			},
+ 		},
+ 	},
++	{
++		.prod_num = IQS7222_PROD_NUM_D,
++		.fw_major = 1,
++		.fw_minor = 2,
++		.touch_link = 1770,
++		.allow_offset = 9,
++		.event_offset = 10,
++		.comms_offset = 11,
++		.reg_grps = {
++			[IQS7222_REG_GRP_STAT] = {
++				.base = IQS7222_SYS_STATUS,
++				.num_row = 1,
++				.num_col = 7,
++			},
++			[IQS7222_REG_GRP_CYCLE] = {
++				.base = 0x8000,
++				.num_row = 7,
++				.num_col = 2,
++			},
++			[IQS7222_REG_GRP_GLBL] = {
++				.base = 0x8700,
++				.num_row = 1,
++				.num_col = 3,
++			},
++			[IQS7222_REG_GRP_BTN] = {
++				.base = 0x9000,
++				.num_row = 14,
++				.num_col = 3,
++			},
++			[IQS7222_REG_GRP_CHAN] = {
++				.base = 0xA000,
++				.num_row = 14,
++				.num_col = 4,
++			},
++			[IQS7222_REG_GRP_FILT] = {
++				.base = 0xAE00,
++				.num_row = 1,
++				.num_col = 2,
++			},
++			[IQS7222_REG_GRP_TPAD] = {
++				.base = 0xB000,
++				.num_row = 1,
++				.num_col = 24,
++			},
++			[IQS7222_REG_GRP_GPIO] = {
++				.base = 0xC000,
++				.num_row = 3,
++				.num_col = 3,
++			},
++			[IQS7222_REG_GRP_SYS] = {
++				.base = IQS7222_SYS_SETUP,
++				.num_row = 1,
++				.num_col = 12,
++			},
++		},
++	},
++	{
++		.prod_num = IQS7222_PROD_NUM_D,
++		.fw_major = 1,
++		.fw_minor = 1,
++		.touch_link = 1774,
++		.allow_offset = 9,
++		.event_offset = 10,
++		.comms_offset = 11,
++		.reg_grps = {
++			[IQS7222_REG_GRP_STAT] = {
++				.base = IQS7222_SYS_STATUS,
++				.num_row = 1,
++				.num_col = 7,
++			},
++			[IQS7222_REG_GRP_CYCLE] = {
++				.base = 0x8000,
++				.num_row = 7,
++				.num_col = 2,
++			},
++			[IQS7222_REG_GRP_GLBL] = {
++				.base = 0x8700,
++				.num_row = 1,
++				.num_col = 3,
++			},
++			[IQS7222_REG_GRP_BTN] = {
++				.base = 0x9000,
++				.num_row = 14,
++				.num_col = 3,
++			},
++			[IQS7222_REG_GRP_CHAN] = {
++				.base = 0xA000,
++				.num_row = 14,
++				.num_col = 4,
++			},
++			[IQS7222_REG_GRP_FILT] = {
++				.base = 0xAE00,
++				.num_row = 1,
++				.num_col = 2,
++			},
++			[IQS7222_REG_GRP_TPAD] = {
++				.base = 0xB000,
++				.num_row = 1,
++				.num_col = 24,
++			},
++			[IQS7222_REG_GRP_GPIO] = {
++				.base = 0xC000,
++				.num_row = 3,
++				.num_col = 3,
++			},
++			[IQS7222_REG_GRP_SYS] = {
++				.base = IQS7222_SYS_SETUP,
++				.num_row = 1,
++				.num_col = 12,
++			},
++		},
++	},
+ 	{
+ 		.prod_num = IQS7222_PROD_NUM_D,
+ 		.fw_major = 0,
+-- 
+2.43.0
+
diff --git a/queue-6.8/io_uring-net-correct-the-type-of-variable.patch b/queue-6.8/io_uring-net-correct-the-type-of-variable.patch
new file mode 100644
index 00000000000..6633add5c7c
--- /dev/null
+++ b/queue-6.8/io_uring-net-correct-the-type-of-variable.patch
@@ -0,0 +1,37 @@
+From 0d8f354eed94bf6a1712f10e4a0c35a9983c09c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 19:43:48 +0500
+Subject: io_uring/net: correct the type of variable
+
+From: Muhammad Usama Anjum <usama.anjum@collabora.com>
+
+[ Upstream commit 86bcacc957fc2d0403aa0e652757eec59a5fd7ca ]
+
+The namelen is of type int. It shouldn't be made size_t which is
+unsigned. The signed number is needed for error checking before use.
+
+Fixes: c55978024d12 ("io_uring/net: move receive multishot out of the generic msghdr path")
+Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Link: https://lore.kernel.org/r/20240301144349.2807544-1-usama.anjum@collabora.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/net.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/io_uring/net.c b/io_uring/net.c
+index 058e04ea68c04..4aaeada03f1e7 100644
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -536,7 +536,7 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags)
+ 
+ static int io_recvmsg_mshot_prep(struct io_kiocb *req,
+ 				 struct io_async_msghdr *iomsg,
+-				 size_t namelen, size_t controllen)
++				 int namelen, size_t controllen)
+ {
+ 	if ((req->flags & (REQ_F_APOLL_MULTISHOT|REQ_F_BUFFER_SELECT)) ==
+ 			  (REQ_F_APOLL_MULTISHOT|REQ_F_BUFFER_SELECT)) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/io_uring-net-fix-overflow-check-in-io_recvmsg_mshot_.patch b/queue-6.8/io_uring-net-fix-overflow-check-in-io_recvmsg_mshot_.patch
new file mode 100644
index 00000000000..1e99d6916e4
--- /dev/null
+++ b/queue-6.8/io_uring-net-fix-overflow-check-in-io_recvmsg_mshot_.patch
@@ -0,0 +1,54 @@
+From c1bc023c8862ee8dd1116be303431525074dffe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 18:29:39 +0300
+Subject: io_uring/net: fix overflow check in io_recvmsg_mshot_prep()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 8ede3db5061bb1fe28e2c9683329aafa89d2b1b4 ]
+
+The "controllen" variable is type size_t (unsigned long).  Casting it
+to int could lead to an integer underflow.
+
+The check_add_overflow() function considers the type of the destination
+which is type int.  If we add two positive values and the result cannot
+fit in an integer then that's counted as an overflow.
+
+However, if we cast "controllen" to an int and it turns negative, then
+negative values *can* fit into an int type so there is no overflow.
+
+Good: 100 + (unsigned long)-4 = 96  <-- overflow
+ Bad: 100 + (int)-4 = 96 <-- no overflow
+
+I deleted the cast of the sizeof() as well.  That's not a bug but the
+cast is unnecessary.
+
+Fixes: 9b0fc3c054ff ("io_uring: fix types in io_recvmsg_multishot_overflow")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/138bd2e2-ede8-4bcc-aa7b-f3d9de167a37@moroto.mountain
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/net.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/io_uring/net.c b/io_uring/net.c
+index 1d9bfde71809a..058e04ea68c04 100644
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -544,10 +544,10 @@ static int io_recvmsg_mshot_prep(struct io_kiocb *req,
+ 
+ 		if (unlikely(namelen < 0))
+ 			return -EOVERFLOW;
+-		if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
++		if (check_add_overflow(sizeof(struct io_uring_recvmsg_out),
+ 					namelen, &hdr))
+ 			return -EOVERFLOW;
+-		if (check_add_overflow(hdr, (int)controllen, &hdr))
++		if (check_add_overflow(hdr, controllen, &hdr))
+ 			return -EOVERFLOW;
+ 
+ 		iomsg->namelen = namelen;
+-- 
+2.43.0
+
diff --git a/queue-6.8/io_uring-net-move-receive-multishot-out-of-the-gener.patch b/queue-6.8/io_uring-net-move-receive-multishot-out-of-the-gener.patch
new file mode 100644
index 00000000000..7c1dbd08ecd
--- /dev/null
+++ b/queue-6.8/io_uring-net-move-receive-multishot-out-of-the-gener.patch
@@ -0,0 +1,274 @@
+From 3bc5a85bd14637e0dd6b37f16f1491bff13e07d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 11:09:20 -0700
+Subject: io_uring/net: move receive multishot out of the generic msghdr path
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit c55978024d123d43808ab393a0a4ce3ce8568150 ]
+
+Move the actual user_msghdr / compat_msghdr into the send and receive
+sides, respectively, so we can move the uaddr receive handling into its
+own handler, and ditto the multishot with buffer selection logic.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 8ede3db5061b ("io_uring/net: fix overflow check in io_recvmsg_mshot_prep()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/net.c | 161 ++++++++++++++++++++++++++++---------------------
+ 1 file changed, 91 insertions(+), 70 deletions(-)
+
+diff --git a/io_uring/net.c b/io_uring/net.c
+index ef495e2aac2bc..1d9bfde71809a 100644
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -204,46 +204,26 @@ static int io_setup_async_msg(struct io_kiocb *req,
+ 	return -EAGAIN;
+ }
+ 
+-static bool io_recvmsg_multishot_overflow(struct io_async_msghdr *iomsg)
+-{
+-	int hdr;
+-
+-	if (iomsg->namelen < 0)
+-		return true;
+-	if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
+-			       iomsg->namelen, &hdr))
+-		return true;
+-	if (check_add_overflow(hdr, (int)iomsg->controllen, &hdr))
+-		return true;
+-
+-	return false;
+-}
+-
+ #ifdef CONFIG_COMPAT
+-static int __io_compat_msg_copy_hdr(struct io_kiocb *req,
+-				    struct io_async_msghdr *iomsg,
+-				    struct sockaddr __user **addr, int ddir)
++static int io_compat_msg_copy_hdr(struct io_kiocb *req,
++				  struct io_async_msghdr *iomsg,
++				  struct compat_msghdr *msg, int ddir)
+ {
+ 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+-	struct compat_msghdr msg;
+ 	struct compat_iovec __user *uiov;
+ 	int ret;
+ 
+-	if (copy_from_user(&msg, sr->umsg_compat, sizeof(msg)))
++	if (copy_from_user(msg, sr->umsg_compat, sizeof(*msg)))
+ 		return -EFAULT;
+ 
+-	ret = __get_compat_msghdr(&iomsg->msg, &msg, addr);
+-	if (ret)
+-		return ret;
+-
+-	uiov = compat_ptr(msg.msg_iov);
++	uiov = compat_ptr(msg->msg_iov);
+ 	if (req->flags & REQ_F_BUFFER_SELECT) {
+ 		compat_ssize_t clen;
+ 
+ 		iomsg->free_iov = NULL;
+-		if (msg.msg_iovlen == 0) {
++		if (msg->msg_iovlen == 0) {
+ 			sr->len = 0;
+-		} else if (msg.msg_iovlen > 1) {
++		} else if (msg->msg_iovlen > 1) {
+ 			return -EINVAL;
+ 		} else {
+ 			if (!access_ok(uiov, sizeof(*uiov)))
+@@ -255,18 +235,11 @@ static int __io_compat_msg_copy_hdr(struct io_kiocb *req,
+ 			sr->len = clen;
+ 		}
+ 
+-		if (ddir == ITER_DEST && req->flags & REQ_F_APOLL_MULTISHOT) {
+-			iomsg->namelen = msg.msg_namelen;
+-			iomsg->controllen = msg.msg_controllen;
+-			if (io_recvmsg_multishot_overflow(iomsg))
+-				return -EOVERFLOW;
+-		}
+-
+ 		return 0;
+ 	}
+ 
+ 	iomsg->free_iov = iomsg->fast_iov;
+-	ret = __import_iovec(ddir, (struct iovec __user *)uiov, msg.msg_iovlen,
++	ret = __import_iovec(ddir, (struct iovec __user *)uiov, msg->msg_iovlen,
+ 				UIO_FASTIOV, &iomsg->free_iov,
+ 				&iomsg->msg.msg_iter, true);
+ 	if (unlikely(ret < 0))
+@@ -276,47 +249,35 @@ static int __io_compat_msg_copy_hdr(struct io_kiocb *req,
+ }
+ #endif
+ 
+-static int __io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
+-			     struct sockaddr __user **addr, int ddir)
++static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
++			   struct user_msghdr *msg, int ddir)
+ {
+ 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+-	struct user_msghdr msg;
+ 	int ret;
+ 
+-	if (copy_from_user(&msg, sr->umsg, sizeof(*sr->umsg)))
++	if (copy_from_user(msg, sr->umsg, sizeof(*sr->umsg)))
+ 		return -EFAULT;
+ 
+-	ret = __copy_msghdr(&iomsg->msg, &msg, addr);
+-	if (ret)
+-		return ret;
+-
+ 	if (req->flags & REQ_F_BUFFER_SELECT) {
+-		if (msg.msg_iovlen == 0) {
++		if (msg->msg_iovlen == 0) {
+ 			sr->len = iomsg->fast_iov[0].iov_len = 0;
+ 			iomsg->fast_iov[0].iov_base = NULL;
+ 			iomsg->free_iov = NULL;
+-		} else if (msg.msg_iovlen > 1) {
++		} else if (msg->msg_iovlen > 1) {
+ 			return -EINVAL;
+ 		} else {
+-			if (copy_from_user(iomsg->fast_iov, msg.msg_iov,
+-					   sizeof(*msg.msg_iov)))
++			if (copy_from_user(iomsg->fast_iov, msg->msg_iov,
++					   sizeof(*msg->msg_iov)))
+ 				return -EFAULT;
+ 			sr->len = iomsg->fast_iov[0].iov_len;
+ 			iomsg->free_iov = NULL;
+ 		}
+ 
+-		if (ddir == ITER_DEST && req->flags & REQ_F_APOLL_MULTISHOT) {
+-			iomsg->namelen = msg.msg_namelen;
+-			iomsg->controllen = msg.msg_controllen;
+-			if (io_recvmsg_multishot_overflow(iomsg))
+-				return -EOVERFLOW;
+-		}
+-
+ 		return 0;
+ 	}
+ 
+ 	iomsg->free_iov = iomsg->fast_iov;
+-	ret = __import_iovec(ddir, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
++	ret = __import_iovec(ddir, msg->msg_iov, msg->msg_iovlen, UIO_FASTIOV,
+ 				&iomsg->free_iov, &iomsg->msg.msg_iter, false);
+ 	if (unlikely(ret < 0))
+ 		return ret;
+@@ -324,30 +285,34 @@ static int __io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg
+ 	return 0;
+ }
+ 
+-static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
+-			   struct sockaddr __user **addr, int ddir)
++static int io_sendmsg_copy_hdr(struct io_kiocb *req,
++			       struct io_async_msghdr *iomsg)
+ {
++	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
++	struct user_msghdr msg;
++	int ret;
++
+ 	iomsg->msg.msg_name = &iomsg->addr;
+ 	iomsg->msg.msg_iter.nr_segs = 0;
+ 
+ #ifdef CONFIG_COMPAT
+-	if (req->ctx->compat)
+-		return __io_compat_msg_copy_hdr(req, iomsg, addr, ddir);
+-#endif
++	if (unlikely(req->ctx->compat)) {
++		struct compat_msghdr cmsg;
+ 
+-	return __io_msg_copy_hdr(req, iomsg, addr, ddir);
+-}
++		ret = io_compat_msg_copy_hdr(req, iomsg, &cmsg, ITER_SOURCE);
++		if (unlikely(ret))
++			return ret;
+ 
+-static int io_sendmsg_copy_hdr(struct io_kiocb *req,
+-			       struct io_async_msghdr *iomsg)
+-{
+-	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+-	int ret;
++		return __get_compat_msghdr(&iomsg->msg, &cmsg, NULL);
++	}
++#endif
+ 
+-	ret = io_msg_copy_hdr(req, iomsg, NULL, ITER_SOURCE);
+-	if (ret)
++	ret = io_msg_copy_hdr(req, iomsg, &msg, ITER_SOURCE);
++	if (unlikely(ret))
+ 		return ret;
+ 
++	ret = __copy_msghdr(&iomsg->msg, &msg, NULL);
++
+ 	/* save msg_control as sys_sendmsg() overwrites it */
+ 	sr->msg_control = iomsg->msg.msg_control_user;
+ 	return ret;
+@@ -569,10 +534,66 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags)
+ 	return IOU_OK;
+ }
+ 
++static int io_recvmsg_mshot_prep(struct io_kiocb *req,
++				 struct io_async_msghdr *iomsg,
++				 size_t namelen, size_t controllen)
++{
++	if ((req->flags & (REQ_F_APOLL_MULTISHOT|REQ_F_BUFFER_SELECT)) ==
++			  (REQ_F_APOLL_MULTISHOT|REQ_F_BUFFER_SELECT)) {
++		int hdr;
++
++		if (unlikely(namelen < 0))
++			return -EOVERFLOW;
++		if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
++					namelen, &hdr))
++			return -EOVERFLOW;
++		if (check_add_overflow(hdr, (int)controllen, &hdr))
++			return -EOVERFLOW;
++
++		iomsg->namelen = namelen;
++		iomsg->controllen = controllen;
++		return 0;
++	}
++
++	return 0;
++}
++
+ static int io_recvmsg_copy_hdr(struct io_kiocb *req,
+ 			       struct io_async_msghdr *iomsg)
+ {
+-	return io_msg_copy_hdr(req, iomsg, &iomsg->uaddr, ITER_DEST);
++	struct user_msghdr msg;
++	int ret;
++
++	iomsg->msg.msg_name = &iomsg->addr;
++	iomsg->msg.msg_iter.nr_segs = 0;
++
++#ifdef CONFIG_COMPAT
++	if (unlikely(req->ctx->compat)) {
++		struct compat_msghdr cmsg;
++
++		ret = io_compat_msg_copy_hdr(req, iomsg, &cmsg, ITER_DEST);
++		if (unlikely(ret))
++			return ret;
++
++		ret = __get_compat_msghdr(&iomsg->msg, &cmsg, &iomsg->uaddr);
++		if (unlikely(ret))
++			return ret;
++
++		return io_recvmsg_mshot_prep(req, iomsg, cmsg.msg_namelen,
++						cmsg.msg_controllen);
++	}
++#endif
++
++	ret = io_msg_copy_hdr(req, iomsg, &msg, ITER_DEST);
++	if (unlikely(ret))
++		return ret;
++
++	ret = __copy_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
++	if (unlikely(ret))
++		return ret;
++
++	return io_recvmsg_mshot_prep(req, iomsg, msg.msg_namelen,
++					msg.msg_controllen);
+ }
+ 
+ int io_recvmsg_prep_async(struct io_kiocb *req)
+-- 
+2.43.0
+
diff --git a/queue-6.8/io_uring-net-unify-how-recvmsg-and-sendmsg-copy-in-t.patch b/queue-6.8/io_uring-net-unify-how-recvmsg-and-sendmsg-copy-in-t.patch
new file mode 100644
index 00000000000..3edfed3f0fa
--- /dev/null
+++ b/queue-6.8/io_uring-net-unify-how-recvmsg-and-sendmsg-copy-in-t.patch
@@ -0,0 +1,330 @@
+From 78460125e75c6f567ee1939348d2f505b421ce91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 14:16:47 -0700
+Subject: io_uring/net: unify how recvmsg and sendmsg copy in the msghdr
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 52307ac4f2b507f60bae6df5be938d35e199c688 ]
+
+For recvmsg, we roll our own since we support buffer selections. This
+isn't the case for sendmsg right now, but in preparation for doing so,
+make the recvmsg copy helpers generic so we can call them from the
+sendmsg side as well.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 8ede3db5061b ("io_uring/net: fix overflow check in io_recvmsg_mshot_prep()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/net.c | 271 ++++++++++++++++++++++++++-----------------------
+ 1 file changed, 142 insertions(+), 129 deletions(-)
+
+diff --git a/io_uring/net.c b/io_uring/net.c
+index 161622029147c..ef495e2aac2bc 100644
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@ -204,16 +204,150 @@ static int io_setup_async_msg(struct io_kiocb *req,
+ 	return -EAGAIN;
+ }
+ 
++static bool io_recvmsg_multishot_overflow(struct io_async_msghdr *iomsg)
++{
++	int hdr;
++
++	if (iomsg->namelen < 0)
++		return true;
++	if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
++			       iomsg->namelen, &hdr))
++		return true;
++	if (check_add_overflow(hdr, (int)iomsg->controllen, &hdr))
++		return true;
++
++	return false;
++}
++
++#ifdef CONFIG_COMPAT
++static int __io_compat_msg_copy_hdr(struct io_kiocb *req,
++				    struct io_async_msghdr *iomsg,
++				    struct sockaddr __user **addr, int ddir)
++{
++	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
++	struct compat_msghdr msg;
++	struct compat_iovec __user *uiov;
++	int ret;
++
++	if (copy_from_user(&msg, sr->umsg_compat, sizeof(msg)))
++		return -EFAULT;
++
++	ret = __get_compat_msghdr(&iomsg->msg, &msg, addr);
++	if (ret)
++		return ret;
++
++	uiov = compat_ptr(msg.msg_iov);
++	if (req->flags & REQ_F_BUFFER_SELECT) {
++		compat_ssize_t clen;
++
++		iomsg->free_iov = NULL;
++		if (msg.msg_iovlen == 0) {
++			sr->len = 0;
++		} else if (msg.msg_iovlen > 1) {
++			return -EINVAL;
++		} else {
++			if (!access_ok(uiov, sizeof(*uiov)))
++				return -EFAULT;
++			if (__get_user(clen, &uiov->iov_len))
++				return -EFAULT;
++			if (clen < 0)
++				return -EINVAL;
++			sr->len = clen;
++		}
++
++		if (ddir == ITER_DEST && req->flags & REQ_F_APOLL_MULTISHOT) {
++			iomsg->namelen = msg.msg_namelen;
++			iomsg->controllen = msg.msg_controllen;
++			if (io_recvmsg_multishot_overflow(iomsg))
++				return -EOVERFLOW;
++		}
++
++		return 0;
++	}
++
++	iomsg->free_iov = iomsg->fast_iov;
++	ret = __import_iovec(ddir, (struct iovec __user *)uiov, msg.msg_iovlen,
++				UIO_FASTIOV, &iomsg->free_iov,
++				&iomsg->msg.msg_iter, true);
++	if (unlikely(ret < 0))
++		return ret;
++
++	return 0;
++}
++#endif
++
++static int __io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
++			     struct sockaddr __user **addr, int ddir)
++{
++	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
++	struct user_msghdr msg;
++	int ret;
++
++	if (copy_from_user(&msg, sr->umsg, sizeof(*sr->umsg)))
++		return -EFAULT;
++
++	ret = __copy_msghdr(&iomsg->msg, &msg, addr);
++	if (ret)
++		return ret;
++
++	if (req->flags & REQ_F_BUFFER_SELECT) {
++		if (msg.msg_iovlen == 0) {
++			sr->len = iomsg->fast_iov[0].iov_len = 0;
++			iomsg->fast_iov[0].iov_base = NULL;
++			iomsg->free_iov = NULL;
++		} else if (msg.msg_iovlen > 1) {
++			return -EINVAL;
++		} else {
++			if (copy_from_user(iomsg->fast_iov, msg.msg_iov,
++					   sizeof(*msg.msg_iov)))
++				return -EFAULT;
++			sr->len = iomsg->fast_iov[0].iov_len;
++			iomsg->free_iov = NULL;
++		}
++
++		if (ddir == ITER_DEST && req->flags & REQ_F_APOLL_MULTISHOT) {
++			iomsg->namelen = msg.msg_namelen;
++			iomsg->controllen = msg.msg_controllen;
++			if (io_recvmsg_multishot_overflow(iomsg))
++				return -EOVERFLOW;
++		}
++
++		return 0;
++	}
++
++	iomsg->free_iov = iomsg->fast_iov;
++	ret = __import_iovec(ddir, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
++				&iomsg->free_iov, &iomsg->msg.msg_iter, false);
++	if (unlikely(ret < 0))
++		return ret;
++
++	return 0;
++}
++
++static int io_msg_copy_hdr(struct io_kiocb *req, struct io_async_msghdr *iomsg,
++			   struct sockaddr __user **addr, int ddir)
++{
++	iomsg->msg.msg_name = &iomsg->addr;
++	iomsg->msg.msg_iter.nr_segs = 0;
++
++#ifdef CONFIG_COMPAT
++	if (req->ctx->compat)
++		return __io_compat_msg_copy_hdr(req, iomsg, addr, ddir);
++#endif
++
++	return __io_msg_copy_hdr(req, iomsg, addr, ddir);
++}
++
+ static int io_sendmsg_copy_hdr(struct io_kiocb *req,
+ 			       struct io_async_msghdr *iomsg)
+ {
+ 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+ 	int ret;
+ 
+-	iomsg->msg.msg_name = &iomsg->addr;
+-	iomsg->free_iov = iomsg->fast_iov;
+-	ret = sendmsg_copy_msghdr(&iomsg->msg, sr->umsg, sr->msg_flags,
+-					&iomsg->free_iov);
++	ret = io_msg_copy_hdr(req, iomsg, NULL, ITER_SOURCE);
++	if (ret)
++		return ret;
++
+ 	/* save msg_control as sys_sendmsg() overwrites it */
+ 	sr->msg_control = iomsg->msg.msg_control_user;
+ 	return ret;
+@@ -435,142 +569,21 @@ int io_send(struct io_kiocb *req, unsigned int issue_flags)
+ 	return IOU_OK;
+ }
+ 
+-static bool io_recvmsg_multishot_overflow(struct io_async_msghdr *iomsg)
+-{
+-	int hdr;
+-
+-	if (iomsg->namelen < 0)
+-		return true;
+-	if (check_add_overflow((int)sizeof(struct io_uring_recvmsg_out),
+-			       iomsg->namelen, &hdr))
+-		return true;
+-	if (check_add_overflow(hdr, (int)iomsg->controllen, &hdr))
+-		return true;
+-
+-	return false;
+-}
+-
+-static int __io_recvmsg_copy_hdr(struct io_kiocb *req,
+-				 struct io_async_msghdr *iomsg)
+-{
+-	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+-	struct user_msghdr msg;
+-	int ret;
+-
+-	if (copy_from_user(&msg, sr->umsg, sizeof(*sr->umsg)))
+-		return -EFAULT;
+-
+-	ret = __copy_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
+-	if (ret)
+-		return ret;
+-
+-	if (req->flags & REQ_F_BUFFER_SELECT) {
+-		if (msg.msg_iovlen == 0) {
+-			sr->len = iomsg->fast_iov[0].iov_len = 0;
+-			iomsg->fast_iov[0].iov_base = NULL;
+-			iomsg->free_iov = NULL;
+-		} else if (msg.msg_iovlen > 1) {
+-			return -EINVAL;
+-		} else {
+-			if (copy_from_user(iomsg->fast_iov, msg.msg_iov, sizeof(*msg.msg_iov)))
+-				return -EFAULT;
+-			sr->len = iomsg->fast_iov[0].iov_len;
+-			iomsg->free_iov = NULL;
+-		}
+-
+-		if (req->flags & REQ_F_APOLL_MULTISHOT) {
+-			iomsg->namelen = msg.msg_namelen;
+-			iomsg->controllen = msg.msg_controllen;
+-			if (io_recvmsg_multishot_overflow(iomsg))
+-				return -EOVERFLOW;
+-		}
+-	} else {
+-		iomsg->free_iov = iomsg->fast_iov;
+-		ret = __import_iovec(ITER_DEST, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
+-				     &iomsg->free_iov, &iomsg->msg.msg_iter,
+-				     false);
+-		if (ret > 0)
+-			ret = 0;
+-	}
+-
+-	return ret;
+-}
+-
+-#ifdef CONFIG_COMPAT
+-static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
+-					struct io_async_msghdr *iomsg)
+-{
+-	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
+-	struct compat_msghdr msg;
+-	struct compat_iovec __user *uiov;
+-	int ret;
+-
+-	if (copy_from_user(&msg, sr->umsg_compat, sizeof(msg)))
+-		return -EFAULT;
+-
+-	ret = __get_compat_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
+-	if (ret)
+-		return ret;
+-
+-	uiov = compat_ptr(msg.msg_iov);
+-	if (req->flags & REQ_F_BUFFER_SELECT) {
+-		compat_ssize_t clen;
+-
+-		iomsg->free_iov = NULL;
+-		if (msg.msg_iovlen == 0) {
+-			sr->len = 0;
+-		} else if (msg.msg_iovlen > 1) {
+-			return -EINVAL;
+-		} else {
+-			if (!access_ok(uiov, sizeof(*uiov)))
+-				return -EFAULT;
+-			if (__get_user(clen, &uiov->iov_len))
+-				return -EFAULT;
+-			if (clen < 0)
+-				return -EINVAL;
+-			sr->len = clen;
+-		}
+-
+-		if (req->flags & REQ_F_APOLL_MULTISHOT) {
+-			iomsg->namelen = msg.msg_namelen;
+-			iomsg->controllen = msg.msg_controllen;
+-			if (io_recvmsg_multishot_overflow(iomsg))
+-				return -EOVERFLOW;
+-		}
+-	} else {
+-		iomsg->free_iov = iomsg->fast_iov;
+-		ret = __import_iovec(ITER_DEST, (struct iovec __user *)uiov, msg.msg_iovlen,
+-				   UIO_FASTIOV, &iomsg->free_iov,
+-				   &iomsg->msg.msg_iter, true);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return 0;
+-}
+-#endif
+-
+ static int io_recvmsg_copy_hdr(struct io_kiocb *req,
+ 			       struct io_async_msghdr *iomsg)
+ {
+-	iomsg->msg.msg_name = &iomsg->addr;
+-	iomsg->msg.msg_iter.nr_segs = 0;
+-
+-#ifdef CONFIG_COMPAT
+-	if (req->ctx->compat)
+-		return __io_compat_recvmsg_copy_hdr(req, iomsg);
+-#endif
+-
+-	return __io_recvmsg_copy_hdr(req, iomsg);
++	return io_msg_copy_hdr(req, iomsg, &iomsg->uaddr, ITER_DEST);
+ }
+ 
+ int io_recvmsg_prep_async(struct io_kiocb *req)
+ {
++	struct io_async_msghdr *iomsg;
+ 	int ret;
+ 
+ 	if (!io_msg_alloc_async_prep(req))
+ 		return -ENOMEM;
+-	ret = io_recvmsg_copy_hdr(req, req->async_data);
++	iomsg = req->async_data;
++	ret = io_recvmsg_copy_hdr(req, iomsg);
+ 	if (!ret)
+ 		req->flags |= REQ_F_NEED_CLEANUP;
+ 	return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.8/io_uring-remove-looping-around-handling-traditional-.patch b/queue-6.8/io_uring-remove-looping-around-handling-traditional-.patch
new file mode 100644
index 00000000000..4f23689d7ed
--- /dev/null
+++ b/queue-6.8/io_uring-remove-looping-around-handling-traditional-.patch
@@ -0,0 +1,126 @@
+From c10bd2794bf423d23fa9d2a59265cbea9f8e7dcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 07:00:47 -0700
+Subject: io_uring: remove looping around handling traditional task_work
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 592b4805432af075468876771c0f7d41273ccb3c ]
+
+A previous commit added looping around handling traditional task_work
+as an optimization, and while that may seem like a good idea, it's also
+possible to run into application starvation doing so. If the task_work
+generation is bursty, we can get very deep task_work queues, and we can
+end up looping in here for a very long time.
+
+One immediately observable problem with that is handling network traffic
+using provided buffers, where flooding incoming traffic and looping
+task_work handling will very quickly lead to buffer starvation as we
+keep running task_work rather than returning to the application so it
+can handle the associated CQEs and also provide buffers back.
+
+Fixes: 3a0c037b0e16 ("io_uring: batch task_work")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/io_uring.c | 45 +++++++--------------------------------------
+ 1 file changed, 7 insertions(+), 38 deletions(-)
+
+diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
+index cd9a137ad6cef..5233a20d01b54 100644
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -1176,12 +1176,11 @@ static void ctx_flush_and_put(struct io_ring_ctx *ctx, struct io_tw_state *ts)
+ 
+ static unsigned int handle_tw_list(struct llist_node *node,
+ 				   struct io_ring_ctx **ctx,
+-				   struct io_tw_state *ts,
+-				   struct llist_node *last)
++				   struct io_tw_state *ts)
+ {
+ 	unsigned int count = 0;
+ 
+-	while (node && node != last) {
++	do {
+ 		struct llist_node *next = node->next;
+ 		struct io_kiocb *req = container_of(node, struct io_kiocb,
+ 						    io_task_work.node);
+@@ -1205,7 +1204,7 @@ static unsigned int handle_tw_list(struct llist_node *node,
+ 			*ctx = NULL;
+ 			cond_resched();
+ 		}
+-	}
++	} while (node);
+ 
+ 	return count;
+ }
+@@ -1224,22 +1223,6 @@ static inline struct llist_node *io_llist_xchg(struct llist_head *head,
+ 	return xchg(&head->first, new);
+ }
+ 
+-/**
+- * io_llist_cmpxchg - possibly swap all entries in a lock-less list
+- * @head:	the head of lock-less list to delete all entries
+- * @old:	expected old value of the first entry of the list
+- * @new:	new entry as the head of the list
+- *
+- * perform a cmpxchg on the first entry of the list.
+- */
+-
+-static inline struct llist_node *io_llist_cmpxchg(struct llist_head *head,
+-						  struct llist_node *old,
+-						  struct llist_node *new)
+-{
+-	return cmpxchg(&head->first, old, new);
+-}
+-
+ static __cold void io_fallback_tw(struct io_uring_task *tctx, bool sync)
+ {
+ 	struct llist_node *node = llist_del_all(&tctx->task_list);
+@@ -1274,9 +1257,7 @@ void tctx_task_work(struct callback_head *cb)
+ 	struct io_ring_ctx *ctx = NULL;
+ 	struct io_uring_task *tctx = container_of(cb, struct io_uring_task,
+ 						  task_work);
+-	struct llist_node fake = {};
+ 	struct llist_node *node;
+-	unsigned int loops = 0;
+ 	unsigned int count = 0;
+ 
+ 	if (unlikely(current->flags & PF_EXITING)) {
+@@ -1284,21 +1265,9 @@ void tctx_task_work(struct callback_head *cb)
+ 		return;
+ 	}
+ 
+-	do {
+-		loops++;
+-		node = io_llist_xchg(&tctx->task_list, &fake);
+-		count += handle_tw_list(node, &ctx, &ts, &fake);
+-
+-		/* skip expensive cmpxchg if there are items in the list */
+-		if (READ_ONCE(tctx->task_list.first) != &fake)
+-			continue;
+-		if (ts.locked && !wq_list_empty(&ctx->submit_state.compl_reqs)) {
+-			io_submit_flush_completions(ctx);
+-			if (READ_ONCE(tctx->task_list.first) != &fake)
+-				continue;
+-		}
+-		node = io_llist_cmpxchg(&tctx->task_list, &fake, NULL);
+-	} while (node != &fake);
++	node = llist_del_all(&tctx->task_list);
++	if (node)
++		count = handle_tw_list(node, &ctx, &ts);
+ 
+ 	ctx_flush_and_put(ctx, &ts);
+ 
+@@ -1306,7 +1275,7 @@ void tctx_task_work(struct callback_head *cb)
+ 	if (unlikely(atomic_read(&tctx->in_cancel)))
+ 		io_uring_drop_tctx_refs(current);
+ 
+-	trace_io_uring_task_work_run(tctx, count, loops);
++	trace_io_uring_task_work_run(tctx, count, 1);
+ }
+ 
+ static inline void io_req_local_work_add(struct io_kiocb *req, unsigned flags)
+-- 
+2.43.0
+
diff --git a/queue-6.8/io_uring-remove-unconditional-looping-in-local-task_.patch b/queue-6.8/io_uring-remove-unconditional-looping-in-local-task_.patch
new file mode 100644
index 00000000000..4ecbefc23be
--- /dev/null
+++ b/queue-6.8/io_uring-remove-unconditional-looping-in-local-task_.patch
@@ -0,0 +1,165 @@
+From 4524658898dff95be36a6cbc38080a80d501f886 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 10:50:08 -0700
+Subject: io_uring: remove unconditional looping in local task_work handling
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit 9fe3eaea4a3530ca34a8d8ff00b1848c528789ca ]
+
+If we have a ton of notifications coming in, we can be looping in here
+for a long time. This can be problematic for various reasons, mostly
+because we can starve userspace. If the application is waiting on N
+events, then only re-run if we need more events.
+
+Fixes: c0e0d6ba25f1 ("io_uring: add IORING_SETUP_DEFER_TASKRUN")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ io_uring/io_uring.c | 44 +++++++++++++++++++++++++++++---------------
+ 1 file changed, 29 insertions(+), 15 deletions(-)
+
+diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
+index 5233a20d01b54..39dfb83dc9fc4 100644
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -1389,7 +1389,20 @@ static void __cold io_move_task_work_from_local(struct io_ring_ctx *ctx)
+ 	}
+ }
+ 
+-static int __io_run_local_work(struct io_ring_ctx *ctx, struct io_tw_state *ts)
++static bool io_run_local_work_continue(struct io_ring_ctx *ctx, int events,
++				       int min_events)
++{
++	if (llist_empty(&ctx->work_llist))
++		return false;
++	if (events < min_events)
++		return true;
++	if (ctx->flags & IORING_SETUP_TASKRUN_FLAG)
++		atomic_or(IORING_SQ_TASKRUN, &ctx->rings->sq_flags);
++	return false;
++}
++
++static int __io_run_local_work(struct io_ring_ctx *ctx, struct io_tw_state *ts,
++			       int min_events)
+ {
+ 	struct llist_node *node;
+ 	unsigned int loops = 0;
+@@ -1418,18 +1431,20 @@ static int __io_run_local_work(struct io_ring_ctx *ctx, struct io_tw_state *ts)
+ 	}
+ 	loops++;
+ 
+-	if (!llist_empty(&ctx->work_llist))
++	if (io_run_local_work_continue(ctx, ret, min_events))
+ 		goto again;
+ 	if (ts->locked) {
+ 		io_submit_flush_completions(ctx);
+-		if (!llist_empty(&ctx->work_llist))
++		if (io_run_local_work_continue(ctx, ret, min_events))
+ 			goto again;
+ 	}
++
+ 	trace_io_uring_local_work_run(ctx, ret, loops);
+ 	return ret;
+ }
+ 
+-static inline int io_run_local_work_locked(struct io_ring_ctx *ctx)
++static inline int io_run_local_work_locked(struct io_ring_ctx *ctx,
++					   int min_events)
+ {
+ 	struct io_tw_state ts = { .locked = true, };
+ 	int ret;
+@@ -1437,20 +1452,20 @@ static inline int io_run_local_work_locked(struct io_ring_ctx *ctx)
+ 	if (llist_empty(&ctx->work_llist))
+ 		return 0;
+ 
+-	ret = __io_run_local_work(ctx, &ts);
++	ret = __io_run_local_work(ctx, &ts, min_events);
+ 	/* shouldn't happen! */
+ 	if (WARN_ON_ONCE(!ts.locked))
+ 		mutex_lock(&ctx->uring_lock);
+ 	return ret;
+ }
+ 
+-static int io_run_local_work(struct io_ring_ctx *ctx)
++static int io_run_local_work(struct io_ring_ctx *ctx, int min_events)
+ {
+ 	struct io_tw_state ts = {};
+ 	int ret;
+ 
+ 	ts.locked = mutex_trylock(&ctx->uring_lock);
+-	ret = __io_run_local_work(ctx, &ts);
++	ret = __io_run_local_work(ctx, &ts, min_events);
+ 	if (ts.locked)
+ 		mutex_unlock(&ctx->uring_lock);
+ 
+@@ -1646,7 +1661,7 @@ static int io_iopoll_check(struct io_ring_ctx *ctx, long min)
+ 		    io_task_work_pending(ctx)) {
+ 			u32 tail = ctx->cached_cq_tail;
+ 
+-			(void) io_run_local_work_locked(ctx);
++			(void) io_run_local_work_locked(ctx, min);
+ 
+ 			if (task_work_pending(current) ||
+ 			    wq_list_empty(&ctx->iopoll_list)) {
+@@ -2489,7 +2504,7 @@ int io_run_task_work_sig(struct io_ring_ctx *ctx)
+ {
+ 	if (!llist_empty(&ctx->work_llist)) {
+ 		__set_current_state(TASK_RUNNING);
+-		if (io_run_local_work(ctx) > 0)
++		if (io_run_local_work(ctx, INT_MAX) > 0)
+ 			return 0;
+ 	}
+ 	if (io_run_task_work() > 0)
+@@ -2557,7 +2572,7 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
+ 	if (!io_allowed_run_tw(ctx))
+ 		return -EEXIST;
+ 	if (!llist_empty(&ctx->work_llist))
+-		io_run_local_work(ctx);
++		io_run_local_work(ctx, min_events);
+ 	io_run_task_work();
+ 	io_cqring_overflow_flush(ctx);
+ 	/* if user messes with these they will just get an early return */
+@@ -2595,11 +2610,10 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
+ 
+ 	trace_io_uring_cqring_wait(ctx, min_events);
+ 	do {
++		int nr_wait = (int) iowq.cq_tail - READ_ONCE(ctx->rings->cq.tail);
+ 		unsigned long check_cq;
+ 
+ 		if (ctx->flags & IORING_SETUP_DEFER_TASKRUN) {
+-			int nr_wait = (int) iowq.cq_tail - READ_ONCE(ctx->rings->cq.tail);
+-
+ 			atomic_set(&ctx->cq_wait_nr, nr_wait);
+ 			set_current_state(TASK_INTERRUPTIBLE);
+ 		} else {
+@@ -2618,7 +2632,7 @@ static int io_cqring_wait(struct io_ring_ctx *ctx, int min_events,
+ 		 */
+ 		io_run_task_work();
+ 		if (!llist_empty(&ctx->work_llist))
+-			io_run_local_work(ctx);
++			io_run_local_work(ctx, nr_wait);
+ 
+ 		/*
+ 		 * Non-local task_work will be run on exit to userspace, but
+@@ -3273,7 +3287,7 @@ static __cold bool io_uring_try_cancel_requests(struct io_ring_ctx *ctx,
+ 
+ 	if ((ctx->flags & IORING_SETUP_DEFER_TASKRUN) &&
+ 	    io_allowed_defer_tw_run(ctx))
+-		ret |= io_run_local_work(ctx) > 0;
++		ret |= io_run_local_work(ctx, INT_MAX) > 0;
+ 	ret |= io_cancel_defer_files(ctx, task, cancel_all);
+ 	mutex_lock(&ctx->uring_lock);
+ 	ret |= io_poll_remove_all(ctx, task, cancel_all);
+@@ -3635,7 +3649,7 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned int, fd, u32, to_submit,
+ 			 * it should handle ownership problems if any.
+ 			 */
+ 			if (ctx->flags & IORING_SETUP_DEFER_TASKRUN)
+-				(void)io_run_local_work_locked(ctx);
++				(void)io_run_local_work_locked(ctx, min_complete);
+ 		}
+ 		mutex_unlock(&ctx->uring_lock);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/iomap-clear-the-per-folio-dirty-bits-on-all-writebac.patch b/queue-6.8/iomap-clear-the-per-folio-dirty-bits-on-all-writebac.patch
new file mode 100644
index 00000000000..7c0c4ec7022
--- /dev/null
+++ b/queue-6.8/iomap-clear-the-per-folio-dirty-bits-on-all-writebac.patch
@@ -0,0 +1,71 @@
+From 1c638af6f22f5442dcc4b3cb408758d69eaf543d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 08:26:57 +0100
+Subject: iomap: clear the per-folio dirty bits on all writeback failures
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 7ea1d9b4a840c2dd01d1234663d4a8ef256cfe39 ]
+
+write_cache_pages always clear the page dirty bit before calling into the
+file systems, and leaves folios with a writeback failure without the
+dirty bit after return.  We also clear the per-block writeback bits for
+writeback failures unless no I/O has submitted, which will leave the
+folio in an inconsistent state where it doesn't have the folio dirty,
+but one or more per-block dirty bits.  This seems to be due the place
+where the iomap_clear_range_dirty call was inserted into the existing
+not very clearly structured code when adding per-block dirty bit support
+and not actually intentional.  Switch to always clearing the dirty on
+writeback failure.
+
+Fixes: 4ce02c679722 ("iomap: Add per-block dirty state tracking to improve performance")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20231207072710.176093-2-hch@lst.de
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap/buffered-io.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
+index 093c4515b22a5..228fd2e05e12f 100644
+--- a/fs/iomap/buffered-io.c
++++ b/fs/iomap/buffered-io.c
+@@ -1833,16 +1833,10 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,
+ 	if (unlikely(error)) {
+ 		/*
+ 		 * Let the filesystem know what portion of the current page
+-		 * failed to map. If the page hasn't been added to ioend, it
+-		 * won't be affected by I/O completion and we must unlock it
+-		 * now.
++		 * failed to map.
+ 		 */
+ 		if (wpc->ops->discard_folio)
+ 			wpc->ops->discard_folio(folio, pos);
+-		if (!count) {
+-			folio_unlock(folio);
+-			goto done;
+-		}
+ 	}
+ 
+ 	/*
+@@ -1851,6 +1845,16 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc,
+ 	 * all the dirty bits in the folio here.
+ 	 */
+ 	iomap_clear_range_dirty(folio, 0, folio_size(folio));
++
++	/*
++	 * If the page hasn't been added to the ioend, it won't be affected by
++	 * I/O completion and we must unlock it now.
++	 */
++	if (error && !count) {
++		folio_unlock(folio);
++		goto done;
++	}
++
+ 	folio_start_writeback(folio);
+ 	folio_unlock(folio);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-add-static-iommu_ops-release_domain.patch b/queue-6.8/iommu-add-static-iommu_ops-release_domain.patch
new file mode 100644
index 00000000000..2a332890b74
--- /dev/null
+++ b/queue-6.8/iommu-add-static-iommu_ops-release_domain.patch
@@ -0,0 +1,94 @@
+From 23c614c7241cb347538937012be2dd3c1deceb82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 20:21:17 +0800
+Subject: iommu: Add static iommu_ops->release_domain
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 0061ffe289e19caabeea8103e69cb0f1896e34d8 ]
+
+The current device_release callback for individual iommu drivers does the
+following:
+
+1) Silent IOMMU DMA translation: It detaches any existing domain from the
+   device and puts it into a blocking state (some drivers might use the
+   identity state).
+2) Resource release: It releases resources allocated during the
+   device_probe callback and restores the device to its pre-probe state.
+
+Step 1 is challenging for individual iommu drivers because each must check
+if a domain is already attached to the device. Additionally, if a deferred
+attach never occurred, the device_release should avoid modifying hardware
+configuration regardless of the reason for its call.
+
+To simplify this process, introduce a static release_domain within the
+iommu_ops structure. It can be either a blocking or identity domain
+depending on the iommu hardware. The iommu core will decide whether to
+attach this domain before the device_release callback, eliminating the
+need for repetitive code in various drivers.
+
+Consequently, the device_release callback can focus solely on the opposite
+operations of device_probe, including releasing all resources allocated
+during that callback.
+
+Co-developed-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20240305013305.204605-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 19 +++++++++++++++----
+ include/linux/iommu.h |  1 +
+ 2 files changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index d14413916f93a..cd1210026ac53 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -463,13 +463,24 @@ static void iommu_deinit_device(struct device *dev)
+ 
+ 	/*
+ 	 * release_device() must stop using any attached domain on the device.
+-	 * If there are still other devices in the group they are not effected
++	 * If there are still other devices in the group, they are not affected
+ 	 * by this callback.
+ 	 *
+-	 * The IOMMU driver must set the device to either an identity or
+-	 * blocking translation and stop using any domain pointer, as it is
+-	 * going to be freed.
++	 * If the iommu driver provides release_domain, the core code ensures
++	 * that domain is attached prior to calling release_device. Drivers can
++	 * use this to enforce a translation on the idle iommu. Typically, the
++	 * global static blocked_domain is a good choice.
++	 *
++	 * Otherwise, the iommu driver must set the device to either an identity
++	 * or a blocking translation in release_device() and stop using any
++	 * domain pointer, as it is going to be freed.
++	 *
++	 * Regardless, if a delayed attach never occurred, then the release
++	 * should still avoid touching any hardware configuration either.
+ 	 */
++	if (!dev->iommu->attach_deferred && ops->release_domain)
++		ops->release_domain->ops->attach_dev(ops->release_domain, dev);
++
+ 	if (ops->release_device)
+ 		ops->release_device(dev);
+ 
+diff --git a/include/linux/iommu.h b/include/linux/iommu.h
+index 5e27cb3a3be99..c948289f64d08 100644
+--- a/include/linux/iommu.h
++++ b/include/linux/iommu.h
+@@ -487,6 +487,7 @@ struct iommu_ops {
+ 	struct module *owner;
+ 	struct iommu_domain *identity_domain;
+ 	struct iommu_domain *blocked_domain;
++	struct iommu_domain *release_domain;
+ 	struct iommu_domain *default_domain;
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-amd-mark-interrupt-as-managed.patch b/queue-6.8/iommu-amd-mark-interrupt-as-managed.patch
new file mode 100644
index 00000000000..fa119608c0d
--- /dev/null
+++ b/queue-6.8/iommu-amd-mark-interrupt-as-managed.patch
@@ -0,0 +1,69 @@
+From f608fb342a4206610c20366dec70eb7b834dbff3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 17:34:00 -0600
+Subject: iommu/amd: Mark interrupt as managed
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit 0feda94c868d396fac3b3cb14089d2d989a07c72 ]
+
+On many systems that have an AMD IOMMU the following sequence of
+warnings is observed during bootup.
+
+```
+pci 0000:00:00.2  can't derive routing for PCI INT A
+pci 0000:00:00.2: PCI INT A: not connected
+```
+
+This series of events happens because of the IOMMU initialization
+sequence order and the lack of _PRT entries for the IOMMU.
+
+During initialization the IOMMU driver first enables the PCI device
+using pci_enable_device().  This will call acpi_pci_irq_enable()
+which will check if the interrupt is declared in a PCI routing table
+(_PRT) entry. According to the PCI spec [1] these routing entries
+are only required under PCI root bridges:
+	The _PRT object is required under all PCI root bridges
+
+The IOMMU is directly connected to the root complex, so there is no
+parent bridge to look for a _PRT entry. The first warning is emitted
+since no entry could be found in the hierarchy. The second warning is
+then emitted because the interrupt hasn't yet been configured to any
+value.  The pin was configured in pci_read_irq() but the byte in
+PCI_INTERRUPT_LINE return 0xff which means "Unknown".
+
+After that sequence of events pci_enable_msi() is called and this
+will allocate an interrupt.
+
+That is both of these warnings are totally harmless because the IOMMU
+uses MSI for interrupts.  To avoid even trying to probe for a _PRT
+entry mark the IOMMU as IRQ managed. This avoids both warnings.
+
+Link: https://uefi.org/htmlspecs/ACPI_Spec_6_4_html/06_Device_Configuration/Device_Configuration.html?highlight=_prt#prt-pci-routing-table [1]
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Fixes: cffe0a2b5a34 ("x86, irq: Keep balance of IOAPIC pin reference count")
+Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
+Link: https://lore.kernel.org/r/20240122233400.1802-1-mario.limonciello@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd/init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
+index c83bd0c2a1c92..40979b0f5250f 100644
+--- a/drivers/iommu/amd/init.c
++++ b/drivers/iommu/amd/init.c
+@@ -2068,6 +2068,9 @@ static int __init iommu_init_pci(struct amd_iommu *iommu)
+ 	/* Prevent binding other PCI device drivers to IOMMU devices */
+ 	iommu->dev->match_driver = false;
+ 
++	/* ACPI _PRT won't have an IRQ for IOMMU */
++	iommu->dev->irq_managed = 1;
++
+ 	pci_read_config_dword(iommu->dev, cap_ptr + MMIO_CAP_HDR_OFFSET,
+ 			      &iommu->cap);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-arm-smmu-v3-check-that-the-rid-domain-is-s1-in.patch b/queue-6.8/iommu-arm-smmu-v3-check-that-the-rid-domain-is-s1-in.patch
new file mode 100644
index 00000000000..d788695a276
--- /dev/null
+++ b/queue-6.8/iommu-arm-smmu-v3-check-that-the-rid-domain-is-s1-in.patch
@@ -0,0 +1,61 @@
+From 47ae226f2334f7f8614671beeb7e90a554508077 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 13:07:22 -0400
+Subject: iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+[ Upstream commit ae91f6552c301e5e8569667e9d5440d5f75a90c4 ]
+
+The SVA code only works if the RID domain is a S1 domain and has already
+installed the cdtable.
+
+Originally the check for this was in arm_smmu_sva_bind() but when the op
+was removed the test didn't get copied over to the new
+arm_smmu_sva_set_dev_pasid().
+
+Without the test wrong usage usually will hit a WARN_ON() in
+arm_smmu_write_ctx_desc() due to a missing ctx table.
+
+However, the next patches wil change things so that an IDENTITY domain is
+not a struct arm_smmu_domain and this will get into memory corruption if
+the struct is wrongly casted.
+
+Fail in arm_smmu_sva_set_dev_pasid() if the STE does not have a S1, which
+is a proxy for the STE having a pointer to the CD table. Write it in a way
+that will be compatible with the next patches.
+
+Fixes: 386fa64fd52b ("arm-smmu-v3/sva: Add SVA domain support")
+Reported-by: Shameerali Kolothum Thodi <shameerali.kolothum.thodi@huawei.com>
+Closes: https://lore.kernel.org/linux-iommu/2a828e481416405fb3a4cceb9e075a59@huawei.com/
+Tested-by: Nicolin Chen <nicolinc@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/11-v6-96275f25c39d+2d4-smmuv3_newapi_p1_jgg@nvidia.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
+index 4a27fbdb2d844..2610e82c0ecd0 100644
+--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c
+@@ -364,7 +364,13 @@ static int __arm_smmu_sva_bind(struct device *dev, ioasid_t pasid,
+ 	struct arm_smmu_bond *bond;
+ 	struct arm_smmu_master *master = dev_iommu_priv_get(dev);
+ 	struct iommu_domain *domain = iommu_get_domain_for_dev(dev);
+-	struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
++	struct arm_smmu_domain *smmu_domain;
++
++	if (!(domain->type & __IOMMU_DOMAIN_PAGING))
++		return -ENODEV;
++	smmu_domain = to_smmu_domain(domain);
++	if (smmu_domain->stage != ARM_SMMU_DOMAIN_S1)
++		return -ENODEV;
+ 
+ 	if (!master || !master->sva_enabled)
+ 		return -ENODEV;
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-fix-compilation-without-config_iommu_intel.patch b/queue-6.8/iommu-fix-compilation-without-config_iommu_intel.patch
new file mode 100644
index 00000000000..3b4978f6471
--- /dev/null
+++ b/queue-6.8/iommu-fix-compilation-without-config_iommu_intel.patch
@@ -0,0 +1,68 @@
+From e4d4ac0a87778621c93a3c34d6e14d54ee8f916e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 20:44:19 +0100
+Subject: iommu: Fix compilation without CONFIG_IOMMU_INTEL
+
+From: Bert Karwatzki <spasswolf@web.de>
+
+[ Upstream commit 70bad345e622c23bb530016925c936ab04a646ac ]
+
+When the kernel is comiled with CONFIG_IRQ_REMAP=y but without
+CONFIG_IOMMU_INTEL compilation fails since commit def054b01a8678 with an
+undefined reference to device_rbtree_find(). This patch makes sure that
+intel specific code is only compiled with CONFIG_IOMMU_INTEL=y.
+
+Signed-off-by: Bert Karwatzki <spasswolf@web.de>
+Fixes: 80a9b50c0b9e ("iommu/vt-d: Improve ITE fault handling if target  device isn't present")
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Link: https://lore.kernel.org/r/20240307194419.15801-1-spasswolf@web.de
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/Kconfig         | 2 +-
+ drivers/iommu/intel/Makefile  | 2 ++
+ drivers/iommu/irq_remapping.c | 3 ++-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
+index 9a29d742617e3..9dbb55e745bd9 100644
+--- a/drivers/iommu/Kconfig
++++ b/drivers/iommu/Kconfig
+@@ -196,7 +196,7 @@ source "drivers/iommu/iommufd/Kconfig"
+ config IRQ_REMAP
+ 	bool "Support for Interrupt Remapping"
+ 	depends on X86_64 && X86_IO_APIC && PCI_MSI && ACPI
+-	select DMAR_TABLE
++	select DMAR_TABLE if INTEL_IOMMU
+ 	help
+ 	  Supports Interrupt remapping for IO-APIC and MSI devices.
+ 	  To use x2apic mode in the CPU's which support x2APIC enhancements or
+diff --git a/drivers/iommu/intel/Makefile b/drivers/iommu/intel/Makefile
+index 5dabf081a7793..5402b699a1229 100644
+--- a/drivers/iommu/intel/Makefile
++++ b/drivers/iommu/intel/Makefile
+@@ -5,5 +5,7 @@ obj-$(CONFIG_DMAR_TABLE) += trace.o cap_audit.o
+ obj-$(CONFIG_DMAR_PERF) += perf.o
+ obj-$(CONFIG_INTEL_IOMMU_DEBUGFS) += debugfs.o
+ obj-$(CONFIG_INTEL_IOMMU_SVM) += svm.o
++ifdef CONFIG_INTEL_IOMMU
+ obj-$(CONFIG_IRQ_REMAP) += irq_remapping.o
++endif
+ obj-$(CONFIG_INTEL_IOMMU_PERF_EVENTS) += perfmon.o
+diff --git a/drivers/iommu/irq_remapping.c b/drivers/iommu/irq_remapping.c
+index 83314b9d8f38b..ee59647c20501 100644
+--- a/drivers/iommu/irq_remapping.c
++++ b/drivers/iommu/irq_remapping.c
+@@ -99,7 +99,8 @@ int __init irq_remapping_prepare(void)
+ 	if (disable_irq_remap)
+ 		return -ENOSYS;
+ 
+-	if (intel_irq_remap_ops.prepare() == 0)
++	if (IS_ENABLED(CONFIG_INTEL_IOMMU) &&
++	    intel_irq_remap_ops.prepare() == 0)
+ 		remap_ops = &intel_irq_remap_ops;
+ 	else if (IS_ENABLED(CONFIG_AMD_IOMMU) &&
+ 		 amd_iommu_irq_ops.prepare() == 0)
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch b/queue-6.8/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
new file mode 100644
index 00000000000..2d6cb3562ae
--- /dev/null
+++ b/queue-6.8/iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
@@ -0,0 +1,203 @@
+From 4e79c7676dddc4555695b8afa905c7151cca20a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 20:21:15 +0800
+Subject: iommu/vt-d: Don't issue ATS Invalidation request when device is
+ disconnected
+
+From: Ethan Zhao <haifeng.zhao@linux.intel.com>
+
+[ Upstream commit 4fc82cd907ac075648789cc3a00877778aa1838b ]
+
+For those endpoint devices connect to system via hotplug capable ports,
+users could request a hot reset to the device by flapping device's link
+through setting the slot's link control register, as pciehp_ist() DLLSC
+interrupt sequence response, pciehp will unload the device driver and
+then power it off. thus cause an IOMMU device-TLB invalidation (Intel
+VT-d spec, or ATS Invalidation in PCIe spec r6.1) request for non-existence
+target device to be sent and deadly loop to retry that request after ITE
+fault triggered in interrupt context.
+
+That would cause following continuous hard lockup warning and system hang
+
+[ 4211.433662] pcieport 0000:17:01.0: pciehp: Slot(108): Link Down
+[ 4211.433664] pcieport 0000:17:01.0: pciehp: Slot(108): Card not present
+[ 4223.822591] NMI watchdog: Watchdog detected hard LOCKUP on cpu 144
+[ 4223.822622] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S
+         OE    kernel version xxxx
+[ 4223.822623] Hardware name: vendorname xxxx 666-106,
+BIOS 01.01.02.03.01 05/15/2023
+[ 4223.822623] RIP: 0010:qi_submit_sync+0x2c0/0x490
+[ 4223.822624] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b
+ 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 1
+0 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39
+[ 4223.822624] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093
+[ 4223.822625] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005
+[ 4223.822625] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340
+[ 4223.822625] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000
+[ 4223.822626] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200
+[ 4223.822626] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004
+[ 4223.822626] FS:  0000000000000000(0000) GS:ffffa237ae400000(0000)
+knlGS:0000000000000000
+[ 4223.822627] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 4223.822627] CR2: 00007ffe86515d80 CR3: 000002fd3000a001 CR4: 0000000000770ee0
+[ 4223.822627] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 4223.822628] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
+[ 4223.822628] PKRU: 55555554
+[ 4223.822628] Call Trace:
+[ 4223.822628]  qi_flush_dev_iotlb+0xb1/0xd0
+[ 4223.822628]  __dmar_remove_one_dev_info+0x224/0x250
+[ 4223.822629]  dmar_remove_one_dev_info+0x3e/0x50
+[ 4223.822629]  intel_iommu_release_device+0x1f/0x30
+[ 4223.822629]  iommu_release_device+0x33/0x60
+[ 4223.822629]  iommu_bus_notifier+0x7f/0x90
+[ 4223.822630]  blocking_notifier_call_chain+0x60/0x90
+[ 4223.822630]  device_del+0x2e5/0x420
+[ 4223.822630]  pci_remove_bus_device+0x70/0x110
+[ 4223.822630]  pciehp_unconfigure_device+0x7c/0x130
+[ 4223.822631]  pciehp_disable_slot+0x6b/0x100
+[ 4223.822631]  pciehp_handle_presence_or_link_change+0xd8/0x320
+[ 4223.822631]  pciehp_ist+0x176/0x180
+[ 4223.822631]  ? irq_finalize_oneshot.part.50+0x110/0x110
+[ 4223.822632]  irq_thread_fn+0x19/0x50
+[ 4223.822632]  irq_thread+0x104/0x190
+[ 4223.822632]  ? irq_forced_thread_fn+0x90/0x90
+[ 4223.822632]  ? irq_thread_check_affinity+0xe0/0xe0
+[ 4223.822633]  kthread+0x114/0x130
+[ 4223.822633]  ? __kthread_cancel_work+0x40/0x40
+[ 4223.822633]  ret_from_fork+0x1f/0x30
+[ 4223.822633] Kernel panic - not syncing: Hard LOCKUP
+[ 4223.822634] CPU: 144 PID: 1422 Comm: irq/57-pciehp Kdump: loaded Tainted: G S
+         OE     kernel version xxxx
+[ 4223.822634] Hardware name: vendorname xxxx 666-106,
+BIOS 01.01.02.03.01 05/15/2023
+[ 4223.822634] Call Trace:
+[ 4223.822634]  <NMI>
+[ 4223.822635]  dump_stack+0x6d/0x88
+[ 4223.822635]  panic+0x101/0x2d0
+[ 4223.822635]  ? ret_from_fork+0x11/0x30
+[ 4223.822635]  nmi_panic.cold.14+0xc/0xc
+[ 4223.822636]  watchdog_overflow_callback.cold.8+0x6d/0x81
+[ 4223.822636]  __perf_event_overflow+0x4f/0xf0
+[ 4223.822636]  handle_pmi_common+0x1ef/0x290
+[ 4223.822636]  ? __set_pte_vaddr+0x28/0x40
+[ 4223.822637]  ? flush_tlb_one_kernel+0xa/0x20
+[ 4223.822637]  ? __native_set_fixmap+0x24/0x30
+[ 4223.822637]  ? ghes_copy_tofrom_phys+0x70/0x100
+[ 4223.822637]  ? __ghes_peek_estatus.isra.16+0x49/0xa0
+[ 4223.822637]  intel_pmu_handle_irq+0xba/0x2b0
+[ 4223.822638]  perf_event_nmi_handler+0x24/0x40
+[ 4223.822638]  nmi_handle+0x4d/0xf0
+[ 4223.822638]  default_do_nmi+0x49/0x100
+[ 4223.822638]  exc_nmi+0x134/0x180
+[ 4223.822639]  end_repeat_nmi+0x16/0x67
+[ 4223.822639] RIP: 0010:qi_submit_sync+0x2c0/0x490
+[ 4223.822639] Code: 48 be 00 00 00 00 00 08 00 00 49 85 74 24 20 0f 95 c1 48 8b
+ 57 10 83 c1 04 83 3c 1a 03 0f 84 a2 01 00 00 49 8b 04 24 8b 70 34 <40> f6 c6 10
+ 74 17 49 8b 04 24 8b 80 80 00 00 00 89 c2 d3 fa 41 39
+[ 4223.822640] RSP: 0018:ffffc4f074f0bbb8 EFLAGS: 00000093
+[ 4223.822640] RAX: ffffc4f040059000 RBX: 0000000000000014 RCX: 0000000000000005
+[ 4223.822640] RDX: ffff9f3841315800 RSI: 0000000000000000 RDI: ffff9f38401a8340
+[ 4223.822641] RBP: ffff9f38401a8340 R08: ffffc4f074f0bc00 R09: 0000000000000000
+[ 4223.822641] R10: 0000000000000010 R11: 0000000000000018 R12: ffff9f384005e200
+[ 4223.822641] R13: 0000000000000004 R14: 0000000000000046 R15: 0000000000000004
+[ 4223.822641]  ? qi_submit_sync+0x2c0/0x490
+[ 4223.822642]  ? qi_submit_sync+0x2c0/0x490
+[ 4223.822642]  </NMI>
+[ 4223.822642]  qi_flush_dev_iotlb+0xb1/0xd0
+[ 4223.822642]  __dmar_remove_one_dev_info+0x224/0x250
+[ 4223.822643]  dmar_remove_one_dev_info+0x3e/0x50
+[ 4223.822643]  intel_iommu_release_device+0x1f/0x30
+[ 4223.822643]  iommu_release_device+0x33/0x60
+[ 4223.822643]  iommu_bus_notifier+0x7f/0x90
+[ 4223.822644]  blocking_notifier_call_chain+0x60/0x90
+[ 4223.822644]  device_del+0x2e5/0x420
+[ 4223.822644]  pci_remove_bus_device+0x70/0x110
+[ 4223.822644]  pciehp_unconfigure_device+0x7c/0x130
+[ 4223.822644]  pciehp_disable_slot+0x6b/0x100
+[ 4223.822645]  pciehp_handle_presence_or_link_change+0xd8/0x320
+[ 4223.822645]  pciehp_ist+0x176/0x180
+[ 4223.822645]  ? irq_finalize_oneshot.part.50+0x110/0x110
+[ 4223.822645]  irq_thread_fn+0x19/0x50
+[ 4223.822646]  irq_thread+0x104/0x190
+[ 4223.822646]  ? irq_forced_thread_fn+0x90/0x90
+[ 4223.822646]  ? irq_thread_check_affinity+0xe0/0xe0
+[ 4223.822646]  kthread+0x114/0x130
+[ 4223.822647]  ? __kthread_cancel_work+0x40/0x40
+[ 4223.822647]  ret_from_fork+0x1f/0x30
+[ 4223.822647] Kernel Offset: 0x6400000 from 0xffffffff81000000 (relocation
+range: 0xffffffff80000000-0xffffffffbfffffff)
+
+Such issue could be triggered by all kinds of regular surprise removal
+hotplug operation. like:
+
+1. pull EP(endpoint device) out directly.
+2. turn off EP's power.
+3. bring the link down.
+etc.
+
+this patch aims to work for regular safe removal and surprise removal
+unplug. these hot unplug handling process could be optimized for fix the
+ATS Invalidation hang issue by calling pci_dev_is_disconnected() in
+function devtlb_invalidation_with_pasid() to check target device state to
+avoid sending meaningless ATS Invalidation request to iommu when device is
+gone. (see IMPLEMENTATION NOTE in PCIe spec r6.1 section 10.3.1)
+
+For safe removal, device wouldn't be removed until the whole software
+handling process is done, it wouldn't trigger the hard lock up issue
+caused by too long ATS Invalidation timeout wait. In safe removal path,
+device state isn't set to pci_channel_io_perm_failure in
+pciehp_unconfigure_device() by checking 'presence' parameter, calling
+pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will return
+false there, wouldn't break the function.
+
+For surprise removal, device state is set to pci_channel_io_perm_failure in
+pciehp_unconfigure_device(), means device is already gone (disconnected)
+call pci_dev_is_disconnected() in devtlb_invalidation_with_pasid() will
+return true to break the function not to send ATS Invalidation request to
+the disconnected device blindly, thus avoid to trigger further ITE fault,
+and ITE fault will block all invalidation request to be handled.
+furthermore retry the timeout request could trigger hard lockup.
+
+safe removal (present) & surprise removal (not present)
+
+pciehp_ist()
+   pciehp_handle_presence_or_link_change()
+     pciehp_disable_slot()
+       remove_board()
+         pciehp_unconfigure_device(presence) {
+           if (!presence)
+                pci_walk_bus(parent, pci_dev_set_disconnected, NULL);
+           }
+
+this patch works for regular safe removal and surprise removal of ATS
+capable endpoint on PCIe switch downstream ports.
+
+Fixes: 6f7db75e1c46 ("iommu/vt-d: Add second level page table interface")
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Tested-by: Haorong Ye <yehaorong@bytedance.com>
+Signed-off-by: Ethan Zhao <haifeng.zhao@linux.intel.com>
+Link: https://lore.kernel.org/r/20240301080727.3529832-3-haifeng.zhao@linux.intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/pasid.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index 108158e2b907d..746c7abe2237d 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -214,6 +214,9 @@ devtlb_invalidation_with_pasid(struct intel_iommu *iommu,
+ 	if (!info || !info->ats_enabled)
+ 		return;
+ 
++	if (pci_dev_is_disconnected(to_pci_dev(dev)))
++		return;
++
+ 	sid = info->bus << 8 | info->devfn;
+ 	qdep = info->ats_qdep;
+ 	pfsid = info->pfsid;
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-vt-d-fix-null-domain-on-device-release.patch b/queue-6.8/iommu-vt-d-fix-null-domain-on-device-release.patch
new file mode 100644
index 00000000000..22cb4788c36
--- /dev/null
+++ b/queue-6.8/iommu-vt-d-fix-null-domain-on-device-release.patch
@@ -0,0 +1,190 @@
+From 4e0da1ed8ebafd02399baef867cd9540bceba081 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 20:21:18 +0800
+Subject: iommu/vt-d: Fix NULL domain on device release
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 81e921fd321614c2ad8ac333b041aae1da7a1c6d ]
+
+In the kdump kernel, the IOMMU operates in deferred_attach mode. In this
+mode, info->domain may not yet be assigned by the time the release_device
+function is called. It leads to the following crash in the crash kernel:
+
+    BUG: kernel NULL pointer dereference, address: 000000000000003c
+    ...
+    RIP: 0010:do_raw_spin_lock+0xa/0xa0
+    ...
+    _raw_spin_lock_irqsave+0x1b/0x30
+    intel_iommu_release_device+0x96/0x170
+    iommu_deinit_device+0x39/0xf0
+    __iommu_group_remove_device+0xa0/0xd0
+    iommu_bus_notifier+0x55/0xb0
+    notifier_call_chain+0x5a/0xd0
+    blocking_notifier_call_chain+0x41/0x60
+    bus_notify+0x34/0x50
+    device_del+0x269/0x3d0
+    pci_remove_bus_device+0x77/0x100
+    p2sb_bar+0xae/0x1d0
+    ...
+    i801_probe+0x423/0x740
+
+Use the release_domain mechanism to fix it. The scalable mode context
+entry which is not part of release domain should be cleared in
+release_device().
+
+Fixes: 586081d3f6b1 ("iommu/vt-d: Remove DEFER_DEVICE_DOMAIN_INFO")
+Reported-by: Eric Badger <ebadger@purestorage.com>
+Closes: https://lore.kernel.org/r/20240113181713.1817855-1-ebadger@purestorage.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Link: https://lore.kernel.org/r/20240305013305.204605-3-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/iommu.c | 31 ++++--------------
+ drivers/iommu/intel/pasid.c | 64 +++++++++++++++++++++++++++++++++++++
+ drivers/iommu/intel/pasid.h |  1 +
+ 3 files changed, 71 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 31b5d852ba732..5dba58f322f03 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -3874,30 +3874,6 @@ static void domain_context_clear(struct device_domain_info *info)
+ 			       &domain_context_clear_one_cb, info);
+ }
+ 
+-static void dmar_remove_one_dev_info(struct device *dev)
+-{
+-	struct device_domain_info *info = dev_iommu_priv_get(dev);
+-	struct dmar_domain *domain = info->domain;
+-	struct intel_iommu *iommu = info->iommu;
+-	unsigned long flags;
+-
+-	if (!dev_is_real_dma_subdevice(info->dev)) {
+-		if (dev_is_pci(info->dev) && sm_supported(iommu))
+-			intel_pasid_tear_down_entry(iommu, info->dev,
+-					IOMMU_NO_PASID, false);
+-
+-		iommu_disable_pci_caps(info);
+-		domain_context_clear(info);
+-	}
+-
+-	spin_lock_irqsave(&domain->lock, flags);
+-	list_del(&info->link);
+-	spin_unlock_irqrestore(&domain->lock, flags);
+-
+-	domain_detach_iommu(domain, iommu);
+-	info->domain = NULL;
+-}
+-
+ /*
+  * Clear the page table pointer in context or pasid table entries so that
+  * all DMA requests without PASID from the device are blocked. If the page
+@@ -4436,7 +4412,11 @@ static void intel_iommu_release_device(struct device *dev)
+ 	mutex_lock(&iommu->iopf_lock);
+ 	device_rbtree_remove(info);
+ 	mutex_unlock(&iommu->iopf_lock);
+-	dmar_remove_one_dev_info(dev);
++
++	if (sm_supported(iommu) && !dev_is_real_dma_subdevice(dev) &&
++	    !context_copied(iommu, info->bus, info->devfn))
++		intel_pasid_teardown_sm_context(dev);
++
+ 	intel_pasid_free_table(dev);
+ 	intel_iommu_debugfs_remove_dev(info);
+ 	kfree(info);
+@@ -4942,6 +4922,7 @@ static const struct iommu_dirty_ops intel_dirty_ops = {
+ 
+ const struct iommu_ops intel_iommu_ops = {
+ 	.blocked_domain		= &blocking_domain,
++	.release_domain		= &blocking_domain,
+ 	.capable		= intel_iommu_capable,
+ 	.hw_info		= intel_iommu_hw_info,
+ 	.domain_alloc		= intel_iommu_domain_alloc,
+diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
+index 746c7abe2237d..a51e895d9a178 100644
+--- a/drivers/iommu/intel/pasid.c
++++ b/drivers/iommu/intel/pasid.c
+@@ -670,3 +670,67 @@ int intel_pasid_setup_nested(struct intel_iommu *iommu, struct device *dev,
+ 
+ 	return 0;
+ }
++
++/*
++ * Interfaces to setup or teardown a pasid table to the scalable-mode
++ * context table entry:
++ */
++
++static void device_pasid_table_teardown(struct device *dev, u8 bus, u8 devfn)
++{
++	struct device_domain_info *info = dev_iommu_priv_get(dev);
++	struct intel_iommu *iommu = info->iommu;
++	struct context_entry *context;
++
++	spin_lock(&iommu->lock);
++	context = iommu_context_addr(iommu, bus, devfn, false);
++	if (!context) {
++		spin_unlock(&iommu->lock);
++		return;
++	}
++
++	context_clear_entry(context);
++	__iommu_flush_cache(iommu, context, sizeof(*context));
++	spin_unlock(&iommu->lock);
++
++	/*
++	 * Cache invalidation for changes to a scalable-mode context table
++	 * entry.
++	 *
++	 * Section 6.5.3.3 of the VT-d spec:
++	 * - Device-selective context-cache invalidation;
++	 * - Domain-selective PASID-cache invalidation to affected domains
++	 *   (can be skipped if all PASID entries were not-present);
++	 * - Domain-selective IOTLB invalidation to affected domains;
++	 * - Global Device-TLB invalidation to affected functions.
++	 *
++	 * The iommu has been parked in the blocking state. All domains have
++	 * been detached from the device or PASID. The PASID and IOTLB caches
++	 * have been invalidated during the domain detach path.
++	 */
++	iommu->flush.flush_context(iommu, 0, PCI_DEVID(bus, devfn),
++				   DMA_CCMD_MASK_NOBIT, DMA_CCMD_DEVICE_INVL);
++	devtlb_invalidation_with_pasid(iommu, dev, IOMMU_NO_PASID);
++}
++
++static int pci_pasid_table_teardown(struct pci_dev *pdev, u16 alias, void *data)
++{
++	struct device *dev = data;
++
++	if (dev == &pdev->dev)
++		device_pasid_table_teardown(dev, PCI_BUS_NUM(alias), alias & 0xff);
++
++	return 0;
++}
++
++void intel_pasid_teardown_sm_context(struct device *dev)
++{
++	struct device_domain_info *info = dev_iommu_priv_get(dev);
++
++	if (!dev_is_pci(dev)) {
++		device_pasid_table_teardown(dev, info->bus, info->devfn);
++		return;
++	}
++
++	pci_for_each_dma_alias(to_pci_dev(dev), pci_pasid_table_teardown, dev);
++}
+diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h
+index 487ede039bdde..42fda97fd8516 100644
+--- a/drivers/iommu/intel/pasid.h
++++ b/drivers/iommu/intel/pasid.h
+@@ -318,4 +318,5 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu,
+ 				 bool fault_ignore);
+ void intel_pasid_setup_page_snoop_control(struct intel_iommu *iommu,
+ 					  struct device *dev, u32 pasid);
++void intel_pasid_teardown_sm_context(struct device *dev);
+ #endif /* __INTEL_PASID_H */
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-vt-d-improve-ite-fault-handling-if-target-devi.patch b/queue-6.8/iommu-vt-d-improve-ite-fault-handling-if-target-devi.patch
new file mode 100644
index 00000000000..56402cad3e8
--- /dev/null
+++ b/queue-6.8/iommu-vt-d-improve-ite-fault-handling-if-target-devi.patch
@@ -0,0 +1,82 @@
+From 7487a47a96d920756c3a962662cbe8cc489e1d39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 20:21:16 +0800
+Subject: iommu/vt-d: Improve ITE fault handling if target device isn't present
+
+From: Ethan Zhao <haifeng.zhao@linux.intel.com>
+
+[ Upstream commit 80a9b50c0b9e297669a8a400eb35468cd87a9aed ]
+
+Because surprise removal could happen anytime, e.g. user could request safe
+removal to EP(endpoint device) via sysfs and brings its link down to do
+surprise removal cocurrently. such aggressive cases would cause ATS
+invalidation request issued to non-existence target device, then deadly
+loop to retry that request after ITE fault triggered in interrupt context.
+this patch aims to optimize the ITE handling by checking the target device
+presence state to avoid retrying the timeout request blindly, thus avoid
+hard lockup or system hang.
+
+Devices TLB should only be invalidated when devices are in the
+iommu->device_rbtree (probed, not released) and present.
+
+Fixes: 6ba6c3a4cacf ("VT-d: add device IOTLB invalidation support")
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Ethan Zhao <haifeng.zhao@linux.intel.com>
+Link: https://lore.kernel.org/r/20240301080727.3529832-4-haifeng.zhao@linux.intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/dmar.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
+index f9b63c2875f71..ad8a340fc7f1d 100644
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -1272,6 +1272,8 @@ static int qi_check_fault(struct intel_iommu *iommu, int index, int wait_index)
+ {
+ 	u32 fault;
+ 	int head, tail;
++	struct device *dev;
++	u64 iqe_err, ite_sid;
+ 	struct q_inval *qi = iommu->qi;
+ 	int shift = qi_shift(iommu);
+ 
+@@ -1316,6 +1318,13 @@ static int qi_check_fault(struct intel_iommu *iommu, int index, int wait_index)
+ 		tail = readl(iommu->reg + DMAR_IQT_REG);
+ 		tail = ((tail >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
+ 
++		/*
++		 * SID field is valid only when the ITE field is Set in FSTS_REG
++		 * see Intel VT-d spec r4.1, section 11.4.9.9
++		 */
++		iqe_err = dmar_readq(iommu->reg + DMAR_IQER_REG);
++		ite_sid = DMAR_IQER_REG_ITESID(iqe_err);
++
+ 		writel(DMA_FSTS_ITE, iommu->reg + DMAR_FSTS_REG);
+ 		pr_info("Invalidation Time-out Error (ITE) cleared\n");
+ 
+@@ -1325,6 +1334,19 @@ static int qi_check_fault(struct intel_iommu *iommu, int index, int wait_index)
+ 			head = (head - 2 + QI_LENGTH) % QI_LENGTH;
+ 		} while (head != tail);
+ 
++		/*
++		 * If device was released or isn't present, no need to retry
++		 * the ATS invalidate request anymore.
++		 *
++		 * 0 value of ite_sid means old VT-d device, no ite_sid value.
++		 * see Intel VT-d spec r4.1, section 11.4.9.9
++		 */
++		if (ite_sid) {
++			dev = device_rbtree_find(iommu, ite_sid);
++			if (!dev || !dev_is_pci(dev) ||
++			    !pci_device_is_present(to_pci_dev(dev)))
++				return -ETIMEDOUT;
++		}
+ 		if (qi->desc_status[wait_index] == QI_ABORT)
+ 			return -EAGAIN;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-vt-d-use-device-rbtree-in-iopf-reporting-path.patch b/queue-6.8/iommu-vt-d-use-device-rbtree-in-iopf-reporting-path.patch
new file mode 100644
index 00000000000..3309ecbddae
--- /dev/null
+++ b/queue-6.8/iommu-vt-d-use-device-rbtree-in-iopf-reporting-path.patch
@@ -0,0 +1,128 @@
+From ca880b5e6dd9089d34f4f58cd584fc81fb4f42b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 10:14:41 +0800
+Subject: iommu/vt-d: Use device rbtree in iopf reporting path
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit def054b01a867822254e1dda13d587f5c7a99e2a ]
+
+The existing I/O page fault handler currently locates the PCI device by
+calling pci_get_domain_bus_and_slot(). This function searches the list
+of all PCI devices until the desired device is found. To improve lookup
+efficiency, replace it with device_rbtree_find() to search the device
+within the probed device rbtree.
+
+The I/O page fault is initiated by the device, which does not have any
+synchronization mechanism with the software to ensure that the device
+stays in the probed device tree. Theoretically, a device could be released
+by the IOMMU subsystem after device_rbtree_find() and before
+iopf_get_dev_fault_param(), which would cause a use-after-free problem.
+
+Add a mutex to synchronize the I/O page fault reporting path and the IOMMU
+release device path. This lock doesn't introduce any performance overhead,
+as the conflict between I/O page fault reporting and device releasing is
+very rare.
+
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/20240220065939.121116-3-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/dmar.c  |  1 +
+ drivers/iommu/intel/iommu.c |  3 +++
+ drivers/iommu/intel/iommu.h |  2 ++
+ drivers/iommu/intel/svm.c   | 17 +++++++++--------
+ 4 files changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
+index ad8a340fc7f1d..36d7427b12026 100644
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -1097,6 +1097,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+ 	iommu->segment = drhd->segment;
+ 	iommu->device_rbtree = RB_ROOT;
+ 	spin_lock_init(&iommu->device_rbtree_lock);
++	mutex_init(&iommu->iopf_lock);
+ 	iommu->node = NUMA_NO_NODE;
+ 
+ 	ver = readl(iommu->reg + DMAR_VER_REG);
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 9e07e4425ff65..31b5d852ba732 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -4431,8 +4431,11 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
+ static void intel_iommu_release_device(struct device *dev)
+ {
+ 	struct device_domain_info *info = dev_iommu_priv_get(dev);
++	struct intel_iommu *iommu = info->iommu;
+ 
++	mutex_lock(&iommu->iopf_lock);
+ 	device_rbtree_remove(info);
++	mutex_unlock(&iommu->iopf_lock);
+ 	dmar_remove_one_dev_info(dev);
+ 	intel_pasid_free_table(dev);
+ 	intel_iommu_debugfs_remove_dev(info);
+diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
+index df00240ebe90b..cd267ba64eda1 100644
+--- a/drivers/iommu/intel/iommu.h
++++ b/drivers/iommu/intel/iommu.h
+@@ -719,6 +719,8 @@ struct intel_iommu {
+ #endif
+ 	struct iopf_queue *iopf_queue;
+ 	unsigned char iopfq_name[16];
++	/* Synchronization between fault report and iommu device release. */
++	struct mutex iopf_lock;
+ 	struct q_inval  *qi;            /* Queued invalidation info */
+ 	u32 iommu_state[MAX_SR_DMAR_REGS]; /* Store iommu states between suspend and resume.*/
+ 
+diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
+index 40edd282903fb..ec47ec81f0ecd 100644
+--- a/drivers/iommu/intel/svm.c
++++ b/drivers/iommu/intel/svm.c
+@@ -650,7 +650,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ 	struct intel_iommu *iommu = d;
+ 	struct page_req_dsc *req;
+ 	int head, tail, handled;
+-	struct pci_dev *pdev;
++	struct device *dev;
+ 	u64 address;
+ 
+ 	/*
+@@ -696,23 +696,24 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ 		if (unlikely(req->lpig && !req->rd_req && !req->wr_req))
+ 			goto prq_advance;
+ 
+-		pdev = pci_get_domain_bus_and_slot(iommu->segment,
+-						   PCI_BUS_NUM(req->rid),
+-						   req->rid & 0xff);
+ 		/*
+ 		 * If prq is to be handled outside iommu driver via receiver of
+ 		 * the fault notifiers, we skip the page response here.
+ 		 */
+-		if (!pdev)
++		mutex_lock(&iommu->iopf_lock);
++		dev = device_rbtree_find(iommu, req->rid);
++		if (!dev) {
++			mutex_unlock(&iommu->iopf_lock);
+ 			goto bad_req;
++		}
+ 
+-		if (intel_svm_prq_report(iommu, &pdev->dev, req))
++		if (intel_svm_prq_report(iommu, dev, req))
+ 			handle_bad_prq_event(iommu, req, QI_RESP_INVALID);
+ 		else
+-			trace_prq_report(iommu, &pdev->dev, req->qw_0, req->qw_1,
++			trace_prq_report(iommu, dev, req->qw_0, req->qw_1,
+ 					 req->priv_data[0], req->priv_data[1],
+ 					 iommu->prq_seq_number++);
+-		pci_dev_put(pdev);
++		mutex_unlock(&iommu->iopf_lock);
+ prq_advance:
+ 		head = (head + sizeof(*req)) & PRQ_RING_MASK;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/iommu-vt-d-use-rbtree-to-track-iommu-probed-devices.patch b/queue-6.8/iommu-vt-d-use-rbtree-to-track-iommu-probed-devices.patch
new file mode 100644
index 00000000000..1d3cdd8a959
--- /dev/null
+++ b/queue-6.8/iommu-vt-d-use-rbtree-to-track-iommu-probed-devices.patch
@@ -0,0 +1,213 @@
+From 07b6876b788899dedecfcaa16f21b5dd03edd169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 10:14:40 +0800
+Subject: iommu/vt-d: Use rbtree to track iommu probed devices
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 1a75cc710b956010137b4fe1d1fa3282bfd8f86c ]
+
+Use a red-black tree(rbtree) to track devices probed by the driver's
+probe_device callback. These devices need to be looked up quickly by
+a source ID when the hardware reports a fault, either recoverable or
+unrecoverable.
+
+Fault reporting paths are critical. Searching a list in this scenario
+is inefficient, with an algorithm complexity of O(n). An rbtree is a
+self-balancing binary search tree, offering an average search time
+complexity of O(log(n)). This significant performance improvement
+makes rbtrees a better choice.
+
+Furthermore, rbtrees are implemented on a per-iommu basis, eliminating
+the need for global searches and further enhancing efficiency in
+critical fault paths. The rbtree is protected by a spin lock with
+interrupts disabled to ensure thread-safe access even within interrupt
+contexts.
+
+Co-developed-by: Huang Jiaqing <jiaqing.huang@intel.com>
+Signed-off-by: Huang Jiaqing <jiaqing.huang@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Link: https://lore.kernel.org/r/20240220065939.121116-2-baolu.lu@linux.intel.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: 80a9b50c0b9e ("iommu/vt-d: Improve ITE fault handling if target device isn't present")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel/dmar.c  |  3 +-
+ drivers/iommu/intel/iommu.c | 88 ++++++++++++++++++++++++++++++++++++-
+ drivers/iommu/intel/iommu.h |  8 ++++
+ 3 files changed, 96 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
+index 23cb80d62a9ab..f9b63c2875f71 100644
+--- a/drivers/iommu/intel/dmar.c
++++ b/drivers/iommu/intel/dmar.c
+@@ -1095,7 +1095,8 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd)
+ 	iommu->agaw = agaw;
+ 	iommu->msagaw = msagaw;
+ 	iommu->segment = drhd->segment;
+-
++	iommu->device_rbtree = RB_ROOT;
++	spin_lock_init(&iommu->device_rbtree_lock);
+ 	iommu->node = NUMA_NO_NODE;
+ 
+ 	ver = readl(iommu->reg + DMAR_VER_REG);
+diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
+index 11652e0bcab3a..9e07e4425ff65 100644
+--- a/drivers/iommu/intel/iommu.c
++++ b/drivers/iommu/intel/iommu.c
+@@ -97,6 +97,81 @@ static phys_addr_t root_entry_uctp(struct root_entry *re)
+ 	return re->hi & VTD_PAGE_MASK;
+ }
+ 
++static int device_rid_cmp_key(const void *key, const struct rb_node *node)
++{
++	struct device_domain_info *info =
++		rb_entry(node, struct device_domain_info, node);
++	const u16 *rid_lhs = key;
++
++	if (*rid_lhs < PCI_DEVID(info->bus, info->devfn))
++		return -1;
++
++	if (*rid_lhs > PCI_DEVID(info->bus, info->devfn))
++		return 1;
++
++	return 0;
++}
++
++static int device_rid_cmp(struct rb_node *lhs, const struct rb_node *rhs)
++{
++	struct device_domain_info *info =
++		rb_entry(lhs, struct device_domain_info, node);
++	u16 key = PCI_DEVID(info->bus, info->devfn);
++
++	return device_rid_cmp_key(&key, rhs);
++}
++
++/*
++ * Looks up an IOMMU-probed device using its source ID.
++ *
++ * Returns the pointer to the device if there is a match. Otherwise,
++ * returns NULL.
++ *
++ * Note that this helper doesn't guarantee that the device won't be
++ * released by the iommu subsystem after being returned. The caller
++ * should use its own synchronization mechanism to avoid the device
++ * being released during its use if its possibly the case.
++ */
++struct device *device_rbtree_find(struct intel_iommu *iommu, u16 rid)
++{
++	struct device_domain_info *info = NULL;
++	struct rb_node *node;
++	unsigned long flags;
++
++	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
++	node = rb_find(&rid, &iommu->device_rbtree, device_rid_cmp_key);
++	if (node)
++		info = rb_entry(node, struct device_domain_info, node);
++	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
++
++	return info ? info->dev : NULL;
++}
++
++static int device_rbtree_insert(struct intel_iommu *iommu,
++				struct device_domain_info *info)
++{
++	struct rb_node *curr;
++	unsigned long flags;
++
++	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
++	curr = rb_find_add(&info->node, &iommu->device_rbtree, device_rid_cmp);
++	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
++	if (WARN_ON(curr))
++		return -EEXIST;
++
++	return 0;
++}
++
++static void device_rbtree_remove(struct device_domain_info *info)
++{
++	struct intel_iommu *iommu = info->iommu;
++	unsigned long flags;
++
++	spin_lock_irqsave(&iommu->device_rbtree_lock, flags);
++	rb_erase(&info->node, &iommu->device_rbtree);
++	spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags);
++}
++
+ /*
+  * This domain is a statically identity mapping domain.
+  *	1. This domain creats a static 1:1 mapping to all usable memory.
+@@ -4330,25 +4405,34 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev)
+ 	}
+ 
+ 	dev_iommu_priv_set(dev, info);
++	ret = device_rbtree_insert(iommu, info);
++	if (ret)
++		goto free;
+ 
+ 	if (sm_supported(iommu) && !dev_is_real_dma_subdevice(dev)) {
+ 		ret = intel_pasid_alloc_table(dev);
+ 		if (ret) {
+ 			dev_err(dev, "PASID table allocation failed\n");
+-			kfree(info);
+-			return ERR_PTR(ret);
++			goto clear_rbtree;
+ 		}
+ 	}
+ 
+ 	intel_iommu_debugfs_create_dev(info);
+ 
+ 	return &iommu->iommu;
++clear_rbtree:
++	device_rbtree_remove(info);
++free:
++	kfree(info);
++
++	return ERR_PTR(ret);
+ }
+ 
+ static void intel_iommu_release_device(struct device *dev)
+ {
+ 	struct device_domain_info *info = dev_iommu_priv_get(dev);
+ 
++	device_rbtree_remove(info);
+ 	dmar_remove_one_dev_info(dev);
+ 	intel_pasid_free_table(dev);
+ 	intel_iommu_debugfs_remove_dev(info);
+diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
+index 4145c04cb1c68..df00240ebe90b 100644
+--- a/drivers/iommu/intel/iommu.h
++++ b/drivers/iommu/intel/iommu.h
+@@ -722,6 +722,11 @@ struct intel_iommu {
+ 	struct q_inval  *qi;            /* Queued invalidation info */
+ 	u32 iommu_state[MAX_SR_DMAR_REGS]; /* Store iommu states between suspend and resume.*/
+ 
++	/* rb tree for all probed devices */
++	struct rb_root device_rbtree;
++	/* protect the device_rbtree */
++	spinlock_t device_rbtree_lock;
++
+ #ifdef CONFIG_IRQ_REMAP
+ 	struct ir_table *ir_table;	/* Interrupt remapping info */
+ 	struct irq_domain *ir_domain;
+@@ -755,6 +760,8 @@ struct device_domain_info {
+ 	struct intel_iommu *iommu; /* IOMMU used by this device */
+ 	struct dmar_domain *domain; /* pointer to domain */
+ 	struct pasid_table *pasid_table; /* pasid table */
++	/* device tracking node(lookup by PCI RID) */
++	struct rb_node node;
+ #ifdef CONFIG_INTEL_IOMMU_DEBUGFS
+ 	struct dentry *debugfs_dentry; /* pointer to device directory dentry */
+ #endif
+@@ -1081,6 +1088,7 @@ void free_pgtable_page(void *vaddr);
+ void iommu_flush_write_buffer(struct intel_iommu *iommu);
+ struct iommu_domain *intel_nested_domain_alloc(struct iommu_domain *parent,
+ 					       const struct iommu_user_data *user_data);
++struct device *device_rbtree_find(struct intel_iommu *iommu, u16 rid);
+ 
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ void intel_svm_check(struct intel_iommu *iommu);
+-- 
+2.43.0
+
diff --git a/queue-6.8/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch b/queue-6.8/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
new file mode 100644
index 00000000000..5b4fe807105
--- /dev/null
+++ b/queue-6.8/ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
@@ -0,0 +1,45 @@
+From 6cab423a519fffb01d1110eaae2d94055588c834 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: ipmr: fix incorrect parameter validation in the
+ ip_mroute_getsockopt() function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 5c3be3e0eb44b7f978bb6cbb20ad956adb93f736 ]
+
+The 'olr' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'olr' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ipmr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 3622298365105..b53c36c473a5b 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1603,9 +1603,11 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, sockptr_t optval,
+ 
+ 	if (copy_from_sockptr(&olr, optlen, sizeof(int)))
+ 		return -EFAULT;
+-	olr = min_t(unsigned int, olr, sizeof(int));
+ 	if (olr < 0)
+ 		return -EINVAL;
++
++	olr = min_t(unsigned int, olr, sizeof(int));
++
+ 	if (copy_to_sockptr(optlen, &olr, sizeof(int)))
+ 		return -EFAULT;
+ 	if (copy_to_sockptr(optval, &val, olr))
+-- 
+2.43.0
+
diff --git a/queue-6.8/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch b/queue-6.8/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
new file mode 100644
index 00000000000..c6bb3b682e3
--- /dev/null
+++ b/queue-6.8/ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
@@ -0,0 +1,55 @@
+From d82da40508fa8ffd4b2e6f775e4de14396d79a8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 18:01:57 +0800
+Subject: ipv6: fib6_rules: flush route cache when rule is changed
+
+From: Shiming Cheng <shiming.cheng@mediatek.com>
+
+[ Upstream commit c4386ab4f6c600f75fdfd21143f89bac3e625d0d ]
+
+When rule policy is changed, ipv6 socket cache is not refreshed.
+The sock's skb still uses a outdated route cache and was sent to
+a wrong interface.
+
+To avoid this error we should update fib node's version when
+rule is changed. Then skb's route will be reroute checked as
+route cache version is already different with fib node version.
+The route cache is refreshed to match the latest rule.
+
+Fixes: 101367c2f8c4 ("[IPV6]: Policy Routing Rules")
+Signed-off-by: Shiming Cheng <shiming.cheng@mediatek.com>
+Signed-off-by: Lena Wang <lena.wang@mediatek.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/fib6_rules.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
+index 7523c4baef35e..52c04f0ac4981 100644
+--- a/net/ipv6/fib6_rules.c
++++ b/net/ipv6/fib6_rules.c
+@@ -449,6 +449,11 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
+ 	       + nla_total_size(16); /* src */
+ }
+ 
++static void fib6_rule_flush_cache(struct fib_rules_ops *ops)
++{
++	rt_genid_bump_ipv6(ops->fro_net);
++}
++
+ static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
+ 	.family			= AF_INET6,
+ 	.rule_size		= sizeof(struct fib6_rule),
+@@ -461,6 +466,7 @@ static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
+ 	.compare		= fib6_rule_compare,
+ 	.fill			= fib6_rule_fill,
+ 	.nlmsg_payload		= fib6_rule_nlmsg_payload,
++	.flush_cache		= fib6_rule_flush_cache,
+ 	.nlgroup		= RTNLGRP_IPV6_RULE,
+ 	.owner			= THIS_MODULE,
+ 	.fro_net		= &init_net,
+-- 
+2.43.0
+
diff --git a/queue-6.8/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch b/queue-6.8/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
new file mode 100644
index 00000000000..c18d55aa9bf
--- /dev/null
+++ b/queue-6.8/ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
@@ -0,0 +1,43 @@
+From f6e8d78c70520b1bf3b8d3d73279a0d8c3967ec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 15:30:56 +0000
+Subject: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 17ef8efc00b34918b966388b2af0993811895a8c ]
+
+As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops
+in igmp6_event_query() and igmp6_event_report()")) I think the
+synchronize_net() call in ipv6_mc_down() is not needed.
+
+Under load, synchronize_net() can last between 200 usec and 5 ms.
+
+KASAN seems to agree as well.
+
+Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Taehee Yoo <ap420073@gmail.com>
+Cc: Cong Wang <xiyou.wangcong@gmail.com>
+Cc: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/mcast.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index bc6e0a0bad3c1..76ee1615ff2a0 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -2719,7 +2719,6 @@ void ipv6_mc_down(struct inet6_dev *idev)
+ 	/* Should stop work after group drop. or we will
+ 	 * start work again in mld_ifc_event()
+ 	 */
+-	synchronize_net();
+ 	mld_query_stop_work(idev);
+ 	mld_report_stop_work(idev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/kunit-setup-dma-masks-on-the-kunit-device.patch b/queue-6.8/kunit-setup-dma-masks-on-the-kunit-device.patch
new file mode 100644
index 00000000000..22462627928
--- /dev/null
+++ b/queue-6.8/kunit-setup-dma-masks-on-the-kunit-device.patch
@@ -0,0 +1,60 @@
+From f08f4b1dddd8b317df7442140c10a7a52916b8c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 13:53:24 +0100
+Subject: kunit: Setup DMA masks on the kunit device
+
+From: Maxime Ripard <mripard@kernel.org>
+
+[ Upstream commit c5215d54dc10e801a6cefef62445a00a4c28a515 ]
+
+Commit d393acce7b3f ("drm/tests: Switch to kunit devices") switched the
+DRM device creation helpers from an ad-hoc implementation to the new
+kunit device creation helpers introduced in commit d03c720e03bd ("kunit:
+Add APIs for managing devices").
+
+However, while the DRM helpers were using a platform_device, the kunit
+helpers are using a dedicated bus and device type.
+
+That situation creates small differences in the initialisation, and one
+of them is that the kunit devices do not have the DMA masks setup. In
+turn, this means that we can't do any kind of DMA buffer allocation
+anymore, which creates a regression on some (downstream for now) tests.
+
+Let's set up a default DMA mask that should work on any platform to fix
+it.
+
+Fixes: d03c720e03bd ("kunit: Add APIs for managing devices")
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/device.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/kunit/device.c b/lib/kunit/device.c
+index 644a38a1f5b1c..9ea399049749e 100644
+--- a/lib/kunit/device.c
++++ b/lib/kunit/device.c
+@@ -10,6 +10,7 @@
+  */
+ 
+ #include <linux/device.h>
++#include <linux/dma-mapping.h>
+ 
+ #include <kunit/test.h>
+ #include <kunit/device.h>
+@@ -133,6 +134,9 @@ static struct kunit_device *kunit_device_register_internal(struct kunit *test,
+ 		return ERR_PTR(err);
+ 	}
+ 
++	kunit_dev->dev.dma_mask = &kunit_dev->dev.coherent_dma_mask;
++	kunit_dev->dev.coherent_dma_mask = DMA_BIT_MASK(32);
++
+ 	kunit_add_action(test, device_unregister_wrapper, &kunit_dev->dev);
+ 
+ 	return kunit_dev;
+-- 
+2.43.0
+
diff --git a/queue-6.8/kunit-test-log-the-correct-filter-string-in-executor.patch b/queue-6.8/kunit-test-log-the-correct-filter-string-in-executor.patch
new file mode 100644
index 00000000000..7587705a1df
--- /dev/null
+++ b/queue-6.8/kunit-test-log-the-correct-filter-string-in-executor.patch
@@ -0,0 +1,44 @@
+From 461989d11f89a7f0051263f30bff60d02f1d1d0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:14 +0800
+Subject: kunit: test: Log the correct filter string in executor_test
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 6f2f793fba78eb4a0d5a34a71bc781118ed923d3 ]
+
+KUnit's executor_test logs the filter string in KUNIT_ASSERT_EQ_MSG(),
+but passed a random character from the filter, rather than the whole
+string.
+
+This was found by annotating KUNIT_ASSERT_EQ_MSG() to let gcc validate
+the format string.
+
+Fixes: 76066f93f1df ("kunit: add tests for filtering attributes")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Reviewed-by: Daniel Latypov <dlatypov@google.com>
+Reviewed-by: Rae Moar <rmoar@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/executor_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/kunit/executor_test.c b/lib/kunit/executor_test.c
+index 22d4ee86dbedd..3f7f967e3688e 100644
+--- a/lib/kunit/executor_test.c
++++ b/lib/kunit/executor_test.c
+@@ -129,7 +129,7 @@ static void parse_filter_attr_test(struct kunit *test)
+ 			GFP_KERNEL);
+ 	for (j = 0; j < filter_count; j++) {
+ 		parsed_filters[j] = kunit_next_attr_filter(&filter, &err);
+-		KUNIT_ASSERT_EQ_MSG(test, err, 0, "failed to parse filter '%s'", filters[j]);
++		KUNIT_ASSERT_EQ_MSG(test, err, 0, "failed to parse filter from '%s'", filters);
+ 	}
+ 
+ 	KUNIT_EXPECT_STREQ(test, kunit_attr_filter_name(parsed_filters[0]), "speed");
+-- 
+2.43.0
+
diff --git a/queue-6.8/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch b/queue-6.8/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
new file mode 100644
index 00000000000..1ba30544613
--- /dev/null
+++ b/queue-6.8/l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
@@ -0,0 +1,47 @@
+From 156dbb43b3cc1c3d9c56b17be38f68514abf7fda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 955e9876ba4ee26eeaab1b13517f5b2c88e73d55 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 3557baabf280 ("[L2TP]: PPP over L2TP driver core")
+Reviewed-by: Tom Parkin <tparkin@katalix.com>
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/l2tp/l2tp_ppp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index f011af6601c9c..6146e4e67bbb5 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1356,11 +1356,11 @@ static int pppol2tp_getsockopt(struct socket *sock, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	err = -ENOTCONN;
+ 	if (!sk->sk_user_data)
+ 		goto end;
+-- 
+2.43.0
+
diff --git a/queue-6.8/leds-aw2013-unlock-mutex-before-destroying-it.patch b/queue-6.8/leds-aw2013-unlock-mutex-before-destroying-it.patch
new file mode 100644
index 00000000000..11a55160358
--- /dev/null
+++ b/queue-6.8/leds-aw2013-unlock-mutex-before-destroying-it.patch
@@ -0,0 +1,37 @@
+From 8ef0e3023cdd58cf7816bdb680a5de46dcc2d808 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 20:36:05 +0300
+Subject: leds: aw2013: Unlock mutex before destroying it
+
+From: George Stark <gnstark@salutedevices.com>
+
+[ Upstream commit 6969d0a2ba1adc9ba6a49b9805f24080896c255c ]
+
+In the probe() callback in case of error mutex is destroyed being locked
+which is not allowed so unlock the mutex before destroying.
+
+Fixes: 59ea3c9faf32 ("leds: add aw2013 driver")
+Signed-off-by: George Stark <gnstark@salutedevices.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20231214173614.2820929-2-gnstark@salutedevices.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-aw2013.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/leds/leds-aw2013.c b/drivers/leds/leds-aw2013.c
+index 91f44b23cb113..17235a5e576ae 100644
+--- a/drivers/leds/leds-aw2013.c
++++ b/drivers/leds/leds-aw2013.c
+@@ -405,6 +405,7 @@ static int aw2013_probe(struct i2c_client *client)
+ 			       chip->regulators);
+ 
+ error:
++	mutex_unlock(&chip->mutex);
+ 	mutex_destroy(&chip->mutex);
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch b/queue-6.8/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
new file mode 100644
index 00000000000..18987c1a098
--- /dev/null
+++ b/queue-6.8/leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
@@ -0,0 +1,41 @@
+From 436aca1e3303c1b51216d95db314306c6cb4a4f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 20:11:30 +0100
+Subject: leds: sgm3140: Add missing timer cleanup and flash gpio control
+
+From: Ondrej Jirman <megi@xff.cz>
+
+[ Upstream commit 205c29887a333ee4b37596e6533373e38cb23947 ]
+
+Enabling strobe and then setting brightness to 0 causes the driver to enter
+invalid state after strobe end timer fires. We should cancel strobe mode
+resources when changing brightness (aka torch mode).
+
+Fixes: cef8ec8cbd21 ("leds: add sgm3140 driver")
+Signed-off-by: Ondrej Jirman <megi@xff.cz>
+Link: https://lore.kernel.org/r/20240217191133.1757553-1-megi@xff.cz
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/flash/leds-sgm3140.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/leds/flash/leds-sgm3140.c b/drivers/leds/flash/leds-sgm3140.c
+index eb648ff54b4e5..db0ac6641954e 100644
+--- a/drivers/leds/flash/leds-sgm3140.c
++++ b/drivers/leds/flash/leds-sgm3140.c
+@@ -114,8 +114,11 @@ static int sgm3140_brightness_set(struct led_classdev *led_cdev,
+ 				"failed to enable regulator: %d\n", ret);
+ 			return ret;
+ 		}
++		gpiod_set_value_cansleep(priv->flash_gpio, 0);
+ 		gpiod_set_value_cansleep(priv->enable_gpio, 1);
+ 	} else {
++		del_timer_sync(&priv->powerdown_timer);
++		gpiod_set_value_cansleep(priv->flash_gpio, 0);
+ 		gpiod_set_value_cansleep(priv->enable_gpio, 0);
+ 		ret = regulator_disable(priv->vin_regulator);
+ 		if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch b/queue-6.8/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
new file mode 100644
index 00000000000..098833baef3
--- /dev/null
+++ b/queue-6.8/lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
@@ -0,0 +1,43 @@
+From 2083243232ac7857f7525890e36cdc41e67b8aca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:15 +0800
+Subject: lib/cmdline: Fix an invalid format specifier in an assertion msg
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit d2733a026fc7247ba42d7a8e1b737cf14bf1df21 ]
+
+The correct format specifier for p - n (both p and n are pointers) is
+%td, as the type should be ptrdiff_t.
+
+This was discovered by annotating KUnit assertion macros with gcc's
+printf specifier, but note that gcc incorrectly suggested a %d or %ld
+specifier (depending on the pointer size of the architecture being
+built).
+
+Fixes: 0ea09083116d ("lib/cmdline: Allow get_options() to take 0 to validate the input")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Daniel Latypov <dlatypov@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/cmdline_kunit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/cmdline_kunit.c b/lib/cmdline_kunit.c
+index d4572dbc91453..705b82736be08 100644
+--- a/lib/cmdline_kunit.c
++++ b/lib/cmdline_kunit.c
+@@ -124,7 +124,7 @@ static void cmdline_do_one_range_test(struct kunit *test, const char *in,
+ 			    n, e[0], r[0]);
+ 
+ 	p = memchr_inv(&r[1], 0, sizeof(r) - sizeof(r[0]));
+-	KUNIT_EXPECT_PTR_EQ_MSG(test, p, NULL, "in test %u at %u out of bound", n, p - r);
++	KUNIT_EXPECT_PTR_EQ_MSG(test, p, NULL, "in test %u at %td out of bound", n, p - r);
+ }
+ 
+ static void cmdline_test_range(struct kunit *test)
+-- 
+2.43.0
+
diff --git a/queue-6.8/lib-memcpy_kunit-fix-an-invalid-format-specifier-in-.patch b/queue-6.8/lib-memcpy_kunit-fix-an-invalid-format-specifier-in-.patch
new file mode 100644
index 00000000000..d4b7c1d271e
--- /dev/null
+++ b/queue-6.8/lib-memcpy_kunit-fix-an-invalid-format-specifier-in-.patch
@@ -0,0 +1,51 @@
+From 6f51b66fdfb10d47fe3ba84a8672bc9c6c61af19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:16 +0800
+Subject: lib: memcpy_kunit: Fix an invalid format specifier in an assertion
+ msg
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 0a549ed22c3c7cc6da5c5f5918efd019944489a5 ]
+
+The 'i' passed as an assertion message is a size_t, so should use '%zu',
+not '%d'.
+
+This was found by annotating the _MSG() variants of KUnit's assertions
+to let gcc validate the format strings.
+
+Fixes: bb95ebbe89a7 ("lib: Introduce CONFIG_MEMCPY_KUNIT_TEST")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/memcpy_kunit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/memcpy_kunit.c b/lib/memcpy_kunit.c
+index 440aee705ccca..30e00ef0bf2e0 100644
+--- a/lib/memcpy_kunit.c
++++ b/lib/memcpy_kunit.c
+@@ -32,7 +32,7 @@ struct some_bytes {
+ 	BUILD_BUG_ON(sizeof(instance.data) != 32);	\
+ 	for (size_t i = 0; i < sizeof(instance.data); i++) {	\
+ 		KUNIT_ASSERT_EQ_MSG(test, instance.data[i], v, \
+-			"line %d: '%s' not initialized to 0x%02x @ %d (saw 0x%02x)\n", \
++			"line %d: '%s' not initialized to 0x%02x @ %zu (saw 0x%02x)\n", \
+ 			__LINE__, #instance, v, i, instance.data[i]);	\
+ 	}	\
+ } while (0)
+@@ -41,7 +41,7 @@ struct some_bytes {
+ 	BUILD_BUG_ON(sizeof(one) != sizeof(two)); \
+ 	for (size_t i = 0; i < sizeof(one); i++) {	\
+ 		KUNIT_EXPECT_EQ_MSG(test, one.data[i], two.data[i], \
+-			"line %d: %s.data[%d] (0x%02x) != %s.data[%d] (0x%02x)\n", \
++			"line %d: %s.data[%zu] (0x%02x) != %s.data[%zu] (0x%02x)\n", \
+ 			__LINE__, #one, i, one.data[i], #two, i, two.data[i]); \
+ 	}	\
+ 	kunit_info(test, "ok: " TEST_OP "() " name "\n");	\
+-- 
+2.43.0
+
diff --git a/queue-6.8/lib-stackdepot-fix-first-entry-having-a-0-handle.patch b/queue-6.8/lib-stackdepot-fix-first-entry-having-a-0-handle.patch
new file mode 100644
index 00000000000..276d328d9b1
--- /dev/null
+++ b/queue-6.8/lib-stackdepot-fix-first-entry-having-a-0-handle.patch
@@ -0,0 +1,204 @@
+From 2765075fbdd2a1dffcd59be3bd9c1c1f7c582241 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 22:59:01 +0100
+Subject: lib/stackdepot: fix first entry having a 0-handle
+
+From: Oscar Salvador <osalvador@suse.de>
+
+[ Upstream commit 3ee34eabac2abb6b1b6fcdebffe18870719ad000 ]
+
+Patch series "page_owner: print stacks and their outstanding allocations",
+v10.
+
+page_owner is a great debug functionality tool that lets us know about all
+pages that have been allocated/freed and their specific stacktrace.  This
+comes very handy when debugging memory leaks, since with some scripting we
+can see the outstanding allocations, which might point to a memory leak.
+
+In my experience, that is one of the most useful cases, but it can get
+really tedious to screen through all pages and try to reconstruct the
+stack <-> allocated/freed relationship, becoming most of the time a
+daunting and slow process when we have tons of allocation/free operations.
+
+This patchset aims to ease that by adding a new functionality into
+page_owner.  This functionality creates a new directory called
+'page_owner_stacks' under 'sys/kernel//debug' with a read-only file called
+'show_stacks', which prints out all the stacks followed by their
+outstanding number of allocations (being that the times the stacktrace has
+allocated but not freed yet).  This gives us a clear and a quick overview
+of stacks <-> allocated/free.
+
+We take advantage of the new refcount_f field that stack_record struct
+gained, and increment/decrement the stack refcount on every
+__set_page_owner() (alloc operation) and __reset_page_owner (free
+operation) call.
+
+Unfortunately, we cannot use the new stackdepot api STACK_DEPOT_FLAG_GET
+because it does not fulfill page_owner needs, meaning we would have to
+special case things, at which point makes more sense for page_owner to do
+its own {dec,inc}rementing of the stacks.  E.g: Using
+STACK_DEPOT_FLAG_PUT, once the refcount reaches 0, such stack gets
+evicted, so page_owner would lose information.
+
+This patchset also creates a new file called 'set_threshold' within
+'page_owner_stacks' directory, and by writing a value to it, the stacks
+which refcount is below such value will be filtered out.
+
+A PoC can be found below:
+
+ # cat /sys/kernel/debug/page_owner_stacks/show_stacks > page_owner_full_stacks.txt
+ # head -40 page_owner_full_stacks.txt
+  prep_new_page+0xa9/0x120
+  get_page_from_freelist+0x801/0x2210
+  __alloc_pages+0x18b/0x350
+  alloc_pages_mpol+0x91/0x1f0
+  folio_alloc+0x14/0x50
+  filemap_alloc_folio+0xb2/0x100
+  page_cache_ra_unbounded+0x96/0x180
+  filemap_get_pages+0xfd/0x590
+  filemap_read+0xcc/0x330
+  blkdev_read_iter+0xb8/0x150
+  vfs_read+0x285/0x320
+  ksys_read+0xa5/0xe0
+  do_syscall_64+0x80/0x160
+  entry_SYSCALL_64_after_hwframe+0x6e/0x76
+ stack_count: 521
+
+  prep_new_page+0xa9/0x120
+  get_page_from_freelist+0x801/0x2210
+  __alloc_pages+0x18b/0x350
+  alloc_pages_mpol+0x91/0x1f0
+  folio_alloc+0x14/0x50
+  filemap_alloc_folio+0xb2/0x100
+  __filemap_get_folio+0x14a/0x490
+  ext4_write_begin+0xbd/0x4b0 [ext4]
+  generic_perform_write+0xc1/0x1e0
+  ext4_buffered_write_iter+0x68/0xe0 [ext4]
+  ext4_file_write_iter+0x70/0x740 [ext4]
+  vfs_write+0x33d/0x420
+  ksys_write+0xa5/0xe0
+  do_syscall_64+0x80/0x160
+  entry_SYSCALL_64_after_hwframe+0x6e/0x76
+ stack_count: 4609
+...
+...
+
+ # echo 5000 > /sys/kernel/debug/page_owner_stacks/set_threshold
+ # cat /sys/kernel/debug/page_owner_stacks/show_stacks > page_owner_full_stacks_5000.txt
+ # head -40 page_owner_full_stacks_5000.txt
+  prep_new_page+0xa9/0x120
+  get_page_from_freelist+0x801/0x2210
+  __alloc_pages+0x18b/0x350
+  alloc_pages_mpol+0x91/0x1f0
+  folio_alloc+0x14/0x50
+  filemap_alloc_folio+0xb2/0x100
+  __filemap_get_folio+0x14a/0x490
+  ext4_write_begin+0xbd/0x4b0 [ext4]
+  generic_perform_write+0xc1/0x1e0
+  ext4_buffered_write_iter+0x68/0xe0 [ext4]
+  ext4_file_write_iter+0x70/0x740 [ext4]
+  vfs_write+0x33d/0x420
+  ksys_pwrite64+0x75/0x90
+  do_syscall_64+0x80/0x160
+  entry_SYSCALL_64_after_hwframe+0x6e/0x76
+ stack_count: 6781
+
+  prep_new_page+0xa9/0x120
+  get_page_from_freelist+0x801/0x2210
+  __alloc_pages+0x18b/0x350
+  pcpu_populate_chunk+0xec/0x350
+  pcpu_balance_workfn+0x2d1/0x4a0
+  process_scheduled_works+0x84/0x380
+  worker_thread+0x12a/0x2a0
+  kthread+0xe3/0x110
+  ret_from_fork+0x30/0x50
+  ret_from_fork_asm+0x1b/0x30
+ stack_count: 8641
+
+This patch (of 7):
+
+The very first entry of stack_record gets a handle of 0, but this is wrong
+because stackdepot treats a 0-handle as a non-valid one.  E.g: See the
+check in stack_depot_fetch()
+
+Fix this by adding and offset of 1.
+
+This bug has been lurking since the very beginning of stackdepot, but no
+one really cared as it seems.  Because of that I am not adding a Fixes
+tag.
+
+Link: https://lkml.kernel.org/r/20240215215907.20121-1-osalvador@suse.de
+Link: https://lkml.kernel.org/r/20240215215907.20121-2-osalvador@suse.de
+Co-developed-by: Marco Elver <elver@google.com>
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Oscar Salvador <osalvador@suse.de>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Acked-by: Andrey Konovalov <andreyknvl@gmail.com>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: dc24559472a6 ("lib/stackdepot: off by one in depot_fetch_stack()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/stackdepot.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/lib/stackdepot.c b/lib/stackdepot.c
+index 4a7055a63d9f8..c043a4186bc59 100644
+--- a/lib/stackdepot.c
++++ b/lib/stackdepot.c
+@@ -45,15 +45,16 @@
+ #define DEPOT_POOL_INDEX_BITS (DEPOT_HANDLE_BITS - DEPOT_OFFSET_BITS - \
+ 			       STACK_DEPOT_EXTRA_BITS)
+ #define DEPOT_POOLS_CAP 8192
++/* The pool_index is offset by 1 so the first record does not have a 0 handle. */
+ #define DEPOT_MAX_POOLS \
+-	(((1LL << (DEPOT_POOL_INDEX_BITS)) < DEPOT_POOLS_CAP) ? \
+-	 (1LL << (DEPOT_POOL_INDEX_BITS)) : DEPOT_POOLS_CAP)
++	(((1LL << (DEPOT_POOL_INDEX_BITS)) - 1 < DEPOT_POOLS_CAP) ? \
++	 (1LL << (DEPOT_POOL_INDEX_BITS)) - 1 : DEPOT_POOLS_CAP)
+ 
+ /* Compact structure that stores a reference to a stack. */
+ union handle_parts {
+ 	depot_stack_handle_t handle;
+ 	struct {
+-		u32 pool_index	: DEPOT_POOL_INDEX_BITS;
++		u32 pool_index	: DEPOT_POOL_INDEX_BITS; /* pool_index is offset by 1 */
+ 		u32 offset	: DEPOT_OFFSET_BITS;
+ 		u32 extra	: STACK_DEPOT_EXTRA_BITS;
+ 	};
+@@ -372,7 +373,7 @@ static struct stack_record *depot_pop_free_pool(void **prealloc, size_t size)
+ 	stack = current_pool + pool_offset;
+ 
+ 	/* Pre-initialize handle once. */
+-	stack->handle.pool_index = pool_index;
++	stack->handle.pool_index = pool_index + 1;
+ 	stack->handle.offset = pool_offset >> DEPOT_STACK_ALIGN;
+ 	stack->handle.extra = 0;
+ 	INIT_LIST_HEAD(&stack->hash_list);
+@@ -483,18 +484,19 @@ static struct stack_record *depot_fetch_stack(depot_stack_handle_t handle)
+ 	const int pools_num_cached = READ_ONCE(pools_num);
+ 	union handle_parts parts = { .handle = handle };
+ 	void *pool;
++	u32 pool_index = parts.pool_index - 1;
+ 	size_t offset = parts.offset << DEPOT_STACK_ALIGN;
+ 	struct stack_record *stack;
+ 
+ 	lockdep_assert_not_held(&pool_lock);
+ 
+-	if (parts.pool_index > pools_num_cached) {
++	if (pool_index > pools_num_cached) {
+ 		WARN(1, "pool index %d out of bounds (%d) for stack id %08x\n",
+-		     parts.pool_index, pools_num_cached, handle);
++		     pool_index, pools_num_cached, handle);
+ 		return NULL;
+ 	}
+ 
+-	pool = stack_pools[parts.pool_index];
++	pool = stack_pools[pool_index];
+ 	if (WARN_ON(!pool))
+ 		return NULL;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/lib-stackdepot-off-by-one-in-depot_fetch_stack.patch b/queue-6.8/lib-stackdepot-off-by-one-in-depot_fetch_stack.patch
new file mode 100644
index 00000000000..9cb98c621a0
--- /dev/null
+++ b/queue-6.8/lib-stackdepot-off-by-one-in-depot_fetch_stack.patch
@@ -0,0 +1,45 @@
+From c636e21dfe98b513dbade2b1c231a0a2c3a4127d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Feb 2024 17:20:13 +0300
+Subject: lib/stackdepot: off by one in depot_fetch_stack()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit dc24559472a682eb124e869cb110e7a2fd857322 ]
+
+The stack_pools[] array has DEPOT_MAX_POOLS.  The "pools_num" tracks the
+number of pools which are initialized.  See depot_init_pool() for more
+details.
+
+If pool_index == pools_num_cached, this will read one element beyond what
+we want.  If not all the pools are initialized, then the pool will be
+NULL, triggering a WARN(), and if they are all initialized it will read
+one element beyond the end of the array.
+
+Link: https://lkml.kernel.org/r/361ac881-60b7-471f-91e5-5bf8fe8042b2@moroto.mountain
+Fixes: b29d31885814 ("lib/stackdepot: store free stack records in a freelist")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <andreyknvl@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/stackdepot.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/stackdepot.c b/lib/stackdepot.c
+index c043a4186bc59..c1ec2b4b6dabf 100644
+--- a/lib/stackdepot.c
++++ b/lib/stackdepot.c
+@@ -490,7 +490,7 @@ static struct stack_record *depot_fetch_stack(depot_stack_handle_t handle)
+ 
+ 	lockdep_assert_not_held(&pool_lock);
+ 
+-	if (pool_index > pools_num_cached) {
++	if (pool_index >= pools_num_cached) {
+ 		WARN(1, "pool index %d out of bounds (%d) for stack id %08x\n",
+ 		     pool_index, pools_num_cached, handle);
+ 		return NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-add-bpf_token_create-api.patch b/queue-6.8/libbpf-add-bpf_token_create-api.patch
new file mode 100644
index 00000000000..0751fe1c4e9
--- /dev/null
+++ b/queue-6.8/libbpf-add-bpf_token_create-api.patch
@@ -0,0 +1,95 @@
+From 35d25b9121bf859861a2e87169f48d9c4ae877c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 18:21:09 -0800
+Subject: libbpf: Add bpf_token_create() API
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 639ecd7d6247c48a0175f5b458b648f5d4b6dc34 ]
+
+Add low-level wrapper API for BPF_TOKEN_CREATE command in bpf() syscall.
+
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20240124022127.2379740-13-andrii@kernel.org
+Stable-dep-of: c81a8ab196b5 ("libbpf: Add btf__new_split() API that was declared but not implemented")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf.c      | 17 +++++++++++++++++
+ tools/lib/bpf/bpf.h      | 24 ++++++++++++++++++++++++
+ tools/lib/bpf/libbpf.map |  1 +
+ 3 files changed, 42 insertions(+)
+
+diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
+index 9dc9625651dcf..d4019928a8646 100644
+--- a/tools/lib/bpf/bpf.c
++++ b/tools/lib/bpf/bpf.c
+@@ -1287,3 +1287,20 @@ int bpf_prog_bind_map(int prog_fd, int map_fd,
+ 	ret = sys_bpf(BPF_PROG_BIND_MAP, &attr, attr_sz);
+ 	return libbpf_err_errno(ret);
+ }
++
++int bpf_token_create(int bpffs_fd, struct bpf_token_create_opts *opts)
++{
++	const size_t attr_sz = offsetofend(union bpf_attr, token_create);
++	union bpf_attr attr;
++	int fd;
++
++	if (!OPTS_VALID(opts, bpf_token_create_opts))
++		return libbpf_err(-EINVAL);
++
++	memset(&attr, 0, attr_sz);
++	attr.token_create.bpffs_fd = bpffs_fd;
++	attr.token_create.flags = OPTS_GET(opts, flags, 0);
++
++	fd = sys_bpf_fd(BPF_TOKEN_CREATE, &attr, attr_sz);
++	return libbpf_err_errno(fd);
++}
+diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
+index dad7917903d19..02b0810c8dece 100644
+--- a/tools/lib/bpf/bpf.h
++++ b/tools/lib/bpf/bpf.h
+@@ -640,6 +640,30 @@ struct bpf_test_run_opts {
+ LIBBPF_API int bpf_prog_test_run_opts(int prog_fd,
+ 				      struct bpf_test_run_opts *opts);
+ 
++struct bpf_token_create_opts {
++	size_t sz; /* size of this struct for forward/backward compatibility */
++	__u32 flags;
++	size_t :0;
++};
++#define bpf_token_create_opts__last_field flags
++
++/**
++ * @brief **bpf_token_create()** creates a new instance of BPF token derived
++ * from specified BPF FS mount point.
++ *
++ * BPF token created with this API can be passed to bpf() syscall for
++ * commands like BPF_PROG_LOAD, BPF_MAP_CREATE, etc.
++ *
++ * @param bpffs_fd FD for BPF FS instance from which to derive a BPF token
++ * instance.
++ * @param opts optional BPF token creation options, can be NULL
++ *
++ * @return BPF token FD > 0, on success; negative error code, otherwise (errno
++ * is also set to the error code)
++ */
++LIBBPF_API int bpf_token_create(int bpffs_fd,
++				struct bpf_token_create_opts *opts);
++
+ #ifdef __cplusplus
+ } /* extern "C" */
+ #endif
+diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
+index 91c5aef7dae7d..d9e1f57534fa7 100644
+--- a/tools/lib/bpf/libbpf.map
++++ b/tools/lib/bpf/libbpf.map
+@@ -411,4 +411,5 @@ LIBBPF_1.3.0 {
+ } LIBBPF_1.2.0;
+ 
+ LIBBPF_1.4.0 {
++		bpf_token_create;
+ } LIBBPF_1.3.0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-add-btf__new_split-api-that-was-declared-but-.patch b/queue-6.8/libbpf-add-btf__new_split-api-that-was-declared-but-.patch
new file mode 100644
index 00000000000..758d81aec32
--- /dev/null
+++ b/queue-6.8/libbpf-add-btf__new_split-api-that-was-declared-but-.patch
@@ -0,0 +1,64 @@
+From 334f0334339f36da511e929ee8f1b89432880ebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 09:20:25 -0800
+Subject: libbpf: Add btf__new_split() API that was declared but not
+ implemented
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit c81a8ab196b5083d5109a51585fcc24fa2055a77 ]
+
+Seems like original commit adding split BTF support intended to add
+btf__new_split() API, and even declared it in libbpf.map, but never
+added (trivial) implementation. Fix this.
+
+Fixes: ba451366bf44 ("libbpf: Implement basic split BTF support")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/bpf/20240201172027.604869-4-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.c      | 5 +++++
+ tools/lib/bpf/libbpf.map | 3 ++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
+index ee95fd379d4d8..b61bc5d1009b7 100644
+--- a/tools/lib/bpf/btf.c
++++ b/tools/lib/bpf/btf.c
+@@ -1079,6 +1079,11 @@ struct btf *btf__new(const void *data, __u32 size)
+ 	return libbpf_ptr(btf_new(data, size, NULL));
+ }
+ 
++struct btf *btf__new_split(const void *data, __u32 size, struct btf *base_btf)
++{
++	return libbpf_ptr(btf_new(data, size, base_btf));
++}
++
+ static struct btf *btf_parse_elf(const char *path, struct btf *base_btf,
+ 				 struct btf_ext **btf_ext)
+ {
+diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
+index d9e1f57534fa7..386964f572a8f 100644
+--- a/tools/lib/bpf/libbpf.map
++++ b/tools/lib/bpf/libbpf.map
+@@ -245,7 +245,6 @@ LIBBPF_0.3.0 {
+ 		btf__parse_raw_split;
+ 		btf__parse_split;
+ 		btf__new_empty_split;
+-		btf__new_split;
+ 		ring_buffer__epoll_fd;
+ } LIBBPF_0.2.0;
+ 
+@@ -411,5 +410,7 @@ LIBBPF_1.3.0 {
+ } LIBBPF_1.2.0;
+ 
+ LIBBPF_1.4.0 {
++	global:
+ 		bpf_token_create;
++		btf__new_split;
+ } LIBBPF_1.3.0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-add-missed-btf_ext__raw_data-api.patch b/queue-6.8/libbpf-add-missed-btf_ext__raw_data-api.patch
new file mode 100644
index 00000000000..8cc93f76c00
--- /dev/null
+++ b/queue-6.8/libbpf-add-missed-btf_ext__raw_data-api.patch
@@ -0,0 +1,81 @@
+From 012492b32ad0e17dbd9c453c836cd31e3343c517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 09:20:26 -0800
+Subject: libbpf: Add missed btf_ext__raw_data() API
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit b9551da8cf3ade01a50316df8a618fd945723ee0 ]
+
+Another API that was declared in libbpf.map but actual implementation
+was missing. btf_ext__get_raw_data() was intended as a discouraged alias
+to consistently-named btf_ext__raw_data(), so make this an actuality.
+
+Fixes: 20eccf29e297 ("libbpf: hide and discourage inconsistently named getters")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/bpf/20240201172027.604869-5-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/btf.c      | 6 +++++-
+ tools/lib/bpf/libbpf.map | 2 +-
+ tools/lib/bpf/linker.c   | 2 +-
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c
+index b61bc5d1009b7..119d45eadb2ed 100644
+--- a/tools/lib/bpf/btf.c
++++ b/tools/lib/bpf/btf.c
+@@ -3044,12 +3044,16 @@ struct btf_ext *btf_ext__new(const __u8 *data, __u32 size)
+ 	return btf_ext;
+ }
+ 
+-const void *btf_ext__get_raw_data(const struct btf_ext *btf_ext, __u32 *size)
++const void *btf_ext__raw_data(const struct btf_ext *btf_ext, __u32 *size)
+ {
+ 	*size = btf_ext->data_size;
+ 	return btf_ext->data;
+ }
+ 
++__attribute__((alias("btf_ext__raw_data")))
++const void *btf_ext__get_raw_data(const struct btf_ext *btf_ext, __u32 *size);
++
++
+ struct btf_dedup;
+ 
+ static struct btf_dedup *btf_dedup_new(struct btf *btf, const struct btf_dedup_opts *opts);
+diff --git a/tools/lib/bpf/libbpf.map b/tools/lib/bpf/libbpf.map
+index 386964f572a8f..86804fd90dd1a 100644
+--- a/tools/lib/bpf/libbpf.map
++++ b/tools/lib/bpf/libbpf.map
+@@ -325,7 +325,6 @@ LIBBPF_0.7.0 {
+ 		bpf_xdp_detach;
+ 		bpf_xdp_query;
+ 		bpf_xdp_query_id;
+-		btf_ext__raw_data;
+ 		libbpf_probe_bpf_helper;
+ 		libbpf_probe_bpf_map_type;
+ 		libbpf_probe_bpf_prog_type;
+@@ -413,4 +412,5 @@ LIBBPF_1.4.0 {
+ 	global:
+ 		bpf_token_create;
+ 		btf__new_split;
++		btf_ext__raw_data;
+ } LIBBPF_1.3.0;
+diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
+index 16bca56002ab3..0d4be829551b5 100644
+--- a/tools/lib/bpf/linker.c
++++ b/tools/lib/bpf/linker.c
+@@ -2732,7 +2732,7 @@ static int finalize_btf(struct bpf_linker *linker)
+ 
+ 	/* Emit .BTF.ext section */
+ 	if (linker->btf_ext) {
+-		raw_data = btf_ext__get_raw_data(linker->btf_ext, &raw_sz);
++		raw_data = btf_ext__raw_data(linker->btf_ext, &raw_sz);
+ 		if (!raw_data)
+ 			return -ENOMEM;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-add-missing-libbpf_api-annotation-to-libbpf_s.patch b/queue-6.8/libbpf-add-missing-libbpf_api-annotation-to-libbpf_s.patch
new file mode 100644
index 00000000000..657c4f2fa52
--- /dev/null
+++ b/queue-6.8/libbpf-add-missing-libbpf_api-annotation-to-libbpf_s.patch
@@ -0,0 +1,40 @@
+From 26c5d6720a8075c307bcb10557a4f92ada7479e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 09:20:24 -0800
+Subject: libbpf: Add missing LIBBPF_API annotation to libbpf_set_memlock_rlim
+ API
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 93ee1eb85e28d1e35bb059c1f5965d65d5fc83c2 ]
+
+LIBBPF_API annotation seems missing on libbpf_set_memlock_rlim API, so
+add it to make this API callable from libbpf's shared library version.
+
+Fixes: e542f2c4cd16 ("libbpf: Auto-bump RLIMIT_MEMLOCK if kernel needs it for BPF")
+Fixes: ab9a5a05dc48 ("libbpf: fix up few libbpf.map problems")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/bpf/20240201172027.604869-3-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/bpf.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
+index d0f53772bdc02..dad7917903d19 100644
+--- a/tools/lib/bpf/bpf.h
++++ b/tools/lib/bpf/bpf.h
+@@ -35,7 +35,7 @@
+ extern "C" {
+ #endif
+ 
+-int libbpf_set_memlock_rlim(size_t memlock_bytes);
++LIBBPF_API int libbpf_set_memlock_rlim(size_t memlock_bytes);
+ 
+ struct bpf_map_create_opts {
+ 	size_t sz; /* size of this struct for forward/backward compatibility */
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch b/queue-6.8/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
new file mode 100644
index 00000000000..4922cbb53e5
--- /dev/null
+++ b/queue-6.8/libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
@@ -0,0 +1,54 @@
+From 9290c4e284e9ae6c2c39c0593234484b19788645 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:06:18 +0300
+Subject: libbpf: Apply map_set_def_max_entries() for inner_maps on creation
+
+From: Andrey Grafin <conquistador@yandex-team.ru>
+
+[ Upstream commit f04deb90e516e8e48bf8693397529bc942a9e80b ]
+
+This patch allows to auto create BPF_MAP_TYPE_ARRAY_OF_MAPS and
+BPF_MAP_TYPE_HASH_OF_MAPS with values of BPF_MAP_TYPE_PERF_EVENT_ARRAY
+by bpf_object__load().
+
+Previous behaviour created a zero filled btf_map_def for inner maps and
+tried to use it for a map creation but the linux kernel forbids to create
+a BPF_MAP_TYPE_PERF_EVENT_ARRAY map with max_entries=0.
+
+Fixes: 646f02ffdd49 ("libbpf: Add BTF-defined map-in-map support")
+Signed-off-by: Andrey Grafin <conquistador@yandex-team.ru>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/bpf/20240117130619.9403-1-conquistador@yandex-team.ru
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index afd09571c482b..b8b00da629071 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -70,6 +70,7 @@
+ 
+ static struct bpf_map *bpf_object__add_map(struct bpf_object *obj);
+ static bool prog_is_subprog(const struct bpf_object *obj, const struct bpf_program *prog);
++static int map_set_def_max_entries(struct bpf_map *map);
+ 
+ static const char * const attach_type_name[] = {
+ 	[BPF_CGROUP_INET_INGRESS]	= "cgroup_inet_ingress",
+@@ -5172,6 +5173,9 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
+ 
+ 	if (bpf_map_type__is_map_in_map(def->type)) {
+ 		if (map->inner_map) {
++			err = map_set_def_max_entries(map->inner_map);
++			if (err)
++				return err;
+ 			err = bpf_object__create_map(obj, map->inner_map, true);
+ 			if (err) {
+ 				pr_warn("map '%s': failed to create inner map: %d\n",
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-fix-__arg_ctx-type-enforcement-for-perf_event.patch b/queue-6.8/libbpf-fix-__arg_ctx-type-enforcement-for-perf_event.patch
new file mode 100644
index 00000000000..fbe4fea9038
--- /dev/null
+++ b/queue-6.8/libbpf-fix-__arg_ctx-type-enforcement-for-perf_event.patch
@@ -0,0 +1,74 @@
+From 5f412169da163abe591babc80d1edfc5fd18f619 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 12:55:05 -0800
+Subject: libbpf: fix __arg_ctx type enforcement for perf_event programs
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 9eea8fafe33eb70868f6ace2fc1e17c4ff5539c3 ]
+
+Adjust PERF_EVENT type enforcement around __arg_ctx to match exactly
+what kernel is doing.
+
+Fixes: 76ec90a996e3 ("libbpf: warn on unexpected __arg_ctx type when rewriting BTF")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20240125205510.3642094-3-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index b8b00da629071..910f72c9e6a49 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -33,6 +33,7 @@
+ #include <linux/filter.h>
+ #include <linux/limits.h>
+ #include <linux/perf_event.h>
++#include <linux/bpf_perf_event.h>
+ #include <linux/ring_buffer.h>
+ #include <sys/epoll.h>
+ #include <sys/ioctl.h>
+@@ -6699,6 +6700,14 @@ static struct {
+ 	/* all other program types don't have "named" context structs */
+ };
+ 
++/* forward declarations for arch-specific underlying types of bpf_user_pt_regs_t typedef,
++ * for below __builtin_types_compatible_p() checks;
++ * with this approach we don't need any extra arch-specific #ifdef guards
++ */
++struct pt_regs;
++struct user_pt_regs;
++struct user_regs_struct;
++
+ static bool need_func_arg_type_fixup(const struct btf *btf, const struct bpf_program *prog,
+ 				     const char *subprog_name, int arg_idx,
+ 				     int arg_type_id, const char *ctx_name)
+@@ -6739,11 +6748,21 @@ static bool need_func_arg_type_fixup(const struct btf *btf, const struct bpf_pro
+ 	/* special cases */
+ 	switch (prog->type) {
+ 	case BPF_PROG_TYPE_KPROBE:
+-	case BPF_PROG_TYPE_PERF_EVENT:
+ 		/* `struct pt_regs *` is expected, but we need to fix up */
+ 		if (btf_is_struct(t) && strcmp(tname, "pt_regs") == 0)
+ 			return true;
+ 		break;
++	case BPF_PROG_TYPE_PERF_EVENT:
++		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct pt_regs) &&
++		    btf_is_struct(t) && strcmp(tname, "pt_regs") == 0)
++			return 0;
++		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_pt_regs) &&
++		    btf_is_struct(t) && strcmp(tname, "user_pt_regs") == 0)
++			return 0;
++		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_regs_struct) &&
++		    btf_is_struct(t) && strcmp(tname, "user_regs_struct") == 0)
++			return 0;
++		break;
+ 	case BPF_PROG_TYPE_RAW_TRACEPOINT:
+ 	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
+ 		/* allow u64* as ctx */
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-fix-faccessat-usage-on-android.patch b/queue-6.8/libbpf-fix-faccessat-usage-on-android.patch
new file mode 100644
index 00000000000..e5a2f06a1e7
--- /dev/null
+++ b/queue-6.8/libbpf-fix-faccessat-usage-on-android.patch
@@ -0,0 +1,56 @@
+From 14edcf281f5e9599f1bfc81f81364b6a22bbae42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 14:09:44 -0800
+Subject: libbpf: Fix faccessat() usage on Android
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit ad57654053805bf9a62602aaec74cc78edb6f235 ]
+
+Android implementation of libc errors out with -EINVAL in faccessat() if
+passed AT_EACCESS ([0]), this leads to ridiculous issue with libbpf
+refusing to load /sys/kernel/btf/vmlinux on Androids ([1]). Fix by
+detecting Android and redefining AT_EACCESS to 0, it's equivalent on
+Android.
+
+  [0] https://android.googlesource.com/platform/bionic/+/refs/heads/android13-release/libc/bionic/faccessat.cpp#50
+  [1] https://github.com/libbpf/libbpf-bootstrap/issues/250#issuecomment-1911324250
+
+Fixes: 6a4ab8869d0b ("libbpf: Fix the case of running as non-root with capabilities")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/20240126220944.2497665-1-andrii@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf_internal.h | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf_internal.h b/tools/lib/bpf/libbpf_internal.h
+index 27e4e320e1a69..878a0d0b51f5c 100644
+--- a/tools/lib/bpf/libbpf_internal.h
++++ b/tools/lib/bpf/libbpf_internal.h
+@@ -18,6 +18,20 @@
+ #include <libelf.h>
+ #include "relo_core.h"
+ 
++/* Android's libc doesn't support AT_EACCESS in faccessat() implementation
++ * ([0]), and just returns -EINVAL even if file exists and is accessible.
++ * See [1] for issues caused by this.
++ *
++ * So just redefine it to 0 on Android.
++ *
++ * [0] https://android.googlesource.com/platform/bionic/+/refs/heads/android13-release/libc/bionic/faccessat.cpp#50
++ * [1] https://github.com/libbpf/libbpf-bootstrap/issues/250#issuecomment-1911324250
++ */
++#ifdef __ANDROID__
++#undef AT_EACCESS
++#define AT_EACCESS 0
++#endif
++
+ /* make sure libbpf doesn't use kernel-only integer typedefs */
+ #pragma GCC poison u8 u16 u32 u64 s8 s16 s32 s64
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-fix-return-value-for-perf_event-__arg_ctx-typ.patch b/queue-6.8/libbpf-fix-return-value-for-perf_event-__arg_ctx-typ.patch
new file mode 100644
index 00000000000..62811699b8d
--- /dev/null
+++ b/queue-6.8/libbpf-fix-return-value-for-perf_event-__arg_ctx-typ.patch
@@ -0,0 +1,50 @@
+From 290afa9bd207e61ad0a214d794af1f075a08eafe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Feb 2024 16:22:43 -0800
+Subject: libbpf: fix return value for PERF_EVENT __arg_ctx type fix up check
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit d7bc416aa5cc183691287e8f0b1d5b182a7ce9c3 ]
+
+If PERF_EVENT program has __arg_ctx argument with matching
+architecture-specific pt_regs/user_pt_regs/user_regs_struct pointer
+type, libbpf should still perform type rewrite for old kernels, but not
+emit the warning. Fix copy/paste from kernel code where 0 is meant to
+signify "no error" condition. For libbpf we need to return "true" to
+proceed with type rewrite (which for PERF_EVENT program will be
+a canonical `struct bpf_perf_event_data *` type).
+
+Fixes: 9eea8fafe33e ("libbpf: fix __arg_ctx type enforcement for perf_event programs")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20240206002243.1439450-1-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 910f72c9e6a49..92bca96587a4a 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -6755,13 +6755,13 @@ static bool need_func_arg_type_fixup(const struct btf *btf, const struct bpf_pro
+ 	case BPF_PROG_TYPE_PERF_EVENT:
+ 		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct pt_regs) &&
+ 		    btf_is_struct(t) && strcmp(tname, "pt_regs") == 0)
+-			return 0;
++			return true;
+ 		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_pt_regs) &&
+ 		    btf_is_struct(t) && strcmp(tname, "user_pt_regs") == 0)
+-			return 0;
++			return true;
+ 		if (__builtin_types_compatible_p(bpf_user_pt_regs_t, struct user_regs_struct) &&
+ 		    btf_is_struct(t) && strcmp(tname, "user_regs_struct") == 0)
+-			return 0;
++			return true;
+ 		break;
+ 	case BPF_PROG_TYPE_RAW_TRACEPOINT:
+ 	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
+-- 
+2.43.0
+
diff --git a/queue-6.8/libbpf-use-opts_set-macro-in-bpf_xdp_query.patch b/queue-6.8/libbpf-use-opts_set-macro-in-bpf_xdp_query.patch
new file mode 100644
index 00000000000..33f39319b81
--- /dev/null
+++ b/queue-6.8/libbpf-use-opts_set-macro-in-bpf_xdp_query.patch
@@ -0,0 +1,52 @@
+From f8698d58b7e957939cf70b2946faf6ec3d98a72e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 13:59:22 +0100
+Subject: libbpf: Use OPTS_SET() macro in bpf_xdp_query()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 92a871ab9fa59a74d013bc04f321026a057618e7 ]
+
+When the feature_flags and xdp_zc_max_segs fields were added to the libbpf
+bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.
+This causes libbpf to write to those fields unconditionally, which means
+that programs compiled against an older version of libbpf (with a smaller
+size of the bpf_xdp_query_opts struct) will have its stack corrupted by
+libbpf writing out of bounds.
+
+The patch adding the feature_flags field has an early bail out if the
+feature_flags field is not part of the opts struct (via the OPTS_HAS)
+macro, but the patch adding xdp_zc_max_segs does not. For consistency, this
+fix just changes the assignments to both fields to use the OPTS_SET()
+macro.
+
+Fixes: 13ce2daa259a ("xsk: add new netlink attribute dedicated for ZC max frags")
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240206125922.1992815-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/netlink.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/netlink.c b/tools/lib/bpf/netlink.c
+index 090bcf6e3b3d5..68a2def171751 100644
+--- a/tools/lib/bpf/netlink.c
++++ b/tools/lib/bpf/netlink.c
+@@ -496,8 +496,8 @@ int bpf_xdp_query(int ifindex, int xdp_flags, struct bpf_xdp_query_opts *opts)
+ 	if (err)
+ 		return libbpf_err(err);
+ 
+-	opts->feature_flags = md.flags;
+-	opts->xdp_zc_max_segs = md.xdp_zc_max_segs;
++	OPTS_SET(opts, feature_flags, md.flags);
++	OPTS_SET(opts, xdp_zc_max_segs, md.xdp_zc_max_segs);
+ 
+ skip_feature_flags:
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch b/queue-6.8/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
new file mode 100644
index 00000000000..e729a3cbeb7
--- /dev/null
+++ b/queue-6.8/md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
@@ -0,0 +1,73 @@
+From 512281cfdd901ff0793eef2e1d7e20e0551e5431 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 11:14:40 +0800
+Subject: md: Don't clear MD_CLOSING when the raid is about to stop
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 9674f54e41fffaf06f6a60202e1fa4cc13de3cf5 ]
+
+The raid should not be opened anymore when it is about to be stopped.
+However, other processes can open it again if the flag MD_CLOSING is
+cleared before exiting. From now on, this flag will not be cleared when
+the raid will be stopped.
+
+Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20240226031444.3606764-6-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index bfd04a9e80796..d344e6fa3b26f 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6279,7 +6279,15 @@ static void md_clean(struct mddev *mddev)
+ 	mddev->persistent = 0;
+ 	mddev->level = LEVEL_NONE;
+ 	mddev->clevel[0] = 0;
+-	mddev->flags = 0;
++	/*
++	 * Don't clear MD_CLOSING, or mddev can be opened again.
++	 * 'hold_active != 0' means mddev is still in the creation
++	 * process and will be used later.
++	 */
++	if (mddev->hold_active)
++		mddev->flags = 0;
++	else
++		mddev->flags &= BIT_ULL_MASK(MD_CLOSING);
+ 	mddev->sb_flags = 0;
+ 	mddev->ro = MD_RDWR;
+ 	mddev->metadata_type[0] = 0;
+@@ -7625,7 +7633,6 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
+ 	int err = 0;
+ 	void __user *argp = (void __user *)arg;
+ 	struct mddev *mddev = NULL;
+-	bool did_set_md_closing = false;
+ 
+ 	if (!md_ioctl_valid(cmd))
+ 		return -ENOTTY;
+@@ -7709,7 +7716,6 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
+ 			err = -EBUSY;
+ 			goto out;
+ 		}
+-		did_set_md_closing = true;
+ 		mutex_unlock(&mddev->open_mutex);
+ 		sync_blockdev(bdev);
+ 	}
+@@ -7851,7 +7857,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
+ 				     mddev_unlock(mddev);
+ 
+ out:
+-	if(did_set_md_closing)
++	if (cmd == STOP_ARRAY_RO || (err && cmd == STOP_ARRAY))
+ 		clear_bit(MD_CLOSING, &mddev->flags);
+ 	return err;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/md-fix-kmemleak-of-rdev-serial.patch b/queue-6.8/md-fix-kmemleak-of-rdev-serial.patch
new file mode 100644
index 00000000000..176ea173bdf
--- /dev/null
+++ b/queue-6.8/md-fix-kmemleak-of-rdev-serial.patch
@@ -0,0 +1,57 @@
+From 1610f246234f633d517a1fedd4155f56214f5a11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 16:55:56 +0800
+Subject: md: fix kmemleak of rdev->serial
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 6cf350658736681b9d6b0b6e58c5c76b235bb4c4 ]
+
+If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be
+alloc not be freed, and kmemleak occurs.
+
+unreferenced object 0xffff88815a350000 (size 49152):
+  comm "mdadm", pid 789, jiffies 4294716910
+  hex dump (first 32 bytes):
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace (crc f773277a):
+    [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0
+    [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270
+    [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f
+    [<00000000f206d60a>] kvmalloc_node+0x74/0x150
+    [<0000000034bf3363>] rdev_init_serial+0x67/0x170
+    [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220
+    [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630
+    [<0000000073c28560>] md_add_new_disk+0x400/0x9f0
+    [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10
+    [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0
+    [<0000000085086a11>] vfs_ioctl+0x22/0x60
+    [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0
+    [<00000000e54e675e>] do_syscall_64+0x71/0x150
+    [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74
+
+Fixes: 963c555e75b0 ("md: introduce mddev_create/destroy_wb_pool for the change of member device")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20240208085556.2412922-1-linan666@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 9e41a9aaba8b5..bfd04a9e80796 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2566,6 +2566,7 @@ static int bind_rdev_to_array(struct md_rdev *rdev, struct mddev *mddev)
+  fail:
+ 	pr_warn("md: failed to register dev-%s for %s\n",
+ 		b, mdname(mddev));
++	mddev_destroy_serial_pool(mddev, rdev);
+ 	return err;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/md-raid1-factor-out-helpers-to-add-rdev-to-conf.patch b/queue-6.8/md-raid1-factor-out-helpers-to-add-rdev-to-conf.patch
new file mode 100644
index 00000000000..cf2eb22e85a
--- /dev/null
+++ b/queue-6.8/md-raid1-factor-out-helpers-to-add-rdev-to-conf.patch
@@ -0,0 +1,171 @@
+From 1afa28a108d61dbb3465ad282f8f9206df41dd48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 17:57:05 +0800
+Subject: md/raid1: factor out helpers to add rdev to conf
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 969d6589abcb369d53d84ec7c9c37f4b23ec1ad9 ]
+
+There are no functional changes, just make code cleaner and prepare to
+record disk non-rotational information while adding and removing rdev to
+conf
+
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20240229095714.926789-3-yukuai1@huaweicloud.com
+Stable-dep-of: 257ac239ffcf ("md/raid1: fix choose next idle in read_balance()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 85 +++++++++++++++++++++++++++++-----------------
+ 1 file changed, 53 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 286f8b16c7bde..a560824e038b4 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1760,6 +1760,44 @@ static int raid1_spare_active(struct mddev *mddev)
+ 	return count;
+ }
+ 
++static bool raid1_add_conf(struct r1conf *conf, struct md_rdev *rdev, int disk,
++			   bool replacement)
++{
++	struct raid1_info *info = conf->mirrors + disk;
++
++	if (replacement)
++		info += conf->raid_disks;
++
++	if (info->rdev)
++		return false;
++
++	rdev->raid_disk = disk;
++	info->head_position = 0;
++	info->seq_start = MaxSector;
++	WRITE_ONCE(info->rdev, rdev);
++
++	return true;
++}
++
++static bool raid1_remove_conf(struct r1conf *conf, int disk)
++{
++	struct raid1_info *info = conf->mirrors + disk;
++	struct md_rdev *rdev = info->rdev;
++
++	if (!rdev || test_bit(In_sync, &rdev->flags) ||
++	    atomic_read(&rdev->nr_pending))
++		return false;
++
++	/* Only remove non-faulty devices if recovery is not possible. */
++	if (!test_bit(Faulty, &rdev->flags) &&
++	    rdev->mddev->recovery_disabled != conf->recovery_disabled &&
++	    rdev->mddev->degraded < conf->raid_disks)
++		return false;
++
++	WRITE_ONCE(info->rdev, NULL);
++	return true;
++}
++
+ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ {
+ 	struct r1conf *conf = mddev->private;
+@@ -1795,15 +1833,13 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ 				disk_stack_limits(mddev->gendisk, rdev->bdev,
+ 						  rdev->data_offset << 9);
+ 
+-			p->head_position = 0;
+-			rdev->raid_disk = mirror;
++			raid1_add_conf(conf, rdev, mirror, false);
+ 			err = 0;
+ 			/* As all devices are equivalent, we don't need a full recovery
+ 			 * if this was recently any drive of the array
+ 			 */
+ 			if (rdev->saved_raid_disk < 0)
+ 				conf->fullsync = 1;
+-			WRITE_ONCE(p->rdev, rdev);
+ 			break;
+ 		}
+ 		if (test_bit(WantReplacement, &p->rdev->flags) &&
+@@ -1813,13 +1849,11 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ 
+ 	if (err && repl_slot >= 0) {
+ 		/* Add this device as a replacement */
+-		p = conf->mirrors + repl_slot;
+ 		clear_bit(In_sync, &rdev->flags);
+ 		set_bit(Replacement, &rdev->flags);
+-		rdev->raid_disk = repl_slot;
++		raid1_add_conf(conf, rdev, repl_slot, true);
+ 		err = 0;
+ 		conf->fullsync = 1;
+-		WRITE_ONCE(p[conf->raid_disks].rdev, rdev);
+ 	}
+ 
+ 	print_conf(conf);
+@@ -1836,27 +1870,20 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
+ 	if (unlikely(number >= conf->raid_disks))
+ 		goto abort;
+ 
+-	if (rdev != p->rdev)
+-		p = conf->mirrors + conf->raid_disks + number;
++	if (rdev != p->rdev) {
++		number += conf->raid_disks;
++		p = conf->mirrors + number;
++	}
+ 
+ 	print_conf(conf);
+ 	if (rdev == p->rdev) {
+-		if (test_bit(In_sync, &rdev->flags) ||
+-		    atomic_read(&rdev->nr_pending)) {
+-			err = -EBUSY;
+-			goto abort;
+-		}
+-		/* Only remove non-faulty devices if recovery
+-		 * is not possible.
+-		 */
+-		if (!test_bit(Faulty, &rdev->flags) &&
+-		    mddev->recovery_disabled != conf->recovery_disabled &&
+-		    mddev->degraded < conf->raid_disks) {
++		if (!raid1_remove_conf(conf, number)) {
+ 			err = -EBUSY;
+ 			goto abort;
+ 		}
+-		WRITE_ONCE(p->rdev, NULL);
+-		if (conf->mirrors[conf->raid_disks + number].rdev) {
++
++		if (number < conf->raid_disks &&
++		    conf->mirrors[conf->raid_disks + number].rdev) {
+ 			/* We just removed a device that is being replaced.
+ 			 * Move down the replacement.  We drain all IO before
+ 			 * doing this to avoid confusion.
+@@ -3006,23 +3033,17 @@ static struct r1conf *setup_conf(struct mddev *mddev)
+ 
+ 	err = -EINVAL;
+ 	spin_lock_init(&conf->device_lock);
++	conf->raid_disks = mddev->raid_disks;
+ 	rdev_for_each(rdev, mddev) {
+ 		int disk_idx = rdev->raid_disk;
+-		if (disk_idx >= mddev->raid_disks
+-		    || disk_idx < 0)
++
++		if (disk_idx >= conf->raid_disks || disk_idx < 0)
+ 			continue;
+-		if (test_bit(Replacement, &rdev->flags))
+-			disk = conf->mirrors + mddev->raid_disks + disk_idx;
+-		else
+-			disk = conf->mirrors + disk_idx;
+ 
+-		if (disk->rdev)
++		if (!raid1_add_conf(conf, rdev, disk_idx,
++				    test_bit(Replacement, &rdev->flags)))
+ 			goto abort;
+-		disk->rdev = rdev;
+-		disk->head_position = 0;
+-		disk->seq_start = MaxSector;
+ 	}
+-	conf->raid_disks = mddev->raid_disks;
+ 	conf->mddev = mddev;
+ 	INIT_LIST_HEAD(&conf->retry_list);
+ 	INIT_LIST_HEAD(&conf->bio_end_io_list);
+-- 
+2.43.0
+
diff --git a/queue-6.8/md-raid1-fix-choose-next-idle-in-read_balance.patch b/queue-6.8/md-raid1-fix-choose-next-idle-in-read_balance.patch
new file mode 100644
index 00000000000..7d6fc37806c
--- /dev/null
+++ b/queue-6.8/md-raid1-fix-choose-next-idle-in-read_balance.patch
@@ -0,0 +1,148 @@
+From 6d693609b7141c49be796c87d2f0269df52e10c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 17:57:07 +0800
+Subject: md/raid1: fix choose next idle in read_balance()
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 257ac239ffcfd097a9a0732bf5095fb00164f334 ]
+
+Commit 12cee5a8a29e ("md/raid1: prevent merging too large request") add
+the case choose next idle in read_balance():
+
+read_balance:
+ for_each_rdev
+  if(next_seq_sect == this_sector || dist == 0)
+  -> sequential reads
+   best_disk = disk;
+   if (...)
+    choose_next_idle = 1
+    continue;
+
+ for_each_rdev
+ -> iterate next rdev
+  if (pending == 0)
+   best_disk = disk;
+   -> choose the next idle disk
+   break;
+
+  if (choose_next_idle)
+   -> keep using this rdev if there are no other idle disk
+   contine
+
+However, commit 2e52d449bcec ("md/raid1: add failfast handling for reads.")
+remove the code:
+
+-               /* If device is idle, use it */
+-               if (pending == 0) {
+-                       best_disk = disk;
+-                       break;
+-               }
+
+Hence choose next idle will never work now, fix this problem by
+following:
+
+1) don't set best_disk in this case, read_balance() will choose the best
+   disk after iterating all the disks;
+2) add 'pending' so that other idle disk will be chosen;
+3) add a new local variable 'sequential_disk' to record the disk, and if
+   there is no other idle disk, 'sequential_disk' will be chosen;
+
+Fixes: 2e52d449bcec ("md/raid1: add failfast handling for reads.")
+Co-developed-by: Paul Luse <paul.e.luse@linux.intel.com>
+Signed-off-by: Paul Luse <paul.e.luse@linux.intel.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20240229095714.926789-5-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid1.c | 32 ++++++++++++++++++++++----------
+ 1 file changed, 22 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 456d745eb93b3..82c9bb404ccca 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -601,13 +601,12 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 	const sector_t this_sector = r1_bio->sector;
+ 	int sectors;
+ 	int best_good_sectors;
+-	int best_disk, best_dist_disk, best_pending_disk;
++	int best_disk, best_dist_disk, best_pending_disk, sequential_disk;
+ 	int disk;
+ 	sector_t best_dist;
+ 	unsigned int min_pending;
+ 	struct md_rdev *rdev;
+ 	int choose_first;
+-	int choose_next_idle;
+ 
+ 	/*
+ 	 * Check if we can balance. We can balance on the whole
+@@ -618,11 +617,11 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 	sectors = r1_bio->sectors;
+ 	best_disk = -1;
+ 	best_dist_disk = -1;
++	sequential_disk = -1;
+ 	best_dist = MaxSector;
+ 	best_pending_disk = -1;
+ 	min_pending = UINT_MAX;
+ 	best_good_sectors = 0;
+-	choose_next_idle = 0;
+ 	clear_bit(R1BIO_FailFast, &r1_bio->state);
+ 
+ 	if ((conf->mddev->recovery_cp < this_sector + sectors) ||
+@@ -715,7 +714,6 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 			int opt_iosize = bdev_io_opt(rdev->bdev) >> 9;
+ 			struct raid1_info *mirror = &conf->mirrors[disk];
+ 
+-			best_disk = disk;
+ 			/*
+ 			 * If buffered sequential IO size exceeds optimal
+ 			 * iosize, check if there is idle disk. If yes, choose
+@@ -734,15 +732,22 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 			    mirror->next_seq_sect > opt_iosize &&
+ 			    mirror->next_seq_sect - opt_iosize >=
+ 			    mirror->seq_start) {
+-				choose_next_idle = 1;
+-				continue;
++				/*
++				 * Add 'pending' to avoid choosing this disk if
++				 * there is other idle disk.
++				 */
++				pending++;
++				/*
++				 * If there is no other idle disk, this disk
++				 * will be chosen.
++				 */
++				sequential_disk = disk;
++			} else {
++				best_disk = disk;
++				break;
+ 			}
+-			break;
+ 		}
+ 
+-		if (choose_next_idle)
+-			continue;
+-
+ 		if (min_pending > pending) {
+ 			min_pending = pending;
+ 			best_pending_disk = disk;
+@@ -754,6 +759,13 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 		}
+ 	}
+ 
++	/*
++	 * sequential IO size exceeds optimal iosize, however, there is no other
++	 * idle disk, so choose the sequential disk.
++	 */
++	if (best_disk == -1 && min_pending != 0)
++		best_disk = sequential_disk;
++
+ 	/*
+ 	 * If all disks are rotational, choose the closest disk. If any disk is
+ 	 * non-rotational, choose the disk with less pending request even the
+-- 
+2.43.0
+
diff --git a/queue-6.8/md-raid1-record-nonrot-rdevs-while-adding-removing-r.patch b/queue-6.8/md-raid1-record-nonrot-rdevs-while-adding-removing-r.patch
new file mode 100644
index 00000000000..35cf452d709
--- /dev/null
+++ b/queue-6.8/md-raid1-record-nonrot-rdevs-while-adding-removing-r.patch
@@ -0,0 +1,139 @@
+From c1e7bd330c34776a9a1a0f1fe45cff620a8f9897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 17:57:06 +0800
+Subject: md/raid1: record nonrot rdevs while adding/removing rdevs to conf
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 2c27d09d3a76b33629d2e681bf8b774f776ade7f ]
+
+For raid1, each read will iterate all the rdevs from conf and check if
+any rdev is non-rotational, then choose rdev with minimal IO inflight
+if so, or rdev with closest distance otherwise.
+
+Disk nonrot info can be changed through sysfs entry:
+
+/sys/block/[disk_name]/queue/rotational
+
+However, consider that this should only be used for testing, and user
+really shouldn't do this in real life. Record the number of non-rotational
+disks in conf, to avoid checking each rdev in IO fast path and simplify
+read_balance() a little bit.
+
+Co-developed-by: Paul Luse <paul.e.luse@linux.intel.com>
+Signed-off-by: Paul Luse <paul.e.luse@linux.intel.com>
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20240229095714.926789-4-yukuai1@huaweicloud.com
+Stable-dep-of: 257ac239ffcf ("md/raid1: fix choose next idle in read_balance()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.h    |  1 +
+ drivers/md/raid1.c | 17 ++++++++++-------
+ drivers/md/raid1.h |  1 +
+ 3 files changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 8d881cc597992..27d187ca6258a 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -207,6 +207,7 @@ enum flag_bits {
+ 				 * check if there is collision between raid1
+ 				 * serial bios.
+ 				 */
++	Nonrot,			/* non-rotational device (SSD) */
+ };
+ 
+ static inline int is_badblock(struct md_rdev *rdev, sector_t s, int sectors,
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index a560824e038b4..456d745eb93b3 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -602,7 +602,6 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 	int sectors;
+ 	int best_good_sectors;
+ 	int best_disk, best_dist_disk, best_pending_disk;
+-	int has_nonrot_disk;
+ 	int disk;
+ 	sector_t best_dist;
+ 	unsigned int min_pending;
+@@ -623,7 +622,6 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 	best_pending_disk = -1;
+ 	min_pending = UINT_MAX;
+ 	best_good_sectors = 0;
+-	has_nonrot_disk = 0;
+ 	choose_next_idle = 0;
+ 	clear_bit(R1BIO_FailFast, &r1_bio->state);
+ 
+@@ -640,7 +638,6 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 		sector_t first_bad;
+ 		int bad_sectors;
+ 		unsigned int pending;
+-		bool nonrot;
+ 
+ 		rdev = conf->mirrors[disk].rdev;
+ 		if (r1_bio->bios[disk] == IO_BLOCKED
+@@ -706,8 +703,6 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 			/* At least two disks to choose from so failfast is OK */
+ 			set_bit(R1BIO_FailFast, &r1_bio->state);
+ 
+-		nonrot = bdev_nonrot(rdev->bdev);
+-		has_nonrot_disk |= nonrot;
+ 		pending = atomic_read(&rdev->nr_pending);
+ 		dist = abs(this_sector - conf->mirrors[disk].head_position);
+ 		if (choose_first) {
+@@ -734,7 +729,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 			 * small, but not a big deal since when the second disk
+ 			 * starts IO, the first disk is likely still busy.
+ 			 */
+-			if (nonrot && opt_iosize > 0 &&
++			if (test_bit(Nonrot, &rdev->flags) && opt_iosize > 0 &&
+ 			    mirror->seq_start != MaxSector &&
+ 			    mirror->next_seq_sect > opt_iosize &&
+ 			    mirror->next_seq_sect - opt_iosize >=
+@@ -766,7 +761,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
+ 	 * mixed ratation/non-rotational disks depending on workload.
+ 	 */
+ 	if (best_disk == -1) {
+-		if (has_nonrot_disk || min_pending == 0)
++		if (READ_ONCE(conf->nonrot_disks) || min_pending == 0)
+ 			best_disk = best_pending_disk;
+ 		else
+ 			best_disk = best_dist_disk;
+@@ -1771,6 +1766,11 @@ static bool raid1_add_conf(struct r1conf *conf, struct md_rdev *rdev, int disk,
+ 	if (info->rdev)
+ 		return false;
+ 
++	if (bdev_nonrot(rdev->bdev)) {
++		set_bit(Nonrot, &rdev->flags);
++		WRITE_ONCE(conf->nonrot_disks, conf->nonrot_disks + 1);
++	}
++
+ 	rdev->raid_disk = disk;
+ 	info->head_position = 0;
+ 	info->seq_start = MaxSector;
+@@ -1794,6 +1794,9 @@ static bool raid1_remove_conf(struct r1conf *conf, int disk)
+ 	    rdev->mddev->degraded < conf->raid_disks)
+ 		return false;
+ 
++	if (test_and_clear_bit(Nonrot, &rdev->flags))
++		WRITE_ONCE(conf->nonrot_disks, conf->nonrot_disks - 1);
++
+ 	WRITE_ONCE(info->rdev, NULL);
+ 	return true;
+ }
+diff --git a/drivers/md/raid1.h b/drivers/md/raid1.h
+index 14d4211a123a8..5300cbaa58a41 100644
+--- a/drivers/md/raid1.h
++++ b/drivers/md/raid1.h
+@@ -71,6 +71,7 @@ struct r1conf {
+ 						 * allow for replacements.
+ 						 */
+ 	int			raid_disks;
++	int			nonrot_disks;
+ 
+ 	spinlock_t		device_lock;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-cadence-csi2rx-use-match-fwnode-for-media-link.patch b/queue-6.8/media-cadence-csi2rx-use-match-fwnode-for-media-link.patch
new file mode 100644
index 00000000000..58164d2841c
--- /dev/null
+++ b/queue-6.8/media-cadence-csi2rx-use-match-fwnode-for-media-link.patch
@@ -0,0 +1,40 @@
+From 71f6d6ed4b7d7efdfbfef1cb2a2bc4c76ff38f13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 10:00:21 +0100
+Subject: media: cadence: csi2rx: use match fwnode for media link
+
+From: Julien Massot <julien.massot@collabora.com>
+
+[ Upstream commit 448699c522af9e3266f168c3f51f4c3713c7bee1 ]
+
+Since commit 1029939b3782 ("media: v4l: async: Simplify async sub-device fwnode matching"),
+async connections are matched using the async sub-device fwnode, not that
+of the endpoint. Fix this by using the fwnode of the connection match to
+find the pad.
+
+Fixes: 1029939b3782 ("media: v4l: async: Simplify async sub-device fwnode matching")
+Signed-off-by: Julien Massot <julien.massot@collabora.com>
+Reviewed-by: Jai Luthra <j-luthra@ti.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/cadence/cdns-csi2rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c
+index fead5426830e8..0ea5fa956fe9a 100644
+--- a/drivers/media/platform/cadence/cdns-csi2rx.c
++++ b/drivers/media/platform/cadence/cdns-csi2rx.c
+@@ -468,7 +468,7 @@ static int csi2rx_async_bound(struct v4l2_async_notifier *notifier,
+ 	struct csi2rx_priv *csi2rx = v4l2_subdev_to_csi2rx(subdev);
+ 
+ 	csi2rx->source_pad = media_entity_get_fwnode_pad(&s_subdev->entity,
+-							 s_subdev->fwnode,
++							 asd->match.fwnode,
+ 							 MEDIA_PAD_FL_SOURCE);
+ 	if (csi2rx->source_pad < 0) {
+ 		dev_err(csi2rx->dev, "Couldn't find output pad for subdev %s\n",
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-cedrus-h265-fix-configuring-bitstream-size.patch b/queue-6.8/media-cedrus-h265-fix-configuring-bitstream-size.patch
new file mode 100644
index 00000000000..bbb2a0d1c35
--- /dev/null
+++ b/queue-6.8/media-cedrus-h265-fix-configuring-bitstream-size.patch
@@ -0,0 +1,72 @@
+From 567e6153ed737d8fce971c91c30fdfb3b0151cb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 14:09:25 +0100
+Subject: media: cedrus: h265: Fix configuring bitstream size
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 3a11887f7f11a6bb1f05e7f67b3ea20dadfec443 ]
+
+bit_size field holds size of slice, not slice + header. Because of HW
+quirks, driver can't program in just slice, but also preceding header.
+But that means that currently used bit_size is wrong (too small).
+Instead, just use size of whole buffer. There is no harm in doing this.
+
+Fixes: 86caab29da78 ("media: cedrus: Add HEVC/H.265 decoding support")
+Suggested-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
+index 52e94c8f2f01a..780da4a8b5af1 100644
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c
+@@ -427,11 +427,11 @@ static int cedrus_h265_setup(struct cedrus_ctx *ctx, struct cedrus_run *run)
+ 	unsigned int ctb_addr_x, ctb_addr_y;
+ 	struct cedrus_buffer *cedrus_buf;
+ 	dma_addr_t src_buf_addr;
+-	dma_addr_t src_buf_end_addr;
+ 	u32 chroma_log2_weight_denom;
+ 	u32 num_entry_point_offsets;
+ 	u32 output_pic_list_index;
+ 	u32 pic_order_cnt[2];
++	size_t slice_bytes;
+ 	u8 padding;
+ 	int count;
+ 	u32 reg;
+@@ -443,6 +443,7 @@ static int cedrus_h265_setup(struct cedrus_ctx *ctx, struct cedrus_run *run)
+ 	pred_weight_table = &slice_params->pred_weight_table;
+ 	num_entry_point_offsets = slice_params->num_entry_point_offsets;
+ 	cedrus_buf = vb2_to_cedrus_buffer(&run->dst->vb2_buf);
++	slice_bytes = vb2_get_plane_payload(&run->src->vb2_buf, 0);
+ 
+ 	/*
+ 	 * If entry points offsets are present, we should get them
+@@ -490,7 +491,7 @@ static int cedrus_h265_setup(struct cedrus_ctx *ctx, struct cedrus_run *run)
+ 
+ 	cedrus_write(dev, VE_DEC_H265_BITS_OFFSET, 0);
+ 
+-	reg = slice_params->bit_size;
++	reg = slice_bytes * 8;
+ 	cedrus_write(dev, VE_DEC_H265_BITS_LEN, reg);
+ 
+ 	/* Source beginning and end addresses. */
+@@ -504,10 +505,7 @@ static int cedrus_h265_setup(struct cedrus_ctx *ctx, struct cedrus_run *run)
+ 
+ 	cedrus_write(dev, VE_DEC_H265_BITS_ADDR, reg);
+ 
+-	src_buf_end_addr = src_buf_addr +
+-			   DIV_ROUND_UP(slice_params->bit_size, 8);
+-
+-	reg = VE_DEC_H265_BITS_END_ADDR_BASE(src_buf_end_addr);
++	reg = VE_DEC_H265_BITS_END_ADDR_BASE(src_buf_addr + slice_bytes);
+ 	cedrus_write(dev, VE_DEC_H265_BITS_END_ADDR, reg);
+ 
+ 	/* Coding tree block address */
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-dt-bindings-techwell-tw9900-fix-port-schema-re.patch b/queue-6.8/media-dt-bindings-techwell-tw9900-fix-port-schema-re.patch
new file mode 100644
index 00000000000..637b386003f
--- /dev/null
+++ b/queue-6.8/media-dt-bindings-techwell-tw9900-fix-port-schema-re.patch
@@ -0,0 +1,37 @@
+From c921396d9f68f248d29d4d2f10d71fb6de71b581 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 16:23:25 -0600
+Subject: media: dt-bindings: techwell,tw9900: Fix port schema ref
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit c9cd7308d64b13741ee03be81836a324fc4d657d ]
+
+The port@0 node doesn't define any extra properties in the port or endpoint
+nodes, so the $ref should be to "/properties/port" instead as it restricts
+extra properties.
+
+Fixes: 0f82ffa9a295 ("media: dt-bindings: media: i2c: Add bindings for TW9900")
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/media/i2c/techwell,tw9900.yaml          | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/media/i2c/techwell,tw9900.yaml b/Documentation/devicetree/bindings/media/i2c/techwell,tw9900.yaml
+index e37317f810722..c9673391afdbd 100644
+--- a/Documentation/devicetree/bindings/media/i2c/techwell,tw9900.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/techwell,tw9900.yaml
+@@ -36,7 +36,7 @@ properties:
+ 
+     properties:
+       port@0:
+-        $ref: /schemas/graph.yaml#/$defs/port-base
++        $ref: /schemas/graph.yaml#/properties/port
+         description: Analog input port
+ 
+         properties:
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch b/queue-6.8/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
new file mode 100644
index 00000000000..f81295b670b
--- /dev/null
+++ b/queue-6.8/media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
@@ -0,0 +1,95 @@
+From e31190815d6ed2722203e93e642782e6ca8e9752 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 17:31:44 +0100
+Subject: media: dvb-frontends: avoid stack overflow warnings with clang
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7a4cf27d1f0538f779bf31b8c99eda394e277119 ]
+
+A previous patch worked around a KASAN issue in stv0367, now a similar
+problem showed up with clang:
+
+drivers/media/dvb-frontends/stv0367.c:1222:12: error: stack frame size (3624) exceeds limit (2048) in 'stv0367ter_set_frontend' [-Werror,-Wframe-larger-than]
+ 1214 | static int stv0367ter_set_frontend(struct dvb_frontend *fe)
+
+Rework the stv0367_writereg() function to be simpler and mark both
+register access functions as noinline_for_stack so the temporary
+i2c_msg structures do not get duplicated on the stack when KASAN_STACK
+is enabled.
+
+Fixes: 3cd890dbe2a4 ("media: dvb-frontends: fix i2c access helpers for KASAN")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/stv0367.c | 34 +++++++--------------------
+ 1 file changed, 8 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
+index 48326434488c4..72540ef4e5f88 100644
+--- a/drivers/media/dvb-frontends/stv0367.c
++++ b/drivers/media/dvb-frontends/stv0367.c
+@@ -118,50 +118,32 @@ static const s32 stv0367cab_RF_LookUp2[RF_LOOKUP_TABLE2_SIZE][RF_LOOKUP_TABLE2_S
+ 	}
+ };
+ 
+-static
+-int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
++static noinline_for_stack
++int stv0367_writereg(struct stv0367_state *state, u16 reg, u8 data)
+ {
+-	u8 buf[MAX_XFER_SIZE];
++	u8 buf[3] = { MSB(reg), LSB(reg), data };
+ 	struct i2c_msg msg = {
+ 		.addr = state->config->demod_address,
+ 		.flags = 0,
+ 		.buf = buf,
+-		.len = len + 2
++		.len = 3,
+ 	};
+ 	int ret;
+ 
+-	if (2 + len > sizeof(buf)) {
+-		printk(KERN_WARNING
+-		       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+-		       KBUILD_MODNAME, reg, len);
+-		return -EINVAL;
+-	}
+-
+-
+-	buf[0] = MSB(reg);
+-	buf[1] = LSB(reg);
+-	memcpy(buf + 2, data, len);
+-
+ 	if (i2cdebug)
+ 		printk(KERN_DEBUG "%s: [%02x] %02x: %02x\n", __func__,
+-			state->config->demod_address, reg, buf[2]);
++			state->config->demod_address, reg, data);
+ 
+ 	ret = i2c_transfer(state->i2c, &msg, 1);
+ 	if (ret != 1)
+ 		printk(KERN_ERR "%s: i2c write error! ([%02x] %02x: %02x)\n",
+-			__func__, state->config->demod_address, reg, buf[2]);
++			__func__, state->config->demod_address, reg, data);
+ 
+ 	return (ret != 1) ? -EREMOTEIO : 0;
+ }
+ 
+-static int stv0367_writereg(struct stv0367_state *state, u16 reg, u8 data)
+-{
+-	u8 tmp = data; /* see gcc.gnu.org/bugzilla/show_bug.cgi?id=81715 */
+-
+-	return stv0367_writeregs(state, reg, &tmp, 1);
+-}
+-
+-static u8 stv0367_readreg(struct stv0367_state *state, u16 reg)
++static noinline_for_stack
++u8 stv0367_readreg(struct stv0367_state *state, u16 reg)
+ {
+ 	u8 b0[] = { 0, 0 };
+ 	u8 b1[] = { 0 };
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-edia-dvbdev-fix-a-use-after-free.patch b/queue-6.8/media-edia-dvbdev-fix-a-use-after-free.patch
new file mode 100644
index 00000000000..0727f99eca6
--- /dev/null
+++ b/queue-6.8/media-edia-dvbdev-fix-a-use-after-free.patch
@@ -0,0 +1,84 @@
+From 5ed10f156a06cd6aa2d314f0a05c03bde64d0686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Feb 2024 14:40:43 +0100
+Subject: media: edia: dvbdev: fix a use-after-free
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 ]
+
+In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed
+in several error-handling paths. However, *pdvbdev is not set to NULL
+after dvbdev's deallocation, causing use-after-frees in many places,
+for example, in the following call chain:
+
+budget_register
+  |-> dvb_dmxdev_init
+        |-> dvb_register_device
+  |-> dvb_dmxdev_release
+        |-> dvb_unregister_device
+              |-> dvb_remove_device
+                    |-> dvb_device_put
+                          |-> kref_put
+
+When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in
+dvb_register_device) could point to memory that had been freed in
+dvb_register_device. Thereafter, this pointer is transferred to
+kref_put and triggering a use-after-free.
+
+Link: https://lore.kernel.org/linux-media/20240203134046.3120099-1-alexious@zju.edu.cn
+Fixes: b61901024776 ("V4L/DVB (5244): Dvbdev: fix illegal re-usage of fileoperations struct")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dvbdev.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index 49f0eb7d0b9d3..733d0bc4b4cc3 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -490,6 +490,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);
+ 		if (!dvbdevfops) {
+ 			kfree(dvbdev);
++			*pdvbdev = NULL;
+ 			mutex_unlock(&dvbdev_register_lock);
+ 			return -ENOMEM;
+ 		}
+@@ -498,6 +499,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		if (!new_node) {
+ 			kfree(dvbdevfops);
+ 			kfree(dvbdev);
++			*pdvbdev = NULL;
+ 			mutex_unlock(&dvbdev_register_lock);
+ 			return -ENOMEM;
+ 		}
+@@ -531,6 +533,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		}
+ 		list_del(&dvbdev->list_head);
+ 		kfree(dvbdev);
++		*pdvbdev = NULL;
+ 		up_write(&minor_rwsem);
+ 		mutex_unlock(&dvbdev_register_lock);
+ 		return -EINVAL;
+@@ -553,6 +556,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		dvb_media_device_free(dvbdev);
+ 		list_del(&dvbdev->list_head);
+ 		kfree(dvbdev);
++		*pdvbdev = NULL;
+ 		mutex_unlock(&dvbdev_register_lock);
+ 		return ret;
+ 	}
+@@ -571,6 +575,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
+ 		dvb_media_device_free(dvbdev);
+ 		list_del(&dvbdev->list_head);
+ 		kfree(dvbdev);
++		*pdvbdev = NULL;
+ 		mutex_unlock(&dvbdev_register_lock);
+ 		return PTR_ERR(clsdev);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-em28xx-annotate-unchecked-call-to-media_device.patch b/queue-6.8/media-em28xx-annotate-unchecked-call-to-media_device.patch
new file mode 100644
index 00000000000..909b3ae16d7
--- /dev/null
+++ b/queue-6.8/media-em28xx-annotate-unchecked-call-to-media_device.patch
@@ -0,0 +1,42 @@
+From 145c6d11ebdb475e47b3c5f99c78a27d30a9aeb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 05:42:26 -0800
+Subject: media: em28xx: annotate unchecked call to media_device_register()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit fd61d77a3d28444b2635f0c8b5a2ecd6a4d94026 ]
+
+Static analyzers generate alerts for an unchecked call to
+`media_device_register()`. However, in this case, the device will work
+reliably without the media controller API.
+
+Add a comment above the call to prevent future unnecessary changes.
+
+Suggested-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 4d037c92af7c5..bae76023cf71d 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -4094,6 +4094,10 @@ static int em28xx_usb_probe(struct usb_interface *intf,
+ 	 * topology will likely change after the load of the em28xx subdrivers.
+ 	 */
+ #ifdef CONFIG_MEDIA_CONTROLLER
++	/*
++	 * No need to check the return value, the device will still be
++	 * usable without media controller API.
++	 */
+ 	retval = media_device_register(dev->media_dev);
+ #endif
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-go7007-add-check-of-return-value-of-go7007_rea.patch b/queue-6.8/media-go7007-add-check-of-return-value-of-go7007_rea.patch
new file mode 100644
index 00000000000..72a0deda7ec
--- /dev/null
+++ b/queue-6.8/media-go7007-add-check-of-return-value-of-go7007_rea.patch
@@ -0,0 +1,40 @@
+From 26f7aed8ea5a94ef8cc421e1f1e551f285806bb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 07:07:05 -0800
+Subject: media: go7007: add check of return value of go7007_read_addr()
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 0b70530ee740861f4776ff724fcc25023df1799a ]
+
+If go7007_read_addr() returns error channel is not assigned a value.
+In this case go to allocfail.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 866b8695d67e ("Staging: add the go7007 video driver")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-usb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
+index eeb85981e02b6..762c13e49bfa5 100644
+--- a/drivers/media/usb/go7007/go7007-usb.c
++++ b/drivers/media/usb/go7007/go7007-usb.c
+@@ -1201,7 +1201,9 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ 				u16 channel;
+ 
+ 				/* read channel number from GPIO[1:0] */
+-				go7007_read_addr(go, 0x3c81, &channel);
++				if (go7007_read_addr(go, 0x3c81, &channel))
++					goto allocfail;
++
+ 				channel &= 0x3;
+ 				go->board_id = GO7007_BOARDID_ADLINK_MPG24;
+ 				usb->board = board = &board_adlink_mpg24;
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch b/queue-6.8/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
new file mode 100644
index 00000000000..9c3ad31820a
--- /dev/null
+++ b/queue-6.8/media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
@@ -0,0 +1,57 @@
+From 2cbe467b871ff01e33ac8ae2e9c591ea409c3e53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 12:37:13 +0800
+Subject: media: go7007: fix a memleak in go7007_load_encoder
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit b9b683844b01d171a72b9c0419a2d760d946ee12 ]
+
+In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without
+a deallocation thereafter. After the following call chain:
+
+saa7134_go7007_init
+  |-> go7007_boot_encoder
+        |-> go7007_load_encoder
+  |-> kfree(go)
+
+go is freed and thus bounce is leaked.
+
+Fixes: 95ef39403f89 ("[media] go7007: remember boot firmware")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/go7007/go7007-driver.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
+index 0c24e29843048..eb03f98b2ef11 100644
+--- a/drivers/media/usb/go7007/go7007-driver.c
++++ b/drivers/media/usb/go7007/go7007-driver.c
+@@ -80,7 +80,7 @@ static int go7007_load_encoder(struct go7007 *go)
+ 	const struct firmware *fw_entry;
+ 	char fw_name[] = "go7007/go7007fw.bin";
+ 	void *bounce;
+-	int fw_len, rv = 0;
++	int fw_len;
+ 	u16 intr_val, intr_data;
+ 
+ 	if (go->boot_fw == NULL) {
+@@ -109,9 +109,11 @@ static int go7007_load_encoder(struct go7007 *go)
+ 	    go7007_read_interrupt(go, &intr_val, &intr_data) < 0 ||
+ 			(intr_val & ~0x1) != 0x5a5a) {
+ 		v4l2_err(go, "error transferring firmware\n");
+-		rv = -1;
++		kfree(go->boot_fw);
++		go->boot_fw = NULL;
++		return -1;
+ 	}
+-	return rv;
++	return 0;
+ }
+ 
+ MODULE_FIRMWARE("go7007/go7007fw.bin");
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-i2c-imx290-fix-imx920-typo.patch b/queue-6.8/media-i2c-imx290-fix-imx920-typo.patch
new file mode 100644
index 00000000000..2b1b276de52
--- /dev/null
+++ b/queue-6.8/media-i2c-imx290-fix-imx920-typo.patch
@@ -0,0 +1,68 @@
+From 1b7ae58f3a7c40d8e47fbe485766c035fcd9714e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 08:15:50 +0100
+Subject: media: i2c: imx290: Fix IMX920 typo
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 6fc62efa266b0918c7b226f45c2eccfcf99a6d8e ]
+
+Replace IMX920 by IMX290.
+
+Fixes: b4ab57b07c5b9 ("media: i2c: imx290: Add crop selection targets support")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/i2c/imx290.c b/drivers/media/i2c/imx290.c
+index 9967f34774334..4150e6e4b9a63 100644
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -150,10 +150,10 @@
+ 
+ #define IMX290_PIXEL_ARRAY_WIDTH			1945
+ #define IMX290_PIXEL_ARRAY_HEIGHT			1097
+-#define IMX920_PIXEL_ARRAY_MARGIN_LEFT			12
+-#define IMX920_PIXEL_ARRAY_MARGIN_RIGHT			13
+-#define IMX920_PIXEL_ARRAY_MARGIN_TOP			8
+-#define IMX920_PIXEL_ARRAY_MARGIN_BOTTOM		9
++#define IMX290_PIXEL_ARRAY_MARGIN_LEFT			12
++#define IMX290_PIXEL_ARRAY_MARGIN_RIGHT			13
++#define IMX290_PIXEL_ARRAY_MARGIN_TOP			8
++#define IMX290_PIXEL_ARRAY_MARGIN_BOTTOM		9
+ #define IMX290_PIXEL_ARRAY_RECORDING_WIDTH		1920
+ #define IMX290_PIXEL_ARRAY_RECORDING_HEIGHT		1080
+ 
+@@ -1161,10 +1161,10 @@ static int imx290_get_selection(struct v4l2_subdev *sd,
+ 		 * The sensor moves the readout by 1 pixel based on flips to
+ 		 * keep the Bayer order the same.
+ 		 */
+-		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP
++		sel->r.top = IMX290_PIXEL_ARRAY_MARGIN_TOP
+ 			   + (IMX290_PIXEL_ARRAY_RECORDING_HEIGHT - format->height) / 2
+ 			   + imx290->vflip->val;
+-		sel->r.left = IMX920_PIXEL_ARRAY_MARGIN_LEFT
++		sel->r.left = IMX290_PIXEL_ARRAY_MARGIN_LEFT
+ 			    + (IMX290_PIXEL_ARRAY_RECORDING_WIDTH - format->width) / 2
+ 			    + imx290->hflip->val;
+ 		sel->r.width = format->width;
+@@ -1183,8 +1183,8 @@ static int imx290_get_selection(struct v4l2_subdev *sd,
+ 		return 0;
+ 
+ 	case V4L2_SEL_TGT_CROP_DEFAULT:
+-		sel->r.top = IMX920_PIXEL_ARRAY_MARGIN_TOP;
+-		sel->r.left = IMX920_PIXEL_ARRAY_MARGIN_LEFT;
++		sel->r.top = IMX290_PIXEL_ARRAY_MARGIN_TOP;
++		sel->r.left = IMX290_PIXEL_ARRAY_MARGIN_LEFT;
+ 		sel->r.width = IMX290_PIXEL_ARRAY_RECORDING_WIDTH;
+ 		sel->r.height = IMX290_PIXEL_ARRAY_RECORDING_HEIGHT;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch b/queue-6.8/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
new file mode 100644
index 00000000000..ebdcd303880
--- /dev/null
+++ b/queue-6.8/media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
@@ -0,0 +1,35 @@
+From cd3977670ee325f9b5c12a837a8ec5eb0f51513a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 13:00:33 +0100
+Subject: media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit 4797a3dd46f220e6d83daf54d70c5b33db6deb01 ]
+
+Free the memory allocated in v4l2_ctrl_handler_init on release.
+
+Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device")
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-csc-scaler.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/media/imx/imx-media-csc-scaler.c b/drivers/staging/media/imx/imx-media-csc-scaler.c
+index 1fd39a2fca98a..95cca281e8a37 100644
+--- a/drivers/staging/media/imx/imx-media-csc-scaler.c
++++ b/drivers/staging/media/imx/imx-media-csc-scaler.c
+@@ -803,6 +803,7 @@ static int ipu_csc_scaler_release(struct file *file)
+ 
+ 	dev_dbg(priv->dev, "Releasing instance %p\n", ctx);
+ 
++	v4l2_ctrl_handler_free(&ctx->ctrl_hdlr);
+ 	v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+ 	v4l2_fh_del(&ctx->fh);
+ 	v4l2_fh_exit(&ctx->fh);
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-ivsc-csi-swap-sink-and-source-pads.patch b/queue-6.8/media-ivsc-csi-swap-sink-and-source-pads.patch
new file mode 100644
index 00000000000..62cbad7d7a6
--- /dev/null
+++ b/queue-6.8/media-ivsc-csi-swap-sink-and-source-pads.patch
@@ -0,0 +1,48 @@
+From be1cd677bec673bde59d385f05c73cace4b30de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:17:09 +0200
+Subject: media: ivsc: csi: Swap SINK and SOURCE pads
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 48f5fd8967f8dd01679fc1618b0cba02095cddc5 ]
+
+This patch swaps SINK and SOURCE pads of the MEI CSI sub-device. While
+this does change the UAPI by swapping the pads, the driver has never been
+usable in upstream kernel as the Intel IPU6 driver it depends on any
+functionality has not yet been merged.
+
+Fixes: 29006e196a56 ("media: pci: intel: ivsc: Add CSI submodule")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/intel/ivsc/mei_csi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/intel/ivsc/mei_csi.c b/drivers/media/pci/intel/ivsc/mei_csi.c
+index 15b905f66ab72..3c74d06a27fad 100644
+--- a/drivers/media/pci/intel/ivsc/mei_csi.c
++++ b/drivers/media/pci/intel/ivsc/mei_csi.c
+@@ -71,8 +71,8 @@ enum ivsc_privacy_status {
+ };
+ 
+ enum csi_pads {
+-	CSI_PAD_SOURCE,
+ 	CSI_PAD_SINK,
++	CSI_PAD_SOURCE,
+ 	CSI_NUM_PADS
+ };
+ 
+@@ -587,7 +587,7 @@ static int mei_csi_notify_bound(struct v4l2_async_notifier *notifier,
+ 	csi->remote_pad = pad;
+ 
+ 	return media_create_pad_link(&subdev->entity, pad,
+-				     &csi->subdev.entity, 1,
++				     &csi->subdev.entity, CSI_PAD_SINK,
+ 				     MEDIA_LNK_FL_ENABLED |
+ 				     MEDIA_LNK_FL_IMMUTABLE);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch b/queue-6.8/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
new file mode 100644
index 00000000000..7ea1fe5df34
--- /dev/null
+++ b/queue-6.8/media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
@@ -0,0 +1,93 @@
+From 3d4db2575794bb65e520ef6d33876646ba7a8f5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 13:10:22 +0100
+Subject: media: mediatek: vcodec: avoid -Wcast-function-type-strict warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bfb1b99802ef16045402deb855c197591dc78886 ]
+
+The ipi handler here tries hard to maintain const-ness of its argument,
+but by doing that causes a warning about function type casts:
+
+drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c:38:32: error: cast from 'mtk_vcodec_ipi_handler' (aka 'void (*)(void *, unsigned int, void *)') to 'ipi_handler_t' (aka 'void (*)(const void *, unsigned int, void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   38 |         ipi_handler_t handler_const = (ipi_handler_t)handler;
+      |                                       ^~~~~~~~~~~~~~~~~~~~~~
+
+Remove the hack and just use a non-const argument.
+
+Fixes: bf1d556ad4e0 ("media: mtk-vcodec: abstract firmware interface")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/mdp/mtk_mdp_vpu.c      |  2 +-
+ .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c         | 10 +---------
+ drivers/media/platform/mediatek/vpu/mtk_vpu.c          |  2 +-
+ drivers/media/platform/mediatek/vpu/mtk_vpu.h          |  2 +-
+ 4 files changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/platform/mediatek/mdp/mtk_mdp_vpu.c b/drivers/media/platform/mediatek/mdp/mtk_mdp_vpu.c
+index b065ccd069140..378a1cba0144f 100644
+--- a/drivers/media/platform/mediatek/mdp/mtk_mdp_vpu.c
++++ b/drivers/media/platform/mediatek/mdp/mtk_mdp_vpu.c
+@@ -26,7 +26,7 @@ static void mtk_mdp_vpu_handle_init_ack(const struct mdp_ipi_comm_ack *msg)
+ 	vpu->inst_addr = msg->vpu_inst_addr;
+ }
+ 
+-static void mtk_mdp_vpu_ipi_handler(const void *data, unsigned int len,
++static void mtk_mdp_vpu_ipi_handler(void *data, unsigned int len,
+ 				    void *priv)
+ {
+ 	const struct mdp_ipi_comm_ack *msg = data;
+diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+index 9f6e4b59455da..4c34344dc7dcb 100644
+--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
++++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c
+@@ -29,15 +29,7 @@ static int mtk_vcodec_vpu_set_ipi_register(struct mtk_vcodec_fw *fw, int id,
+ 					   mtk_vcodec_ipi_handler handler,
+ 					   const char *name, void *priv)
+ {
+-	/*
+-	 * The handler we receive takes a void * as its first argument. We
+-	 * cannot change this because it needs to be passed down to the rproc
+-	 * subsystem when SCP is used. VPU takes a const argument, which is
+-	 * more constrained, so the conversion below is safe.
+-	 */
+-	ipi_handler_t handler_const = (ipi_handler_t)handler;
+-
+-	return vpu_ipi_register(fw->pdev, id, handler_const, name, priv);
++	return vpu_ipi_register(fw->pdev, id, handler, name, priv);
+ }
+ 
+ static int mtk_vcodec_vpu_ipi_send(struct mtk_vcodec_fw *fw, int id, void *buf,
+diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+index 7243604a82a5b..724ae7c2ab3ba 100644
+--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c
++++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c
+@@ -635,7 +635,7 @@ int vpu_load_firmware(struct platform_device *pdev)
+ }
+ EXPORT_SYMBOL_GPL(vpu_load_firmware);
+ 
+-static void vpu_init_ipi_handler(const void *data, unsigned int len, void *priv)
++static void vpu_init_ipi_handler(void *data, unsigned int len, void *priv)
+ {
+ 	struct mtk_vpu *vpu = priv;
+ 	const struct vpu_run *run = data;
+diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.h b/drivers/media/platform/mediatek/vpu/mtk_vpu.h
+index a56053ff135af..da05f3e740810 100644
+--- a/drivers/media/platform/mediatek/vpu/mtk_vpu.h
++++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.h
+@@ -17,7 +17,7 @@
+  * VPU interfaces with other blocks by share memory and interrupt.
+  */
+ 
+-typedef void (*ipi_handler_t) (const void *data,
++typedef void (*ipi_handler_t) (void *data,
+ 			       unsigned int len,
+ 			       void *priv);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-pvrusb2-fix-pvr2_stream_callback-casts.patch b/queue-6.8/media-pvrusb2-fix-pvr2_stream_callback-casts.patch
new file mode 100644
index 00000000000..d33a7a58490
--- /dev/null
+++ b/queue-6.8/media-pvrusb2-fix-pvr2_stream_callback-casts.patch
@@ -0,0 +1,115 @@
+From 0608184d9dae678b733e07b3e8ae55ae37c73246 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:04:27 +0100
+Subject: media: pvrusb2: fix pvr2_stream_callback casts
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 30baa4a96b23add91a87305baaeba82c4e109e1f ]
+
+clang-16 complains about a control flow integrity (KCFI) issue in pvrusb2,
+which casts three different prototypes into pvr2_stream_callback:
+
+drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1070:30: error: cast from 'void (*)(struct pvr2_v4l2_fh *)' to 'pvr2_stream_callback' (aka 'void (*)(void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1070 |         pvr2_stream_set_callback(sp,(pvr2_stream_callback)pvr2_v4l2_notify,fh);
+      |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/media/usb/pvrusb2/pvrusb2-context.c:110:6: error: cast from 'void (*)(struct pvr2_context *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  110 |                                         (void (*)(void *))pvr2_context_notify,
+      |                                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/media/usb/pvrusb2/pvrusb2-dvb.c:152:6: error: cast from 'void (*)(struct pvr2_dvb_adapter *)' to 'pvr2_stream_callback' (aka 'void (*)(void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+  152 |                                  (pvr2_stream_callback) pvr2_dvb_notify, adap);
+      |                                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Change the functions to actually take a void* argument so the cast is no longer
+needed.
+
+Fixes: bb8ce9d9143c ("V4L/DVB (7682): pvrusb2-dvb: finish up stream & buffer handling")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-context.c | 8 ++++----
+ drivers/media/usb/pvrusb2/pvrusb2-dvb.c     | 6 ++++--
+ drivers/media/usb/pvrusb2/pvrusb2-v4l2.c    | 6 ++++--
+ 3 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+index 1764674de98bc..58f2f3ff10ee2 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+@@ -90,8 +90,10 @@ static void pvr2_context_destroy(struct pvr2_context *mp)
+ }
+ 
+ 
+-static void pvr2_context_notify(struct pvr2_context *mp)
++static void pvr2_context_notify(void *ptr)
+ {
++	struct pvr2_context *mp = ptr;
++
+ 	pvr2_context_set_notify(mp,!0);
+ }
+ 
+@@ -106,9 +108,7 @@ static void pvr2_context_check(struct pvr2_context *mp)
+ 		pvr2_trace(PVR2_TRACE_CTXT,
+ 			   "pvr2_context %p (initialize)", mp);
+ 		/* Finish hardware initialization */
+-		if (pvr2_hdw_initialize(mp->hdw,
+-					(void (*)(void *))pvr2_context_notify,
+-					mp)) {
++		if (pvr2_hdw_initialize(mp->hdw, pvr2_context_notify, mp)) {
+ 			mp->video_stream.stream =
+ 				pvr2_hdw_get_video_stream(mp->hdw);
+ 			/* Trigger interface initialization.  By doing this
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-dvb.c b/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
+index 26811efe0fb58..9a9bae21c6147 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-dvb.c
+@@ -88,8 +88,10 @@ static int pvr2_dvb_feed_thread(void *data)
+ 	return stat;
+ }
+ 
+-static void pvr2_dvb_notify(struct pvr2_dvb_adapter *adap)
++static void pvr2_dvb_notify(void *ptr)
+ {
++	struct pvr2_dvb_adapter *adap = ptr;
++
+ 	wake_up(&adap->buffer_wait_data);
+ }
+ 
+@@ -149,7 +151,7 @@ static int pvr2_dvb_stream_do_start(struct pvr2_dvb_adapter *adap)
+ 	}
+ 
+ 	pvr2_stream_set_callback(pvr->video_stream.stream,
+-				 (pvr2_stream_callback) pvr2_dvb_notify, adap);
++				 pvr2_dvb_notify, adap);
+ 
+ 	ret = pvr2_stream_set_buffer_count(stream, PVR2_DVB_BUFFER_COUNT);
+ 	if (ret < 0) return ret;
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+index d195bd6a2248b..d608b793fa847 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+@@ -1033,8 +1033,10 @@ static int pvr2_v4l2_open(struct file *file)
+ }
+ 
+ 
+-static void pvr2_v4l2_notify(struct pvr2_v4l2_fh *fhp)
++static void pvr2_v4l2_notify(void *ptr)
+ {
++	struct pvr2_v4l2_fh *fhp = ptr;
++
+ 	wake_up(&fhp->wait_data);
+ }
+ 
+@@ -1067,7 +1069,7 @@ static int pvr2_v4l2_iosetup(struct pvr2_v4l2_fh *fh)
+ 
+ 	hdw = fh->channel.mc_head->hdw;
+ 	sp = fh->pdi->stream->stream;
+-	pvr2_stream_set_callback(sp,(pvr2_stream_callback)pvr2_v4l2_notify,fh);
++	pvr2_stream_set_callback(sp, pvr2_v4l2_notify, fh);
+ 	pvr2_hdw_set_stream_type(hdw,fh->pdi->config);
+ 	if ((ret = pvr2_hdw_set_streaming(hdw,!0)) < 0) return ret;
+ 	return pvr2_ioread_set_enabled(fh->rhp,!0);
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch b/queue-6.8/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
new file mode 100644
index 00000000000..08e7e8a19d7
--- /dev/null
+++ b/queue-6.8/media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
@@ -0,0 +1,75 @@
+From 0ae1670e7846685096f91dc1c9ebe86a2308ab10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 15:30:47 +0800
+Subject: media: pvrusb2: fix uaf in pvr2_context_set_notify
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit 0a0b79ea55de8514e1750884e5fec77f9fdd01ee ]
+
+[Syzbot reported]
+BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35
+Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26
+
+CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
+Workqueue: usb_hub_wq hub_event
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
+ print_address_description mm/kasan/report.c:377 [inline]
+ print_report+0xc4/0x620 mm/kasan/report.c:488
+ kasan_report+0xda/0x110 mm/kasan/report.c:601
+ pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35
+ pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline]
+ pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272
+
+Freed by task 906:
+kasan_save_stack+0x33/0x50 mm/kasan/common.c:47
+kasan_save_track+0x14/0x30 mm/kasan/common.c:68
+kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
+poison_slab_object mm/kasan/common.c:241 [inline]
+__kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257
+kasan_slab_free include/linux/kasan.h:184 [inline]
+slab_free_hook mm/slub.c:2121 [inline]
+slab_free mm/slub.c:4299 [inline]
+kfree+0x105/0x340 mm/slub.c:4409
+pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]
+pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158
+
+[Analyze]
+Task A set disconnect_flag = !0, which resulted in Task B's condition being met
+and releasing mp, leading to this issue.
+
+[Fix]
+Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect()
+to avoid this issue.
+
+Reported-and-tested-by: syzbot+ce750e124675d4599449@syzkaller.appspotmail.com
+Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload")
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-context.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+index 58f2f3ff10ee2..73c95ba2328a4 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+@@ -267,9 +267,9 @@ static void pvr2_context_exit(struct pvr2_context *mp)
+ void pvr2_context_disconnect(struct pvr2_context *mp)
+ {
+ 	pvr2_hdw_disconnect(mp->hdw);
+-	mp->disconnect_flag = !0;
+ 	if (!pvr2_context_shutok())
+ 		pvr2_context_notify(mp);
++	mp->disconnect_flag = !0;
+ }
+ 
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-pvrusb2-remove-redundant-null-check.patch b/queue-6.8/media-pvrusb2-remove-redundant-null-check.patch
new file mode 100644
index 00000000000..746df517796
--- /dev/null
+++ b/queue-6.8/media-pvrusb2-remove-redundant-null-check.patch
@@ -0,0 +1,41 @@
+From 200f07bd85e7069df74a9aee0f9df4b23499a17a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 07:07:25 -0800
+Subject: media: pvrusb2: remove redundant NULL check
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 95ac1210fb2753f968ebce0730d4fbc553c2a3dc ]
+
+Pointer dip->stream cannot be NULL due to a shift, thus remove redundant
+NULL check.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: c74e0062684b ("V4L/DVB (5059): Pvrusb2: Be smarter about mode restoration")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+index c04ab7258d645..d195bd6a2248b 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c
+@@ -1198,11 +1198,6 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip,
+ 		dip->minor_type = pvr2_v4l_type_video;
+ 		nr_ptr = video_nr;
+ 		caps |= V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_AUDIO;
+-		if (!dip->stream) {
+-			pr_err(KBUILD_MODNAME
+-				": Failed to set up pvrusb2 v4l video dev due to missing stream instance\n");
+-			return;
+-		}
+ 		break;
+ 	case VFL_TYPE_VBI:
+ 		dip->config = pvr2_config_vbi;
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-sun8i-di-fix-chroma-difference-threshold.patch b/queue-6.8/media-sun8i-di-fix-chroma-difference-threshold.patch
new file mode 100644
index 00000000000..75eb7865e63
--- /dev/null
+++ b/queue-6.8/media-sun8i-di-fix-chroma-difference-threshold.patch
@@ -0,0 +1,36 @@
+From 61b7de2e248ae0385a55835d8c4558b81e6ca468 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 14:34:22 +0100
+Subject: media: sun8i-di: Fix chroma difference threshold
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 856525e8db272b0ce6d9c6e6c2eeb97892b485a6 ]
+
+While there is no good explanation what this value does, vendor driver
+uses value 31 for it. Align driver with it.
+
+Fixes: a4260ea49547 ("media: sun4i: Add H3 deinterlace driver")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sunxi/sun8i-di/sun8i-di.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+index 5d58a5e781371..a1c35a2b68ed9 100644
+--- a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
++++ b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+@@ -304,7 +304,7 @@ static void deinterlace_init(struct deinterlace_dev *dev)
+ 
+ 	deinterlace_clr_set_bits(dev, DEINTERLACE_CHROMA_DIFF,
+ 				 DEINTERLACE_CHROMA_DIFF_TH_MSK,
+-				 DEINTERLACE_CHROMA_DIFF_TH(5));
++				 DEINTERLACE_CHROMA_DIFF_TH(31));
+ }
+ 
+ static inline struct deinterlace_ctx *deinterlace_file2ctx(struct file *file)
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-sun8i-di-fix-coefficient-writes.patch b/queue-6.8/media-sun8i-di-fix-coefficient-writes.patch
new file mode 100644
index 00000000000..a939796ef00
--- /dev/null
+++ b/queue-6.8/media-sun8i-di-fix-coefficient-writes.patch
@@ -0,0 +1,102 @@
+From 6c5c1430348938a9d59384d2b89e7c0052f0215f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 14:34:20 +0100
+Subject: media: sun8i-di: Fix coefficient writes
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit 794b581f8c6eb7b60fe468ccb96dd3cd38ff779f ]
+
+Currently coefficients are applied only once, since they don't change.
+However, this is done before enable bit is set and thus it doesn't get
+applied properly.
+
+Fix that by applying coefficients after enable bit is set. While this
+means that it will be done evey time, it doesn't bring much time
+penalty.
+
+Fixes: a4260ea49547 ("media: sun4i: Add H3 deinterlace driver")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/sunxi/sun8i-di/sun8i-di.c  | 42 +++++++++----------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+index 954fabec27f63..26f6964996f2c 100644
+--- a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
++++ b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+@@ -66,6 +66,7 @@ static void deinterlace_device_run(void *priv)
+ 	struct vb2_v4l2_buffer *src, *dst;
+ 	unsigned int hstep, vstep;
+ 	dma_addr_t addr;
++	int i;
+ 
+ 	src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+ 	dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
+@@ -160,6 +161,26 @@ static void deinterlace_device_run(void *priv)
+ 	deinterlace_write(dev, DEINTERLACE_CH1_HORZ_FACT, hstep);
+ 	deinterlace_write(dev, DEINTERLACE_CH1_VERT_FACT, vstep);
+ 
++	/* neutral filter coefficients */
++	deinterlace_set_bits(dev, DEINTERLACE_FRM_CTRL,
++			     DEINTERLACE_FRM_CTRL_COEF_ACCESS);
++	readl_poll_timeout(dev->base + DEINTERLACE_STATUS, val,
++			   val & DEINTERLACE_STATUS_COEF_STATUS, 2, 40);
++
++	for (i = 0; i < 32; i++) {
++		deinterlace_write(dev, DEINTERLACE_CH0_HORZ_COEF0 + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++		deinterlace_write(dev, DEINTERLACE_CH0_VERT_COEF + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++		deinterlace_write(dev, DEINTERLACE_CH1_HORZ_COEF0 + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++		deinterlace_write(dev, DEINTERLACE_CH1_VERT_COEF + i * 4,
++				  DEINTERLACE_IDENTITY_COEF);
++	}
++
++	deinterlace_clr_set_bits(dev, DEINTERLACE_FRM_CTRL,
++				 DEINTERLACE_FRM_CTRL_COEF_ACCESS, 0);
++
+ 	deinterlace_clr_set_bits(dev, DEINTERLACE_FIELD_CTRL,
+ 				 DEINTERLACE_FIELD_CTRL_FIELD_CNT_MSK,
+ 				 DEINTERLACE_FIELD_CTRL_FIELD_CNT(ctx->field));
+@@ -248,7 +269,6 @@ static irqreturn_t deinterlace_irq(int irq, void *data)
+ static void deinterlace_init(struct deinterlace_dev *dev)
+ {
+ 	u32 val;
+-	int i;
+ 
+ 	deinterlace_write(dev, DEINTERLACE_BYPASS,
+ 			  DEINTERLACE_BYPASS_CSC);
+@@ -285,26 +305,6 @@ static void deinterlace_init(struct deinterlace_dev *dev)
+ 	deinterlace_clr_set_bits(dev, DEINTERLACE_CHROMA_DIFF,
+ 				 DEINTERLACE_CHROMA_DIFF_TH_MSK,
+ 				 DEINTERLACE_CHROMA_DIFF_TH(5));
+-
+-	/* neutral filter coefficients */
+-	deinterlace_set_bits(dev, DEINTERLACE_FRM_CTRL,
+-			     DEINTERLACE_FRM_CTRL_COEF_ACCESS);
+-	readl_poll_timeout(dev->base + DEINTERLACE_STATUS, val,
+-			   val & DEINTERLACE_STATUS_COEF_STATUS, 2, 40);
+-
+-	for (i = 0; i < 32; i++) {
+-		deinterlace_write(dev, DEINTERLACE_CH0_HORZ_COEF0 + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-		deinterlace_write(dev, DEINTERLACE_CH0_VERT_COEF + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-		deinterlace_write(dev, DEINTERLACE_CH1_HORZ_COEF0 + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-		deinterlace_write(dev, DEINTERLACE_CH1_VERT_COEF + i * 4,
+-				  DEINTERLACE_IDENTITY_COEF);
+-	}
+-
+-	deinterlace_clr_set_bits(dev, DEINTERLACE_FRM_CTRL,
+-				 DEINTERLACE_FRM_CTRL_COEF_ACCESS, 0);
+ }
+ 
+ static inline struct deinterlace_ctx *deinterlace_file2ctx(struct file *file)
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-sun8i-di-fix-power-on-off-sequences.patch b/queue-6.8/media-sun8i-di-fix-power-on-off-sequences.patch
new file mode 100644
index 00000000000..923942122f6
--- /dev/null
+++ b/queue-6.8/media-sun8i-di-fix-power-on-off-sequences.patch
@@ -0,0 +1,88 @@
+From e90756ddb7c9a4b26ab9132a7779f3b21128cbc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 14:34:21 +0100
+Subject: media: sun8i-di: Fix power on/off sequences
+
+From: Jernej Skrabec <jernej.skrabec@gmail.com>
+
+[ Upstream commit cff104e33bad38f4b2c8d58816a7accfaa2879f9 ]
+
+According to user manual, reset line should be deasserted before clocks
+are enabled. Also fix power down sequence to be reverse of that.
+
+Fixes: a4260ea49547 ("media: sun4i: Add H3 deinterlace driver")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/sunxi/sun8i-di/sun8i-di.c  | 25 ++++++++++---------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+index 26f6964996f2c..5d58a5e781371 100644
+--- a/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
++++ b/drivers/media/platform/sunxi/sun8i-di/sun8i-di.c
+@@ -929,11 +929,18 @@ static int deinterlace_runtime_resume(struct device *device)
+ 		return ret;
+ 	}
+ 
++	ret = reset_control_deassert(dev->rstc);
++	if (ret) {
++		dev_err(dev->dev, "Failed to apply reset\n");
++
++		goto err_exclusive_rate;
++	}
++
+ 	ret = clk_prepare_enable(dev->bus_clk);
+ 	if (ret) {
+ 		dev_err(dev->dev, "Failed to enable bus clock\n");
+ 
+-		goto err_exclusive_rate;
++		goto err_rst;
+ 	}
+ 
+ 	ret = clk_prepare_enable(dev->mod_clk);
+@@ -950,23 +957,16 @@ static int deinterlace_runtime_resume(struct device *device)
+ 		goto err_mod_clk;
+ 	}
+ 
+-	ret = reset_control_deassert(dev->rstc);
+-	if (ret) {
+-		dev_err(dev->dev, "Failed to apply reset\n");
+-
+-		goto err_ram_clk;
+-	}
+-
+ 	deinterlace_init(dev);
+ 
+ 	return 0;
+ 
+-err_ram_clk:
+-	clk_disable_unprepare(dev->ram_clk);
+ err_mod_clk:
+ 	clk_disable_unprepare(dev->mod_clk);
+ err_bus_clk:
+ 	clk_disable_unprepare(dev->bus_clk);
++err_rst:
++	reset_control_assert(dev->rstc);
+ err_exclusive_rate:
+ 	clk_rate_exclusive_put(dev->mod_clk);
+ 
+@@ -977,11 +977,12 @@ static int deinterlace_runtime_suspend(struct device *device)
+ {
+ 	struct deinterlace_dev *dev = dev_get_drvdata(device);
+ 
+-	reset_control_assert(dev->rstc);
+-
+ 	clk_disable_unprepare(dev->ram_clk);
+ 	clk_disable_unprepare(dev->mod_clk);
+ 	clk_disable_unprepare(dev->bus_clk);
++
++	reset_control_assert(dev->rstc);
++
+ 	clk_rate_exclusive_put(dev->mod_clk);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-tc358743-register-v4l2-async-device-only-after.patch b/queue-6.8/media-tc358743-register-v4l2-async-device-only-after.patch
new file mode 100644
index 00000000000..89941be1974
--- /dev/null
+++ b/queue-6.8/media-tc358743-register-v4l2-async-device-only-after.patch
@@ -0,0 +1,51 @@
+From 073e4218d4177b6a3d3032a6c997070d89fd3dc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 10:01:11 +0100
+Subject: media: tc358743: register v4l2 async device only after successful
+ setup
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit 87399f1ff92203d65f1febf5919429f4bb613a02 ]
+
+Ensure the device has been setup correctly before registering the v4l2
+async device, thus allowing userspace to access.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Fixes: 4c5211a10039 ("[media] tc358743: register v4l2 asynchronous subdevice")
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240110090111.458115-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/tc358743.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 2785935da497b..558152575d102 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -2091,9 +2091,6 @@ static int tc358743_probe(struct i2c_client *client)
+ 	state->mbus_fmt_code = MEDIA_BUS_FMT_RGB888_1X24;
+ 
+ 	sd->dev = &client->dev;
+-	err = v4l2_async_register_subdev(sd);
+-	if (err < 0)
+-		goto err_hdl;
+ 
+ 	mutex_init(&state->confctl_mutex);
+ 
+@@ -2151,6 +2148,10 @@ static int tc358743_probe(struct i2c_client *client)
+ 	if (err)
+ 		goto err_work_queues;
+ 
++	err = v4l2_async_register_subdev(sd);
++	if (err < 0)
++		goto err_work_queues;
++
+ 	v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
+ 		  client->addr << 1, client->adapter->name);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch b/queue-6.8/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
new file mode 100644
index 00000000000..0f9a22d30cb
--- /dev/null
+++ b/queue-6.8/media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
@@ -0,0 +1,52 @@
+From 612324059a39be12a9a6be1b43a2cffc21acba0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 13:17:04 +0800
+Subject: media: ttpci: fix two memleaks in budget_av_attach
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit d0b07f712bf61e1a3cf23c87c663791c42e50837 ]
+
+When saa7146_register_device and saa7146_vv_init fails, budget_av_attach
+should free the resources it allocates, like the error-handling of
+ttpci_budget_init does. Besides, there are two fixme comment refers to
+such deallocations.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ttpci/budget-av.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/pci/ttpci/budget-av.c b/drivers/media/pci/ttpci/budget-av.c
+index 230b104a7cdf0..a47c5850ef875 100644
+--- a/drivers/media/pci/ttpci/budget-av.c
++++ b/drivers/media/pci/ttpci/budget-av.c
+@@ -1463,7 +1463,8 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
+ 		budget_av->has_saa7113 = 1;
+ 		err = saa7146_vv_init(dev, &vv_data);
+ 		if (err != 0) {
+-			/* fixme: proper cleanup here */
++			ttpci_budget_deinit(&budget_av->budget);
++			kfree(budget_av);
+ 			ERR("cannot init vv subsystem\n");
+ 			return err;
+ 		}
+@@ -1472,9 +1473,10 @@ static int budget_av_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio
+ 		vv_data.vid_ops.vidioc_s_input = vidioc_s_input;
+ 
+ 		if ((err = saa7146_register_device(&budget_av->vd, dev, "knc1", VFL_TYPE_VIDEO))) {
+-			/* fixme: proper cleanup here */
+-			ERR("cannot register capture v4l2 device\n");
+ 			saa7146_vv_release(dev);
++			ttpci_budget_deinit(&budget_av->budget);
++			kfree(budget_av);
++			ERR("cannot register capture v4l2 device\n");
+ 			return err;
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-usbtv-remove-useless-locks-in-usbtv_video_free.patch b/queue-6.8/media-usbtv-remove-useless-locks-in-usbtv_video_free.patch
new file mode 100644
index 00000000000..68336d4beb1
--- /dev/null
+++ b/queue-6.8/media-usbtv-remove-useless-locks-in-usbtv_video_free.patch
@@ -0,0 +1,55 @@
+From f7616338456505e9623dbb2c21feab5d750aa52b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Mar 2024 11:37:08 +0100
+Subject: media: usbtv: Remove useless locks in usbtv_video_free()
+
+From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+
+[ Upstream commit 65e6a2773d655172143cc0b927cdc89549842895 ]
+
+Remove locks calls in usbtv_video_free() because
+are useless and may led to a deadlock as reported here:
+https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000
+Also remove usbtv_stop() call since it will be called when
+unregistering the device.
+
+Before 'c838530d230b' this issue would only be noticed if you
+disconnect while streaming and now it is noticeable even when
+disconnecting while not streaming.
+
+Fixes: c838530d230b ("media: media videobuf2: Be more flexible on the number of queue stored buffers")
+Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber")
+
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+[hverkuil: fix minor spelling mistake in log message]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/usbtv/usbtv-video.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
+index 62a583040cd48..702f1c8bd2ab3 100644
+--- a/drivers/media/usb/usbtv/usbtv-video.c
++++ b/drivers/media/usb/usbtv/usbtv-video.c
+@@ -963,15 +963,8 @@ int usbtv_video_init(struct usbtv *usbtv)
+ 
+ void usbtv_video_free(struct usbtv *usbtv)
+ {
+-	mutex_lock(&usbtv->vb2q_lock);
+-	mutex_lock(&usbtv->v4l2_lock);
+-
+-	usbtv_stop(usbtv);
+ 	vb2_video_unregister_device(&usbtv->vdev);
+ 	v4l2_device_disconnect(&usbtv->v4l2_dev);
+ 
+-	mutex_unlock(&usbtv->v4l2_lock);
+-	mutex_unlock(&usbtv->vb2q_lock);
+-
+ 	v4l2_device_put(&usbtv->v4l2_dev);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-v4l2-cci-print-leading-0-on-error.patch b/queue-6.8/media-v4l2-cci-print-leading-0-on-error.patch
new file mode 100644
index 00000000000..bf3fc60b6ed
--- /dev/null
+++ b/queue-6.8/media-v4l2-cci-print-leading-0-on-error.patch
@@ -0,0 +1,47 @@
+From 1b7a85bf7c9e796d3414683750ad107df33d77d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 14:20:03 +0100
+Subject: media: v4l2: cci: print leading 0 on error
+
+From: Julien Massot <julien.massot@collabora.com>
+
+[ Upstream commit 58ab1f9e140006e9e5686640f1773260038fe889 ]
+
+In some error cases leading '0' for register address
+were missing.
+
+Fixes: 613cbb91e9ce ("media: Add MIPI CCI register access helper functions")
+Signed-off-by: Julien Massot <julien.massot@collabora.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-cci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-cci.c b/drivers/media/v4l2-core/v4l2-cci.c
+index 10005c80f43b5..ee3475bed37fa 100644
+--- a/drivers/media/v4l2-core/v4l2-cci.c
++++ b/drivers/media/v4l2-core/v4l2-cci.c
+@@ -32,7 +32,7 @@ int cci_read(struct regmap *map, u32 reg, u64 *val, int *err)
+ 
+ 	ret = regmap_bulk_read(map, reg, buf, len);
+ 	if (ret) {
+-		dev_err(regmap_get_device(map), "Error reading reg 0x%4x: %d\n",
++		dev_err(regmap_get_device(map), "Error reading reg 0x%04x: %d\n",
+ 			reg, ret);
+ 		goto out;
+ 	}
+@@ -131,7 +131,7 @@ int cci_write(struct regmap *map, u32 reg, u64 val, int *err)
+ 
+ 	ret = regmap_bulk_write(map, reg, buf, len);
+ 	if (ret)
+-		dev_err(regmap_get_device(map), "Error writing reg 0x%4x: %d\n",
++		dev_err(regmap_get_device(map), "Error writing reg 0x%04x: %d\n",
+ 			reg, ret);
+ 
+ out:
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch b/queue-6.8/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
new file mode 100644
index 00000000000..f2c65c26f6e
--- /dev/null
+++ b/queue-6.8/media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
@@ -0,0 +1,48 @@
+From 873659badaf5f4367f8af2c77bb1ee48c5a6f7ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 20:48:44 +0800
+Subject: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 8f94b49a5b5d386c038e355bef6347298aabd211 ]
+
+The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity
+but isn't freed in its following error-handling paths. This patch
+adds such deallocation to prevent memleak of entity->name.
+
+Fixes: be2fff656322 ("media: add helpers for memory-to-memory media controller")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-mem2mem.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c
+index 9e983176542be..75517134a5e94 100644
+--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
+@@ -1087,11 +1087,17 @@ static int v4l2_m2m_register_entity(struct media_device *mdev,
+ 	entity->function = function;
+ 
+ 	ret = media_entity_pads_init(entity, num_pads, pads);
+-	if (ret)
++	if (ret) {
++		kfree(entity->name);
++		entity->name = NULL;
+ 		return ret;
++	}
+ 	ret = media_device_register_entity(mdev, entity);
+-	if (ret)
++	if (ret) {
++		kfree(entity->name);
++		entity->name = NULL;
+ 		return ret;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch b/queue-6.8/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
new file mode 100644
index 00000000000..8ddee054a56
--- /dev/null
+++ b/queue-6.8/media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
@@ -0,0 +1,112 @@
+From a35db4754a1066530cecaf2a78dd7ed9f8ad2953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Feb 2024 20:47:53 +0800
+Subject: media: v4l2-tpg: fix some memleaks in tpg_alloc
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 8cf9c5051076e0eb958f4361d50d8b0c3ee6691c ]
+
+In tpg_alloc, resources should be deallocated in each and every
+error-handling paths, since they are allocated in for statements.
+Otherwise there would be memleaks because tpg_free is called only when
+tpg_alloc return 0.
+
+Fixes: 63881df94d3e ("[media] vivid: add the Test Pattern Generator")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 52 +++++++++++++++----
+ 1 file changed, 42 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index a366566f22c3b..642c48e8c1f58 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -113,6 +113,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
+ {
+ 	unsigned pat;
+ 	unsigned plane;
++	int ret = 0;
+ 
+ 	tpg->max_line_width = max_w;
+ 	for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++) {
+@@ -121,14 +122,18 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
+ 
+ 			tpg->lines[pat][plane] =
+ 				vzalloc(array3_size(max_w, 2, pixelsz));
+-			if (!tpg->lines[pat][plane])
+-				return -ENOMEM;
++			if (!tpg->lines[pat][plane]) {
++				ret = -ENOMEM;
++				goto free_lines;
++			}
+ 			if (plane == 0)
+ 				continue;
+ 			tpg->downsampled_lines[pat][plane] =
+ 				vzalloc(array3_size(max_w, 2, pixelsz));
+-			if (!tpg->downsampled_lines[pat][plane])
+-				return -ENOMEM;
++			if (!tpg->downsampled_lines[pat][plane]) {
++				ret = -ENOMEM;
++				goto free_lines;
++			}
+ 		}
+ 	}
+ 	for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
+@@ -136,18 +141,45 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
+ 
+ 		tpg->contrast_line[plane] =
+ 			vzalloc(array_size(pixelsz, max_w));
+-		if (!tpg->contrast_line[plane])
+-			return -ENOMEM;
++		if (!tpg->contrast_line[plane]) {
++			ret = -ENOMEM;
++			goto free_contrast_line;
++		}
+ 		tpg->black_line[plane] =
+ 			vzalloc(array_size(pixelsz, max_w));
+-		if (!tpg->black_line[plane])
+-			return -ENOMEM;
++		if (!tpg->black_line[plane]) {
++			ret = -ENOMEM;
++			goto free_contrast_line;
++		}
+ 		tpg->random_line[plane] =
+ 			vzalloc(array3_size(max_w, 2, pixelsz));
+-		if (!tpg->random_line[plane])
+-			return -ENOMEM;
++		if (!tpg->random_line[plane]) {
++			ret = -ENOMEM;
++			goto free_contrast_line;
++		}
+ 	}
+ 	return 0;
++
++free_contrast_line:
++	for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
++		vfree(tpg->contrast_line[plane]);
++		vfree(tpg->black_line[plane]);
++		vfree(tpg->random_line[plane]);
++		tpg->contrast_line[plane] = NULL;
++		tpg->black_line[plane] = NULL;
++		tpg->random_line[plane] = NULL;
++	}
++free_lines:
++	for (pat = 0; pat < TPG_MAX_PAT_LINES; pat++)
++		for (plane = 0; plane < TPG_MAX_PLANES; plane++) {
++			vfree(tpg->lines[pat][plane]);
++			tpg->lines[pat][plane] = NULL;
++			if (plane == 0)
++				continue;
++			vfree(tpg->downsampled_lines[pat][plane]);
++			tpg->downsampled_lines[pat][plane] = NULL;
++		}
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(tpg_alloc);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/media-videobuf2-add-missing-doc-comment-for-waiting_.patch b/queue-6.8/media-videobuf2-add-missing-doc-comment-for-waiting_.patch
new file mode 100644
index 00000000000..6d7714db5e6
--- /dev/null
+++ b/queue-6.8/media-videobuf2-add-missing-doc-comment-for-waiting_.patch
@@ -0,0 +1,76 @@
+From ddaabd69b1247506fd673dfa6ed2c4c541562c31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 20:12:03 +0100
+Subject: media: videobuf2: Add missing doc comment for waiting_in_dqbuf
+
+From: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+
+[ Upstream commit 26a3a10342748862dcc8d22222563f6ca03d6ca3 ]
+
+While at it rearrange other comments to match the order of struct members.
+
+Fixes: d65842f7126a ("media: vb2: add waiting_in_dqbuf flag")
+
+Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Acked-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/media/videobuf2-core.h | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h
+index 56719a26a46c3..bec8c3a1ed824 100644
+--- a/include/media/videobuf2-core.h
++++ b/include/media/videobuf2-core.h
+@@ -72,6 +72,10 @@ struct vb2_buffer;
+  *		 argument to other ops in this structure.
+  * @put_userptr: inform the allocator that a USERPTR buffer will no longer
+  *		 be used.
++ * @prepare:	called every time the buffer is passed from userspace to the
++ *		driver, useful for cache synchronisation, optional.
++ * @finish:	called every time the buffer is passed back from the driver
++ *		to the userspace, also optional.
+  * @attach_dmabuf: attach a shared &struct dma_buf for a hardware operation;
+  *		   used for DMABUF memory types; dev is the alloc device
+  *		   dbuf is the shared dma_buf; returns ERR_PTR() on failure;
+@@ -86,10 +90,6 @@ struct vb2_buffer;
+  *		dmabuf.
+  * @unmap_dmabuf: releases access control to the dmabuf - allocator is notified
+  *		  that this driver is done using the dmabuf for now.
+- * @prepare:	called every time the buffer is passed from userspace to the
+- *		driver, useful for cache synchronisation, optional.
+- * @finish:	called every time the buffer is passed back from the driver
+- *		to the userspace, also optional.
+  * @vaddr:	return a kernel virtual address to a given memory buffer
+  *		associated with the passed private structure or NULL if no
+  *		such mapping exists.
+@@ -484,7 +484,6 @@ struct vb2_buf_ops {
+  *		caller. For example, for V4L2, it should match
+  *		the types defined on &enum v4l2_buf_type.
+  * @io_modes:	supported io methods (see &enum vb2_io_modes).
+- * @alloc_devs:	&struct device memory type/allocator-specific per-plane device
+  * @dev:	device to use for the default allocation context if the driver
+  *		doesn't fill in the @alloc_devs array.
+  * @dma_attrs:	DMA attributes to use for the DMA.
+@@ -553,6 +552,7 @@ struct vb2_buf_ops {
+  *		VIDIOC_REQBUFS will ensure at least @min_queued_buffers
+  *		buffers will be allocated. Note that VIDIOC_CREATE_BUFS will not
+  *		modify the requested buffer count.
++ * @alloc_devs:	&struct device memory type/allocator-specific per-plane device
+  */
+ /*
+  * Private elements (won't appear at the uAPI book):
+@@ -577,6 +577,9 @@ struct vb2_buf_ops {
+  * @waiting_for_buffers: used in poll() to check if vb2 is still waiting for
+  *		buffers. Only set for capture queues if qbuf has not yet been
+  *		called since poll() needs to return %EPOLLERR in that situation.
++ * @waiting_in_dqbuf: set by the core for the duration of a blocking DQBUF, when
++ *		it has to wait for a buffer to become available with vb2_queue->lock
++ *		released. Used to prevent destroying the queue by other threads.
+  * @is_multiplanar: set if buffer type is multiplanar
+  * @is_output:	set if buffer type is output
+  * @copy_timestamp: set if vb2-core should set timestamps
+-- 
+2.43.0
+
diff --git a/queue-6.8/memory-tegra-correct-dla-client-names.patch b/queue-6.8/memory-tegra-correct-dla-client-names.patch
new file mode 100644
index 00000000000..a943b11e1e5
--- /dev/null
+++ b/queue-6.8/memory-tegra-correct-dla-client-names.patch
@@ -0,0 +1,107 @@
+From dcebfffee2169d2dd2af04fc2b3d626653d46e3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 12:44:28 +0000
+Subject: memory: tegra: Correct DLA client names
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit 51d915cbeef4c7a154f5d810b1e10d8125f2b0cc ]
+
+Some of the names for the Tegra234 DLA clients are not unique and do not
+align with the name of the client ID definitions. Therefore, it is not
+possible to determine the exact DLA client from messages that print the
+client name. Fix this by correcting the DLA memory client names for
+Tegra234 to align with the name of the corresponding memory client ID.
+
+Note that although the client names are also used by the interconnect
+framework, interconnect support for the DLA clients has not been added
+and so this issue does not impact the interconnect support.
+
+Fixes: 5cd24ca0985f ("memory: tegra: Add DLA clients for Tegra234")
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20240220124430.19072-1-jonathanh@nvidia.com
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/tegra/tegra234.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/memory/tegra/tegra234.c b/drivers/memory/tegra/tegra234.c
+index abff87f917cb4..b8a7af2d36c11 100644
+--- a/drivers/memory/tegra/tegra234.c
++++ b/drivers/memory/tegra/tegra234.c
+@@ -121,7 +121,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDB,
+-		.name = "dla0rdb",
++		.name = "dla1rdb",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+@@ -407,7 +407,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDB1,
+-		.name = "dla0rdb1",
++		.name = "dla1rdb1",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+@@ -417,7 +417,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1WRB,
+-		.name = "dla0wrb",
++		.name = "dla1wrb",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+@@ -699,7 +699,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDA,
+-		.name = "dla0rda",
++		.name = "dla1rda",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+@@ -709,7 +709,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1FALRDB,
+-		.name = "dla0falrdb",
++		.name = "dla1falrdb",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+@@ -719,7 +719,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1WRA,
+-		.name = "dla0wra",
++		.name = "dla1wra",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+@@ -729,7 +729,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1FALWRB,
+-		.name = "dla0falwrb",
++		.name = "dla1falwrb",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+@@ -917,7 +917,7 @@ static const struct tegra_mc_client tegra234_mc_clients[] = {
+ 		},
+ 	}, {
+ 		.id = TEGRA234_MEMORY_CLIENT_DLA1RDA1,
+-		.name = "dla0rda1",
++		.name = "dla1rda1",
+ 		.sid = TEGRA234_SID_NVDLA1,
+ 		.regs = {
+ 			.sid = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch b/queue-6.8/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
new file mode 100644
index 00000000000..4978d5bf0bb
--- /dev/null
+++ b/queue-6.8/mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
@@ -0,0 +1,42 @@
+From 1c3920e9b5a7bb2312f91a65837a9db013112a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 11:50:12 +0000
+Subject: mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle()
+ takes a ref
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+[ Upstream commit e28c28a34ee9fa2ea671a20e5e7064e6220d55e7 ]
+
+of_parse_phandle() returns a device_node with refcount incremented, which
+the callee needs to call of_node_put() on when done. We should only call
+of_node_put() when the property argument is provided though as otherwise
+nothing has taken a reference on the node.
+
+Fixes: f36e789a1f8d ("mfd: altera-sysmgr: Add SOCFPGA System Manager")
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Link: https://lore.kernel.org/r/20240220115012.471689-4-peter.griffin@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/altera-sysmgr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/altera-sysmgr.c b/drivers/mfd/altera-sysmgr.c
+index 0e52bd2ebd74b..fb5f988e61f37 100644
+--- a/drivers/mfd/altera-sysmgr.c
++++ b/drivers/mfd/altera-sysmgr.c
+@@ -109,7 +109,9 @@ struct regmap *altr_sysmgr_regmap_lookup_by_phandle(struct device_node *np,
+ 
+ 	dev = driver_find_device_by_of_node(&altr_sysmgr_driver.driver,
+ 					    (void *)sysmgr_np);
+-	of_node_put(sysmgr_np);
++	if (property)
++		of_node_put(sysmgr_np);
++
+ 	if (!dev)
+ 		return ERR_PTR(-EPROBE_DEFER);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/mfd-cs42l43-fix-wrong-gpio_fn_sel-and-spi_clk_config.patch b/queue-6.8/mfd-cs42l43-fix-wrong-gpio_fn_sel-and-spi_clk_config.patch
new file mode 100644
index 00000000000..af956c365ed
--- /dev/null
+++ b/queue-6.8/mfd-cs42l43-fix-wrong-gpio_fn_sel-and-spi_clk_config.patch
@@ -0,0 +1,48 @@
+From f5fd9e38a60c3ab9a72749ae19f47c27abfc0fba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 10:15:47 +0000
+Subject: mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults
+
+From: Maciej Strozek <mstrozek@opensource.cirrus.com>
+
+[ Upstream commit 78334c343bef528b911da83a6b041d15a1a72efb ]
+
+Two regs have wrong values in existing fields, change them to match
+the datasheet.
+
+Fixes: ace6d1448138 ("mfd: cs42l43: Add support for cs42l43 core driver")
+
+Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20240301101547.2136948-1-mstrozek@opensource.cirrus.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/cs42l43.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
+index 73c88ee6a866c..1cea3f8f467d4 100644
+--- a/drivers/mfd/cs42l43.c
++++ b/drivers/mfd/cs42l43.c
+@@ -84,7 +84,7 @@ const struct reg_default cs42l43_reg_default[CS42L43_N_DEFAULTS] = {
+ 	{ CS42L43_DRV_CTRL_5,				0x136C00C0 },
+ 	{ CS42L43_GPIO_CTRL1,				0x00000707 },
+ 	{ CS42L43_GPIO_CTRL2,				0x00000000 },
+-	{ CS42L43_GPIO_FN_SEL,				0x00000000 },
++	{ CS42L43_GPIO_FN_SEL,				0x00000004 },
+ 	{ CS42L43_MCLK_SRC_SEL,				0x00000000 },
+ 	{ CS42L43_SAMPLE_RATE1,				0x00000003 },
+ 	{ CS42L43_SAMPLE_RATE2,				0x00000003 },
+@@ -217,7 +217,7 @@ const struct reg_default cs42l43_reg_default[CS42L43_N_DEFAULTS] = {
+ 	{ CS42L43_CTRL_REG,				0x00000006 },
+ 	{ CS42L43_FDIV_FRAC,				0x40000000 },
+ 	{ CS42L43_CAL_RATIO,				0x00000080 },
+-	{ CS42L43_SPI_CLK_CONFIG1,			0x00000000 },
++	{ CS42L43_SPI_CLK_CONFIG1,			0x00000001 },
+ 	{ CS42L43_SPI_CONFIG1,				0x00000000 },
+ 	{ CS42L43_SPI_CONFIG2,				0x00000000 },
+ 	{ CS42L43_SPI_CONFIG3,				0x00000001 },
+-- 
+2.43.0
+
diff --git a/queue-6.8/mfd-cs42l43-fix-wrong-register-defaults.patch b/queue-6.8/mfd-cs42l43-fix-wrong-register-defaults.patch
new file mode 100644
index 00000000000..6f61186c995
--- /dev/null
+++ b/queue-6.8/mfd-cs42l43-fix-wrong-register-defaults.patch
@@ -0,0 +1,111 @@
+From 4b773ba457537c68686915cc4d53a633dabc20d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 15:56:14 +0000
+Subject: mfd: cs42l43: Fix wrong register defaults
+
+From: Maciej Strozek <mstrozek@opensource.cirrus.com>
+
+[ Upstream commit c9e1e505cde1a8ddd0968b4d54ec2ea1937dfe00 ]
+
+A few regs have unnecessary values in defaults, change them to match the
+datasheet
+
+Fixes: ace6d1448138 ("mfd: cs42l43: Add support for cs42l43 core driver")
+
+Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20240229155616.118457-1-mstrozek@opensource.cirrus.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/cs42l43.c | 68 +++++++++++++++++++++----------------------
+ 1 file changed, 34 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/mfd/cs42l43.c b/drivers/mfd/cs42l43.c
+index 7b6d07cbe6fc6..73c88ee6a866c 100644
+--- a/drivers/mfd/cs42l43.c
++++ b/drivers/mfd/cs42l43.c
+@@ -131,38 +131,38 @@ const struct reg_default cs42l43_reg_default[CS42L43_N_DEFAULTS] = {
+ 	{ CS42L43_ASP_TX_CH4_CTRL,			0x00170091 },
+ 	{ CS42L43_ASP_TX_CH5_CTRL,			0x001700C1 },
+ 	{ CS42L43_ASP_TX_CH6_CTRL,			0x001700F1 },
+-	{ CS42L43_ASPTX1_INPUT,				0x00800000 },
+-	{ CS42L43_ASPTX2_INPUT,				0x00800000 },
+-	{ CS42L43_ASPTX3_INPUT,				0x00800000 },
+-	{ CS42L43_ASPTX4_INPUT,				0x00800000 },
+-	{ CS42L43_ASPTX5_INPUT,				0x00800000 },
+-	{ CS42L43_ASPTX6_INPUT,				0x00800000 },
+-	{ CS42L43_SWIRE_DP1_CH1_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP1_CH2_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP1_CH3_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP1_CH4_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP2_CH1_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP2_CH2_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP3_CH1_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP3_CH2_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP4_CH1_INPUT,			0x00800000 },
+-	{ CS42L43_SWIRE_DP4_CH2_INPUT,			0x00800000 },
+-	{ CS42L43_ASRC_INT1_INPUT1,			0x00800000 },
+-	{ CS42L43_ASRC_INT2_INPUT1,			0x00800000 },
+-	{ CS42L43_ASRC_INT3_INPUT1,			0x00800000 },
+-	{ CS42L43_ASRC_INT4_INPUT1,			0x00800000 },
+-	{ CS42L43_ASRC_DEC1_INPUT1,			0x00800000 },
+-	{ CS42L43_ASRC_DEC2_INPUT1,			0x00800000 },
+-	{ CS42L43_ASRC_DEC3_INPUT1,			0x00800000 },
+-	{ CS42L43_ASRC_DEC4_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC1INT1_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC1INT2_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC1DEC1_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC1DEC2_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC2INT1_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC2INT2_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC2DEC1_INPUT1,			0x00800000 },
+-	{ CS42L43_ISRC2DEC2_INPUT1,			0x00800000 },
++	{ CS42L43_ASPTX1_INPUT,				0x00000000 },
++	{ CS42L43_ASPTX2_INPUT,				0x00000000 },
++	{ CS42L43_ASPTX3_INPUT,				0x00000000 },
++	{ CS42L43_ASPTX4_INPUT,				0x00000000 },
++	{ CS42L43_ASPTX5_INPUT,				0x00000000 },
++	{ CS42L43_ASPTX6_INPUT,				0x00000000 },
++	{ CS42L43_SWIRE_DP1_CH1_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP1_CH2_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP1_CH3_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP1_CH4_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP2_CH1_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP2_CH2_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP3_CH1_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP3_CH2_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP4_CH1_INPUT,			0x00000000 },
++	{ CS42L43_SWIRE_DP4_CH2_INPUT,			0x00000000 },
++	{ CS42L43_ASRC_INT1_INPUT1,			0x00000000 },
++	{ CS42L43_ASRC_INT2_INPUT1,			0x00000000 },
++	{ CS42L43_ASRC_INT3_INPUT1,			0x00000000 },
++	{ CS42L43_ASRC_INT4_INPUT1,			0x00000000 },
++	{ CS42L43_ASRC_DEC1_INPUT1,			0x00000000 },
++	{ CS42L43_ASRC_DEC2_INPUT1,			0x00000000 },
++	{ CS42L43_ASRC_DEC3_INPUT1,			0x00000000 },
++	{ CS42L43_ASRC_DEC4_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC1INT1_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC1INT2_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC1DEC1_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC1DEC2_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC2INT1_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC2INT2_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC2DEC1_INPUT1,			0x00000000 },
++	{ CS42L43_ISRC2DEC2_INPUT1,			0x00000000 },
+ 	{ CS42L43_EQ1MIX_INPUT1,			0x00800000 },
+ 	{ CS42L43_EQ1MIX_INPUT2,			0x00800000 },
+ 	{ CS42L43_EQ1MIX_INPUT3,			0x00800000 },
+@@ -171,8 +171,8 @@ const struct reg_default cs42l43_reg_default[CS42L43_N_DEFAULTS] = {
+ 	{ CS42L43_EQ2MIX_INPUT2,			0x00800000 },
+ 	{ CS42L43_EQ2MIX_INPUT3,			0x00800000 },
+ 	{ CS42L43_EQ2MIX_INPUT4,			0x00800000 },
+-	{ CS42L43_SPDIF1_INPUT1,			0x00800000 },
+-	{ CS42L43_SPDIF2_INPUT1,			0x00800000 },
++	{ CS42L43_SPDIF1_INPUT1,			0x00000000 },
++	{ CS42L43_SPDIF2_INPUT1,			0x00000000 },
+ 	{ CS42L43_AMP1MIX_INPUT1,			0x00800000 },
+ 	{ CS42L43_AMP1MIX_INPUT2,			0x00800000 },
+ 	{ CS42L43_AMP1MIX_INPUT3,			0x00800000 },
+-- 
+2.43.0
+
diff --git a/queue-6.8/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch b/queue-6.8/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
new file mode 100644
index 00000000000..b39c5c19074
--- /dev/null
+++ b/queue-6.8/mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
@@ -0,0 +1,42 @@
+From 8ee1ec1c8761bca25045d0c45264d0227880409c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 11:50:10 +0000
+Subject: mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a
+ ref
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+[ Upstream commit d2b0680cf3b05490b579e71b0df6e07451977745 ]
+
+of_parse_phandle() returns a device_node with refcount incremented, which
+the callee needs to call of_node_put() on when done. We should only call
+of_node_put() when the property argument is provided though as otherwise
+nothing has taken a reference on the node.
+
+Fixes: 45330bb43421 ("mfd: syscon: Allow property as NULL in syscon_regmap_lookup_by_phandle")
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Link: https://lore.kernel.org/r/20240220115012.471689-2-peter.griffin@linaro.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/syscon.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
+index c9550368d9ea5..7d0e91164cbaa 100644
+--- a/drivers/mfd/syscon.c
++++ b/drivers/mfd/syscon.c
+@@ -238,7 +238,9 @@ struct regmap *syscon_regmap_lookup_by_phandle(struct device_node *np,
+ 		return ERR_PTR(-ENODEV);
+ 
+ 	regmap = syscon_node_to_regmap(syscon_np);
+-	of_node_put(syscon_np);
++
++	if (property)
++		of_node_put(syscon_np);
+ 
+ 	return regmap;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/mips-cm-convert-__mips_cm_l2sync_phys_base-to-weak-f.patch b/queue-6.8/mips-cm-convert-__mips_cm_l2sync_phys_base-to-weak-f.patch
new file mode 100644
index 00000000000..f82f3822547
--- /dev/null
+++ b/queue-6.8/mips-cm-convert-__mips_cm_l2sync_phys_base-to-weak-f.patch
@@ -0,0 +1,90 @@
+From 29359357b4fbb28fe8f9cb243985e0645f63081e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 13:54:21 +0300
+Subject: mips: cm: Convert __mips_cm_l2sync_phys_base() to weak function
+
+From: Serge Semin <fancer.lancer@gmail.com>
+
+[ Upstream commit 8bc8db2ab2832daabdd06feeabdd511dc9575bb6 ]
+
+The __mips_cm_l2sync_phys_base() and mips_cm_l2sync_phys_base() couple was
+introduced in commit 9f98f3dd0c51 ("MIPS: Add generic CM probe & access
+code") where the former method was a weak implementation of the later
+function. Such design pattern permitted to re-define the original method
+and to use the weak implementation in the new function. A similar approach
+was introduced in the framework of another arch-specific programmable
+interface: mips_cm_phys_base() and __mips_cm_phys_base(). The only
+difference is that the underscored method of the later couple was declared
+in the "asm/mips-cm.h" header file, but it wasn't done for the CM L2-sync
+methods in the subject. Due to the missing global function declaration
+the "missing prototype" warning was spotted in the framework of the commit
+9a2036724cd6 ("mips: mark local function static if possible") and fixed
+just be re-qualifying the weak method as static. Doing that broke what was
+originally implied by having the weak implementation globally defined.
+
+Let's fix the broken CM2 L2-sync arch-interface by dropping the static
+qualifier and, seeing the implemented pattern hasn't been used for over 10
+years but will be required soon (see the link for the discussion around
+it), converting it to a single weakly defined method:
+mips_cm_l2sync_phys_base().
+
+Fixes: 9a2036724cd6 ("mips: mark local function static if possible")
+Link: https://lore.kernel.org/linux-mips/20240215171740.14550-3-fancer.lancer@gmail.com
+Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mips-cm.h | 13 +++++++++++++
+ arch/mips/kernel/mips-cm.c      |  5 +----
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
+index 23c67c0871b17..6cc79296c8ef2 100644
+--- a/arch/mips/include/asm/mips-cm.h
++++ b/arch/mips/include/asm/mips-cm.h
+@@ -33,6 +33,19 @@ extern void __iomem *mips_cm_l2sync_base;
+  */
+ extern phys_addr_t __mips_cm_phys_base(void);
+ 
++/**
++ * mips_cm_l2sync_phys_base - retrieve the physical base address of the CM
++ *                            L2-sync region
++ *
++ * This function returns the physical base address of the Coherence Manager
++ * L2-cache only region. It provides a default implementation which reads the
++ * CMGCRL2OnlySyncBase register where available or returns a 4K region just
++ * behind the CM GCR base address. It may be overridden by platforms which
++ * determine this address in a different way by defining a function with the
++ * same prototype.
++ */
++extern phys_addr_t mips_cm_l2sync_phys_base(void);
++
+ /*
+  * mips_cm_is64 - determine CM register width
+  *
+diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
+index 84b3affb9de88..268ac0b811e35 100644
+--- a/arch/mips/kernel/mips-cm.c
++++ b/arch/mips/kernel/mips-cm.c
+@@ -201,7 +201,7 @@ phys_addr_t __mips_cm_phys_base(void)
+ phys_addr_t mips_cm_phys_base(void)
+ 	__attribute__((weak, alias("__mips_cm_phys_base")));
+ 
+-static phys_addr_t __mips_cm_l2sync_phys_base(void)
++phys_addr_t __weak mips_cm_l2sync_phys_base(void)
+ {
+ 	u32 base_reg;
+ 
+@@ -217,9 +217,6 @@ static phys_addr_t __mips_cm_l2sync_phys_base(void)
+ 	return mips_cm_phys_base() + MIPS_CM_GCR_SIZE;
+ }
+ 
+-phys_addr_t mips_cm_l2sync_phys_base(void)
+-	__attribute__((weak, alias("__mips_cm_l2sync_phys_base")));
+-
+ static void mips_cm_probe_l2sync(void)
+ {
+ 	unsigned major_rev;
+-- 
+2.43.0
+
diff --git a/queue-6.8/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch b/queue-6.8/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
new file mode 100644
index 00000000000..4a72df26212
--- /dev/null
+++ b/queue-6.8/mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
@@ -0,0 +1,50 @@
+From 116a2855d59e3332865805bd756f84f3a190b0d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 22:37:39 +0100
+Subject: mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the
+ .remove function
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ae5004a40a262d329039b99b62bd3fe7645b66ad ]
+
+This looks strange to call release_mem_region() in a remove function
+without any request_mem_region() in the probe or "struct resource"
+somewhere.
+
+So remove the corresponding code.
+
+Fixes: 3a96dff0f828 ("mmc: SD/MMC Host Controller for Wondermedia WM8505/WM8650")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/bb0bb1ed1e18de55e8c0547625bde271e64b8c31.1708983064.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/wmt-sdmmc.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
+index 77d5f1d244899..860380931b6cd 100644
+--- a/drivers/mmc/host/wmt-sdmmc.c
++++ b/drivers/mmc/host/wmt-sdmmc.c
+@@ -883,7 +883,6 @@ static void wmt_mci_remove(struct platform_device *pdev)
+ {
+ 	struct mmc_host *mmc;
+ 	struct wmt_mci_priv *priv;
+-	struct resource *res;
+ 	u32 reg_tmp;
+ 
+ 	mmc = platform_get_drvdata(pdev);
+@@ -911,9 +910,6 @@ static void wmt_mci_remove(struct platform_device *pdev)
+ 	clk_disable_unprepare(priv->clk_sdmmc);
+ 	clk_put(priv->clk_sdmmc);
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	release_mem_region(res->start, resource_size(res));
+-
+ 	mmc_free_host(mmc);
+ 
+ 	dev_info(&pdev->dev, "WMT MCI device removed\n");
+-- 
+2.43.0
+
diff --git a/queue-6.8/modules-wait-do_free_init-correctly.patch b/queue-6.8/modules-wait-do_free_init-correctly.patch
new file mode 100644
index 00000000000..b4a722ef055
--- /dev/null
+++ b/queue-6.8/modules-wait-do_free_init-correctly.patch
@@ -0,0 +1,125 @@
+From 142fc26aac4df26764543bdece94334a88f0fc0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 10:35:46 +0800
+Subject: modules: wait do_free_init correctly
+
+From: Changbin Du <changbin.du@huawei.com>
+
+[ Upstream commit 8f8cd6c0a43ed637e620bbe45a8d0e0c2f4d5130 ]
+
+The synchronization here is to ensure the ordering of freeing of a module
+init so that it happens before W+X checking.  It is worth noting it is not
+that the freeing was not happening, it is just that our sanity checkers
+raced against the permission checkers which assume init memory is already
+gone.
+
+Commit 1a7b7d922081 ("modules: Use vmalloc special flag") moved calling
+do_free_init() into a global workqueue instead of relying on it being
+called through call_rcu(..., do_free_init), which used to allowed us call
+do_free_init() asynchronously after the end of a subsequent grace period.
+The move to a global workqueue broke the gaurantees for code which needed
+to be sure the do_free_init() would complete with rcu_barrier().  To fix
+this callers which used to rely on rcu_barrier() must now instead use
+flush_work(&init_free_wq).
+
+Without this fix, we still could encounter false positive reports in W+X
+checking since the rcu_barrier() here can not ensure the ordering now.
+
+Even worse, the rcu_barrier() can introduce significant delay.  Eric
+Chanudet reported that the rcu_barrier introduces ~0.1s delay on a
+PREEMPT_RT kernel.
+
+  [    0.291444] Freeing unused kernel memory: 5568K
+  [    0.402442] Run /sbin/init as init process
+
+With this fix, the above delay can be eliminated.
+
+Link: https://lkml.kernel.org/r/20240227023546.2490667-1-changbin.du@huawei.com
+Fixes: 1a7b7d922081 ("modules: Use vmalloc special flag")
+Signed-off-by: Changbin Du <changbin.du@huawei.com>
+Tested-by: Eric Chanudet <echanude@redhat.com>
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Xiaoyi Su <suxiaoyi@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/moduleloader.h | 8 ++++++++
+ init/main.c                  | 5 +++--
+ kernel/module/main.c         | 9 +++++++--
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
+index 001b2ce83832e..89b1e0ed98114 100644
+--- a/include/linux/moduleloader.h
++++ b/include/linux/moduleloader.h
+@@ -115,6 +115,14 @@ int module_finalize(const Elf_Ehdr *hdr,
+ 		    const Elf_Shdr *sechdrs,
+ 		    struct module *mod);
+ 
++#ifdef CONFIG_MODULES
++void flush_module_init_free_work(void);
++#else
++static inline void flush_module_init_free_work(void)
++{
++}
++#endif
++
+ /* Any cleanup needed when module leaves. */
+ void module_arch_cleanup(struct module *mod);
+ 
+diff --git a/init/main.c b/init/main.c
+index e24b0780fdff7..9e6ab6d593bd8 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -88,6 +88,7 @@
+ #include <linux/sched/task_stack.h>
+ #include <linux/context_tracking.h>
+ #include <linux/random.h>
++#include <linux/moduleloader.h>
+ #include <linux/list.h>
+ #include <linux/integrity.h>
+ #include <linux/proc_ns.h>
+@@ -1402,11 +1403,11 @@ static void mark_readonly(void)
+ 	if (rodata_enabled) {
+ 		/*
+ 		 * load_module() results in W+X mappings, which are cleaned
+-		 * up with call_rcu().  Let's make sure that queued work is
++		 * up with init_free_wq. Let's make sure that queued work is
+ 		 * flushed so that we don't hit false positives looking for
+ 		 * insecure pages which are W+X.
+ 		 */
+-		rcu_barrier();
++		flush_module_init_free_work();
+ 		mark_rodata_ro();
+ 		rodata_test();
+ 	} else
+diff --git a/kernel/module/main.c b/kernel/module/main.c
+index 36681911c05ac..b0b99348e1a8b 100644
+--- a/kernel/module/main.c
++++ b/kernel/module/main.c
+@@ -2489,6 +2489,11 @@ static void do_free_init(struct work_struct *w)
+ 	}
+ }
+ 
++void flush_module_init_free_work(void)
++{
++	flush_work(&init_free_wq);
++}
++
+ #undef MODULE_PARAM_PREFIX
+ #define MODULE_PARAM_PREFIX "module."
+ /* Default value for module->async_probe_requested */
+@@ -2593,8 +2598,8 @@ static noinline int do_init_module(struct module *mod)
+ 	 * Note that module_alloc() on most architectures creates W+X page
+ 	 * mappings which won't be cleaned up until do_free_init() runs.  Any
+ 	 * code such as mark_rodata_ro() which depends on those mappings to
+-	 * be cleaned up needs to sync with the queued work - ie
+-	 * rcu_barrier()
++	 * be cleaned up needs to sync with the queued work by invoking
++	 * flush_module_init_free_work().
+ 	 */
+ 	if (llist_add(&freeinit->node, &init_free_list))
+ 		schedule_work(&init_free_wq);
+-- 
+2.43.0
+
diff --git a/queue-6.8/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch b/queue-6.8/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
new file mode 100644
index 00000000000..405637f5527
--- /dev/null
+++ b/queue-6.8/mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
@@ -0,0 +1,39 @@
+From 4c5f124b0efafeb72e081045f5fb8a68c7a06fdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 12:34:18 +0200
+Subject: mtd: maps: physmap-core: fix flash size larger than 32-bit
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 3884f03edd34887514a0865a80769cd5362d5c3b ]
+
+mtd-ram can potentially be larger than 4GB. get_bitmask_order() uses
+fls() that is not guaranteed to work with values larger than 32-bit.
+Specifically on aarch64 fls() returns 0 when all 32 LSB bits are clear.
+Use fls64() instead.
+
+Fixes: ba32ce95cbd987 ("mtd: maps: Merge gpio-addr-flash.c into physmap-core.c")
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/9fbf3664ce00f8b07867f1011834015f21d162a5.1707388458.git.baruch@tkos.co.il
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/maps/physmap-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/maps/physmap-core.c b/drivers/mtd/maps/physmap-core.c
+index 746a27d15d440..96eb2e782c382 100644
+--- a/drivers/mtd/maps/physmap-core.c
++++ b/drivers/mtd/maps/physmap-core.c
+@@ -518,7 +518,7 @@ static int physmap_flash_probe(struct platform_device *dev)
+ 		if (!info->maps[i].phys)
+ 			info->maps[i].phys = res->start;
+ 
+-		info->win_order = get_bitmask_order(resource_size(res)) - 1;
++		info->win_order = fls64(resource_size(res)) - 1;
+ 		info->maps[i].size = BIT(info->win_order +
+ 					 (info->gpios ?
+ 					  info->gpios->ndescs : 0));
+-- 
+2.43.0
+
diff --git a/queue-6.8/mtd-maps-sun_uflash-declare-uflash_devinit-static.patch b/queue-6.8/mtd-maps-sun_uflash-declare-uflash_devinit-static.patch
new file mode 100644
index 00000000000..70c8b805acf
--- /dev/null
+++ b/queue-6.8/mtd-maps-sun_uflash-declare-uflash_devinit-static.patch
@@ -0,0 +1,43 @@
+From 9ee9198bd3aa83ab6ac51e27493d8c268bc348f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 18:42:24 +0100
+Subject: mtd: maps: sun_uflash: Declare uflash_devinit static
+
+From: Sam Ravnborg <sam@ravnborg.org>
+
+[ Upstream commit 6892982316846d4c40d12b0641d59519d868a784 ]
+
+This fixes the following warning:
+sun_uflash.c:50:5: error: no previous prototype for 'uflash_devinit'
+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Fixes: 0fcb70851fbf ("Makefile.extrawarn: turn on missing-prototypes globally")
+Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Cc: Andreas Larsson <andreas@gaisler.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Acked-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20240224-sam-fix-sparc32-all-builds-v2-3-1f186603c5c4@ravnborg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/maps/sun_uflash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/maps/sun_uflash.c b/drivers/mtd/maps/sun_uflash.c
+index f58cfb15d6e85..b69dade3f7ad0 100644
+--- a/drivers/mtd/maps/sun_uflash.c
++++ b/drivers/mtd/maps/sun_uflash.c
+@@ -47,7 +47,7 @@ struct map_info uflash_map_templ = {
+ 	.bankwidth =	UFLASH_BUSWIDTH,
+ };
+ 
+-int uflash_devinit(struct platform_device *op, struct device_node *dp)
++static int uflash_devinit(struct platform_device *op, struct device_node *dp)
+ {
+ 	struct uflash_dev *up;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/mtd-rawnand-brcmnand-exec_op-helper-functions-return.patch b/queue-6.8/mtd-rawnand-brcmnand-exec_op-helper-functions-return.patch
new file mode 100644
index 00000000000..5d7636ff7cc
--- /dev/null
+++ b/queue-6.8/mtd-rawnand-brcmnand-exec_op-helper-functions-return.patch
@@ -0,0 +1,72 @@
+From d616a0e080bbf1ea2fcc2cca977e3eead63aba30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 19:47:46 -0800
+Subject: mtd: rawnand: brcmnand: exec_op helper functions return type fixes
+
+From: David Regan <dregan@broadcom.com>
+
+[ Upstream commit d4bba1501f72e8af09f2cde3d327147de1b69f5d ]
+
+Fix return types for exec_op reset and status helper functions.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: http://lists.infradead.org/pipermail/linux-mtd/2023-December/102423.html
+Fixes: 3c8260ce7663 ("mtd: rawnand: brcmnand: exec_op implementation")
+Signed-off-by: David Regan <dregan@broadcom.com>
+Signed-off-by: William Zhang <william.zhang@broadcom.com>
+Reviewed-by: William Zhang <william.zhang@broadcom.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240223034758.13753-2-william.zhang@broadcom.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+index 8faca43ae1ff9..b8e70fc64348e 100644
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -625,7 +625,7 @@ enum {
+ /* Only for v7.2 */
+ #define	ACC_CONTROL_ECC_EXT_SHIFT		13
+ 
+-static u8 brcmnand_status(struct brcmnand_host *host);
++static int brcmnand_status(struct brcmnand_host *host);
+ 
+ static inline bool brcmnand_non_mmio_ops(struct brcmnand_controller *ctrl)
+ {
+@@ -1690,7 +1690,7 @@ static int brcmnand_waitfunc(struct nand_chip *chip)
+ 				 INTFC_FLASH_STATUS;
+ }
+ 
+-static u8 brcmnand_status(struct brcmnand_host *host)
++static int brcmnand_status(struct brcmnand_host *host)
+ {
+ 	struct nand_chip *chip = &host->chip;
+ 	struct mtd_info *mtd = nand_to_mtd(chip);
+@@ -1701,7 +1701,7 @@ static u8 brcmnand_status(struct brcmnand_host *host)
+ 	return brcmnand_waitfunc(chip);
+ }
+ 
+-static u8 brcmnand_reset(struct brcmnand_host *host)
++static int brcmnand_reset(struct brcmnand_host *host)
+ {
+ 	struct nand_chip *chip = &host->chip;
+ 
+@@ -2433,7 +2433,11 @@ static int brcmnand_exec_op(struct nand_chip *chip,
+ 
+ 	if (brcmnand_op_is_status(op)) {
+ 		status = op->instrs[1].ctx.data.buf.in;
+-		*status = brcmnand_status(host);
++		ret = brcmnand_status(host);
++		if (ret < 0)
++			return ret;
++
++		*status = ret & 0xFF;
+ 
+ 		return 0;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch b/queue-6.8/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
new file mode 100644
index 00000000000..291afca0d3a
--- /dev/null
+++ b/queue-6.8/mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
@@ -0,0 +1,52 @@
+From c74631209de7d480085ed756f6f55ce71554b72e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:00:09 +0100
+Subject: mtd: rawnand: lpc32xx_mlc: fix irq handler prototype
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 347b828882e6334690e7003ce5e2fe5f233dc508 ]
+
+clang-16 warns about mismatched function prototypes:
+
+drivers/mtd/nand/raw/lpc32xx_mlc.c:783:29: error: cast from 'irqreturn_t (*)(int, struct lpc32xx_nand_host *)' (aka 'enum irqreturn (*)(int, struct lpc32xx_nand_host *)') to 'irq_handler_t' (aka 'enum irqreturn (*)(int, void *)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+
+Change the interrupt handler to the normal way of just passing
+a void* pointer and converting it inside the function..
+
+Fixes: 70f7cb78ec53 ("mtd: add LPC32xx MLC NAND driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240213100146.455811-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/lpc32xx_mlc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/nand/raw/lpc32xx_mlc.c b/drivers/mtd/nand/raw/lpc32xx_mlc.c
+index 488fd452611a6..677fcb03f9bef 100644
+--- a/drivers/mtd/nand/raw/lpc32xx_mlc.c
++++ b/drivers/mtd/nand/raw/lpc32xx_mlc.c
+@@ -303,8 +303,9 @@ static int lpc32xx_nand_device_ready(struct nand_chip *nand_chip)
+ 	return 0;
+ }
+ 
+-static irqreturn_t lpc3xxx_nand_irq(int irq, struct lpc32xx_nand_host *host)
++static irqreturn_t lpc3xxx_nand_irq(int irq, void *data)
+ {
++	struct lpc32xx_nand_host *host = data;
+ 	uint8_t sr;
+ 
+ 	/* Clear interrupt flag by reading status */
+@@ -780,7 +781,7 @@ static int lpc32xx_nand_probe(struct platform_device *pdev)
+ 		goto release_dma_chan;
+ 	}
+ 
+-	if (request_irq(host->irq, (irq_handler_t)&lpc3xxx_nand_irq,
++	if (request_irq(host->irq, &lpc3xxx_nand_irq,
+ 			IRQF_TRIGGER_HIGH, DRV_NAME, host)) {
+ 		dev_err(&pdev->dev, "Error requesting NAND IRQ\n");
+ 		res = -ENXIO;
+-- 
+2.43.0
+
diff --git a/queue-6.8/mtd-spinand-esmt-extend-ids-to-5-bytes.patch b/queue-6.8/mtd-spinand-esmt-extend-ids-to-5-bytes.patch
new file mode 100644
index 00000000000..e34faee6322
--- /dev/null
+++ b/queue-6.8/mtd-spinand-esmt-extend-ids-to-5-bytes.patch
@@ -0,0 +1,68 @@
+From eed282498c55d5f7d04b92fe2aaafebf72c51043 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 22:01:08 +0200
+Subject: mtd: spinand: esmt: Extend IDs to 5 bytes
+
+From: Ezra Buehler <ezra.buehler@husqvarnagroup.com>
+
+[ Upstream commit 4bd14b2fd8a83a2f5220ba4ef323f741e11bfdfd ]
+
+According to the datasheets, the ESMT chips in question will return a 5
+byte long identification code where the last 3 bytes are the JEDEC
+continuation codes (7Fh). Although, I would have expected 4 continuation
+codes as Powerchip Semiconductor (C8h, corresponding to the parameter
+page data) is located in bank 5 of the JEDEC database.
+
+By matching the full 5 bytes we can avoid clashes with GigaDevice NAND
+flashes.
+
+This fix allows the MT7688-based GARDENA smart Gateway to boot again.
+
+Fixes: aa08bf187f32 ("mtd: spinand: esmt: add support for F50D2G41KA")
+Signed-off-by: Ezra Buehler <ezra.buehler@husqvarnagroup.com>
+Reviewed-by: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Tested-by: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20240125200108.24374-3-ezra@easyb.ch
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/spi/esmt.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/nand/spi/esmt.c b/drivers/mtd/nand/spi/esmt.c
+index 31c439a557b18..4597a82de23a4 100644
+--- a/drivers/mtd/nand/spi/esmt.c
++++ b/drivers/mtd/nand/spi/esmt.c
+@@ -104,7 +104,8 @@ static const struct mtd_ooblayout_ops f50l1g41lb_ooblayout = {
+ 
+ static const struct spinand_info esmt_c8_spinand_table[] = {
+ 	SPINAND_INFO("F50L1G41LB",
+-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x01),
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x01, 0x7f,
++				0x7f, 0x7f),
+ 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
+ 		     NAND_ECCREQ(1, 512),
+ 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
+@@ -113,7 +114,8 @@ static const struct spinand_info esmt_c8_spinand_table[] = {
+ 		     0,
+ 		     SPINAND_ECCINFO(&f50l1g41lb_ooblayout, NULL)),
+ 	SPINAND_INFO("F50D1G41LB",
+-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x11),
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x11, 0x7f,
++				0x7f, 0x7f),
+ 		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
+ 		     NAND_ECCREQ(1, 512),
+ 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
+@@ -122,7 +124,8 @@ static const struct spinand_info esmt_c8_spinand_table[] = {
+ 		     0,
+ 		     SPINAND_ECCINFO(&f50l1g41lb_ooblayout, NULL)),
+ 	SPINAND_INFO("F50D2G41KA",
+-		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x51),
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_ADDR, 0x51, 0x7f,
++				0x7f, 0x7f),
+ 		     NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
+ 		     NAND_ECCREQ(8, 512),
+ 		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
+-- 
+2.43.0
+
diff --git a/queue-6.8/nbd-null-check-for-nla_nest_start.patch b/queue-6.8/nbd-null-check-for-nla_nest_start.patch
new file mode 100644
index 00000000000..6aa12d4a068
--- /dev/null
+++ b/queue-6.8/nbd-null-check-for-nla_nest_start.patch
@@ -0,0 +1,43 @@
+From 1946c551bddda5818a08ef3aca253c9dafa8077a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 20:25:38 -0800
+Subject: nbd: null check for nla_nest_start
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 31edf4bbe0ba27fd03ac7d87eb2ee3d2a231af6d ]
+
+nla_nest_start() may fail and return NULL. Insert a check and set errno
+based on other call sites within the same source code.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
+Fixes: 47d902b90a32 ("nbd: add a status netlink command")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20240218042534.it.206-kees@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 33a8f37bb6a1f..b7c332528ed7a 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -2433,6 +2433,12 @@ static int nbd_genl_status(struct sk_buff *skb, struct genl_info *info)
+ 	}
+ 
+ 	dev_list = nla_nest_start_noflag(reply, NBD_ATTR_DEVICE_LIST);
++	if (!dev_list) {
++		nlmsg_free(reply);
++		ret = -EMSGSIZE;
++		goto out;
++	}
++
+ 	if (index == -1) {
+ 		ret = idr_for_each(&nbd_index_idr, &status_cb, reply);
+ 		if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch b/queue-6.8/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
new file mode 100644
index 00000000000..be3ccc239a4
--- /dev/null
+++ b/queue-6.8/net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
@@ -0,0 +1,49 @@
+From 60719fd7e3d67d34972cfd3eea03966ba1871359 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 07:13:29 -0800
+Subject: net: blackhole_dev: fix build warning for ethh set but not used
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 843a8851e89e2e85db04caaf88d8554818319047 ]
+
+lib/test_blackhole_dev.c sets a variable that is never read, causing
+this following building warning:
+
+	lib/test_blackhole_dev.c:32:17: warning: variable 'ethh' set but not used [-Wunused-but-set-variable]
+
+Remove the variable struct ethhdr *ethh, which is unused.
+
+Fixes: 509e56b37cc3 ("blackhole_dev: add a selftest")
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_blackhole_dev.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/lib/test_blackhole_dev.c b/lib/test_blackhole_dev.c
+index 4c40580a99a36..f247089d63c08 100644
+--- a/lib/test_blackhole_dev.c
++++ b/lib/test_blackhole_dev.c
+@@ -29,7 +29,6 @@ static int __init test_blackholedev_init(void)
+ {
+ 	struct ipv6hdr *ip6h;
+ 	struct sk_buff *skb;
+-	struct ethhdr *ethh;
+ 	struct udphdr *uh;
+ 	int data_len;
+ 	int ret;
+@@ -61,7 +60,7 @@ static int __init test_blackholedev_init(void)
+ 	ip6h->saddr = in6addr_loopback;
+ 	ip6h->daddr = in6addr_loopback;
+ 	/* Ether */
+-	ethh = (struct ethhdr *)skb_push(skb, sizeof(struct ethhdr));
++	skb_push(skb, sizeof(struct ethhdr));
+ 	skb_set_mac_header(skb, 0);
+ 
+ 	skb->protocol = htons(ETH_P_IPV6);
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-dsa-microchip-make-sure-drive-strength-configura.patch b/queue-6.8/net-dsa-microchip-make-sure-drive-strength-configura.patch
new file mode 100644
index 00000000000..7283987f220
--- /dev/null
+++ b/queue-6.8/net-dsa-microchip-make-sure-drive-strength-configura.patch
@@ -0,0 +1,67 @@
+From 72e9a029870f46643ea914831195417ccc0d566a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 14:56:12 +0100
+Subject: net: dsa: microchip: make sure drive strength configuration is not
+ lost by soft reset
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit e3fb8e8ba72b053d05ca2602acdd6b869f9f296f ]
+
+This driver has two separate reset sequence in different places:
+- gpio/HW reset on start of ksz_switch_register()
+- SW reset on start of ksz_setup()
+
+The second one will overwrite drive strength configuration made in the
+ksz_switch_register().
+
+To fix it, move ksz_parse_drive_strength() from ksz_switch_register() to
+ksz_setup().
+
+Fixes: d67d7247f641 ("net: dsa: microchip: Add drive strength configuration")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/r/20240304135612.814404-1-o.rempel@pengutronix.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index 245dfb7a7a315..25a49708f4842 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -2185,6 +2185,8 @@ static int ksz_pirq_setup(struct ksz_device *dev, u8 p)
+ 	return ksz_irq_common_setup(dev, pirq);
+ }
+ 
++static int ksz_parse_drive_strength(struct ksz_device *dev);
++
+ static int ksz_setup(struct dsa_switch *ds)
+ {
+ 	struct ksz_device *dev = ds->priv;
+@@ -2206,6 +2208,10 @@ static int ksz_setup(struct dsa_switch *ds)
+ 		return ret;
+ 	}
+ 
++	ret = ksz_parse_drive_strength(dev);
++	if (ret)
++		return ret;
++
+ 	/* set broadcast storm protection 10% rate */
+ 	regmap_update_bits(ksz_regmap_16(dev), regs[S_BROADCAST_CTRL],
+ 			   BROADCAST_STORM_RATE,
+@@ -4242,10 +4248,6 @@ int ksz_switch_register(struct ksz_device *dev)
+ 	for (port_num = 0; port_num < dev->info->port_cnt; ++port_num)
+ 		dev->ports[port_num].interface = PHY_INTERFACE_MODE_NA;
+ 	if (dev->dev->of_node) {
+-		ret = ksz_parse_drive_strength(dev);
+-		if (ret)
+-			return ret;
+-
+ 		ret = of_get_phy_mode(dev->dev->of_node, &interface);
+ 		if (ret == 0)
+ 			dev->compat_interface = interface;
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-ena-remove-ena_select_queue.patch b/queue-6.8/net-ena-remove-ena_select_queue.patch
new file mode 100644
index 00000000000..49d7671e799
--- /dev/null
+++ b/queue-6.8/net-ena-remove-ena_select_queue.patch
@@ -0,0 +1,66 @@
+From 856b9b793d68e093c62febe0622142f7e02c5e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 17:31:04 -0500
+Subject: net: ena: Remove ena_select_queue
+
+From: Kamal Heib <kheib@redhat.com>
+
+[ Upstream commit 78e886ba2b549945ecada055ee0765f0ded5707a ]
+
+Avoid the following warnings by removing the ena_select_queue() function
+and rely on the net core to do the queue selection, The issue happen
+when an skb received from an interface with more queues than ena is
+forwarded to the ena interface.
+
+[ 1176.159959] eth0 selects TX queue 11, but real number of TX queues is 8
+[ 1176.863976] eth0 selects TX queue 14, but real number of TX queues is 8
+[ 1180.767877] eth0 selects TX queue 14, but real number of TX queues is 8
+[ 1188.703742] eth0 selects TX queue 14, but real number of TX queues is 8
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Kamal Heib <kheib@redhat.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 -----------------
+ 1 file changed, 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index 1c0a7828d397b..5482015411f2f 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2670,22 +2670,6 @@ static netdev_tx_t ena_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	return NETDEV_TX_OK;
+ }
+ 
+-static u16 ena_select_queue(struct net_device *dev, struct sk_buff *skb,
+-			    struct net_device *sb_dev)
+-{
+-	u16 qid;
+-	/* we suspect that this is good for in--kernel network services that
+-	 * want to loop incoming skb rx to tx in normal user generated traffic,
+-	 * most probably we will not get to this
+-	 */
+-	if (skb_rx_queue_recorded(skb))
+-		qid = skb_get_rx_queue(skb);
+-	else
+-		qid = netdev_pick_tx(dev, skb, NULL);
+-
+-	return qid;
+-}
+-
+ static void ena_config_host_info(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -2863,7 +2847,6 @@ static const struct net_device_ops ena_netdev_ops = {
+ 	.ndo_open		= ena_open,
+ 	.ndo_stop		= ena_close,
+ 	.ndo_start_xmit		= ena_start_xmit,
+-	.ndo_select_queue	= ena_select_queue,
+ 	.ndo_get_stats64	= ena_get_stats64,
+ 	.ndo_tx_timeout		= ena_tx_timeout,
+ 	.ndo_change_mtu		= ena_change_mtu,
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch b/queue-6.8/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
new file mode 100644
index 00000000000..4aae4fe2d01
--- /dev/null
+++ b/queue-6.8/net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
@@ -0,0 +1,84 @@
+From a0cacf1d3996ed5d6e15b668cdf82cc15bb1e446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 09:01:11 +0800
+Subject: net: hns3: fix kernel crash when 1588 is received on HIP08 devices
+
+From: Yonglong Liu <liuyonglong@huawei.com>
+
+[ Upstream commit 0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3 ]
+
+The HIP08 devices does not register the ptp devices, so the
+hdev->ptp is NULL, but the hardware can receive 1588 messages,
+and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the
+access of hdev->ptp->flags will cause a kernel crash:
+
+[ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
+[ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
+...
+[ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]
+[ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge]
+[ 5889.279101] sp : ffff800012c3bc50
+[ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040
+[ 5889.289927] x27: ffff800009116484 x26: 0000000080007500
+[ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000
+[ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000
+[ 5889.309134] x21: 0000000000000000 x20: ffff204004220080
+[ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000
+[ 5889.321897] x17: 0000000000000000 x16: 0000000000000000
+[ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000
+[ 5889.334617] x13: 0000000000000000 x12: 00000000010011df
+[ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000
+[ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d
+[ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480
+[ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000
+[ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000
+[ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080
+[ 5889.378857] Call trace:
+[ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]
+[ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3]
+[ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3]
+[ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3]
+[ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3]
+[ 5889.411084] napi_poll+0xcc/0x264
+[ 5889.415329] net_rx_action+0xd4/0x21c
+[ 5889.419911] __do_softirq+0x130/0x358
+[ 5889.424484] irq_exit+0x134/0x154
+[ 5889.428700] __handle_domain_irq+0x88/0xf0
+[ 5889.433684] gic_handle_irq+0x78/0x2c0
+[ 5889.438319] el1_irq+0xb8/0x140
+[ 5889.442354] arch_cpu_idle+0x18/0x40
+[ 5889.446816] default_idle_call+0x5c/0x1c0
+[ 5889.451714] cpuidle_idle_call+0x174/0x1b0
+[ 5889.456692] do_idle+0xc8/0x160
+[ 5889.460717] cpu_startup_entry+0x30/0xfc
+[ 5889.465523] secondary_start_kernel+0x158/0x1ec
+[ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80)
+[ 5889.477950] SMP: stopping secondary CPUs
+[ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95
+[ 5890.522951] Starting crashdump kernel...
+
+Fixes: 0bf5eb788512 ("net: hns3: add support for PTP")
+Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
+index 80a2a0073d97a..507d7ce26d831 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c
+@@ -108,7 +108,7 @@ void hclge_ptp_get_rx_hwts(struct hnae3_handle *handle, struct sk_buff *skb,
+ 	u64 ns = nsec;
+ 	u32 sec_h;
+ 
+-	if (!test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags))
++	if (!hdev->ptp || !test_bit(HCLGE_PTP_FLAG_RX_EN, &hdev->ptp->flags))
+ 		return;
+ 
+ 	/* Since the BD does not have enough space for the higher 16 bits of
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch b/queue-6.8/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
new file mode 100644
index 00000000000..92d74c7e0d4
--- /dev/null
+++ b/queue-6.8/net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
@@ -0,0 +1,44 @@
+From 34bba83491d0d8d7de44343a32ae49a055130876 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 09:01:14 +0800
+Subject: net: hns3: fix port duplex configure error in IMP reset
+
+From: Jie Wang <wangjie125@huawei.com>
+
+[ Upstream commit 11d80f79dd9f871a52feba4bf24b5ac39f448eb7 ]
+
+Currently, the mac port is fixed to configured as full dplex mode in
+hclge_mac_init() when driver initialization or reset restore. Users may
+change the mode to half duplex with ethtool,  so it may cause the user
+configuration dropped after reset.
+
+To fix it, don't change the duplex mode when resetting.
+
+Fixes: 2d03eacc0b7e ("net: hns3: Only update mac configuation when necessary")
+Signed-off-by: Jie Wang <wangjie125@huawei.com>
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 5ea9e59569eff..609d3799d7738 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -2890,7 +2890,10 @@ static int hclge_mac_init(struct hclge_dev *hdev)
+ 	int ret;
+ 
+ 	hdev->support_sfp_query = true;
+-	hdev->hw.mac.duplex = HCLGE_MAC_FULL;
++
++	if (!test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state))
++		hdev->hw.mac.duplex = HCLGE_MAC_FULL;
++
+ 	ret = hclge_cfg_mac_speed_dup_hw(hdev, hdev->hw.mac.speed,
+ 					 hdev->hw.mac.duplex, hdev->hw.mac.lane_num);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-hns3-fix-wrong-judgment-condition-issue.patch b/queue-6.8/net-hns3-fix-wrong-judgment-condition-issue.patch
new file mode 100644
index 00000000000..bd9fa75f04d
--- /dev/null
+++ b/queue-6.8/net-hns3-fix-wrong-judgment-condition-issue.patch
@@ -0,0 +1,36 @@
+From e06065da012a6db903df87b1026428255f9d5ddc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 09:01:08 +0800
+Subject: net: hns3: fix wrong judgment condition issue
+
+From: Jijie Shao <shaojijie@huawei.com>
+
+[ Upstream commit 07a1d6dc90baedcf5d713e2b003b9e387130ee30 ]
+
+In hns3_dcbnl_ieee_delapp, should check ieee_delapp not ieee_setapp.
+This path fix the wrong judgment.
+
+Fixes: 0ba22bcb222d ("net: hns3: add support config dscp map to tc")
+Signed-off-by: Jijie Shao <shaojijie@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_dcbnl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_dcbnl.c b/drivers/net/ethernet/hisilicon/hns3/hns3_dcbnl.c
+index 3b6dbf158b98d..f72dc0cee30e5 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_dcbnl.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_dcbnl.c
+@@ -76,7 +76,7 @@ static int hns3_dcbnl_ieee_delapp(struct net_device *ndev, struct dcb_app *app)
+ 	if (hns3_nic_resetting(ndev))
+ 		return -EBUSY;
+ 
+-	if (h->kinfo.dcb_ops->ieee_setapp)
++	if (h->kinfo.dcb_ops->ieee_delapp)
+ 		return h->kinfo.dcb_ops->ieee_delapp(h, app);
+ 
+ 	return -EOPNOTSUPP;
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch b/queue-6.8/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
new file mode 100644
index 00000000000..e653454e138
--- /dev/null
+++ b/queue-6.8/net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
@@ -0,0 +1,125 @@
+From 99891a6b5606acafd5f14d1a77b11c9dc41d9d1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 10:07:16 +0000
+Subject: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b0ec2abf98267f14d032102551581c833b0659d3 ]
+
+Apply the same fix than ones found in :
+
+8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()")
+1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()")
+
+We have to save skb->network_header in a temporary variable
+in order to be able to recompute the network_header pointer
+after a pskb_inet_may_pull() call.
+
+pskb_inet_may_pull() makes sure the needed headers are in skb->head.
+
+syzbot reported:
+BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
+ BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
+ BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]
+ BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409
+  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
+  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
+  IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline]
+  ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409
+  __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389
+  ipgre_rcv net/ipv4/ip_gre.c:411 [inline]
+  gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447
+  gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163
+  ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205
+  ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233
+  NF_HOOK include/linux/netfilter.h:314 [inline]
+  ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254
+  dst_input include/net/dst.h:461 [inline]
+  ip_rcv_finish net/ipv4/ip_input.c:449 [inline]
+  NF_HOOK include/linux/netfilter.h:314 [inline]
+  ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569
+  __netif_receive_skb_one_core net/core/dev.c:5534 [inline]
+  __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648
+  netif_receive_skb_internal net/core/dev.c:5734 [inline]
+  netif_receive_skb+0x58/0x660 net/core/dev.c:5793
+  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556
+  tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009
+  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055
+  call_write_iter include/linux/fs.h:2087 [inline]
+  new_sync_write fs/read_write.c:497 [inline]
+  vfs_write+0xb6b/0x1520 fs/read_write.c:590
+  ksys_write+0x20f/0x4c0 fs/read_write.c:643
+  __do_sys_write fs/read_write.c:655 [inline]
+  __se_sys_write fs/read_write.c:652 [inline]
+  __x64_sys_write+0x93/0xd0 fs/read_write.c:652
+  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+Uninit was created at:
+  __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590
+  alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133
+  alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204
+  skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909
+  tun_build_skb drivers/net/tun.c:1686 [inline]
+  tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826
+  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055
+  call_write_iter include/linux/fs.h:2087 [inline]
+  new_sync_write fs/read_write.c:497 [inline]
+  vfs_write+0xb6b/0x1520 fs/read_write.c:590
+  ksys_write+0x20f/0x4c0 fs/read_write.c:643
+  __do_sys_write fs/read_write.c:655 [inline]
+  __se_sys_write fs/read_write.c:652 [inline]
+  __x64_sys_write+0x93/0xd0 fs/read_write.c:652
+  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+  do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 1b6981de3f295..7af36e4f1647d 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -378,7 +378,7 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+ 		  bool log_ecn_error)
+ {
+ 	const struct iphdr *iph = ip_hdr(skb);
+-	int err;
++	int nh, err;
+ 
+ #ifdef CONFIG_NET_IPGRE_BROADCAST
+ 	if (ipv4_is_multicast(iph->daddr)) {
+@@ -404,8 +404,21 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+ 		tunnel->i_seqno = ntohl(tpi->seq) + 1;
+ 	}
+ 
++	/* Save offset of outer header relative to skb->head,
++	 * because we are going to reset the network header to the inner header
++	 * and might change skb->head.
++	 */
++	nh = skb_network_header(skb) - skb->head;
++
+ 	skb_set_network_header(skb, (tunnel->dev->type == ARPHRD_ETHER) ? ETH_HLEN : 0);
+ 
++	if (!pskb_inet_may_pull(skb)) {
++		DEV_STATS_INC(tunnel->dev, rx_length_errors);
++		DEV_STATS_INC(tunnel->dev, rx_errors);
++		goto drop;
++	}
++	iph = (struct iphdr *)(skb->head + nh);
++
+ 	err = IP_ECN_decapsulate(iph, skb);
+ 	if (unlikely(err)) {
+ 		if (log_ecn_error)
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch b/queue-6.8/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
new file mode 100644
index 00000000000..dcc07b0b43c
--- /dev/null
+++ b/queue-6.8/net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
@@ -0,0 +1,45 @@
+From 53b6cb0621949db735407b4f69c22839de4510fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: net: kcm: fix incorrect parameter validation in the kcm_getsockopt)
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 3ed5f415133f9b7518fbe55ba9ae9a3f5e700929 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/kcm/kcmsock.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index 1184d40167b86..eda933c097926 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -1152,10 +1152,11 @@ static int kcm_getsockopt(struct socket *sock, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	switch (optname) {
+ 	case KCM_RECV_DISABLE:
+ 		val = kcm->rx_disabled;
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-mctp-copy-skb-ext-data-when-fragmenting.patch b/queue-6.8/net-mctp-copy-skb-ext-data-when-fragmenting.patch
new file mode 100644
index 00000000000..68fdfc836f2
--- /dev/null
+++ b/queue-6.8/net-mctp-copy-skb-ext-data-when-fragmenting.patch
@@ -0,0 +1,62 @@
+From 2198dae438fc70978de0c44febedadde50ef612f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 17:51:54 +0800
+Subject: net: mctp: copy skb ext data when fragmenting
+
+From: Jeremy Kerr <jk@codeconstruct.com.au>
+
+[ Upstream commit 1394c1dec1c619a46867ed32791a29695372bff8 ]
+
+If we're fragmenting on local output, the original packet may contain
+ext data for the MCTP flows. We'll want this in the resulting fragment
+skbs too.
+
+So, do a skb_ext_copy() in the fragmentation path, and implement the
+MCTP-specific parts of an ext copy operation.
+
+Fixes: 67737c457281 ("mctp: Pass flow data & flow release events to drivers")
+Reported-by: Jian Zhang <zhangjian.3032@bytedance.com>
+Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 8 ++++++++
+ net/mctp/route.c  | 3 +++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index edbbef563d4d9..71dee435d549d 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -6736,6 +6736,14 @@ static struct skb_ext *skb_ext_maybe_cow(struct skb_ext *old,
+ 		for (i = 0; i < sp->len; i++)
+ 			xfrm_state_hold(sp->xvec[i]);
+ 	}
++#endif
++#ifdef CONFIG_MCTP_FLOWS
++	if (old_active & (1 << SKB_EXT_MCTP)) {
++		struct mctp_flow *flow = skb_ext_get_ptr(old, SKB_EXT_MCTP);
++
++		if (flow->key)
++			refcount_inc(&flow->key->refs);
++	}
+ #endif
+ 	__skb_ext_put(old);
+ 	return new;
+diff --git a/net/mctp/route.c b/net/mctp/route.c
+index ceee44ea09d97..01c530dbc1a65 100644
+--- a/net/mctp/route.c
++++ b/net/mctp/route.c
+@@ -843,6 +843,9 @@ static int mctp_do_fragment_route(struct mctp_route *rt, struct sk_buff *skb,
+ 		/* copy message payload */
+ 		skb_copy_bits(skb, pos, skb_transport_header(skb2), size);
+ 
++		/* we need to copy the extensions, for MCTP flow data */
++		skb_ext_copy(skb2, skb);
++
+ 		/* do route */
+ 		rc = rt->output(rt, skb2);
+ 		if (rc)
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch b/queue-6.8/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
new file mode 100644
index 00000000000..e7362b6f88f
--- /dev/null
+++ b/queue-6.8/net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
@@ -0,0 +1,91 @@
+From e5f01ce1967c7f890645404356a41d04823b7e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 12:06:08 +0100
+Subject: net: phy: dp83822: Fix RGMII TX delay configuration
+
+From: Tim Pambor <tp@osasysteme.de>
+
+[ Upstream commit c8a5c731fd1223090af57da33838c671a7fc6a78 ]
+
+The logic for enabling the TX clock shift is inverse of enabling the RX
+clock shift. The TX clock shift is disabled when DP83822_TX_CLK_SHIFT is
+set. Correct the current behavior and always write the delay configuration
+to ensure consistent delay settings regardless of bootloader configuration.
+
+Reference: https://www.ti.com/lit/ds/symlink/dp83822i.pdf p. 69
+
+Fixes: 8095295292b5 ("net: phy: DP83822: Add setting the fixed internal delay")
+Signed-off-by: Tim Pambor <tp@osasysteme.de>
+Link: https://lore.kernel.org/r/20240305110608.104072-1-tp@osasysteme.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83822.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c
+index b7cb71817780c..29e1cbea6dc0c 100644
+--- a/drivers/net/phy/dp83822.c
++++ b/drivers/net/phy/dp83822.c
+@@ -380,7 +380,7 @@ static int dp83822_config_init(struct phy_device *phydev)
+ {
+ 	struct dp83822_private *dp83822 = phydev->priv;
+ 	struct device *dev = &phydev->mdio.dev;
+-	int rgmii_delay;
++	int rgmii_delay = 0;
+ 	s32 rx_int_delay;
+ 	s32 tx_int_delay;
+ 	int err = 0;
+@@ -390,30 +390,33 @@ static int dp83822_config_init(struct phy_device *phydev)
+ 		rx_int_delay = phy_get_internal_delay(phydev, dev, NULL, 0,
+ 						      true);
+ 
+-		if (rx_int_delay <= 0)
+-			rgmii_delay = 0;
+-		else
+-			rgmii_delay = DP83822_RX_CLK_SHIFT;
++		/* Set DP83822_RX_CLK_SHIFT to enable rx clk internal delay */
++		if (rx_int_delay > 0)
++			rgmii_delay |= DP83822_RX_CLK_SHIFT;
+ 
+ 		tx_int_delay = phy_get_internal_delay(phydev, dev, NULL, 0,
+ 						      false);
++
++		/* Set DP83822_TX_CLK_SHIFT to disable tx clk internal delay */
+ 		if (tx_int_delay <= 0)
+-			rgmii_delay &= ~DP83822_TX_CLK_SHIFT;
+-		else
+ 			rgmii_delay |= DP83822_TX_CLK_SHIFT;
+ 
+-		if (rgmii_delay) {
+-			err = phy_set_bits_mmd(phydev, DP83822_DEVADDR,
+-					       MII_DP83822_RCSR, rgmii_delay);
+-			if (err)
+-				return err;
+-		}
++		err = phy_modify_mmd(phydev, DP83822_DEVADDR, MII_DP83822_RCSR,
++				     DP83822_RX_CLK_SHIFT | DP83822_TX_CLK_SHIFT, rgmii_delay);
++		if (err)
++			return err;
++
++		err = phy_set_bits_mmd(phydev, DP83822_DEVADDR,
++				       MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
+ 
+-		phy_set_bits_mmd(phydev, DP83822_DEVADDR,
+-					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
++		if (err)
++			return err;
+ 	} else {
+-		phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
+-					MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
++		err = phy_clear_bits_mmd(phydev, DP83822_DEVADDR,
++					 MII_DP83822_RCSR, DP83822_RGMII_MODE_EN);
++
++		if (err)
++			return err;
+ 	}
+ 
+ 	if (dp83822->fx_enabled) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch b/queue-6.8/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
new file mode 100644
index 00000000000..03e9c8ee8c9
--- /dev/null
+++ b/queue-6.8/net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
@@ -0,0 +1,48 @@
+From 92a8368433b760908148953ff5c9aa1416c6d02d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 12:19:06 +0100
+Subject: net: phy: fix phy_get_internal_delay accessing an empty array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kévin L'hôpital <kevin.lhopital@savoirfairelinux.com>
+
+[ Upstream commit 4469c0c5b14a0919f5965c7ceac96b523eb57b79 ]
+
+The phy_get_internal_delay function could try to access to an empty
+array in the case that the driver is calling phy_get_internal_delay
+without defining delay_values and rx-internal-delay-ps or
+tx-internal-delay-ps is defined to 0 in the device-tree.
+This will lead to "unable to handle kernel NULL pointer dereference at
+virtual address 0". To avoid this kernel oops, the test should be delay
+>= 0. As there is already delay < 0 test just before, the test could
+only be size == 0.
+
+Fixes: 92252eec913b ("net: phy: Add a helper to return the index for of the internal delay")
+Co-developed-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Signed-off-by: Enguerrand de Ribaucourt <enguerrand.de-ribaucourt@savoirfairelinux.com>
+Signed-off-by: Kévin L'hôpital <kevin.lhopital@savoirfairelinux.com>
+Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 3611ea64875ef..3ad9bbf65cbeb 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -2959,7 +2959,7 @@ s32 phy_get_internal_delay(struct phy_device *phydev, struct device *dev,
+ 	if (delay < 0)
+ 		return delay;
+ 
+-	if (delay && size == 0)
++	if (size == 0)
+ 		return delay;
+ 
+ 	if (delay < delay_values[0] || delay > delay_values[size - 1]) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch b/queue-6.8/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
new file mode 100644
index 00000000000..f686e9de468
--- /dev/null
+++ b/queue-6.8/net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
@@ -0,0 +1,42 @@
+From 5df56c43ce9ebc8d0e32755b279f1da6dda32dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 23:58:20 +0200
+Subject: net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit d6f4de70f73a106986ee315d7d512539f2f3303a ]
+
+The intent is to check if the strings' are truncated or not. So, >= should
+be used instead of >, because strlcat() and snprintf() return the length of
+the output, excluding the trailing NULL.
+
+Fixes: a02d69261134 ("SUNRPC: Provide functions for managing universal addresses")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/addr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/sunrpc/addr.c b/net/sunrpc/addr.c
+index d435bffc61999..97ff11973c493 100644
+--- a/net/sunrpc/addr.c
++++ b/net/sunrpc/addr.c
+@@ -284,10 +284,10 @@ char *rpc_sockaddr2uaddr(const struct sockaddr *sap, gfp_t gfp_flags)
+ 	}
+ 
+ 	if (snprintf(portbuf, sizeof(portbuf),
+-		     ".%u.%u", port >> 8, port & 0xff) > (int)sizeof(portbuf))
++		     ".%u.%u", port >> 8, port & 0xff) >= (int)sizeof(portbuf))
+ 		return NULL;
+ 
+-	if (strlcat(addrbuf, portbuf, sizeof(addrbuf)) > sizeof(addrbuf))
++	if (strlcat(addrbuf, portbuf, sizeof(addrbuf)) >= sizeof(addrbuf))
+ 		return NULL;
+ 
+ 	return kstrdup(addrbuf, gfp_flags);
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-test-fix-printf-format-specifier-in-skb_segment-.patch b/queue-6.8/net-test-fix-printf-format-specifier-in-skb_segment-.patch
new file mode 100644
index 00000000000..2e38bf420e4
--- /dev/null
+++ b/queue-6.8/net-test-fix-printf-format-specifier-in-skb_segment-.patch
@@ -0,0 +1,43 @@
+From f31145b793c840ce6f831abd75b1888f3640c6b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:19 +0800
+Subject: net: test: Fix printf format specifier in skb_segment kunit test
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit ff3b96f2c9e5c24fca12239cd519a8a18569e687 ]
+
+KUNIT_FAIL() accepts a printf-style format string, but previously did
+not let gcc validate it with the __printf() attribute. The use of %lld
+for the result of PTR_ERR() is not correct.
+
+Instead, use %pe and pass the actual error pointer. printk() will format
+it correctly (and give a symbolic name rather than a number if
+available, which should make the output more readable, too).
+
+Fixes: b3098d32ed6e ("net: add skb_segment kunit test")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/gso_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/gso_test.c b/net/core/gso_test.c
+index 4c2e77bd12f4b..358c44680d917 100644
+--- a/net/core/gso_test.c
++++ b/net/core/gso_test.c
+@@ -225,7 +225,7 @@ static void gso_test_func(struct kunit *test)
+ 
+ 	segs = skb_segment(skb, features);
+ 	if (IS_ERR(segs)) {
+-		KUNIT_FAIL(test, "segs error %lld", PTR_ERR(segs));
++		KUNIT_FAIL(test, "segs error %pe", segs);
+ 		goto free_gso_skb;
+ 	} else if (!segs) {
+ 		KUNIT_FAIL(test, "no segments");
+-- 
+2.43.0
+
diff --git a/queue-6.8/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch b/queue-6.8/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
new file mode 100644
index 00000000000..b92326da5b9
--- /dev/null
+++ b/queue-6.8/net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
@@ -0,0 +1,47 @@
+From cb253daebb82a277fcab5eb86dce128241443e1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: net/x25: fix incorrect parameter validation in the x25_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit d6eb8de2015f0c24822e47356f839167ebde2945 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index f7a7c7798c3b2..d18d51412cc00 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -460,12 +460,12 @@ static int x25_getsockopt(struct socket *sock, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		goto out;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	rc = -EINVAL;
+ 	if (len < 0)
+ 		goto out;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	rc = -EFAULT;
+ 	if (put_user(len, optlen))
+ 		goto out;
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfp-flower-handle-acti_netdevs-allocation-failure.patch b/queue-6.8/nfp-flower-handle-acti_netdevs-allocation-failure.patch
new file mode 100644
index 00000000000..e759c7dc72a
--- /dev/null
+++ b/queue-6.8/nfp-flower-handle-acti_netdevs-allocation-failure.patch
@@ -0,0 +1,45 @@
+From caa188c8d6bc31fd81b082162b638d98f17c1d71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 22:25:40 +0800
+Subject: nfp: flower: handle acti_netdevs allocation failure
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit 84e95149bd341705f0eca6a7fcb955c548805002 ]
+
+The kmalloc_array() in nfp_fl_lag_do_work() will return null, if
+the physical memory has run out. As a result, if we dereference
+the acti_netdevs, the null pointer dereference bugs will happen.
+
+This patch adds a check to judge whether allocation failure occurs.
+If it happens, the delayed work will be rescheduled and try again.
+
+Fixes: bb9a8d031140 ("nfp: flower: monitor and offload LAG groups")
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reviewed-by: Louis Peens <louis.peens@corigine.com>
+Link: https://lore.kernel.org/r/20240308142540.9674-1-duoming@zju.edu.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/flower/lag_conf.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
+index 361d7c495e2d8..2c7bd6e80d993 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/lag_conf.c
+@@ -337,6 +337,11 @@ static void nfp_fl_lag_do_work(struct work_struct *work)
+ 
+ 		acti_netdevs = kmalloc_array(entry->slave_cnt,
+ 					     sizeof(*acti_netdevs), GFP_KERNEL);
++		if (!acti_netdevs) {
++			schedule_delayed_work(&lag->work,
++					      NFP_FL_LAG_DELAY);
++			continue;
++		}
+ 
+ 		/* Include sanity check in the loop. It may be that a bond has
+ 		 * changed between processing the last notification and the
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfs-fix-an-off-by-one-in-root_nfs_cat.patch b/queue-6.8/nfs-fix-an-off-by-one-in-root_nfs_cat.patch
new file mode 100644
index 00000000000..a402c5dbadb
--- /dev/null
+++ b/queue-6.8/nfs-fix-an-off-by-one-in-root_nfs_cat.patch
@@ -0,0 +1,42 @@
+From ff83c0d9689b27aa5300cf478a848833662f1984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Feb 2024 22:16:53 +0100
+Subject: NFS: Fix an off by one in root_nfs_cat()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 698ad1a538da0b6bf969cfee630b4e3a026afb87 ]
+
+The intent is to check if 'dest' is truncated or not. So, >= should be
+used instead of >, because strlcat() returns the length of 'dest' and 'src'
+excluding the trailing NULL.
+
+Fixes: 56463e50d1fc ("NFS: Use super.c for NFSROOT mount option parsing")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfsroot.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c
+index 7600100ba26f0..432612d224374 100644
+--- a/fs/nfs/nfsroot.c
++++ b/fs/nfs/nfsroot.c
+@@ -175,10 +175,10 @@ static int __init root_nfs_cat(char *dest, const char *src,
+ 	size_t len = strlen(dest);
+ 
+ 	if (len && dest[len - 1] != ',')
+-		if (strlcat(dest, ",", destlen) > destlen)
++		if (strlcat(dest, ",", destlen) >= destlen)
+ 			return -1;
+ 
+-	if (strlcat(dest, src, destlen) > destlen)
++	if (strlcat(dest, src, destlen) >= destlen)
+ 		return -1;
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfs-fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch b/queue-6.8/nfs-fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch
new file mode 100644
index 00000000000..8669ee93679
--- /dev/null
+++ b/queue-6.8/nfs-fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch
@@ -0,0 +1,157 @@
+From 527030f049a12e016c4a07fbfdbda5ec6ffc18df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 11:10:06 -0500
+Subject: NFS: Fix nfs_netfs_issue_read() xarray locking for writeback
+ interrupt
+
+From: Dave Wysochanski <dwysocha@redhat.com>
+
+[ Upstream commit fd5860ab6341506004219b080aea40213b299d2e ]
+
+The loop inside nfs_netfs_issue_read() currently does not disable
+interrupts while iterating through pages in the xarray to submit
+for NFS read.  This is not safe though since after taking xa_lock,
+another page in the mapping could be processed for writeback inside
+an interrupt, and deadlock can occur.  The fix is simple and clean
+if we use xa_for_each_range(), which handles the iteration with RCU
+while reducing code complexity.
+
+The problem is easily reproduced with the following test:
+ mount -o vers=3,fsc 127.0.0.1:/export /mnt/nfs
+ dd if=/dev/zero of=/mnt/nfs/file1.bin bs=4096 count=1
+ echo 3 > /proc/sys/vm/drop_caches
+ dd if=/mnt/nfs/file1.bin of=/dev/null
+ umount /mnt/nfs
+
+On the console with a lockdep-enabled kernel a message similar to
+the following will be seen:
+
+ ================================
+ WARNING: inconsistent lock state
+ 6.7.0-lockdbg+ #10 Not tainted
+ --------------------------------
+ inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
+ test5/1708 [HC0[0]:SC0[0]:HE1:SE1] takes:
+ ffff888127baa598 (&xa->xa_lock#4){+.?.}-{3:3}, at:
+nfs_netfs_issue_read+0x1b2/0x4b0 [nfs]
+ {IN-SOFTIRQ-W} state was registered at:
+   lock_acquire+0x144/0x380
+   _raw_spin_lock_irqsave+0x4e/0xa0
+   __folio_end_writeback+0x17e/0x5c0
+   folio_end_writeback+0x93/0x1b0
+   iomap_finish_ioend+0xeb/0x6a0
+   blk_update_request+0x204/0x7f0
+   blk_mq_end_request+0x30/0x1c0
+   blk_complete_reqs+0x7e/0xa0
+   __do_softirq+0x113/0x544
+   __irq_exit_rcu+0xfe/0x120
+   irq_exit_rcu+0xe/0x20
+   sysvec_call_function_single+0x6f/0x90
+   asm_sysvec_call_function_single+0x1a/0x20
+   pv_native_safe_halt+0xf/0x20
+   default_idle+0x9/0x20
+   default_idle_call+0x67/0xa0
+   do_idle+0x2b5/0x300
+   cpu_startup_entry+0x34/0x40
+   start_secondary+0x19d/0x1c0
+   secondary_startup_64_no_verify+0x18f/0x19b
+ irq event stamp: 176891
+ hardirqs last  enabled at (176891): [<ffffffffa67a0be4>]
+_raw_spin_unlock_irqrestore+0x44/0x60
+ hardirqs last disabled at (176890): [<ffffffffa67a0899>]
+_raw_spin_lock_irqsave+0x79/0xa0
+ softirqs last  enabled at (176646): [<ffffffffa515d91e>]
+__irq_exit_rcu+0xfe/0x120
+ softirqs last disabled at (176633): [<ffffffffa515d91e>]
+__irq_exit_rcu+0xfe/0x120
+
+ other info that might help us debug this:
+  Possible unsafe locking scenario:
+
+        CPU0
+        ----
+   lock(&xa->xa_lock#4);
+   <Interrupt>
+     lock(&xa->xa_lock#4);
+
+  *** DEADLOCK ***
+
+ 2 locks held by test5/1708:
+  #0: ffff888127baa498 (&sb->s_type->i_mutex_key#22){++++}-{4:4}, at:
+      nfs_start_io_read+0x28/0x90 [nfs]
+  #1: ffff888127baa650 (mapping.invalidate_lock#3){.+.+}-{4:4}, at:
+      page_cache_ra_unbounded+0xa4/0x280
+
+ stack backtrace:
+ CPU: 6 PID: 1708 Comm: test5 Kdump: loaded Not tainted 6.7.0-lockdbg+
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39
+04/01/2014
+ Call Trace:
+  dump_stack_lvl+0x5b/0x90
+  mark_lock+0xb3f/0xd20
+  __lock_acquire+0x77b/0x3360
+  _raw_spin_lock+0x34/0x80
+  nfs_netfs_issue_read+0x1b2/0x4b0 [nfs]
+  netfs_begin_read+0x77f/0x980 [netfs]
+  nfs_netfs_readahead+0x45/0x60 [nfs]
+  nfs_readahead+0x323/0x5a0 [nfs]
+  read_pages+0xf3/0x5c0
+  page_cache_ra_unbounded+0x1c8/0x280
+  filemap_get_pages+0x38c/0xae0
+  filemap_read+0x206/0x5e0
+  nfs_file_read+0xb7/0x140 [nfs]
+  vfs_read+0x2a9/0x460
+  ksys_read+0xb7/0x140
+
+Fixes: 000dbe0bec05 ("NFS: Convert buffered read paths to use netfs when fscache is enabled")
+Suggested-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/fscache.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index 2d1bfee225c36..ddc1ee0319554 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -301,11 +301,11 @@ static void nfs_netfs_issue_read(struct netfs_io_subrequest *sreq)
+ 	struct inode *inode = sreq->rreq->inode;
+ 	struct nfs_open_context *ctx = sreq->rreq->netfs_priv;
+ 	struct page *page;
++	unsigned long idx;
+ 	int err;
+ 	pgoff_t start = (sreq->start + sreq->transferred) >> PAGE_SHIFT;
+ 	pgoff_t last = ((sreq->start + sreq->len -
+ 			 sreq->transferred - 1) >> PAGE_SHIFT);
+-	XA_STATE(xas, &sreq->rreq->mapping->i_pages, start);
+ 
+ 	nfs_pageio_init_read(&pgio, inode, false,
+ 			     &nfs_async_read_completion_ops);
+@@ -316,19 +316,14 @@ static void nfs_netfs_issue_read(struct netfs_io_subrequest *sreq)
+ 
+ 	pgio.pg_netfs = netfs; /* used in completion */
+ 
+-	xas_lock(&xas);
+-	xas_for_each(&xas, page, last) {
++	xa_for_each_range(&sreq->rreq->mapping->i_pages, idx, page, start, last) {
+ 		/* nfs_read_add_folio() may schedule() due to pNFS layout and other RPCs  */
+-		xas_pause(&xas);
+-		xas_unlock(&xas);
+ 		err = nfs_read_add_folio(&pgio, ctx, page_folio(page));
+ 		if (err < 0) {
+ 			netfs->error = err;
+ 			goto out;
+ 		}
+-		xas_lock(&xas);
+ 	}
+-	xas_unlock(&xas);
+ out:
+ 	nfs_pageio_complete_read(&pgio);
+ 	nfs_netfs_put(netfs);
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch b/queue-6.8/nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch
new file mode 100644
index 00000000000..86c8c20b843
--- /dev/null
+++ b/queue-6.8/nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch
@@ -0,0 +1,96 @@
+From 1585ceff749f63884269c2bc3cc00ab7108e9d98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Mar 2024 11:11:53 -0400
+Subject: nfs: fix panic when nfs4_ff_layout_prepare_ds() fails
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit 719fcafe07c12646691bd62d7f8d94d657fa0766 ]
+
+We've been seeing the following panic in production
+
+BUG: kernel NULL pointer dereference, address: 0000000000000065
+PGD 2f485f067 P4D 2f485f067 PUD 2cc5d8067 PMD 0
+RIP: 0010:ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles]
+Call Trace:
+ <TASK>
+ ? __die+0x78/0xc0
+ ? page_fault_oops+0x286/0x380
+ ? __rpc_execute+0x2c3/0x470 [sunrpc]
+ ? rpc_new_task+0x42/0x1c0 [sunrpc]
+ ? exc_page_fault+0x5d/0x110
+ ? asm_exc_page_fault+0x22/0x30
+ ? ff_layout_free_layoutreturn+0x110/0x110 [nfs_layout_flexfiles]
+ ? ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles]
+ ? ff_layout_cancel_io+0x6f/0x90 [nfs_layout_flexfiles]
+ pnfs_mark_matching_lsegs_return+0x1b0/0x360 [nfsv4]
+ pnfs_error_mark_layout_for_return+0x9e/0x110 [nfsv4]
+ ? ff_layout_send_layouterror+0x50/0x160 [nfs_layout_flexfiles]
+ nfs4_ff_layout_prepare_ds+0x11f/0x290 [nfs_layout_flexfiles]
+ ff_layout_pg_init_write+0xf0/0x1f0 [nfs_layout_flexfiles]
+ __nfs_pageio_add_request+0x154/0x6c0 [nfs]
+ nfs_pageio_add_request+0x26b/0x380 [nfs]
+ nfs_do_writepage+0x111/0x1e0 [nfs]
+ nfs_writepages_callback+0xf/0x30 [nfs]
+ write_cache_pages+0x17f/0x380
+ ? nfs_pageio_init_write+0x50/0x50 [nfs]
+ ? nfs_writepages+0x6d/0x210 [nfs]
+ ? nfs_writepages+0x6d/0x210 [nfs]
+ nfs_writepages+0x125/0x210 [nfs]
+ do_writepages+0x67/0x220
+ ? generic_perform_write+0x14b/0x210
+ filemap_fdatawrite_wbc+0x5b/0x80
+ file_write_and_wait_range+0x6d/0xc0
+ nfs_file_fsync+0x81/0x170 [nfs]
+ ? nfs_file_mmap+0x60/0x60 [nfs]
+ __x64_sys_fsync+0x53/0x90
+ do_syscall_64+0x3d/0x90
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Inspecting the core with drgn I was able to pull this
+
+  >>> prog.crashed_thread().stack_trace()[0]
+  #0 at 0xffffffffa079657a (ff_layout_cancel_io+0x3a/0x84) in ff_layout_cancel_io at fs/nfs/flexfilelayout/flexfilelayout.c:2021:27
+  >>> prog.crashed_thread().stack_trace()[0]['idx']
+  (u32)1
+  >>> prog.crashed_thread().stack_trace()[0]['flseg'].mirror_array[1].mirror_ds
+  (struct nfs4_ff_layout_ds *)0xffffffffffffffed
+
+This is clear from the stack trace, we call nfs4_ff_layout_prepare_ds()
+which could error out initializing the mirror_ds, and then we go to
+clean it all up and our check is only for if (!mirror->mirror_ds).  This
+is inconsistent with the rest of the users of mirror_ds, which have
+
+  if (IS_ERR_OR_NULL(mirror_ds))
+
+to keep from tripping over this exact scenario.  Fix this up in
+ff_layout_cancel_io() to make sure we don't panic when we get an error.
+I also spot checked all the other instances of checking mirror_ds and we
+appear to be doing the correct checks everywhere, only unconditionally
+dereferencing mirror_ds when we know it would be valid.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Fixes: b739a5bd9d9f ("NFSv4/flexfiles: Cancel I/O if the layout is recalled or revoked")
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index ef817a0475ffa..3e724cb7ef01d 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -2016,7 +2016,7 @@ static void ff_layout_cancel_io(struct pnfs_layout_segment *lseg)
+ 	for (idx = 0; idx < flseg->mirror_array_cnt; idx++) {
+ 		mirror = flseg->mirror_array[idx];
+ 		mirror_ds = mirror->mirror_ds;
+-		if (!mirror_ds)
++		if (IS_ERR_OR_NULL(mirror_ds))
+ 			continue;
+ 		ds = mirror->mirror_ds->ds;
+ 		if (!ds)
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfsv4.1-pnfs-fix-nfs-with-tls-in-pnfs.patch b/queue-6.8/nfsv4.1-pnfs-fix-nfs-with-tls-in-pnfs.patch
new file mode 100644
index 00000000000..86342f7d499
--- /dev/null
+++ b/queue-6.8/nfsv4.1-pnfs-fix-nfs-with-tls-in-pnfs.patch
@@ -0,0 +1,112 @@
+From 664357fa1f12e22a43b0b768376c2d06e5be6fb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Feb 2024 18:25:34 -0500
+Subject: NFSv4.1/pnfs: fix NFS with TLS in pnfs
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit a35518cae4b325632840bc8c3aa9ad9bac430038 ]
+
+Currently, even though xprtsec=tls is specified and used for operations
+to MDS, any operations that go to DS travel over unencrypted connection.
+Or additionally, if more than 1 DS can serve the data, then trunked
+connections are also done unencrypted.
+
+IN GETDEVINCEINFO, we get an entry for the DS which carries a protocol
+type (which is TCP), then nfs4_set_ds_client() gets called with TCP
+instead of TCP with TLS.
+
+Currently, each trunked connection is created and uses clp->cl_hostname
+value which if TLS is used would get passed up in the handshake upcall,
+but instead we need to pass in the appropriate trunked address value.
+
+Fixes: c8407f2e560c ("NFS: Add an "xprtsec=" NFS mount option")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs_nfs.c | 44 +++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 43 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c
+index afd23910f3bff..88e061bd711b7 100644
+--- a/fs/nfs/pnfs_nfs.c
++++ b/fs/nfs/pnfs_nfs.c
+@@ -919,6 +919,8 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,
+ 	dprintk("--> %s DS %s\n", __func__, ds->ds_remotestr);
+ 
+ 	list_for_each_entry(da, &ds->ds_addrs, da_node) {
++		char servername[48];
++
+ 		dprintk("%s: DS %s: trying address %s\n",
+ 			__func__, ds->ds_remotestr, da->da_remotestr);
+ 
+@@ -929,6 +931,7 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,
+ 				.dstaddr = (struct sockaddr *)&da->da_addr,
+ 				.addrlen = da->da_addrlen,
+ 				.servername = clp->cl_hostname,
++				.xprtsec = clp->cl_xprtsec,
+ 			};
+ 			struct nfs4_add_xprt_data xprtdata = {
+ 				.clp = clp,
+@@ -938,10 +941,45 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,
+ 				.data = &xprtdata,
+ 			};
+ 
+-			if (da->da_transport != clp->cl_proto)
++			if (da->da_transport != clp->cl_proto &&
++					clp->cl_proto != XPRT_TRANSPORT_TCP_TLS)
+ 				continue;
++			if (da->da_transport == XPRT_TRANSPORT_TCP &&
++				mds_srv->nfs_client->cl_proto ==
++					XPRT_TRANSPORT_TCP_TLS) {
++				struct sockaddr *addr =
++					(struct sockaddr *)&da->da_addr;
++				struct sockaddr_in *sin =
++					(struct sockaddr_in *)&da->da_addr;
++				struct sockaddr_in6 *sin6 =
++					(struct sockaddr_in6 *)&da->da_addr;
++
++				/* for NFS with TLS we need to supply a correct
++				 * servername of the trunked transport, not the
++				 * servername of the main transport stored in
++				 * clp->cl_hostname. And set the protocol to
++				 * indicate to use TLS
++				 */
++				servername[0] = '\0';
++				switch(addr->sa_family) {
++				case AF_INET:
++					snprintf(servername, sizeof(servername),
++						"%pI4", &sin->sin_addr.s_addr);
++					break;
++				case AF_INET6:
++					snprintf(servername, sizeof(servername),
++						"%pI6", &sin6->sin6_addr);
++					break;
++				default:
++					/* do not consider this address */
++					continue;
++				}
++				xprt_args.ident = XPRT_TRANSPORT_TCP_TLS;
++				xprt_args.servername = servername;
++			}
+ 			if (da->da_addr.ss_family != clp->cl_addr.ss_family)
+ 				continue;
++
+ 			/**
+ 			* Test this address for session trunking and
+ 			* add as an alias
+@@ -953,6 +991,10 @@ static int _nfs4_pnfs_v4_ds_connect(struct nfs_server *mds_srv,
+ 			if (xprtdata.cred)
+ 				put_cred(xprtdata.cred);
+ 		} else {
++			if (da->da_transport == XPRT_TRANSPORT_TCP &&
++				mds_srv->nfs_client->cl_proto ==
++					XPRT_TRANSPORT_TCP_TLS)
++				da->da_transport = XPRT_TRANSPORT_TCP_TLS;
+ 			clp = nfs4_set_ds_client(mds_srv,
+ 						&da->da_addr,
+ 						da->da_addrlen,
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch b/queue-6.8/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
new file mode 100644
index 00000000000..acc6ca45dff
--- /dev/null
+++ b/queue-6.8/nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
@@ -0,0 +1,60 @@
+From 3f66477308f94fc888a667d23305d3aef00d191a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 07:51:28 -0700
+Subject: NFSv4.2: fix listxattr maximum XDR buffer size
+
+From: Jorge Mora <jmora1300@gmail.com>
+
+[ Upstream commit bcac8bff90a6ee1629f90669cdb9d28fb86049b0 ]
+
+Switch order of operations to avoid creating a short XDR buffer:
+e.g., buflen = 12, old xdrlen = 12, new xdrlen = 20.
+
+Having a short XDR buffer leads to lxa_maxcount be a few bytes
+less than what is needed to retrieve the whole list when using
+a buflen as returned by a call with size = 0:
+    buflen = listxattr(path, NULL, 0);
+    buf = malloc(buflen);
+    buflen = listxattr(path, buf, buflen);
+
+For a file with one attribute (name = '123456'), the first call
+with size = 0 will return buflen = 12 ('user.123456\x00').
+The second call with size = 12, sends LISTXATTRS with
+lxa_maxcount = 12 + 8 (cookie) + 4 (array count) = 24. The
+XDR buffer needs 8 (cookie) + 4 (array count) + 4 (name count)
++ 6 (name len) + 2 (padding) + 4 (eof) = 28 which is 4 bytes
+shorter than the lxa_maxcount provided in the call.
+
+Fixes: 04a5da690e8f ("NFSv4.2: define limits and sizes for user xattr handling")
+Signed-off-by: Jorge Mora <mora@netapp.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42.h | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs42.h b/fs/nfs/nfs42.h
+index b59876b01a1e3..0282d93c8bccb 100644
+--- a/fs/nfs/nfs42.h
++++ b/fs/nfs/nfs42.h
+@@ -55,11 +55,14 @@ int nfs42_proc_removexattr(struct inode *inode, const char *name);
+  * They would be 7 bytes long in the eventual buffer ("user.x\0"), and
+  * 8 bytes long XDR-encoded.
+  *
+- * Include the trailing eof word as well.
++ * Include the trailing eof word as well and make the result a multiple
++ * of 4 bytes.
+  */
+ static inline u32 nfs42_listxattr_xdrsize(u32 buflen)
+ {
+-	return ((buflen / (XATTR_USER_PREFIX_LEN + 2)) * 8) + 4;
++	u32 size = 8 * buflen / (XATTR_USER_PREFIX_LEN + 2) + 4;
++
++	return (size + 3) & ~3;
+ }
+ #endif /* CONFIG_NFS_V4_2 */
+ #endif /* __LINUX_FS_NFS_NFS4_2_H */
+-- 
+2.43.0
+
diff --git a/queue-6.8/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch b/queue-6.8/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
new file mode 100644
index 00000000000..a7bae122e07
--- /dev/null
+++ b/queue-6.8/nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
@@ -0,0 +1,99 @@
+From a2e0b2eafa5c5e1b4a6eeb8cff95b3b9e6f95c69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 07:56:12 -0700
+Subject: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
+
+From: Jorge Mora <jmora1300@gmail.com>
+
+[ Upstream commit 251a658bbfceafb4d58c76b77682c8bf7bcfad65 ]
+
+A call to listxattr() with a buffer size = 0 returns the actual
+size of the buffer needed for a subsequent call. When size > 0,
+nfs4_listxattr() does not return an error because either
+generic_listxattr() or nfs4_listxattr_nfs4_label() consumes
+exactly all the bytes then size is 0 when calling
+nfs4_listxattr_nfs4_user() which then triggers the following
+kernel BUG:
+
+  [   99.403778] kernel BUG at mm/usercopy.c:102!
+  [   99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
+  [   99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1
+  [   99.415827] Call trace:
+  [   99.415985]  usercopy_abort+0x70/0xa0
+  [   99.416227]  __check_heap_object+0x134/0x158
+  [   99.416505]  check_heap_object+0x150/0x188
+  [   99.416696]  __check_object_size.part.0+0x78/0x168
+  [   99.416886]  __check_object_size+0x28/0x40
+  [   99.417078]  listxattr+0x8c/0x120
+  [   99.417252]  path_listxattr+0x78/0xe0
+  [   99.417476]  __arm64_sys_listxattr+0x28/0x40
+  [   99.417723]  invoke_syscall+0x78/0x100
+  [   99.417929]  el0_svc_common.constprop.0+0x48/0xf0
+  [   99.418186]  do_el0_svc+0x24/0x38
+  [   99.418376]  el0_svc+0x3c/0x110
+  [   99.418554]  el0t_64_sync_handler+0x120/0x130
+  [   99.418788]  el0t_64_sync+0x194/0x198
+  [   99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)
+
+Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl',
+thus calling lisxattr() with size = 16 will trigger the bug.
+
+Add check on nfs4_listxattr() to return ERANGE error when it is
+called with size > 0 and the return value is greater than size.
+
+Fixes: 012a211abd5d ("NFSv4.2: hook in the user extended attribute handlers")
+Signed-off-by: Jorge Mora <mora@netapp.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 23819a7565085..b2ff8c7a21494 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -10615,29 +10615,33 @@ const struct nfs4_minor_version_ops *nfs_v4_minor_ops[] = {
+ static ssize_t nfs4_listxattr(struct dentry *dentry, char *list, size_t size)
+ {
+ 	ssize_t error, error2, error3;
++	size_t left = size;
+ 
+-	error = generic_listxattr(dentry, list, size);
++	error = generic_listxattr(dentry, list, left);
+ 	if (error < 0)
+ 		return error;
+ 	if (list) {
+ 		list += error;
+-		size -= error;
++		left -= error;
+ 	}
+ 
+-	error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, size);
++	error2 = nfs4_listxattr_nfs4_label(d_inode(dentry), list, left);
+ 	if (error2 < 0)
+ 		return error2;
+ 
+ 	if (list) {
+ 		list += error2;
+-		size -= error2;
++		left -= error2;
+ 	}
+ 
+-	error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, size);
++	error3 = nfs4_listxattr_nfs4_user(d_inode(dentry), list, left);
+ 	if (error3 < 0)
+ 		return error3;
+ 
+-	return error + error2 + error3;
++	error += error2 + error3;
++	if (size && error > size)
++		return -ERANGE;
++	return error;
+ }
+ 
+ static void nfs4_enable_swap(struct inode *inode)
+-- 
+2.43.0
+
diff --git a/queue-6.8/ntb-fix-possible-name-leak-in-ntb_register_device.patch b/queue-6.8/ntb-fix-possible-name-leak-in-ntb_register_device.patch
new file mode 100644
index 00000000000..487603f8f17
--- /dev/null
+++ b/queue-6.8/ntb-fix-possible-name-leak-in-ntb_register_device.patch
@@ -0,0 +1,85 @@
+From 289077fff13e6c564bd4f229655ed6edd1b0c40e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 11:30:56 +0800
+Subject: NTB: fix possible name leak in ntb_register_device()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 ]
+
+If device_register() fails in ntb_register_device(), the device name
+allocated by dev_set_name() should be freed. As per the comment in
+device_register(), callers should use put_device() to give up the
+reference in the error path. So fix this by calling put_device() in the
+error path so that the name can be freed in kobject_cleanup().
+
+As a result of this, put_device() in the error path of
+ntb_register_device() is removed and the actual error is returned.
+
+Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweicloud.com
+[mani: reworded commit message]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/core.c                            | 8 +++++++-
+ drivers/pci/endpoint/functions/pci-epf-vntb.c | 6 +-----
+ 2 files changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/ntb/core.c b/drivers/ntb/core.c
+index 27dd93deff6e5..d702bee780826 100644
+--- a/drivers/ntb/core.c
++++ b/drivers/ntb/core.c
+@@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client);
+ 
+ int ntb_register_device(struct ntb_dev *ntb)
+ {
++	int ret;
++
+ 	if (!ntb)
+ 		return -EINVAL;
+ 	if (!ntb->pdev)
+@@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb)
+ 	ntb->ctx_ops = NULL;
+ 	spin_lock_init(&ntb->ctx_lock);
+ 
+-	return device_register(&ntb->dev);
++	ret = device_register(&ntb->dev);
++	if (ret)
++		put_device(&ntb->dev);
++
++	return ret;
+ }
+ EXPORT_SYMBOL(ntb_register_device);
+ 
+diff --git a/drivers/pci/endpoint/functions/pci-epf-vntb.c b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+index e75a2af77328e..5b84821c0d602 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-vntb.c
++++ b/drivers/pci/endpoint/functions/pci-epf-vntb.c
+@@ -1275,15 +1275,11 @@ static int pci_vntb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 	ret = ntb_register_device(&ndev->ntb);
+ 	if (ret) {
+ 		dev_err(dev, "Failed to register NTB device\n");
+-		goto err_register_dev;
++		return ret;
+ 	}
+ 
+ 	dev_dbg(dev, "PCI Virtual NTB driver loaded\n");
+ 	return 0;
+-
+-err_register_dev:
+-	put_device(&ndev->ntb.dev);
+-	return -EINVAL;
+ }
+ 
+ static struct pci_device_id pci_vntb_table[] = {
+-- 
+2.43.0
+
diff --git a/queue-6.8/nvme-host-fix-double-free-of-struct-nvme_id_ns-in-ns.patch b/queue-6.8/nvme-host-fix-double-free-of-struct-nvme_id_ns-in-ns.patch
new file mode 100644
index 00000000000..a0fb9c9a842
--- /dev/null
+++ b/queue-6.8/nvme-host-fix-double-free-of-struct-nvme_id_ns-in-ns.patch
@@ -0,0 +1,52 @@
+From 2c572178bc255a86f62de3d1cc8662729d4c6b4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2024 15:03:03 +0900
+Subject: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
+
+From: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+
+[ Upstream commit 8d0d2447394b13fb22a069f0330f9c49b7fff9d3 ]
+
+When nvme_identify_ns() fails, it frees the pointer to the struct
+nvme_id_ns before it returns. However, ns_update_nuse() calls kfree()
+for the pointer even when nvme_identify_ns() fails. This results in
+KASAN double-free, which was observed with blktests nvme/045 with
+proposed patches [1] on the kernel v6.8-rc7. Fix the double-free by
+skipping kfree() when nvme_identify_ns() fails.
+
+Link: https://lore.kernel.org/linux-block/20240304161303.19681-1-dwagner@suse.de/ [1]
+Fixes: a1a825ab6a60 ("nvme: add csi, ms and nuse to sysfs")
+Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Daniel Wagner <dwagner@suse.de>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/sysfs.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
+index f2832f70e7e0a..09fcaa519e5bc 100644
+--- a/drivers/nvme/host/sysfs.c
++++ b/drivers/nvme/host/sysfs.c
+@@ -221,14 +221,11 @@ static int ns_update_nuse(struct nvme_ns *ns)
+ 
+ 	ret = nvme_identify_ns(ns->ctrl, ns->head->ns_id, &id);
+ 	if (ret)
+-		goto out_free_id;
++		return ret;
+ 
+ 	ns->head->nuse = le64_to_cpu(id->nuse);
+-
+-out_free_id:
+ 	kfree(id);
+-
+-	return ret;
++	return 0;
+ }
+ 
+ static ssize_t nuse_show(struct device *dev, struct device_attribute *attr,
+-- 
+2.43.0
+
diff --git a/queue-6.8/objtool-fix-unwind_hint_-save-restore-across-basic-b.patch b/queue-6.8/objtool-fix-unwind_hint_-save-restore-across-basic-b.patch
new file mode 100644
index 00000000000..fc7cc47bbd5
--- /dev/null
+++ b/queue-6.8/objtool-fix-unwind_hint_-save-restore-across-basic-b.patch
@@ -0,0 +1,54 @@
+From bb4e1a6e37e7d0698d3341d3db574fd9ff0e9564 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 23:35:27 -0800
+Subject: objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 10b4c4bce3f5541f54bcc2039720b11d2bc96d79 ]
+
+If SAVE and RESTORE unwind hints are in different basic blocks, and
+objtool sees the RESTORE before the SAVE, it errors out with:
+
+  vmlinux.o: warning: objtool: vmw_port_hb_in+0x242: objtool isn't smart enough to handle this CFI save/restore combo
+
+In such a case, defer following the RESTORE block until the
+straight-line path gets followed later.
+
+Fixes: 8faea26e6111 ("objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402240702.zJFNmahW-lkp@intel.com/
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Link: https://lore.kernel.org/r/20240227073527.avcm5naavbv3cj5s@treble
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/check.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index 548ec3cd7c00c..c4c2f75eadfd9 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -3620,6 +3620,18 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
+ 				}
+ 
+ 				if (!save_insn->visited) {
++					/*
++					 * If the restore hint insn is at the
++					 * beginning of a basic block and was
++					 * branched to from elsewhere, and the
++					 * save insn hasn't been visited yet,
++					 * defer following this branch for now.
++					 * It will be seen later via the
++					 * straight-line path.
++					 */
++					if (!prev_insn)
++						return 0;
++
+ 					WARN_INSN(insn, "objtool isn't smart enough to handle this CFI save/restore combo");
+ 					return 1;
+ 				}
+-- 
+2.43.0
+
diff --git a/queue-6.8/octeontx2-af-fix-devlink-params.patch b/queue-6.8/octeontx2-af-fix-devlink-params.patch
new file mode 100644
index 00000000000..e876fae5b7c
--- /dev/null
+++ b/queue-6.8/octeontx2-af-fix-devlink-params.patch
@@ -0,0 +1,72 @@
+From 4933002b2ad34593e080599a935fa6fa58db595d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 16:26:23 +0530
+Subject: octeontx2-af: Fix devlink params
+
+From: Sunil Goutham <sgoutham@marvell.com>
+
+[ Upstream commit fc1b2901e0feed933aaee273d0b0ca961539f4d7 ]
+
+Devlink param for adjusting NPC MCAM high zone
+area is in wrong param list and is not getting
+activated on CN10KA silicon.
+That patch fixes this issue.
+
+Fixes: dd7842878633 ("octeontx2-af: Add new devlink param to configure maximum usable NIX block LFs")
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: Sai Krishna <saikrishnag@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../marvell/octeontx2/af/rvu_devlink.c        | 20 +++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+index 1e6fbd98423dc..96c04f7d93f8b 100644
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+@@ -1235,8 +1235,8 @@ static int rvu_af_dl_dwrr_mtu_get(struct devlink *devlink, u32 id,
+ enum rvu_af_dl_param_id {
+ 	RVU_AF_DEVLINK_PARAM_ID_BASE = DEVLINK_PARAM_GENERIC_ID_MAX,
+ 	RVU_AF_DEVLINK_PARAM_ID_DWRR_MTU,
+-	RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
+ 	RVU_AF_DEVLINK_PARAM_ID_NPC_MCAM_ZONE_PERCENT,
++	RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
+ 	RVU_AF_DEVLINK_PARAM_ID_NIX_MAXLF,
+ };
+ 
+@@ -1434,15 +1434,6 @@ static const struct devlink_param rvu_af_dl_params[] = {
+ 			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
+ 			     rvu_af_dl_dwrr_mtu_get, rvu_af_dl_dwrr_mtu_set,
+ 			     rvu_af_dl_dwrr_mtu_validate),
+-};
+-
+-static const struct devlink_param rvu_af_dl_param_exact_match[] = {
+-	DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
+-			     "npc_exact_feature_disable", DEVLINK_PARAM_TYPE_STRING,
+-			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
+-			     rvu_af_npc_exact_feature_get,
+-			     rvu_af_npc_exact_feature_disable,
+-			     rvu_af_npc_exact_feature_validate),
+ 	DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_MCAM_ZONE_PERCENT,
+ 			     "npc_mcam_high_zone_percent", DEVLINK_PARAM_TYPE_U8,
+ 			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
+@@ -1457,6 +1448,15 @@ static const struct devlink_param rvu_af_dl_param_exact_match[] = {
+ 			     rvu_af_dl_nix_maxlf_validate),
+ };
+ 
++static const struct devlink_param rvu_af_dl_param_exact_match[] = {
++	DEVLINK_PARAM_DRIVER(RVU_AF_DEVLINK_PARAM_ID_NPC_EXACT_FEATURE_DISABLE,
++			     "npc_exact_feature_disable", DEVLINK_PARAM_TYPE_STRING,
++			     BIT(DEVLINK_PARAM_CMODE_RUNTIME),
++			     rvu_af_npc_exact_feature_get,
++			     rvu_af_npc_exact_feature_disable,
++			     rvu_af_npc_exact_feature_validate),
++};
++
+ /* Devlink switch mode */
+ static int rvu_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
+ {
+-- 
+2.43.0
+
diff --git a/queue-6.8/opp-debugfs-fix-warning-around-icc_get_name.patch b/queue-6.8/opp-debugfs-fix-warning-around-icc_get_name.patch
new file mode 100644
index 00000000000..8e4d562b7e5
--- /dev/null
+++ b/queue-6.8/opp-debugfs-fix-warning-around-icc_get_name.patch
@@ -0,0 +1,50 @@
+From fbdc64eb266ecf8582cb4f09f7d776140a2cb6e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 16:48:28 +0530
+Subject: OPP: debugfs: Fix warning around icc_get_name()
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit 28330ceb953e39880ea77da4895bb902a1244860 ]
+
+If the kernel isn't built with interconnect support, icc_get_name()
+returns NULL and we get following warning:
+
+drivers/opp/debugfs.c: In function 'bw_name_read':
+drivers/opp/debugfs.c:43:42: error: '%.62s' directive argument is null [-Werror=format-overflow=]
+         i = scnprintf(buf, sizeof(buf), "%.62s\n", icc_get_name(path));
+
+Fix it.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402141313.81ltVF5g-lkp@intel.com/
+Fixes: 0430b1d5704b0 ("opp: Expose bandwidth information via debugfs")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/debugfs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/opp/debugfs.c b/drivers/opp/debugfs.c
+index ec030b19164a3..f157fb50be50c 100644
+--- a/drivers/opp/debugfs.c
++++ b/drivers/opp/debugfs.c
+@@ -37,10 +37,12 @@ static ssize_t bw_name_read(struct file *fp, char __user *userbuf,
+ 			    size_t count, loff_t *ppos)
+ {
+ 	struct icc_path *path = fp->private_data;
++	const char *name = icc_get_name(path);
+ 	char buf[64];
+-	int i;
++	int i = 0;
+ 
+-	i = scnprintf(buf, sizeof(buf), "%.62s\n", icc_get_name(path));
++	if (name)
++		i = scnprintf(buf, sizeof(buf), "%.62s\n", name);
+ 
+ 	return simple_read_from_buffer(userbuf, count, ppos, buf, i);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/ovl-always-reject-mounting-over-case-insensitive-dir.patch b/queue-6.8/ovl-always-reject-mounting-over-case-insensitive-dir.patch
new file mode 100644
index 00000000000..54589f63bcb
--- /dev/null
+++ b/queue-6.8/ovl-always-reject-mounting-over-case-insensitive-dir.patch
@@ -0,0 +1,98 @@
+From 6b46c60fd7ad7aafc9c3b11f26963c91dd06ef0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 12:14:03 -0500
+Subject: ovl: Always reject mounting over case-insensitive directories
+
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+
+[ Upstream commit 2824083db76cb9d4b7910607b367e93b02912865 ]
+
+overlayfs relies on the filesystem setting DCACHE_OP_HASH or
+DCACHE_OP_COMPARE to reject mounting over case-insensitive directories.
+
+Since commit bb9cd9106b22 ("fscrypt: Have filesystems handle their
+d_ops"), we set ->d_op through a hook in ->d_lookup, which
+means the root dentry won't have them, causing the mount to accidentally
+succeed.
+
+In v6.7-rc7, the following sequence will succeed to mount, but any
+dentry other than the root dentry will be a "weird" dentry to ovl and
+fail with EREMOTE.
+
+  mkfs.ext4 -O casefold lower.img
+  mount -O loop lower.img lower
+  mount -t overlay -o lowerdir=lower,upperdir=upper,workdir=work ovl /mnt
+
+Mounting on a subdirectory fails, as expected, because DCACHE_OP_HASH
+and DCACHE_OP_COMPARE are properly set by ->lookup.
+
+Fix by explicitly rejecting superblocks that allow case-insensitive
+dentries. Yes, this will be solved when we move d_op configuration back
+to ->s_d_op. Yet, we better have an explicit fix to avoid messing up
+again.
+
+While there, re-sort the entries to have more descriptive error messages
+first.
+
+Fixes: bb9cd9106b22 ("fscrypt: Have filesystems handle their d_ops")
+Acked-by: Amir Goldstein <amir73il@gmail.com>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20240221171412.10710-2-krisman@suse.de
+Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/params.c | 14 +++++++++++---
+ include/linux/fs.h    |  9 +++++++++
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/fs/overlayfs/params.c b/fs/overlayfs/params.c
+index 112b4b12f8252..36dcc530ac286 100644
+--- a/fs/overlayfs/params.c
++++ b/fs/overlayfs/params.c
+@@ -280,12 +280,20 @@ static int ovl_mount_dir_check(struct fs_context *fc, const struct path *path,
+ {
+ 	struct ovl_fs_context *ctx = fc->fs_private;
+ 
+-	if (ovl_dentry_weird(path->dentry))
+-		return invalfc(fc, "filesystem on %s not supported", name);
+-
+ 	if (!d_is_dir(path->dentry))
+ 		return invalfc(fc, "%s is not a directory", name);
+ 
++	/*
++	 * Root dentries of case-insensitive capable filesystems might
++	 * not have the dentry operations set, but still be incompatible
++	 * with overlayfs.  Check explicitly to prevent post-mount
++	 * failures.
++	 */
++	if (sb_has_encoding(path->mnt->mnt_sb))
++		return invalfc(fc, "case-insensitive capable filesystem on %s not supported", name);
++
++	if (ovl_dentry_weird(path->dentry))
++		return invalfc(fc, "filesystem on %s not supported", name);
+ 
+ 	/*
+ 	 * Check whether upper path is read-only here to report failures
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 1fbc72c5f112c..630468c005040 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -3281,6 +3281,15 @@ extern int generic_check_addressable(unsigned, u64);
+ 
+ extern void generic_set_encrypted_ci_d_ops(struct dentry *dentry);
+ 
++static inline bool sb_has_encoding(const struct super_block *sb)
++{
++#if IS_ENABLED(CONFIG_UNICODE)
++	return !!sb->s_encoding;
++#else
++	return false;
++#endif
++}
++
+ int may_setattr(struct mnt_idmap *idmap, struct inode *inode,
+ 		unsigned int ia_valid);
+ int setattr_prepare(struct mnt_idmap *, struct dentry *, struct iattr *);
+-- 
+2.43.0
+
diff --git a/queue-6.8/ovl-relax-warn_on-in-ovl_verify_area.patch b/queue-6.8/ovl-relax-warn_on-in-ovl_verify_area.patch
new file mode 100644
index 00000000000..27c17a7c843
--- /dev/null
+++ b/queue-6.8/ovl-relax-warn_on-in-ovl_verify_area.patch
@@ -0,0 +1,47 @@
+From c11867df110a15e8ced19edb726156f9c95f4fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Mar 2024 13:59:43 +0200
+Subject: ovl: relax WARN_ON in ovl_verify_area()
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 77a28aa476873048024ad56daf8f4f17d58ee48e ]
+
+syzbot hit an assertion in copy up data loop which looks like it is
+the result of a lower file whose size is being changed underneath
+overlayfs.
+
+This type of use case is documented to cause undefined behavior, so
+returning EIO error for the copy up makes sense, but it should not be
+causing a WARN_ON assertion.
+
+Reported-and-tested-by: syzbot+3abd99031b42acf367ef@syzkaller.appspotmail.com
+Fixes: ca7ab482401c ("ovl: add permission hooks outside of do_splice_direct()")
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/copy_up.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 8586e2f5d2439..0762575a1e708 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -234,11 +234,11 @@ static int ovl_verify_area(loff_t pos, loff_t pos2, loff_t len, loff_t totlen)
+ {
+ 	loff_t tmp;
+ 
+-	if (WARN_ON_ONCE(pos != pos2))
++	if (pos != pos2)
+ 		return -EIO;
+-	if (WARN_ON_ONCE(pos < 0 || len < 0 || totlen < 0))
++	if (pos < 0 || len < 0 || totlen < 0)
+ 		return -EIO;
+-	if (WARN_ON_ONCE(check_add_overflow(pos, len, &tmp)))
++	if (check_add_overflow(pos, len, &tmp))
+ 		return -EIO;
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch b/queue-6.8/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
new file mode 100644
index 00000000000..44211af17e0
--- /dev/null
+++ b/queue-6.8/pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
@@ -0,0 +1,52 @@
+From dc836c7d0e6415b21e332910e787e9ea76466480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 14:16:34 +0100
+Subject: PCI/AER: Fix rootport attribute paths in ABI docs
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 0e7d29a39a546161ea3a49e8e282a43212d7ff68 ]
+
+The 'aer_stats' directory never made it into the sixth and final revision
+of the series adding the sysfs AER attributes.
+
+Link: https://lore.kernel.org/r/20240202131635.11405-2-johan+linaro@kernel.org
+Link: https://lore.kernel.org/lkml/20180621184822.GB14136@bhelgaas-glaptop.roam.corp.google.com/
+Fixes: 12833017e581 ("PCI/AER: Add sysfs attributes for rootport cumulative stats")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats b/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats
+index 860db53037a58..24087d5fd417a 100644
+--- a/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats
++++ b/Documentation/ABI/testing/sysfs-bus-pci-devices-aer_stats
+@@ -100,19 +100,19 @@ collectors) that are AER capable. These indicate the number of error messages as
+ device, so these counters include them and are thus cumulative of all the error
+ messages on the PCI hierarchy originating at that root port.
+ 
+-What:		/sys/bus/pci/devices/<dev>/aer_stats/aer_rootport_total_err_cor
++What:		/sys/bus/pci/devices/<dev>/aer_rootport_total_err_cor
+ Date:		July 2018
+ KernelVersion: 4.19.0
+ Contact:	linux-pci@vger.kernel.org, rajatja@google.com
+ Description:	Total number of ERR_COR messages reported to rootport.
+ 
+-What:	    /sys/bus/pci/devices/<dev>/aer_stats/aer_rootport_total_err_fatal
++What:		/sys/bus/pci/devices/<dev>/aer_rootport_total_err_fatal
+ Date:		July 2018
+ KernelVersion: 4.19.0
+ Contact:	linux-pci@vger.kernel.org, rajatja@google.com
+ Description:	Total number of ERR_FATAL messages reported to rootport.
+ 
+-What:	    /sys/bus/pci/devices/<dev>/aer_stats/aer_rootport_total_err_nonfatal
++What:		/sys/bus/pci/devices/<dev>/aer_rootport_total_err_nonfatal
+ Date:		July 2018
+ KernelVersion: 4.19.0
+ Contact:	linux-pci@vger.kernel.org, rajatja@google.com
+-- 
+2.43.0
+
diff --git a/queue-6.8/pci-brcmstb-fix-broken-brcm_pcie_mdio_write-polling.patch b/queue-6.8/pci-brcmstb-fix-broken-brcm_pcie_mdio_write-polling.patch
new file mode 100644
index 00000000000..57d8ff046ee
--- /dev/null
+++ b/queue-6.8/pci-brcmstb-fix-broken-brcm_pcie_mdio_write-polling.patch
@@ -0,0 +1,44 @@
+From 8f782ad335bfcaa185cebbd508e3399c87bf0c22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 14:37:22 +0100
+Subject: PCI: brcmstb: Fix broken brcm_pcie_mdio_write() polling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Bell <jonathan@raspberrypi.com>
+
+[ Upstream commit 039741a8d7c9a01c1bc84a5ac5aa770a5e138a30 ]
+
+The MDIO_WT_DONE() macro tests bit 31, which is always 0 (== done) as
+readw_poll_timeout_atomic() does a 16-bit read. Replace with the readl
+variant.
+
+[kwilczynski: commit log]
+Fixes: ca5dcc76314d ("PCI: brcmstb: Replace status loops with read_poll_timeout_atomic()")
+Link: https://lore.kernel.org/linux-pci/20240217133722.14391-1-wahrenst@gmx.net
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Acked-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-brcmstb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c
+index 5b0730c3891b8..c08683febdd40 100644
+--- a/drivers/pci/controller/pcie-brcmstb.c
++++ b/drivers/pci/controller/pcie-brcmstb.c
+@@ -336,7 +336,7 @@ static int brcm_pcie_mdio_write(void __iomem *base, u8 port,
+ 	readl(base + PCIE_RC_DL_MDIO_ADDR);
+ 	writel(MDIO_DATA_DONE_MASK | wrdata, base + PCIE_RC_DL_MDIO_WR_DATA);
+ 
+-	err = readw_poll_timeout_atomic(base + PCIE_RC_DL_MDIO_WR_DATA, data,
++	err = readl_poll_timeout_atomic(base + PCIE_RC_DL_MDIO_WR_DATA, data,
+ 					MDIO_WT_DONE(data), 10, 100);
+ 	return err;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch b/queue-6.8/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
new file mode 100644
index 00000000000..3eecee8984d
--- /dev/null
+++ b/queue-6.8/pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
@@ -0,0 +1,45 @@
+From 24119ea0d52b24b819a67033a0b3c018f6851a0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 13:08:15 +0200
+Subject: PCI/DPC: Print all TLP Prefixes, not just the first
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+[ Upstream commit 6568d82512b0a64809acff3d7a747362fa4288c8 ]
+
+The TLP Prefix Log Register consists of multiple DWORDs (PCIe r6.1 sec
+7.9.14.13) but the loop in dpc_process_rp_pio_error() keeps reading from
+the first DWORD, so we print only the first PIO TLP Prefix (duplicated
+several times), and we never print the second, third, etc., Prefixes.
+
+Add the iteration count based offset calculation into the config read.
+
+Fixes: f20c4ea49ec4 ("PCI/DPC: Add eDPC support")
+Link: https://lore.kernel.org/r/20240118110815.3867-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+[bhelgaas: add user-visible details to commit log]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pcie/dpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pcie/dpc.c b/drivers/pci/pcie/dpc.c
+index 94111e4382413..e5d7c12854fa0 100644
+--- a/drivers/pci/pcie/dpc.c
++++ b/drivers/pci/pcie/dpc.c
+@@ -234,7 +234,7 @@ static void dpc_process_rp_pio_error(struct pci_dev *pdev)
+ 
+ 	for (i = 0; i < pdev->dpc_rp_log_size - 5; i++) {
+ 		pci_read_config_dword(pdev,
+-			cap + PCI_EXP_DPC_RP_PIO_TLPPREFIX_LOG, &prefix);
++			cap + PCI_EXP_DPC_RP_PIO_TLPPREFIX_LOG + i * 4, &prefix);
+ 		pci_err(pdev, "TLP Prefix Header: dw%d, %#010x\n", i, prefix);
+ 	}
+  clear_status:
+-- 
+2.43.0
+
diff --git a/queue-6.8/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch b/queue-6.8/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
new file mode 100644
index 00000000000..5c0ade828d9
--- /dev/null
+++ b/queue-6.8/pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
@@ -0,0 +1,67 @@
+From de272affd942d607ff22ec5bf84a78f61abe9c08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 20:21:14 +0800
+Subject: PCI: Make pci_dev_is_disconnected() helper public for other drivers
+
+From: Ethan Zhao <haifeng.zhao@linux.intel.com>
+
+[ Upstream commit 39714fd73c6b60a8d27bcc5b431afb0828bf4434 ]
+
+Make pci_dev_is_disconnected() public so that it can be called from
+Intel VT-d driver to quickly fix/workaround the surprise removal
+unplug hang issue for those ATS capable devices on PCIe switch downstream
+hotplug capable ports.
+
+Beside pci_device_is_present() function, this one has no config space
+space access, so is light enough to optimize the normal pure surprise
+removal and safe removal flow.
+
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Tested-by: Haorong Ye <yehaorong@bytedance.com>
+Signed-off-by: Ethan Zhao <haifeng.zhao@linux.intel.com>
+Link: https://lore.kernel.org/r/20240301080727.3529832-2-haifeng.zhao@linux.intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.h   | 5 -----
+ include/linux/pci.h | 5 +++++
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index e9750b1b19bad..bfc56f7bee1c9 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -368,11 +368,6 @@ static inline int pci_dev_set_disconnected(struct pci_dev *dev, void *unused)
+ 	return 0;
+ }
+ 
+-static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
+-{
+-	return dev->error_state == pci_channel_io_perm_failure;
+-}
+-
+ /* pci_dev priv_flags */
+ #define PCI_DEV_ADDED 0
+ #define PCI_DPC_RECOVERED 1
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 7ab0d13672daf..213109d3c601d 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2517,6 +2517,11 @@ static inline struct pci_dev *pcie_find_root_port(struct pci_dev *dev)
+ 	return NULL;
+ }
+ 
++static inline bool pci_dev_is_disconnected(const struct pci_dev *dev)
++{
++	return dev->error_state == pci_channel_io_perm_failure;
++}
++
+ void pci_request_acs(void);
+ bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags);
+ bool pci_acs_path_enabled(struct pci_dev *start,
+-- 
+2.43.0
+
diff --git a/queue-6.8/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch b/queue-6.8/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
new file mode 100644
index 00000000000..ebdeb00d2ba
--- /dev/null
+++ b/queue-6.8/pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
@@ -0,0 +1,56 @@
+From 0ca33249e62e52dd5a96aafd965d6c286109540b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 14:28:11 +0100
+Subject: PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jörg Wedekind <joerg@wedekind.de>
+
+[ Upstream commit baf67aefbe7d7deafa59ca49612d163f8889934c ]
+
+Per PCIe r6.1, sec 2.2.6.2 and 7.5.3.4, a Requester may not use 8-bit Tags
+unless its Extended Tag Field Enable is set, but all Receivers/Completers
+must handle 8-bit Tags correctly regardless of their Extended Tag Field
+Enable.
+
+Some devices do not handle 8-bit Tags as Completers, so add a quirk for
+them.  If we find such a device, we disable Extended Tags for the entire
+hierarchy to make peer-to-peer DMA possible.
+
+The 3ware 9650SE seems to have issues with handling 8-bit tags. Mark it as
+broken.
+
+This fixes PCI Parity Errors like :
+
+  3w-9xxx: scsi0: ERROR: (0x06:0x000C): PCI Parity Error: clearing.
+  3w-9xxx: scsi0: ERROR: (0x06:0x000D): PCI Abort: clearing.
+  3w-9xxx: scsi0: ERROR: (0x06:0x000E): Controller Queue Error: clearing.
+  3w-9xxx: scsi0: ERROR: (0x06:0x0010): Microcontroller Error: clearing.
+
+Link: https://lore.kernel.org/r/20240219132811.8351-1-joerg@wedekind.de
+Fixes: 60db3a4d8cc9 ("PCI: Enable PCIe Extended Tags if supported")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=202425
+Signed-off-by: Jörg Wedekind <joerg@wedekind.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d797df6e5f3e9..2ebbe51a7efe0 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5527,6 +5527,7 @@ static void quirk_no_ext_tags(struct pci_dev *pdev)
+ 
+ 	pci_walk_bus(bridge->bus, pci_configure_extended_tags, NULL);
+ }
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_3WARE, 0x1004, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0132, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0140, quirk_no_ext_tags);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0141, quirk_no_ext_tags);
+-- 
+2.43.0
+
diff --git a/queue-6.8/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch b/queue-6.8/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
new file mode 100644
index 00000000000..ba4a42af134
--- /dev/null
+++ b/queue-6.8/pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
@@ -0,0 +1,38 @@
+From f2e38890aa19a2266841e18ca034bd86bbb92bfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 20:52:35 +0100
+Subject: PCI/P2PDMA: Fix a sleeping issue in a RCU read section
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 1e5c66afd4a40bb7be17cb33cbb1a1085f727730 ]
+
+It is not allowed to sleep within a RCU read section, so use GFP_ATOMIC
+instead of GFP_KERNEL here.
+
+Link: https://lore.kernel.org/r/02d9ec4a10235def0e764ff1f5be881ba12e16e8.1704397858.git.christophe.jaillet@wanadoo.fr
+Fixes: ae21f835a5bd ("PCI/P2PDMA: Finish RCU conversion of pdev->p2pdma")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/p2pdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
+index 0c361561b855c..4f47a13cb500f 100644
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -661,7 +661,7 @@ calc_map_type_and_dist(struct pci_dev *provider, struct pci_dev *client,
+ 	p2pdma = rcu_dereference(provider->p2pdma);
+ 	if (p2pdma)
+ 		xa_store(&p2pdma->map_types, map_types_idx(client),
+-			 xa_mk_value(map_type), GFP_KERNEL);
++			 xa_mk_value(map_type), GFP_ATOMIC);
+ 	rcu_read_unlock();
+ 	return map_type;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/pci-switchtec-fix-an-error-handling-path-in-switchte.patch b/queue-6.8/pci-switchtec-fix-an-error-handling-path-in-switchte.patch
new file mode 100644
index 00000000000..c63697228e7
--- /dev/null
+++ b/queue-6.8/pci-switchtec-fix-an-error-handling-path-in-switchte.patch
@@ -0,0 +1,51 @@
+From 01e2046d3f2fae4d15b3d35b8372a852a6859097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 15:30:01 +0100
+Subject: PCI: switchtec: Fix an error handling path in switchtec_pci_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit dec529b0b0572b32f9eb91c882dd1f08ca657efb ]
+
+The commit in Fixes changed the logic on how resources are released and
+introduced a new switchtec_exit_pci() that need to be called explicitly in
+order to undo a corresponding switchtec_init_pci().
+
+This was done in the remove function, but not in the probe.
+
+Fix the probe now.
+
+Fixes: df25461119d9 ("PCI: switchtec: Fix stdev_release() crash after surprise hot remove")
+Link: https://lore.kernel.org/r/01446d2ccb91a578239915812f2b7dfbeb2882af.1703428183.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/switch/switchtec.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 1804794d0e686..5a4adf6c04cf8 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -1672,7 +1672,7 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
+ 	rc = switchtec_init_isr(stdev);
+ 	if (rc) {
+ 		dev_err(&stdev->dev, "failed to init isr.\n");
+-		goto err_put;
++		goto err_exit_pci;
+ 	}
+ 
+ 	iowrite32(SWITCHTEC_EVENT_CLEAR |
+@@ -1693,6 +1693,8 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
+ 
+ err_devadd:
+ 	stdev_kill(stdev);
++err_exit_pci:
++	switchtec_exit_pci(stdev);
+ err_put:
+ 	ida_free(&switchtec_minor_ida, MINOR(stdev->dev.devt));
+ 	put_device(&stdev->dev);
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-bpf-clean-up-the-generated-copied-vmlinux.h.patch b/queue-6.8/perf-bpf-clean-up-the-generated-copied-vmlinux.h.patch
new file mode 100644
index 00000000000..b59b114ecf1
--- /dev/null
+++ b/queue-6.8/perf-bpf-clean-up-the-generated-copied-vmlinux.h.patch
@@ -0,0 +1,46 @@
+From f6e66cbcc263925f01345799a13ca838b1ab3238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 11:32:20 -0300
+Subject: perf bpf: Clean up the generated/copied vmlinux.h
+
+From: Arnaldo Carvalho de Melo <acme@kernel.org>
+
+[ Upstream commit ffd856537b95dd65facb4e0c78ca1cb92c2048ff ]
+
+When building perf with BPF skels we either copy the minimalistic
+tools/perf/util/bpf_skel/vmlinux/vmlinux.h or use bpftool to generate a
+vmlinux from BTF, storing the result in $(SKEL_OUT)/vmlinux.h.
+
+We need to remove that when doing a 'make -C tools/perf clean', fix it.
+
+Fixes: b7a2d774c9c5a9a3 ("perf build: Add ability to build with a generated vmlinux.h")
+Reviewed-by: Ian Rogers <irogers@google.com>
+Cc: Andrii Nakryiko <andrii@kernel.org>
+Cc: James Clark <james.clark@arm.com>
+Cc: Tiezhu Yang <yangtiezhu@loongson.cn>
+Cc: Yang Jihong <yangjihong1@huawei.com>
+Cc: bpf@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/Zbz89KK5wHfZ82jv@x1
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/Makefile.perf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
+index f8774a9b1377a..116db7874412d 100644
+--- a/tools/perf/Makefile.perf
++++ b/tools/perf/Makefile.perf
+@@ -1167,7 +1167,7 @@ bpf-skel:
+ endif # CONFIG_PERF_BPF_SKEL
+ 
+ bpf-skel-clean:
+-	$(call QUIET_CLEAN, bpf-skel) $(RM) -r $(SKEL_TMP_OUT) $(SKELETONS)
++	$(call QUIET_CLEAN, bpf-skel) $(RM) -r $(SKEL_TMP_OUT) $(SKELETONS) $(SKEL_OUT)/vmlinux.h
+ 
+ clean:: $(LIBAPI)-clean $(LIBBPF)-clean $(LIBSUBCMD)-clean $(LIBSYMBOL)-clean $(LIBPERF)-clean arm64-sysreg-defs-clean fixdep-clean python-clean bpf-skel-clean tests-coresight-targets-clean
+ 	$(call QUIET_CLEAN, core-objs)  $(RM) $(LIBPERF_A) $(OUTPUT)perf-archive $(OUTPUT)perf-iostat $(LANG_BINDINGS)
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch b/queue-6.8/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
new file mode 100644
index 00000000000..e580ec77f08
--- /dev/null
+++ b/queue-6.8/perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
@@ -0,0 +1,38 @@
+From be8a6bb87ecb2139107fb705b09df74361453ec0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Jan 2024 02:57:56 +0000
+Subject: perf evsel: Fix duplicate initialization of data->id in
+ evsel__parse_sample()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 4962aec0d684c8edb14574ccd0da53e4926ff834 ]
+
+data->id has been initialized at line 2362, remove duplicate initialization.
+
+Fixes: 3ad31d8a0df2 ("perf evsel: Centralize perf_sample initialization")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Reviewed-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240127025756.4041808-1-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/evsel.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 6d7c9c58a9bcb..727dae445da9f 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -2363,7 +2363,6 @@ int evsel__parse_sample(struct evsel *evsel, union perf_event *event,
+ 	data->period = evsel->core.attr.sample_period;
+ 	data->cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
+ 	data->misc    = event->header.misc;
+-	data->id = -1ULL;
+ 	data->data_src = PERF_MEM_DATA_SRC_NONE;
+ 	data->vcpu = -1;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-expr-fix-has_event-function-for-metric-style-ev.patch b/queue-6.8/perf-expr-fix-has_event-function-for-metric-style-ev.patch
new file mode 100644
index 00000000000..044de1d3d15
--- /dev/null
+++ b/queue-6.8/perf-expr-fix-has_event-function-for-metric-style-ev.patch
@@ -0,0 +1,62 @@
+From 3530f987e67931fcc075b5e0101a03fdb54166d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 12:49:45 -0800
+Subject: perf expr: Fix "has_event" function for metric style events
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 6dd76680b925228312756c13b9b983661b552a64 ]
+
+Events in metrics cannot use '/' as a separator, it would be
+recognized as a divide, so they use '@'. The '@' is recognized in the
+metricgroups code and changed to '/', do the same in the has_event
+function so that the parsing is only tried without the @s.
+
+Fixes: 4a4a9bf9075f ("perf expr: Add has_event function")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: K Prateek Nayak <kprateek.nayak@amd.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Kaige Ye <ye@kaige.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240209204947.3873294-3-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/expr.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/expr.c b/tools/perf/util/expr.c
+index 7be23b3ac0821..b8875aac8f870 100644
+--- a/tools/perf/util/expr.c
++++ b/tools/perf/util/expr.c
+@@ -500,7 +500,25 @@ double expr__has_event(const struct expr_parse_ctx *ctx, bool compute_ids, const
+ 	tmp = evlist__new();
+ 	if (!tmp)
+ 		return NAN;
+-	ret = parse_event(tmp, id) ? 0 : 1;
++
++	if (strchr(id, '@')) {
++		char *tmp_id, *p;
++
++		tmp_id = strdup(id);
++		if (!tmp_id) {
++			ret = NAN;
++			goto out;
++		}
++		p = strchr(tmp_id, '@');
++		*p = '/';
++		p = strrchr(tmp_id, '@');
++		*p = '/';
++		ret = parse_event(tmp, tmp_id) ? 0 : 1;
++		free(tmp_id);
++	} else {
++		ret = parse_event(tmp, id) ? 0 : 1;
++	}
++out:
+ 	evlist__delete(tmp);
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-metric-don-t-remove-scale-from-counts.patch b/queue-6.8/perf-metric-don-t-remove-scale-from-counts.patch
new file mode 100644
index 00000000000..bba8c90ade7
--- /dev/null
+++ b/queue-6.8/perf-metric-don-t-remove-scale-from-counts.patch
@@ -0,0 +1,51 @@
+From cf889eab2e779452375cd2bba2df3aec08c72d21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 12:49:47 -0800
+Subject: perf metric: Don't remove scale from counts
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 6d6be5eb45b423a37d746d3ee0fd0c78f76ead9f ]
+
+Counts were switched from the scaled saved value form to the
+aggregated count to avoid double accounting. When this happened the
+removing of scaling for a count should have been removed, however, it
+wasn't and this wasn't observed as it normally doesn't matter because
+a counter's scale is 1. A problem was observed with RAPL events that
+are scaled.
+
+Fixes: 37cc8ad77cf8 ("perf metric: Directly use counts rather than saved_value")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: K Prateek Nayak <kprateek.nayak@amd.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Kaige Ye <ye@kaige.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240209204947.3873294-5-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-shadow.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/tools/perf/util/stat-shadow.c b/tools/perf/util/stat-shadow.c
+index e31426167852a..cf573ff3fa84f 100644
+--- a/tools/perf/util/stat-shadow.c
++++ b/tools/perf/util/stat-shadow.c
+@@ -414,12 +414,7 @@ static int prepare_metric(struct evsel **metric_events,
+ 				val = NAN;
+ 				source_count = 0;
+ 			} else {
+-				/*
+-				 * If an event was scaled during stat gathering,
+-				 * reverse the scale before computing the
+-				 * metric.
+-				 */
+-				val = aggr->counts.val * (1.0 / metric_events[i]->scale);
++				val = aggr->counts.val;
+ 				source_count = evsel__source_count(metric_events[i]);
+ 			}
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-pmu-fix-a-potential-memory-leak-in-perf_pmu__lo.patch b/queue-6.8/perf-pmu-fix-a-potential-memory-leak-in-perf_pmu__lo.patch
new file mode 100644
index 00000000000..0180a7454d2
--- /dev/null
+++ b/queue-6.8/perf-pmu-fix-a-potential-memory-leak-in-perf_pmu__lo.patch
@@ -0,0 +1,46 @@
+From 80a85216f7ed6e7e3afb79c30f1adf68983734a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Aug 2023 23:32:45 +0200
+Subject: perf pmu: Fix a potential memory leak in perf_pmu__lookup()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit ef5de1613d7d92bdc975e6beb34bb0fa94f34078 ]
+
+The commit in Fixes has reordered some code, but missed an error handling
+path.
+
+'goto err' now, in order to avoid a memory leak in case of error.
+
+Fixes: f63a536f03a2 ("perf pmu: Merge JSON events with sysfs at load time")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Cc: kernel-janitors@vger.kernel.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/9538b2b634894c33168dfe9d848d4df31fd4d801.1693085544.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/pmu.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 88b9aa7d3a27a..6b82f4759ce69 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -1019,10 +1019,9 @@ struct perf_pmu *perf_pmu__lookup(struct list_head *pmus, int dirfd, const char
+ 	 * type value and format definitions. Load both right
+ 	 * now.
+ 	 */
+-	if (pmu_format(pmu, dirfd, name)) {
+-		free(pmu);
+-		return NULL;
+-	}
++	if (pmu_format(pmu, dirfd, name))
++		goto err;
++
+ 	pmu->is_core = is_pmu_core(name);
+ 	pmu->cpus = pmu_cpumask(dirfd, name, pmu->is_core);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-pmu-treat-the-msr-pmu-as-software.patch b/queue-6.8/perf-pmu-treat-the-msr-pmu-as-software.patch
new file mode 100644
index 00000000000..62063d6e485
--- /dev/null
+++ b/queue-6.8/perf-pmu-treat-the-msr-pmu-as-software.patch
@@ -0,0 +1,90 @@
+From 6370c61597ccd4a3c1079247091f5d2a5927afb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jan 2024 15:42:00 -0800
+Subject: perf pmu: Treat the msr pmu as software
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 24852ef2e2d5c555c2da05baff112ea414b6e0f5 ]
+
+The msr PMU is a software one, meaning msr events may be grouped
+with events in a hardware context. As the msr PMU isn't marked as a
+software PMU by perf_pmu__is_software, groups with the msr PMU in
+are broken and the msr events placed in a different group. This
+may lead to multiplexing errors where a hardware event isn't
+counted while the msr event, such as tsc, is. Fix all of this by
+marking the msr PMU as software, which agrees with the driver.
+
+Before:
+```
+$ perf stat -e '{slots,tsc}' -a true
+WARNING: events were regrouped to match PMUs
+
+ Performance counter stats for 'system wide':
+
+         1,750,335      slots
+         4,243,557      tsc
+
+       0.001456717 seconds time elapsed
+```
+
+After:
+```
+$ perf stat -e '{slots,tsc}' -a true
+ Performance counter stats for 'system wide':
+
+        12,526,380      slots
+         3,415,163      tsc
+
+       0.001488360 seconds time elapsed
+```
+
+Fixes: 251aa040244a ("perf parse-events: Wildcard most "numeric" events")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Caleb Biggers <caleb.biggers@intel.com>
+Cc: Edward Baker <edward.baker@intel.com>
+Cc: Perry Taylor <perry.taylor@intel.com>
+Cc: Samantha Alt <samantha.alt@intel.com>
+Cc: Weilin Wang <weilin.wang@intel.com>
+Link: https://lore.kernel.org/r/20240124234200.1510417-1-irogers@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/pmu.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 3c9609944a2f3..88b9aa7d3a27a 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -1760,6 +1760,12 @@ bool pmu__name_match(const struct perf_pmu *pmu, const char *pmu_name)
+ 
+ bool perf_pmu__is_software(const struct perf_pmu *pmu)
+ {
++	const char *known_sw_pmus[] = {
++		"kprobe",
++		"msr",
++		"uprobe",
++	};
++
+ 	if (pmu->is_core || pmu->is_uncore || pmu->auxtrace)
+ 		return false;
+ 	switch (pmu->type) {
+@@ -1771,7 +1777,11 @@ bool perf_pmu__is_software(const struct perf_pmu *pmu)
+ 	case PERF_TYPE_BREAKPOINT:	return true;
+ 	default: break;
+ 	}
+-	return !strcmp(pmu->name, "kprobe") || !strcmp(pmu->name, "uprobe");
++	for (size_t i = 0; i < ARRAY_SIZE(known_sw_pmus); i++) {
++		if (!strcmp(pmu->name, known_sw_pmus[i]))
++			return true;
++	}
++	return false;
+ }
+ 
+ FILE *perf_pmu__open_file(const struct perf_pmu *pmu, const char *name)
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-print-events-make-is_event_supported-more-robus.patch b/queue-6.8/perf-print-events-make-is_event_supported-more-robus.patch
new file mode 100644
index 00000000000..1f6dd32e7ae
--- /dev/null
+++ b/queue-6.8/perf-print-events-make-is_event_supported-more-robus.patch
@@ -0,0 +1,154 @@
+From e64da37373fb1ddef8e06ab01471e5b16804e8c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 14:56:05 +0000
+Subject: perf print-events: make is_event_supported() more robust
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+[ Upstream commit 25412c0364f7110faa6053c73e3fd47ca956b8c3 ]
+
+Currently the perf tool doesn't detect support for extended event types
+on Apple M1/M2 systems, and will not auto-expand plain PERF_EVENT_TYPE
+hardware events into per-PMU events. This is due to the detection of
+extended event types not handling mandatory filters required by the
+M1/M2 PMU driver.
+
+PMU drivers and the core perf_events code can require that
+perf_event_attr::exclude_* filters are configured in a specific way and
+may reject certain configurations of filters, for example:
+
+(a) Many PMUs lack support for any event filtering, and require all
+    perf_event_attr::exclude_* bits to be clear. This includes Alpha's
+    CPU PMU, and ARM CPU PMUs prior to the introduction of PMUv2 in
+    ARMv7,
+
+(b) When /proc/sys/kernel/perf_event_paranoid >= 2, the perf core
+    requires that perf_event_attr::exclude_kernel is set.
+
+(c) The Apple M1/M2 PMU requires that perf_event_attr::exclude_guest is
+    set as the hardware PMU does not count while a guest is running (but
+    might be extended in future to do so).
+
+In is_event_supported(), we try to account for cases (a) and (b), first
+attempting to open an event without any filters, and if this fails,
+retrying with perf_event_attr::exclude_kernel set. We do not account for
+case (c), or any other filters that drivers could theoretically require
+to be set.
+
+Thus is_event_supported() will fail to detect support for any events
+targeting an Apple M1/M2 PMU, even where events would be supported with
+perf_event_attr:::exclude_guest set.
+
+Since commit:
+
+  82fe2e45cdb00de4 ("perf pmus: Check if we can encode the PMU number in perf_event_attr.type")
+
+... we use is_event_supported() to detect support for extended types,
+with the PMU ID encoded into the perf_event_attr::type. As above, on an
+Apple M1/M2 system this will always fail to detect that the event is
+supported, and consequently we fail to detect support for extended types
+even when these are supported, as they have been since commit:
+
+  5c816728651ae425 ("arm_pmu: Add PERF_PMU_CAP_EXTENDED_HW_TYPE capability")
+
+Due to this, the perf tool will not automatically expand plain
+PERF_TYPE_HARDWARE events into per-PMU events, even when all the
+necessary kernel support is present.
+
+This patch updates is_event_supported() to additionally try opening
+events with perf_event_attr::exclude_guest set, allowing support for
+events to be detected on Apple M1/M2 systems. I believe that this is
+sufficient for all contemporary CPU PMU drivers, though in future it may
+be necessary to check for other combinations of filter bits.
+
+I've deliberately changed the check to not expect a specific error code
+for missing filters, as today ;the kernel may return a number of
+different error codes for missing filters (e.g. -EACCESS, -EINVAL, or
+-EOPNOTSUPP) depending on why and where the filter configuration is
+rejected, and retrying for any error is more robust.
+
+Note that this does not remove the need for commit:
+
+  a24d9d9dc096fc0d ("perf parse-events: Make legacy events lower priority than sysfs/JSON")
+
+... which is still necessary so that named-pmu/event/ events work on
+kernels without extended type support, even if the event name happens to
+be the same as a PERF_EVENT_TYPE_HARDWARE event (e.g. as is the case for
+the M1/M2 PMU's 'cycles' and 'instructions' events).
+
+Fixes: 82fe2e45cdb00de4 ("perf pmus: Check if we can encode the PMU number in perf_event_attr.type")
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Ian Rogers <irogers@google.com>
+Tested-by: James Clark <james.clark@arm.com>
+Tested-by: Marc Zyngier <maz@kernel.org>
+Cc: Hector Martin <marcan@marcan.st>
+Cc: James Clark <james.clark@arm.com>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Leo Yan <leo.yan@linux.dev>
+Cc: Mike Leach <mike.leach@linaro.org>
+Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
+Cc: Thomas Richter <tmricht@linux.ibm.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240126145605.1005472-1-mark.rutland@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/print-events.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/tools/perf/util/print-events.c b/tools/perf/util/print-events.c
+index 9e47712507cc2..b14d1a894abce 100644
+--- a/tools/perf/util/print-events.c
++++ b/tools/perf/util/print-events.c
+@@ -232,7 +232,6 @@ void print_sdt_events(const struct print_callbacks *print_cb, void *print_state)
+ bool is_event_supported(u8 type, u64 config)
+ {
+ 	bool ret = true;
+-	int open_return;
+ 	struct evsel *evsel;
+ 	struct perf_event_attr attr = {
+ 		.type = type,
+@@ -246,20 +245,32 @@ bool is_event_supported(u8 type, u64 config)
+ 
+ 	evsel = evsel__new(&attr);
+ 	if (evsel) {
+-		open_return = evsel__open(evsel, NULL, tmap);
+-		ret = open_return >= 0;
++		ret = evsel__open(evsel, NULL, tmap) >= 0;
+ 
+-		if (open_return == -EACCES) {
++		if (!ret) {
+ 			/*
+-			 * This happens if the paranoid value
++			 * The event may fail to open if the paranoid value
+ 			 * /proc/sys/kernel/perf_event_paranoid is set to 2
+-			 * Re-run with exclude_kernel set; we don't do that
+-			 * by default as some ARM machines do not support it.
+-			 *
++			 * Re-run with exclude_kernel set; we don't do that by
++			 * default as some ARM machines do not support it.
+ 			 */
+ 			evsel->core.attr.exclude_kernel = 1;
+ 			ret = evsel__open(evsel, NULL, tmap) >= 0;
+ 		}
++
++		if (!ret) {
++			/*
++			 * The event may fail to open if the PMU requires
++			 * exclude_guest to be set (e.g. as the Apple M1 PMU
++			 * requires).
++			 * Re-run with exclude_guest set; we don't do that by
++			 * default as it's equally legitimate for another PMU
++			 * driver to require that exclude_guest is clear.
++			 */
++			evsel->core.attr.exclude_guest = 1;
++			ret = evsel__open(evsel, NULL, tmap) >= 0;
++		}
++
+ 		evsel__delete(evsel);
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-record-check-conflict-between-timestamp-filenam.patch b/queue-6.8/perf-record-check-conflict-between-timestamp-filenam.patch
new file mode 100644
index 00000000000..ecf108b61d2
--- /dev/null
+++ b/queue-6.8/perf-record-check-conflict-between-timestamp-filenam.patch
@@ -0,0 +1,103 @@
+From cb1eb612966954358498b043e5bbdab2b77f265b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 04:03:03 +0000
+Subject: perf record: Check conflict between '--timestamp-filename' option and
+ pipe mode before recording
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 02f9b50e04812782fd006ed21c6da1c5e3e373da ]
+
+In pipe mode, no need to switch perf data output, therefore,
+'--timestamp-filename' option should not take effect.
+Check the conflict before recording and output WARNING.
+In this case, the check pipe mode in perf_data__switch() can be removed.
+
+Before:
+
+  # perf record --timestamp-filename -o- perf test -w noploop | perf report -i- --percent-limit=1
+  # To display the perf.data header info, please use --header/--header-only options.
+  #
+  [ perf record: Woken up 1 times to write data ]
+  [ perf record: Dump -.2024011812110182 ]
+  #
+  # Total Lost Samples: 0
+  #
+  # Samples: 4K of event 'cycles:P'
+  # Event count (approx.): 2176784359
+  #
+  # Overhead  Command  Shared Object         Symbol
+  # ........  .......  ....................  ......................................
+  #
+      97.83%  perf     perf                  [.] noploop
+
+  #
+  # (Tip: Print event counts in CSV format with: perf stat -x,)
+  #
+
+After:
+
+  # perf record --timestamp-filename -o- perf test -w noploop | perf report -i- --percent-limit=1
+  WARNING: --timestamp-filename option is not available in pipe mode.
+  # To display the perf.data header info, please use --header/--header-only options.
+  #
+  [ perf record: Woken up 1 times to write data ]
+  [ perf record: Captured and wrote 0.000 MB - ]
+  #
+  # Total Lost Samples: 0
+  #
+  # Samples: 4K of event 'cycles:P'
+  # Event count (approx.): 2185575421
+  #
+  # Overhead  Command  Shared Object          Symbol
+  # ........  .......  .....................  .............................................
+  #
+      97.75%  perf     perf                   [.] noploop
+
+  #
+  # (Tip: Profiling branch (mis)predictions with: perf record -b / perf report)
+  #
+
+Fixes: ecfd7a9c044e ("perf record: Add '--timestamp-filename' option to append timestamp to output file name")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240119040304.3708522-3-yangjihong1@huawei.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-record.c | 5 +++++
+ tools/perf/util/data.c      | 2 --
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index a8dfa533c1663..3ddd4381aebd2 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -2472,6 +2472,11 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
+ 	if (data->is_pipe && rec->evlist->core.nr_entries == 1)
+ 		rec->opts.sample_id = true;
+ 
++	if (rec->timestamp_filename && perf_data__is_pipe(data)) {
++		rec->timestamp_filename = false;
++		pr_warning("WARNING: --timestamp-filename option is not available in pipe mode.\n");
++	}
++
+ 	evlist__uniquify_name(rec->evlist);
+ 
+ 	/* Debug message used by test scripts */
+diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
+index c29d8a382b196..550675ce0b787 100644
+--- a/tools/perf/util/data.c
++++ b/tools/perf/util/data.c
+@@ -430,8 +430,6 @@ int perf_data__switch(struct perf_data *data,
+ {
+ 	int ret;
+ 
+-	if (check_pipe(data))
+-		return -EINVAL;
+ 	if (perf_data__is_read(data))
+ 		return -EINVAL;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-record-fix-possible-incorrect-free-in-record__s.patch b/queue-6.8/perf-record-fix-possible-incorrect-free-in-record__s.patch
new file mode 100644
index 00000000000..d06d89460c7
--- /dev/null
+++ b/queue-6.8/perf-record-fix-possible-incorrect-free-in-record__s.patch
@@ -0,0 +1,40 @@
+From 147ae47816c0c89c1cbbd668ca513e7bcc304e92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 04:03:02 +0000
+Subject: perf record: Fix possible incorrect free in record__switch_output()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit aff10a165201f6f60cff225083ce301ad3f5d8f1 ]
+
+perf_data__switch() may not assign a legal value to 'new_filename'.
+In this case, 'new_filename' uses the on-stack value, which may cause a
+incorrect free and unexpected result.
+
+Fixes: 03724b2e9c45 ("perf record: Allow to limit number of reported perf.data files")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Acked-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240119040304.3708522-2-yangjihong1@huawei.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-record.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
+index 86c9101251726..a8dfa533c1663 100644
+--- a/tools/perf/builtin-record.c
++++ b/tools/perf/builtin-record.c
+@@ -1830,8 +1830,8 @@ static int
+ record__switch_output(struct record *rec, bool at_exit)
+ {
+ 	struct perf_data *data = &rec->data;
++	char *new_filename = NULL;
+ 	int fd, err;
+-	char *new_filename;
+ 
+ 	/* Same Size:      "2015122520103046"*/
+ 	char timestamp[] = "InvalidTimestamp";
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-srcline-add-missed-addr2line-closes.patch b/queue-6.8/perf-srcline-add-missed-addr2line-closes.patch
new file mode 100644
index 00000000000..279282586d3
--- /dev/null
+++ b/queue-6.8/perf-srcline-add-missed-addr2line-closes.patch
@@ -0,0 +1,46 @@
+From 579763f35672a83b6941f91d5827f86dc1289d9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 16:15:02 -0800
+Subject: perf srcline: Add missed addr2line closes
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit c7ba9d18ae47924a6ea6a47ca139779f58eb83c0 ]
+
+The child_process for addr2line sets in and out to -1 so that pipes
+get created. It is the caller's responsibility to close the pipes,
+finish_command doesn't do it. Add the missed closes.
+
+Fixes: b3801e791231 ("perf srcline: Simplify addr2line subprocess")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Cc: Ravi Bangoria <ravi.bangoria@amd.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Nathan Chancellor <nathan@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: John Garry <john.g.garry@oracle.com>
+Cc: Tom Rix <trix@redhat.com>
+Cc: llvm@lists.linux.dev
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240201001504.1348511-8-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/srcline.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
+index 034b496df2978..7addc34afcf5d 100644
+--- a/tools/perf/util/srcline.c
++++ b/tools/perf/util/srcline.c
+@@ -399,6 +399,8 @@ static void addr2line_subprocess_cleanup(struct child_process *a2l)
+ 		kill(a2l->pid, SIGKILL);
+ 		finish_command(a2l); /* ignore result, we don't care */
+ 		a2l->pid = -1;
++		close(a2l->in);
++		close(a2l->out);
+ 	}
+ 
+ 	free(a2l);
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-stat-avoid-metric-only-segv.patch b/queue-6.8/perf-stat-avoid-metric-only-segv.patch
new file mode 100644
index 00000000000..20e01706883
--- /dev/null
+++ b/queue-6.8/perf-stat-avoid-metric-only-segv.patch
@@ -0,0 +1,43 @@
+From 554e294a766ec7345e889a6c5908d5bd9abbfab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 12:49:46 -0800
+Subject: perf stat: Avoid metric-only segv
+
+From: Ian Rogers <irogers@google.com>
+
+[ Upstream commit 2543947c77e0e224bda86b4e7220c2f6714da463 ]
+
+Cycles is recognized as part of a hard coded metric in stat-shadow.c,
+it may call print_metric_only with a NULL fmt string leading to a
+segfault. Handle the NULL fmt explicitly.
+
+Fixes: 088519f318be ("perf stat: Move the display functions to stat-display.c")
+Signed-off-by: Ian Rogers <irogers@google.com>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: K Prateek Nayak <kprateek.nayak@amd.com>
+Cc: James Clark <james.clark@arm.com>
+Cc: Kaige Ye <ye@kaige.org>
+Cc: John Garry <john.g.garry@oracle.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240209204947.3873294-4-irogers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/stat-display.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c
+index 8c61f8627ebc9..b7d00a538d703 100644
+--- a/tools/perf/util/stat-display.c
++++ b/tools/perf/util/stat-display.c
+@@ -560,7 +560,7 @@ static void print_metric_only(struct perf_stat_config *config,
+ 	if (color)
+ 		mlen += strlen(color) + sizeof(PERF_COLOR_RESET) - 1;
+ 
+-	color_snprintf(str, sizeof(str), color ?: "", fmt, val);
++	color_snprintf(str, sizeof(str), color ?: "", fmt ?: "", val);
+ 	fprintf(out, "%*s ", mlen, str);
+ 	os->first = false;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-thread_map-free-strlist-on-normal-path-in-threa.patch b/queue-6.8/perf-thread_map-free-strlist-on-normal-path-in-threa.patch
new file mode 100644
index 00000000000..4851584fddd
--- /dev/null
+++ b/queue-6.8/perf-thread_map-free-strlist-on-normal-path-in-threa.patch
@@ -0,0 +1,45 @@
+From 1b3acc2dab226eae4c39ae5a6ae857655ea74230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 08:32:28 +0000
+Subject: perf thread_map: Free strlist on normal path in
+ thread_map__new_by_tid_str()
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 1eb3d924e3c0b8c27388b0583a989d757866efb6 ]
+
+slist needs to be freed in both error path and normal path in
+thread_map__new_by_tid_str().
+
+Fixes: b52956c961be3a04 ("perf tools: Allow multiple threads or processes in record, stat, top")
+Reviewed-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240206083228.172607-6-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/thread_map.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c
+index e848579e61a86..ea3b431b97830 100644
+--- a/tools/perf/util/thread_map.c
++++ b/tools/perf/util/thread_map.c
+@@ -280,13 +280,13 @@ struct perf_thread_map *thread_map__new_by_tid_str(const char *tid_str)
+ 		threads->nr = ntasks;
+ 	}
+ out:
++	strlist__delete(slist);
+ 	if (threads)
+ 		refcount_set(&threads->refcnt, 1);
+ 	return threads;
+ 
+ out_free_threads:
+ 	zfree(&threads);
+-	strlist__delete(slist);
+ 	goto out;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-vendor-events-amd-fix-zen-4-cache-latency-event.patch b/queue-6.8/perf-vendor-events-amd-fix-zen-4-cache-latency-event.patch
new file mode 100644
index 00000000000..6252503b2c5
--- /dev/null
+++ b/queue-6.8/perf-vendor-events-amd-fix-zen-4-cache-latency-event.patch
@@ -0,0 +1,231 @@
+From b7f0eee44343a86fa4cd76fd1c873fe48399570e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 14:14:31 +0530
+Subject: perf vendor events amd: Fix Zen 4 cache latency events
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+[ Upstream commit 498d3486376befe4e82b5334d44bbc86b1982ee4 ]
+
+L3PMCx0AC and L3PMCx0AD, used in l3_xi_sampled_latency* events, have a
+quirk that requires them to be programmed with SliceId set to 0x3.
+Without this, the events do not count at all and affects dependent
+metrics such as l3_read_miss_latency.
+
+If ThreadMask is not specified, the amd-uncore driver internally sets
+ThreadMask to 0x3, EnAllCores to 0x1 and EnAllSlices to 0x1 but does
+not set SliceId. Since SliceId must also be set to 0x3 in this case,
+specify all the other fields explicitly.
+
+E.g.
+
+  $ sudo perf stat -e l3_xi_sampled_latency.all,l3_xi_sampled_latency_requests.all -a sleep 1
+
+Before:
+
+   Performance counter stats for 'system wide':
+
+                   0      l3_xi_sampled_latency.all
+                   0      l3_xi_sampled_latency_requests.all
+
+         1.005155399 seconds time elapsed
+
+After:
+
+   Performance counter stats for 'system wide':
+
+             921,446      l3_xi_sampled_latency.all
+              54,210      l3_xi_sampled_latency_requests.all
+
+         1.005664472 seconds time elapsed
+
+Fixes: 5b2ca349c313 ("perf vendor events amd: Add Zen 4 uncore events")
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Reviewed-by: Ian Rogers <irogers@google.com>
+Cc: ananth.narayan@amd.com
+Cc: ravi.bangoria@amd.com
+Cc: eranian@google.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Link: https://lore.kernel.org/r/20240301084431.646221-1-sandipan.das@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../pmu-events/arch/x86/amdzen4/cache.json    | 56 +++++++++++++++++++
+ tools/perf/pmu-events/jevents.py              |  4 ++
+ 2 files changed, 60 insertions(+)
+
+diff --git a/tools/perf/pmu-events/arch/x86/amdzen4/cache.json b/tools/perf/pmu-events/arch/x86/amdzen4/cache.json
+index ecbe9660b2b31..e6d710cf3ce29 100644
+--- a/tools/perf/pmu-events/arch/x86/amdzen4/cache.json
++++ b/tools/perf/pmu-events/arch/x86/amdzen4/cache.json
+@@ -676,6 +676,10 @@
+     "EventCode": "0xac",
+     "BriefDescription": "Average sampled latency when data is sourced from DRAM in the same NUMA node.",
+     "UMask": "0x01",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -683,6 +687,10 @@
+     "EventCode": "0xac",
+     "BriefDescription": "Average sampled latency when data is sourced from DRAM in a different NUMA node.",
+     "UMask": "0x02",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -690,6 +698,10 @@
+     "EventCode": "0xac",
+     "BriefDescription": "Average sampled latency when data is sourced from another CCX's cache when the address was in the same NUMA node.",
+     "UMask": "0x04",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -697,6 +709,10 @@
+     "EventCode": "0xac",
+     "BriefDescription": "Average sampled latency when data is sourced from another CCX's cache when the address was in a different NUMA node.",
+     "UMask": "0x08",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -704,6 +720,10 @@
+     "EventCode": "0xac",
+     "BriefDescription": "Average sampled latency when data is sourced from extension memory (CXL) in the same NUMA node.",
+     "UMask": "0x10",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -711,6 +731,10 @@
+     "EventCode": "0xac",
+     "BriefDescription": "Average sampled latency when data is sourced from extension memory (CXL) in a different NUMA node.",
+     "UMask": "0x20",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -718,6 +742,10 @@
+     "EventCode": "0xac",
+     "BriefDescription": "Average sampled latency from all data sources.",
+     "UMask": "0x3f",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -725,6 +753,10 @@
+     "EventCode": "0xad",
+     "BriefDescription": "L3 cache fill requests sourced from DRAM in the same NUMA node.",
+     "UMask": "0x01",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -732,6 +764,10 @@
+     "EventCode": "0xad",
+     "BriefDescription": "L3 cache fill requests sourced from DRAM in a different NUMA node.",
+     "UMask": "0x02",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -739,6 +775,10 @@
+     "EventCode": "0xad",
+     "BriefDescription": "L3 cache fill requests sourced from another CCX's cache when the address was in the same NUMA node.",
+     "UMask": "0x04",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -746,6 +786,10 @@
+     "EventCode": "0xad",
+     "BriefDescription": "L3 cache fill requests sourced from another CCX's cache when the address was in a different NUMA node.",
+     "UMask": "0x08",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -753,6 +797,10 @@
+     "EventCode": "0xad",
+     "BriefDescription": "L3 cache fill requests sourced from extension memory (CXL) in the same NUMA node.",
+     "UMask": "0x10",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -760,6 +808,10 @@
+     "EventCode": "0xad",
+     "BriefDescription": "L3 cache fill requests sourced from extension memory (CXL) in a different NUMA node.",
+     "UMask": "0x20",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   },
+   {
+@@ -767,6 +819,10 @@
+     "EventCode": "0xad",
+     "BriefDescription": "L3 cache fill requests sourced from all data sources.",
+     "UMask": "0x3f",
++    "EnAllCores": "0x1",
++    "EnAllSlices": "0x1",
++    "SliceId": "0x3",
++    "ThreadMask": "0x3",
+     "Unit": "L3PMC"
+   }
+ ]
+diff --git a/tools/perf/pmu-events/jevents.py b/tools/perf/pmu-events/jevents.py
+index 53ab050c8fa43..ce846f29c08d6 100755
+--- a/tools/perf/pmu-events/jevents.py
++++ b/tools/perf/pmu-events/jevents.py
+@@ -356,6 +356,10 @@ class JsonEvent:
+         ('UMask', 'umask='),
+         ('NodeType', 'type='),
+         ('RdWrMask', 'rdwrmask='),
++        ('EnAllCores', 'enallcores='),
++        ('EnAllSlices', 'enallslices='),
++        ('SliceId', 'sliceid='),
++        ('ThreadMask', 'threadmask='),
+     ]
+     for key, value in event_fields:
+       if key in jd and jd[key] != '0':
+-- 
+2.43.0
+
diff --git a/queue-6.8/perf-x86-amd-core-avoid-register-reset-when-cpu-is-d.patch b/queue-6.8/perf-x86-amd-core-avoid-register-reset-when-cpu-is-d.patch
new file mode 100644
index 00000000000..8a4774f175b
--- /dev/null
+++ b/queue-6.8/perf-x86-amd-core-avoid-register-reset-when-cpu-is-d.patch
@@ -0,0 +1,42 @@
+From a1a742ee96d6f5c2bee9acefc386e9250a962e54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 16:36:26 +0530
+Subject: perf/x86/amd/core: Avoid register reset when CPU is dead
+
+From: Sandipan Das <sandipan.das@amd.com>
+
+[ Upstream commit ad8c91282c95f801c37812d59d2d9eba6899b384 ]
+
+When bringing a CPU online, some of the PMC and LBR related registers
+are reset. The same is done when a CPU is taken offline although that
+is unnecessary. This currently happens in the "cpu_dead" callback which
+is also incorrect as the callback runs on a control CPU instead of the
+one that is being taken offline. This also affects hibernation and
+suspend to RAM on some platforms as reported in the link below.
+
+Fixes: 21d59e3e2c40 ("perf/x86/amd/core: Detect PerfMonV2 support")
+Reported-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Sandipan Das <sandipan.das@amd.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/550a026764342cf7e5812680e3e2b91fe662b5ac.1706526029.git.sandipan.das@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 81f6d8275b6bf..1f114d4bfe303 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -604,7 +604,6 @@ static void amd_pmu_cpu_dead(int cpu)
+ 
+ 	kfree(cpuhw->lbr_sel);
+ 	cpuhw->lbr_sel = NULL;
+-	amd_pmu_cpu_reset(cpu);
+ 
+ 	if (!x86_pmu.amd_nb_constraints)
+ 		return;
+-- 
+2.43.0
+
diff --git a/queue-6.8/phy-qcom-qmp-usb-split-usb-c-phy-driver.patch b/queue-6.8/phy-qcom-qmp-usb-split-usb-c-phy-driver.patch
new file mode 100644
index 00000000000..84dc68162a3
--- /dev/null
+++ b/queue-6.8/phy-qcom-qmp-usb-split-usb-c-phy-driver.patch
@@ -0,0 +1,1454 @@
+From ad83735e48735a1b279f4d556959e5219805977c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 22:55:53 +0200
+Subject: phy: qcom: qmp-usb: split USB-C PHY driver
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 19281571a4d5b6049dad9318db081af48818b1d2 ]
+
+In preparation to adding Type-C handling for MSM8998, QCM2290 and SM6115
+platforms, create new QMP USB-C PHY driver by splitting mentioned
+platforms to a separate file. In future it will also be extended with
+support for the DisplayPort handling. It will also be reused later for
+such platforms as SDM660, SM6125, SM6150.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240113-pmi632-typec-v2-10-182d9aa0a5b3@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: 01b086ccdeff ("phy: qcom: qmp-usbc: handle CLAMP register in a correct way")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/Makefile            |    2 +-
+ drivers/phy/qualcomm/phy-qcom-qmp-usb.c  |  266 ------
+ drivers/phy/qualcomm/phy-qcom-qmp-usbc.c | 1078 ++++++++++++++++++++++
+ 3 files changed, 1079 insertions(+), 267 deletions(-)
+ create mode 100644 drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+
+diff --git a/drivers/phy/qualcomm/Makefile b/drivers/phy/qualcomm/Makefile
+index ffd609ac62336..eb60e950ad533 100644
+--- a/drivers/phy/qualcomm/Makefile
++++ b/drivers/phy/qualcomm/Makefile
+@@ -7,7 +7,7 @@ obj-$(CONFIG_PHY_QCOM_IPQ806X_SATA)	+= phy-qcom-ipq806x-sata.o
+ obj-$(CONFIG_PHY_QCOM_M31_USB)		+= phy-qcom-m31.o
+ obj-$(CONFIG_PHY_QCOM_PCIE2)		+= phy-qcom-pcie2.o
+ 
+-obj-$(CONFIG_PHY_QCOM_QMP_COMBO)	+= phy-qcom-qmp-combo.o
++obj-$(CONFIG_PHY_QCOM_QMP_COMBO)	+= phy-qcom-qmp-combo.o phy-qcom-qmp-usbc.o
+ obj-$(CONFIG_PHY_QCOM_QMP_PCIE)		+= phy-qcom-qmp-pcie.o
+ obj-$(CONFIG_PHY_QCOM_QMP_PCIE_8996)	+= phy-qcom-qmp-pcie-msm8996.o
+ obj-$(CONFIG_PHY_QCOM_QMP_UFS)		+= phy-qcom-qmp-ufs.o
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
+index 5c003988c35d3..4c32304dae87f 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb.c
+@@ -121,15 +121,6 @@ static const unsigned int qmp_v3_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = {
+ 	[QPHY_PCS_MISC_CLAMP_ENABLE]	= QPHY_V3_PCS_MISC_CLAMP_ENABLE,
+ };
+ 
+-static const unsigned int qmp_v3_usb3phy_regs_layout_qcm2290[QPHY_LAYOUT_SIZE] = {
+-	[QPHY_SW_RESET]			= QPHY_V3_PCS_SW_RESET,
+-	[QPHY_START_CTRL]		= QPHY_V3_PCS_START_CONTROL,
+-	[QPHY_PCS_STATUS]		= QPHY_V3_PCS_PCS_STATUS,
+-	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V3_PCS_AUTONOMOUS_MODE_CTRL,
+-	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V3_PCS_LFPS_RXTERM_IRQ_CLEAR,
+-	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
+-};
+-
+ static const unsigned int qmp_v4_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = {
+ 	[QPHY_SW_RESET]			= QPHY_V4_PCS_SW_RESET,
+ 	[QPHY_START_CTRL]		= QPHY_V4_PCS_START_CONTROL,
+@@ -514,115 +505,6 @@ static const struct qmp_phy_init_tbl qmp_v3_usb3_uniphy_pcs_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QPHY_V3_PCS_REFGEN_REQ_CONFIG2, 0x60),
+ };
+ 
+-static const struct qmp_phy_init_tbl msm8998_usb3_serdes_tbl[] = {
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CLK_SELECT, 0x30),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BIAS_EN_CLKBUFLR_EN, 0x04),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYSCLK_EN_SEL, 0x14),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYS_CLK_CTRL, 0x06),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_RESETSM_CNTRL2, 0x08),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_CONFIG, 0x06),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SVS_MODE_CLK_SEL, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_HSCLK_SEL, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DEC_START_MODE0, 0x82),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START1_MODE0, 0xab),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START2_MODE0, 0xea),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START3_MODE0, 0x02),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CP_CTRL_MODE0, 0x06),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_RCTRL_MODE0, 0x16),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_CCTRL_MODE0, 0x36),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN0_MODE0, 0x3f),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE2_MODE0, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE1_MODE0, 0xc9),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORECLK_DIV_MODE0, 0x0a),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP3_MODE0, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP2_MODE0, 0x34),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP1_MODE0, 0x15),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_EN, 0x04),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORE_CLK_EN, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_CFG, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE_MAP, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BG_TIMER, 0x0a),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_IVCO, 0x07),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_INITVAL, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_MODE, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_EN_CENTER, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER1, 0x31),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER2, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER1, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER2, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE1, 0x85),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE2, 0x07),
+-};
+-
+-static const struct qmp_phy_init_tbl msm8998_usb3_tx_tbl[] = {
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0x16),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
+-};
+-
+-static const struct qmp_phy_init_tbl msm8998_usb3_rx_tbl[] = {
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x0f),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x07),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x43),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x1c),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x03),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x05),
+-};
+-
+-static const struct qmp_phy_init_tbl msm8998_usb3_pcs_tbl[] = {
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x40),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_POWER_STATE_CONFIG2, 0x1b),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V1, 0x9f),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V2, 0xb7),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V3, 0x4e),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V4, 0x65),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_LS, 0x6b),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x15),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0d),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V1, 0x15),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V1, 0x0d),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V2, 0x15),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V2, 0x0d),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V3, 0x15),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V3, 0x0d),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V4, 0x15),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V4, 0x0d),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_LS, 0x15),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_LS, 0x0d),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RATE_SLEW_CNTRL, 0x02),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x8a),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
+-};
+-
+ static const struct qmp_phy_init_tbl sm8150_usb3_uniphy_serdes_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QSERDES_V4_COM_SYSCLK_EN_SEL, 0x1a),
+ 	QMP_PHY_INIT_CFG(QSERDES_V4_COM_BIN_VCOCAL_HSCLK_SEL, 0x11),
+@@ -1089,99 +971,6 @@ static const struct qmp_phy_init_tbl sm8350_usb3_uniphy_pcs_usb_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QPHY_V5_PCS_USB3_LFPS_DET_HIGH_COUNT_VAL, 0xf8),
+ };
+ 
+-static const struct qmp_phy_init_tbl qcm2290_usb3_serdes_tbl[] = {
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SYSCLK_EN_SEL, 0x14),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CLKBUFLR_EN, 0x08),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_CLK_SELECT, 0x30),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SYS_CLK_CTRL, 0x06),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL2, 0x08),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TRIM, 0x0f),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SVS_MODE_CLK_SEL, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_HSCLK_SEL, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_DEC_START_MODE0, 0x82),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START1_MODE0, 0x55),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START2_MODE0, 0x55),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START3_MODE0, 0x03),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_CP_CTRL_MODE0, 0x0b),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_RCTRL_MODE0, 0x16),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_CCTRL_MODE0, 0x28),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN0_MODE0, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_CORECLK_DIV, 0x0a),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP1_MODE0, 0x15),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP2_MODE0, 0x34),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP3_MODE0, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_EN, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_CORE_CLK_EN, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_CFG, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_MAP, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TIMER, 0x0a),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_EN_CENTER, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER1, 0x31),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER2, 0x01),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER1, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER2, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE1, 0xde),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE2, 0x07),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_IVCO, 0x0f),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_CMN_CONFIG, 0x06),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_INITVAL, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CTRL_BY_PSM, 0x01),
+-};
+-
+-static const struct qmp_phy_init_tbl qcm2290_usb3_tx_tbl[] = {
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0xc6),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_RX, 0x00),
+-};
+-
+-static const struct qmp_phy_init_tbl qcm2290_usb3_rx_tbl[] = {
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x02),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x77),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x0a),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x03),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x16),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
+-	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x00),
+-};
+-
+-static const struct qmp_phy_init_tbl qcm2290_usb3_pcs_tbl[] = {
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x17),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0f),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x85),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
+-	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x88),
+-};
+-
+ static const struct qmp_phy_init_tbl sc8280xp_usb3_uniphy_serdes_tbl[] = {
+ 	QMP_PHY_INIT_CFG(QSERDES_V5_COM_SYSCLK_EN_SEL, 0x1a),
+ 	QMP_PHY_INIT_CFG(QSERDES_V5_COM_BIN_VCOCAL_HSCLK_SEL, 0x11),
+@@ -1579,16 +1368,6 @@ static const struct qmp_usb_offsets qmp_usb_offsets_v3_msm8996 = {
+ 	.rx		= 0x400,
+ };
+ 
+-static const struct qmp_usb_offsets qmp_usb_offsets_v3_qcm2290 = {
+-	.serdes		= 0x0,
+-	.pcs		= 0xc00,
+-	.pcs_misc	= 0xa00,
+-	.tx		= 0x200,
+-	.rx		= 0x400,
+-	.tx2		= 0x600,
+-	.rx2		= 0x800,
+-};
+-
+ static const struct qmp_usb_offsets qmp_usb_offsets_v4 = {
+ 	.serdes		= 0,
+ 	.pcs		= 0x0800,
+@@ -1753,24 +1532,6 @@ static const struct qmp_phy_cfg qmp_v3_usb3_uniphy_cfg = {
+ 	.has_pwrdn_delay	= true,
+ };
+ 
+-static const struct qmp_phy_cfg msm8998_usb3phy_cfg = {
+-	.lanes			= 2,
+-
+-	.offsets		= &qmp_usb_offsets_v3_qcm2290,
+-
+-	.serdes_tbl             = msm8998_usb3_serdes_tbl,
+-	.serdes_tbl_num         = ARRAY_SIZE(msm8998_usb3_serdes_tbl),
+-	.tx_tbl                 = msm8998_usb3_tx_tbl,
+-	.tx_tbl_num             = ARRAY_SIZE(msm8998_usb3_tx_tbl),
+-	.rx_tbl                 = msm8998_usb3_rx_tbl,
+-	.rx_tbl_num             = ARRAY_SIZE(msm8998_usb3_rx_tbl),
+-	.pcs_tbl                = msm8998_usb3_pcs_tbl,
+-	.pcs_tbl_num            = ARRAY_SIZE(msm8998_usb3_pcs_tbl),
+-	.vreg_list              = qmp_phy_vreg_l,
+-	.num_vregs              = ARRAY_SIZE(qmp_phy_vreg_l),
+-	.regs                   = qmp_v3_usb3phy_regs_layout,
+-};
+-
+ static const struct qmp_phy_cfg sm8150_usb3_uniphy_cfg = {
+ 	.lanes			= 1,
+ 
+@@ -1908,24 +1669,6 @@ static const struct qmp_phy_cfg sm8350_usb3_uniphy_cfg = {
+ 	.has_pwrdn_delay	= true,
+ };
+ 
+-static const struct qmp_phy_cfg qcm2290_usb3phy_cfg = {
+-	.lanes			= 2,
+-
+-	.offsets		= &qmp_usb_offsets_v3_qcm2290,
+-
+-	.serdes_tbl		= qcm2290_usb3_serdes_tbl,
+-	.serdes_tbl_num		= ARRAY_SIZE(qcm2290_usb3_serdes_tbl),
+-	.tx_tbl			= qcm2290_usb3_tx_tbl,
+-	.tx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_tx_tbl),
+-	.rx_tbl			= qcm2290_usb3_rx_tbl,
+-	.rx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_rx_tbl),
+-	.pcs_tbl		= qcm2290_usb3_pcs_tbl,
+-	.pcs_tbl_num		= ARRAY_SIZE(qcm2290_usb3_pcs_tbl),
+-	.vreg_list		= qmp_phy_vreg_l,
+-	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
+-	.regs			= qmp_v3_usb3phy_regs_layout_qcm2290,
+-};
+-
+ static const struct qmp_phy_cfg x1e80100_usb3_uniphy_cfg = {
+ 	.lanes			= 1,
+ 
+@@ -2599,12 +2342,6 @@ static const struct of_device_id qmp_usb_of_match_table[] = {
+ 	}, {
+ 		.compatible = "qcom,msm8996-qmp-usb3-phy",
+ 		.data = &msm8996_usb3phy_cfg,
+-	}, {
+-		.compatible = "qcom,msm8998-qmp-usb3-phy",
+-		.data = &msm8998_usb3phy_cfg,
+-	}, {
+-		.compatible = "qcom,qcm2290-qmp-usb3-phy",
+-		.data = &qcm2290_usb3phy_cfg,
+ 	}, {
+ 		.compatible = "qcom,sa8775p-qmp-usb3-uni-phy",
+ 		.data = &sa8775p_usb3_uniphy_cfg,
+@@ -2623,9 +2360,6 @@ static const struct of_device_id qmp_usb_of_match_table[] = {
+ 	}, {
+ 		.compatible = "qcom,sdx75-qmp-usb3-uni-phy",
+ 		.data = &sdx75_usb3_uniphy_cfg,
+-	}, {
+-		.compatible = "qcom,sm6115-qmp-usb3-phy",
+-		.data = &qcm2290_usb3phy_cfg,
+ 	}, {
+ 		.compatible = "qcom,sm8150-qmp-usb3-uni-phy",
+ 		.data = &sm8150_usb3_uniphy_cfg,
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+new file mode 100644
+index 0000000000000..52f1b3f7b81eb
+--- /dev/null
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+@@ -0,0 +1,1078 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2017, The Linux Foundation. All rights reserved.
++ */
++
++#include <linux/clk.h>
++#include <linux/clk-provider.h>
++#include <linux/delay.h>
++#include <linux/err.h>
++#include <linux/io.h>
++#include <linux/iopoll.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_address.h>
++#include <linux/phy/phy.h>
++#include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
++#include <linux/reset.h>
++#include <linux/slab.h>
++
++#include "phy-qcom-qmp.h"
++#include "phy-qcom-qmp-pcs-misc-v3.h"
++
++/* QPHY_SW_RESET bit */
++#define SW_RESET				BIT(0)
++/* QPHY_POWER_DOWN_CONTROL */
++#define SW_PWRDN				BIT(0)
++/* QPHY_START_CONTROL bits */
++#define SERDES_START				BIT(0)
++#define PCS_START				BIT(1)
++/* QPHY_PCS_STATUS bit */
++#define PHYSTATUS				BIT(6)
++
++/* QPHY_V3_DP_COM_RESET_OVRD_CTRL register bits */
++/* DP PHY soft reset */
++#define SW_DPPHY_RESET				BIT(0)
++/* mux to select DP PHY reset control, 0:HW control, 1: software reset */
++#define SW_DPPHY_RESET_MUX			BIT(1)
++/* USB3 PHY soft reset */
++#define SW_USB3PHY_RESET			BIT(2)
++/* mux to select USB3 PHY reset control, 0:HW control, 1: software reset */
++#define SW_USB3PHY_RESET_MUX			BIT(3)
++
++/* QPHY_V3_DP_COM_PHY_MODE_CTRL register bits */
++#define USB3_MODE				BIT(0) /* enables USB3 mode */
++#define DP_MODE					BIT(1) /* enables DP mode */
++
++/* QPHY_PCS_AUTONOMOUS_MODE_CTRL register bits */
++#define ARCVR_DTCT_EN				BIT(0)
++#define ALFPS_DTCT_EN				BIT(1)
++#define ARCVR_DTCT_EVENT_SEL			BIT(4)
++
++/* QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR register bits */
++#define IRQ_CLEAR				BIT(0)
++
++/* QPHY_V3_PCS_MISC_CLAMP_ENABLE register bits */
++#define CLAMP_EN				BIT(0) /* enables i/o clamp_n */
++
++#define PHY_INIT_COMPLETE_TIMEOUT		10000
++
++struct qmp_phy_init_tbl {
++	unsigned int offset;
++	unsigned int val;
++	/*
++	 * mask of lanes for which this register is written
++	 * for cases when second lane needs different values
++	 */
++	u8 lane_mask;
++};
++
++#define QMP_PHY_INIT_CFG(o, v)		\
++	{				\
++		.offset = o,		\
++		.val = v,		\
++		.lane_mask = 0xff,	\
++	}
++
++#define QMP_PHY_INIT_CFG_LANE(o, v, l)	\
++	{				\
++		.offset = o,		\
++		.val = v,		\
++		.lane_mask = l,		\
++	}
++
++/* set of registers with offsets different per-PHY */
++enum qphy_reg_layout {
++	/* PCS registers */
++	QPHY_SW_RESET,
++	QPHY_START_CTRL,
++	QPHY_PCS_STATUS,
++	QPHY_PCS_AUTONOMOUS_MODE_CTRL,
++	QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR,
++	QPHY_PCS_POWER_DOWN_CONTROL,
++	QPHY_PCS_MISC_CLAMP_ENABLE,
++	/* Keep last to ensure regs_layout arrays are properly initialized */
++	QPHY_LAYOUT_SIZE
++};
++
++static const unsigned int qmp_v3_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = {
++	[QPHY_SW_RESET]			= QPHY_V3_PCS_SW_RESET,
++	[QPHY_START_CTRL]		= QPHY_V3_PCS_START_CONTROL,
++	[QPHY_PCS_STATUS]		= QPHY_V3_PCS_PCS_STATUS,
++	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V3_PCS_AUTONOMOUS_MODE_CTRL,
++	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V3_PCS_LFPS_RXTERM_IRQ_CLEAR,
++	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
++	[QPHY_PCS_MISC_CLAMP_ENABLE]	= QPHY_V3_PCS_MISC_CLAMP_ENABLE,
++};
++
++static const unsigned int qmp_v3_usb3phy_regs_layout_qcm2290[QPHY_LAYOUT_SIZE] = {
++	[QPHY_SW_RESET]			= QPHY_V3_PCS_SW_RESET,
++	[QPHY_START_CTRL]		= QPHY_V3_PCS_START_CONTROL,
++	[QPHY_PCS_STATUS]		= QPHY_V3_PCS_PCS_STATUS,
++	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V3_PCS_AUTONOMOUS_MODE_CTRL,
++	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V3_PCS_LFPS_RXTERM_IRQ_CLEAR,
++	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
++};
++
++static const struct qmp_phy_init_tbl msm8998_usb3_serdes_tbl[] = {
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CLK_SELECT, 0x30),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BIAS_EN_CLKBUFLR_EN, 0x04),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYSCLK_EN_SEL, 0x14),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SYS_CLK_CTRL, 0x06),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_RESETSM_CNTRL2, 0x08),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_CONFIG, 0x06),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SVS_MODE_CLK_SEL, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_HSCLK_SEL, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DEC_START_MODE0, 0x82),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START1_MODE0, 0xab),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START2_MODE0, 0xea),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_DIV_FRAC_START3_MODE0, 0x02),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CP_CTRL_MODE0, 0x06),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_RCTRL_MODE0, 0x16),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_CCTRL_MODE0, 0x36),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_GAIN0_MODE0, 0x3f),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE2_MODE0, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE1_MODE0, 0xc9),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORECLK_DIV_MODE0, 0x0a),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP3_MODE0, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP2_MODE0, 0x34),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP1_MODE0, 0x15),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_EN, 0x04),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CORE_CLK_EN, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_LOCK_CMP_CFG, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_VCO_TUNE_MAP, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BG_TIMER, 0x0a),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_PLL_IVCO, 0x07),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_INTEGLOOP_INITVAL, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CMN_MODE, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_EN_CENTER, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER1, 0x31),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_PER2, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER1, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_ADJ_PER2, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE1, 0x85),
++	QMP_PHY_INIT_CFG(QSERDES_V3_COM_SSC_STEP_SIZE2, 0x07),
++};
++
++static const struct qmp_phy_init_tbl msm8998_usb3_tx_tbl[] = {
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0x16),
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
++};
++
++static const struct qmp_phy_init_tbl msm8998_usb3_rx_tbl[] = {
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x0f),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x07),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x43),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x1c),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x03),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x05),
++};
++
++static const struct qmp_phy_init_tbl msm8998_usb3_pcs_tbl[] = {
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x40),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_POWER_STATE_CONFIG2, 0x1b),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V1, 0x9f),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V2, 0xb7),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V3, 0x4e),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V4, 0x65),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_LS, 0x6b),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x15),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0d),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V1, 0x15),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V1, 0x0d),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V2, 0x15),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V2, 0x0d),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V3, 0x15),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V3, 0x0d),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V4, 0x15),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V4, 0x0d),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_LS, 0x15),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_LS, 0x0d),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RATE_SLEW_CNTRL, 0x02),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x8a),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
++};
++
++static const struct qmp_phy_init_tbl qcm2290_usb3_serdes_tbl[] = {
++	QMP_PHY_INIT_CFG(QSERDES_COM_SYSCLK_EN_SEL, 0x14),
++	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CLKBUFLR_EN, 0x08),
++	QMP_PHY_INIT_CFG(QSERDES_COM_CLK_SELECT, 0x30),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SYS_CLK_CTRL, 0x06),
++	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_RESETSM_CNTRL2, 0x08),
++	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TRIM, 0x0f),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SVS_MODE_CLK_SEL, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_COM_HSCLK_SEL, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_DEC_START_MODE0, 0x82),
++	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START1_MODE0, 0x55),
++	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START2_MODE0, 0x55),
++	QMP_PHY_INIT_CFG(QSERDES_COM_DIV_FRAC_START3_MODE0, 0x03),
++	QMP_PHY_INIT_CFG(QSERDES_COM_CP_CTRL_MODE0, 0x0b),
++	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_RCTRL_MODE0, 0x16),
++	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_CCTRL_MODE0, 0x28),
++	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN0_MODE0, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_GAIN1_MODE0, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_CORECLK_DIV, 0x0a),
++	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP1_MODE0, 0x15),
++	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP2_MODE0, 0x34),
++	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP3_MODE0, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_EN, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_CORE_CLK_EN, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_LOCK_CMP_CFG, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_VCO_TUNE_MAP, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_BG_TIMER, 0x0a),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_EN_CENTER, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER1, 0x31),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_PER2, 0x01),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER1, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_ADJ_PER2, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE1, 0xde),
++	QMP_PHY_INIT_CFG(QSERDES_COM_SSC_STEP_SIZE2, 0x07),
++	QMP_PHY_INIT_CFG(QSERDES_COM_PLL_IVCO, 0x0f),
++	QMP_PHY_INIT_CFG(QSERDES_COM_CMN_CONFIG, 0x06),
++	QMP_PHY_INIT_CFG(QSERDES_COM_INTEGLOOP_INITVAL, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_COM_BIAS_EN_CTRL_BY_PSM, 0x01),
++};
++
++static const struct qmp_phy_init_tbl qcm2290_usb3_tx_tbl[] = {
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_HIGHZ_DRVR_EN, 0x10),
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RCV_DETECT_LVL_2, 0x12),
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_LANE_MODE_1, 0xc6),
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_TX, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_TX_RES_CODE_LANE_OFFSET_RX, 0x00),
++};
++
++static const struct qmp_phy_init_tbl qcm2290_usb3_rx_tbl[] = {
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_FO_GAIN, 0x0b),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_PI_CONTROLS, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_LOW, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FASTLOCK_COUNT_HIGH, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_FO_GAIN, 0x0a),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_GAIN, 0x06),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_UCDR_SO_SATURATION_AND_ENABLE, 0x75),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL2, 0x02),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL3, 0x4e),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQU_ADAPTOR_CNTRL4, 0x18),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_EQ_OFFSET_ADAPTOR_CNTRL1, 0x77),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_OFFSET_ADAPTOR_CNTRL2, 0x80),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_VGA_CAL_CNTRL2, 0x0a),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_CNTRL, 0x03),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_DEGLITCH_CNTRL, 0x16),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_SIGDET_ENABLES, 0x00),
++	QMP_PHY_INIT_CFG(QSERDES_V3_RX_RX_MODE_00, 0x00),
++};
++
++static const struct qmp_phy_init_tbl qcm2290_usb3_pcs_tbl[] = {
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXMGN_V0, 0x9f),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M6DB_V0, 0x17),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TXDEEMPH_M3P5DB_V0, 0x0f),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL2, 0x83),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNTRL1, 0x02),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_L, 0x09),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_CNT_VAL_H_TOL, 0xa2),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_FLL_MAN_CODE, 0x85),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG1, 0xd1),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG2, 0x1f),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LOCK_DETECT_CONFIG3, 0x47),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_WAIT_TIME, 0x75),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RXEQTRAINING_RUN_TIME, 0x13),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_LFPS_TX_ECSTART_EQTLOCK, 0x86),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_PWRUP_RESET_DLY_TIME_AUXCLK, 0x04),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_TSYNC_RSYNC_TIME, 0x44),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_L, 0xe7),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_P1U2_H, 0x03),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_L, 0x40),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RCVR_DTCT_DLY_U3_H, 0x00),
++	QMP_PHY_INIT_CFG(QPHY_V3_PCS_RX_SIGDET_LVL, 0x88),
++};
++
++struct qmp_usbc_offsets {
++	u16 serdes;
++	u16 pcs;
++	u16 pcs_misc;
++	u16 tx;
++	u16 rx;
++	/* for PHYs with >= 2 lanes */
++	u16 tx2;
++	u16 rx2;
++};
++
++/* struct qmp_phy_cfg - per-PHY initialization config */
++struct qmp_phy_cfg {
++	const struct qmp_usbc_offsets *offsets;
++
++	/* Init sequence for PHY blocks - serdes, tx, rx, pcs */
++	const struct qmp_phy_init_tbl *serdes_tbl;
++	int serdes_tbl_num;
++	const struct qmp_phy_init_tbl *tx_tbl;
++	int tx_tbl_num;
++	const struct qmp_phy_init_tbl *rx_tbl;
++	int rx_tbl_num;
++	const struct qmp_phy_init_tbl *pcs_tbl;
++	int pcs_tbl_num;
++
++	/* regulators to be requested */
++	const char * const *vreg_list;
++	int num_vregs;
++
++	/* array of registers with different offsets */
++	const unsigned int *regs;
++
++	/* true, if PHY needs delay after POWER_DOWN */
++	bool has_pwrdn_delay;
++};
++
++struct qmp_usbc {
++	struct device *dev;
++
++	const struct qmp_phy_cfg *cfg;
++
++	void __iomem *serdes;
++	void __iomem *pcs;
++	void __iomem *pcs_misc;
++	void __iomem *tx;
++	void __iomem *rx;
++	void __iomem *tx2;
++	void __iomem *rx2;
++
++	struct clk *pipe_clk;
++	struct clk_bulk_data *clks;
++	int num_clks;
++	int num_resets;
++	struct reset_control_bulk_data *resets;
++	struct regulator_bulk_data *vregs;
++
++	enum phy_mode mode;
++
++	struct phy *phy;
++
++	struct clk_fixed_rate pipe_clk_fixed;
++};
++
++static inline void qphy_setbits(void __iomem *base, u32 offset, u32 val)
++{
++	u32 reg;
++
++	reg = readl(base + offset);
++	reg |= val;
++	writel(reg, base + offset);
++
++	/* ensure that above write is through */
++	readl(base + offset);
++}
++
++static inline void qphy_clrbits(void __iomem *base, u32 offset, u32 val)
++{
++	u32 reg;
++
++	reg = readl(base + offset);
++	reg &= ~val;
++	writel(reg, base + offset);
++
++	/* ensure that above write is through */
++	readl(base + offset);
++}
++
++/* list of clocks required by phy */
++static const char * const qmp_usbc_phy_clk_l[] = {
++	"aux", "cfg_ahb", "ref", "com_aux",
++};
++
++/* list of resets */
++static const char * const usb3phy_legacy_reset_l[] = {
++	"phy", "common",
++};
++
++static const char * const usb3phy_reset_l[] = {
++	"phy_phy", "phy",
++};
++
++/* list of regulators */
++static const char * const qmp_phy_vreg_l[] = {
++	"vdda-phy", "vdda-pll",
++};
++
++static const struct qmp_usbc_offsets qmp_usbc_offsets_v3_qcm2290 = {
++	.serdes		= 0x0,
++	.pcs		= 0xc00,
++	.pcs_misc	= 0xa00,
++	.tx		= 0x200,
++	.rx		= 0x400,
++	.tx2		= 0x600,
++	.rx2		= 0x800,
++};
++
++static const struct qmp_phy_cfg msm8998_usb3phy_cfg = {
++	.offsets		= &qmp_usbc_offsets_v3_qcm2290,
++
++	.serdes_tbl             = msm8998_usb3_serdes_tbl,
++	.serdes_tbl_num         = ARRAY_SIZE(msm8998_usb3_serdes_tbl),
++	.tx_tbl                 = msm8998_usb3_tx_tbl,
++	.tx_tbl_num             = ARRAY_SIZE(msm8998_usb3_tx_tbl),
++	.rx_tbl                 = msm8998_usb3_rx_tbl,
++	.rx_tbl_num             = ARRAY_SIZE(msm8998_usb3_rx_tbl),
++	.pcs_tbl                = msm8998_usb3_pcs_tbl,
++	.pcs_tbl_num            = ARRAY_SIZE(msm8998_usb3_pcs_tbl),
++	.vreg_list              = qmp_phy_vreg_l,
++	.num_vregs              = ARRAY_SIZE(qmp_phy_vreg_l),
++	.regs                   = qmp_v3_usb3phy_regs_layout,
++};
++
++static const struct qmp_phy_cfg qcm2290_usb3phy_cfg = {
++	.offsets		= &qmp_usbc_offsets_v3_qcm2290,
++
++	.serdes_tbl		= qcm2290_usb3_serdes_tbl,
++	.serdes_tbl_num		= ARRAY_SIZE(qcm2290_usb3_serdes_tbl),
++	.tx_tbl			= qcm2290_usb3_tx_tbl,
++	.tx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_tx_tbl),
++	.rx_tbl			= qcm2290_usb3_rx_tbl,
++	.rx_tbl_num		= ARRAY_SIZE(qcm2290_usb3_rx_tbl),
++	.pcs_tbl		= qcm2290_usb3_pcs_tbl,
++	.pcs_tbl_num		= ARRAY_SIZE(qcm2290_usb3_pcs_tbl),
++	.vreg_list		= qmp_phy_vreg_l,
++	.num_vregs		= ARRAY_SIZE(qmp_phy_vreg_l),
++	.regs			= qmp_v3_usb3phy_regs_layout_qcm2290,
++};
++
++static void qmp_usbc_configure_lane(void __iomem *base,
++					const struct qmp_phy_init_tbl tbl[],
++					int num,
++					u8 lane_mask)
++{
++	int i;
++	const struct qmp_phy_init_tbl *t = tbl;
++
++	if (!t)
++		return;
++
++	for (i = 0; i < num; i++, t++) {
++		if (!(t->lane_mask & lane_mask))
++			continue;
++
++		writel(t->val, base + t->offset);
++	}
++}
++
++static void qmp_usbc_configure(void __iomem *base,
++				   const struct qmp_phy_init_tbl tbl[],
++				   int num)
++{
++	qmp_usbc_configure_lane(base, tbl, num, 0xff);
++}
++
++static int qmp_usbc_init(struct phy *phy)
++{
++	struct qmp_usbc *qmp = phy_get_drvdata(phy);
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++	void __iomem *pcs = qmp->pcs;
++	int ret;
++
++	ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
++	if (ret) {
++		dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
++		return ret;
++	}
++
++	ret = reset_control_bulk_assert(qmp->num_resets, qmp->resets);
++	if (ret) {
++		dev_err(qmp->dev, "reset assert failed\n");
++		goto err_disable_regulators;
++	}
++
++	ret = reset_control_bulk_deassert(qmp->num_resets, qmp->resets);
++	if (ret) {
++		dev_err(qmp->dev, "reset deassert failed\n");
++		goto err_disable_regulators;
++	}
++
++	ret = clk_bulk_prepare_enable(qmp->num_clks, qmp->clks);
++	if (ret)
++		goto err_assert_reset;
++
++	qphy_setbits(pcs, cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL], SW_PWRDN);
++
++	return 0;
++
++err_assert_reset:
++	reset_control_bulk_assert(qmp->num_resets, qmp->resets);
++err_disable_regulators:
++	regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
++
++	return ret;
++}
++
++static int qmp_usbc_exit(struct phy *phy)
++{
++	struct qmp_usbc *qmp = phy_get_drvdata(phy);
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++
++	reset_control_bulk_assert(qmp->num_resets, qmp->resets);
++
++	clk_bulk_disable_unprepare(qmp->num_clks, qmp->clks);
++
++	regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
++
++	return 0;
++}
++
++static int qmp_usbc_power_on(struct phy *phy)
++{
++	struct qmp_usbc *qmp = phy_get_drvdata(phy);
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++	void __iomem *status;
++	unsigned int val;
++	int ret;
++
++	qmp_usbc_configure(qmp->serdes, cfg->serdes_tbl, cfg->serdes_tbl_num);
++
++	ret = clk_prepare_enable(qmp->pipe_clk);
++	if (ret) {
++		dev_err(qmp->dev, "pipe_clk enable failed err=%d\n", ret);
++		return ret;
++	}
++
++	/* Tx, Rx, and PCS configurations */
++	qmp_usbc_configure_lane(qmp->tx, cfg->tx_tbl, cfg->tx_tbl_num, 1);
++	qmp_usbc_configure_lane(qmp->rx, cfg->rx_tbl, cfg->rx_tbl_num, 1);
++
++	qmp_usbc_configure_lane(qmp->tx2, cfg->tx_tbl, cfg->tx_tbl_num, 2);
++	qmp_usbc_configure_lane(qmp->rx2, cfg->rx_tbl, cfg->rx_tbl_num, 2);
++
++	qmp_usbc_configure(qmp->pcs, cfg->pcs_tbl, cfg->pcs_tbl_num);
++
++	if (cfg->has_pwrdn_delay)
++		usleep_range(10, 20);
++
++	/* Pull PHY out of reset state */
++	qphy_clrbits(qmp->pcs, cfg->regs[QPHY_SW_RESET], SW_RESET);
++
++	/* start SerDes and Phy-Coding-Sublayer */
++	qphy_setbits(qmp->pcs, cfg->regs[QPHY_START_CTRL], SERDES_START | PCS_START);
++
++	status = qmp->pcs + cfg->regs[QPHY_PCS_STATUS];
++	ret = readl_poll_timeout(status, val, !(val & PHYSTATUS), 200,
++				 PHY_INIT_COMPLETE_TIMEOUT);
++	if (ret) {
++		dev_err(qmp->dev, "phy initialization timed-out\n");
++		goto err_disable_pipe_clk;
++	}
++
++	return 0;
++
++err_disable_pipe_clk:
++	clk_disable_unprepare(qmp->pipe_clk);
++
++	return ret;
++}
++
++static int qmp_usbc_power_off(struct phy *phy)
++{
++	struct qmp_usbc *qmp = phy_get_drvdata(phy);
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++
++	clk_disable_unprepare(qmp->pipe_clk);
++
++	/* PHY reset */
++	qphy_setbits(qmp->pcs, cfg->regs[QPHY_SW_RESET], SW_RESET);
++
++	/* stop SerDes and Phy-Coding-Sublayer */
++	qphy_clrbits(qmp->pcs, cfg->regs[QPHY_START_CTRL],
++			SERDES_START | PCS_START);
++
++	/* Put PHY into POWER DOWN state: active low */
++	qphy_clrbits(qmp->pcs, cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL],
++			SW_PWRDN);
++
++	return 0;
++}
++
++static int qmp_usbc_enable(struct phy *phy)
++{
++	int ret;
++
++	ret = qmp_usbc_init(phy);
++	if (ret)
++		return ret;
++
++	ret = qmp_usbc_power_on(phy);
++	if (ret)
++		qmp_usbc_exit(phy);
++
++	return ret;
++}
++
++static int qmp_usbc_disable(struct phy *phy)
++{
++	int ret;
++
++	ret = qmp_usbc_power_off(phy);
++	if (ret)
++		return ret;
++	return qmp_usbc_exit(phy);
++}
++
++static int qmp_usbc_set_mode(struct phy *phy, enum phy_mode mode, int submode)
++{
++	struct qmp_usbc *qmp = phy_get_drvdata(phy);
++
++	qmp->mode = mode;
++
++	return 0;
++}
++
++static const struct phy_ops qmp_usbc_phy_ops = {
++	.init		= qmp_usbc_enable,
++	.exit		= qmp_usbc_disable,
++	.set_mode	= qmp_usbc_set_mode,
++	.owner		= THIS_MODULE,
++};
++
++static void qmp_usbc_enable_autonomous_mode(struct qmp_usbc *qmp)
++{
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++	void __iomem *pcs = qmp->pcs;
++	void __iomem *pcs_misc = qmp->pcs_misc;
++	u32 intr_mask;
++
++	if (qmp->mode == PHY_MODE_USB_HOST_SS ||
++	    qmp->mode == PHY_MODE_USB_DEVICE_SS)
++		intr_mask = ARCVR_DTCT_EN | ALFPS_DTCT_EN;
++	else
++		intr_mask = ARCVR_DTCT_EN | ARCVR_DTCT_EVENT_SEL;
++
++	/* Clear any pending interrupts status */
++	qphy_setbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
++	/* Writing 1 followed by 0 clears the interrupt */
++	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
++
++	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL],
++		     ARCVR_DTCT_EN | ALFPS_DTCT_EN | ARCVR_DTCT_EVENT_SEL);
++
++	/* Enable required PHY autonomous mode interrupts */
++	qphy_setbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL], intr_mask);
++
++	/* Enable i/o clamp_n for autonomous mode */
++	if (pcs_misc && cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE])
++		qphy_clrbits(pcs_misc, cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE], CLAMP_EN);
++}
++
++static void qmp_usbc_disable_autonomous_mode(struct qmp_usbc *qmp)
++{
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++	void __iomem *pcs = qmp->pcs;
++	void __iomem *pcs_misc = qmp->pcs_misc;
++
++	/* Disable i/o clamp_n on resume for normal mode */
++	if (pcs_misc && cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE])
++		qphy_setbits(pcs_misc, cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE], CLAMP_EN);
++
++	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL],
++		     ARCVR_DTCT_EN | ARCVR_DTCT_EVENT_SEL | ALFPS_DTCT_EN);
++
++	qphy_setbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
++	/* Writing 1 followed by 0 clears the interrupt */
++	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR], IRQ_CLEAR);
++}
++
++static int __maybe_unused qmp_usbc_runtime_suspend(struct device *dev)
++{
++	struct qmp_usbc *qmp = dev_get_drvdata(dev);
++
++	dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qmp->mode);
++
++	if (!qmp->phy->init_count) {
++		dev_vdbg(dev, "PHY not initialized, bailing out\n");
++		return 0;
++	}
++
++	qmp_usbc_enable_autonomous_mode(qmp);
++
++	clk_disable_unprepare(qmp->pipe_clk);
++	clk_bulk_disable_unprepare(qmp->num_clks, qmp->clks);
++
++	return 0;
++}
++
++static int __maybe_unused qmp_usbc_runtime_resume(struct device *dev)
++{
++	struct qmp_usbc *qmp = dev_get_drvdata(dev);
++	int ret = 0;
++
++	dev_vdbg(dev, "Resuming QMP phy, mode:%d\n", qmp->mode);
++
++	if (!qmp->phy->init_count) {
++		dev_vdbg(dev, "PHY not initialized, bailing out\n");
++		return 0;
++	}
++
++	ret = clk_bulk_prepare_enable(qmp->num_clks, qmp->clks);
++	if (ret)
++		return ret;
++
++	ret = clk_prepare_enable(qmp->pipe_clk);
++	if (ret) {
++		dev_err(dev, "pipe_clk enable failed, err=%d\n", ret);
++		clk_bulk_disable_unprepare(qmp->num_clks, qmp->clks);
++		return ret;
++	}
++
++	qmp_usbc_disable_autonomous_mode(qmp);
++
++	return 0;
++}
++
++static const struct dev_pm_ops qmp_usbc_pm_ops = {
++	SET_RUNTIME_PM_OPS(qmp_usbc_runtime_suspend,
++			   qmp_usbc_runtime_resume, NULL)
++};
++
++static int qmp_usbc_vreg_init(struct qmp_usbc *qmp)
++{
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++	struct device *dev = qmp->dev;
++	int num = cfg->num_vregs;
++	int i;
++
++	qmp->vregs = devm_kcalloc(dev, num, sizeof(*qmp->vregs), GFP_KERNEL);
++	if (!qmp->vregs)
++		return -ENOMEM;
++
++	for (i = 0; i < num; i++)
++		qmp->vregs[i].supply = cfg->vreg_list[i];
++
++	return devm_regulator_bulk_get(dev, num, qmp->vregs);
++}
++
++static int qmp_usbc_reset_init(struct qmp_usbc *qmp,
++			      const char *const *reset_list,
++			      int num_resets)
++{
++	struct device *dev = qmp->dev;
++	int i;
++	int ret;
++
++	qmp->resets = devm_kcalloc(dev, num_resets,
++				   sizeof(*qmp->resets), GFP_KERNEL);
++	if (!qmp->resets)
++		return -ENOMEM;
++
++	for (i = 0; i < num_resets; i++)
++		qmp->resets[i].id = reset_list[i];
++
++	qmp->num_resets = num_resets;
++
++	ret = devm_reset_control_bulk_get_exclusive(dev, num_resets, qmp->resets);
++	if (ret)
++		return dev_err_probe(dev, ret, "failed to get resets\n");
++
++	return 0;
++}
++
++static int qmp_usbc_clk_init(struct qmp_usbc *qmp)
++{
++	struct device *dev = qmp->dev;
++	int num = ARRAY_SIZE(qmp_usbc_phy_clk_l);
++	int i;
++
++	qmp->clks = devm_kcalloc(dev, num, sizeof(*qmp->clks), GFP_KERNEL);
++	if (!qmp->clks)
++		return -ENOMEM;
++
++	for (i = 0; i < num; i++)
++		qmp->clks[i].id = qmp_usbc_phy_clk_l[i];
++
++	qmp->num_clks = num;
++
++	return devm_clk_bulk_get_optional(dev, num, qmp->clks);
++}
++
++static void phy_clk_release_provider(void *res)
++{
++	of_clk_del_provider(res);
++}
++
++/*
++ * Register a fixed rate pipe clock.
++ *
++ * The <s>_pipe_clksrc generated by PHY goes to the GCC that gate
++ * controls it. The <s>_pipe_clk coming out of the GCC is requested
++ * by the PHY driver for its operations.
++ * We register the <s>_pipe_clksrc here. The gcc driver takes care
++ * of assigning this <s>_pipe_clksrc as parent to <s>_pipe_clk.
++ * Below picture shows this relationship.
++ *
++ *         +---------------+
++ *         |   PHY block   |<<---------------------------------------+
++ *         |               |                                         |
++ *         |   +-------+   |                   +-----+               |
++ *   I/P---^-->|  PLL  |---^--->pipe_clksrc--->| GCC |--->pipe_clk---+
++ *    clk  |   +-------+   |                   +-----+
++ *         +---------------+
++ */
++static int phy_pipe_clk_register(struct qmp_usbc *qmp, struct device_node *np)
++{
++	struct clk_fixed_rate *fixed = &qmp->pipe_clk_fixed;
++	struct clk_init_data init = { };
++	int ret;
++
++	ret = of_property_read_string(np, "clock-output-names", &init.name);
++	if (ret) {
++		dev_err(qmp->dev, "%pOFn: No clock-output-names\n", np);
++		return ret;
++	}
++
++	init.ops = &clk_fixed_rate_ops;
++
++	/* controllers using QMP phys use 125MHz pipe clock interface */
++	fixed->fixed_rate = 125000000;
++	fixed->hw.init = &init;
++
++	ret = devm_clk_hw_register(qmp->dev, &fixed->hw);
++	if (ret)
++		return ret;
++
++	ret = of_clk_add_hw_provider(np, of_clk_hw_simple_get, &fixed->hw);
++	if (ret)
++		return ret;
++
++	/*
++	 * Roll a devm action because the clock provider is the child node, but
++	 * the child node is not actually a device.
++	 */
++	return devm_add_action_or_reset(qmp->dev, phy_clk_release_provider, np);
++}
++
++static int qmp_usbc_parse_dt_legacy(struct qmp_usbc *qmp, struct device_node *np)
++{
++	struct platform_device *pdev = to_platform_device(qmp->dev);
++	struct device *dev = qmp->dev;
++	int ret;
++
++	qmp->serdes = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(qmp->serdes))
++		return PTR_ERR(qmp->serdes);
++
++	/*
++	 * Get memory resources for the PHY:
++	 * Resources are indexed as: tx -> 0; rx -> 1; pcs -> 2.
++	 * For dual lane PHYs: tx2 -> 3, rx2 -> 4, pcs_misc (optional) -> 5
++	 * For single lane PHYs: pcs_misc (optional) -> 3.
++	 */
++	qmp->tx = devm_of_iomap(dev, np, 0, NULL);
++	if (IS_ERR(qmp->tx))
++		return PTR_ERR(qmp->tx);
++
++	qmp->rx = devm_of_iomap(dev, np, 1, NULL);
++	if (IS_ERR(qmp->rx))
++		return PTR_ERR(qmp->rx);
++
++	qmp->pcs = devm_of_iomap(dev, np, 2, NULL);
++	if (IS_ERR(qmp->pcs))
++		return PTR_ERR(qmp->pcs);
++
++	qmp->tx2 = devm_of_iomap(dev, np, 3, NULL);
++	if (IS_ERR(qmp->tx2))
++		return PTR_ERR(qmp->tx2);
++
++	qmp->rx2 = devm_of_iomap(dev, np, 4, NULL);
++	if (IS_ERR(qmp->rx2))
++		return PTR_ERR(qmp->rx2);
++
++	qmp->pcs_misc = devm_of_iomap(dev, np, 5, NULL);
++	if (IS_ERR(qmp->pcs_misc)) {
++		dev_vdbg(dev, "PHY pcs_misc-reg not used\n");
++		qmp->pcs_misc = NULL;
++	}
++
++	qmp->pipe_clk = devm_get_clk_from_child(dev, np, NULL);
++	if (IS_ERR(qmp->pipe_clk)) {
++		return dev_err_probe(dev, PTR_ERR(qmp->pipe_clk),
++				     "failed to get pipe clock\n");
++	}
++
++	ret = devm_clk_bulk_get_all(qmp->dev, &qmp->clks);
++	if (ret < 0)
++		return ret;
++
++	qmp->num_clks = ret;
++
++	ret = qmp_usbc_reset_init(qmp, usb3phy_legacy_reset_l,
++				 ARRAY_SIZE(usb3phy_legacy_reset_l));
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static int qmp_usbc_parse_dt(struct qmp_usbc *qmp)
++{
++	struct platform_device *pdev = to_platform_device(qmp->dev);
++	const struct qmp_phy_cfg *cfg = qmp->cfg;
++	const struct qmp_usbc_offsets *offs = cfg->offsets;
++	struct device *dev = qmp->dev;
++	void __iomem *base;
++	int ret;
++
++	if (!offs)
++		return -EINVAL;
++
++	base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(base))
++		return PTR_ERR(base);
++
++	qmp->serdes = base + offs->serdes;
++	qmp->pcs = base + offs->pcs;
++	if (offs->pcs_misc)
++		qmp->pcs_misc = base + offs->pcs_misc;
++	qmp->tx = base + offs->tx;
++	qmp->rx = base + offs->rx;
++
++	qmp->tx2 = base + offs->tx2;
++	qmp->rx2 = base + offs->rx2;
++
++	ret = qmp_usbc_clk_init(qmp);
++	if (ret)
++		return ret;
++
++	qmp->pipe_clk = devm_clk_get(dev, "pipe");
++	if (IS_ERR(qmp->pipe_clk)) {
++		return dev_err_probe(dev, PTR_ERR(qmp->pipe_clk),
++				     "failed to get pipe clock\n");
++	}
++
++	ret = qmp_usbc_reset_init(qmp, usb3phy_reset_l,
++				 ARRAY_SIZE(usb3phy_reset_l));
++	if (ret)
++		return ret;
++
++	return 0;
++}
++
++static int qmp_usbc_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct phy_provider *phy_provider;
++	struct device_node *np;
++	struct qmp_usbc *qmp;
++	int ret;
++
++	qmp = devm_kzalloc(dev, sizeof(*qmp), GFP_KERNEL);
++	if (!qmp)
++		return -ENOMEM;
++
++	qmp->dev = dev;
++
++	qmp->cfg = of_device_get_match_data(dev);
++	if (!qmp->cfg)
++		return -EINVAL;
++
++	ret = qmp_usbc_vreg_init(qmp);
++	if (ret)
++		return ret;
++
++	/* Check for legacy binding with child node. */
++	np = of_get_next_available_child(dev->of_node, NULL);
++	if (np) {
++		ret = qmp_usbc_parse_dt_legacy(qmp, np);
++	} else {
++		np = of_node_get(dev->of_node);
++		ret = qmp_usbc_parse_dt(qmp);
++	}
++	if (ret)
++		goto err_node_put;
++
++	pm_runtime_set_active(dev);
++	ret = devm_pm_runtime_enable(dev);
++	if (ret)
++		goto err_node_put;
++	/*
++	 * Prevent runtime pm from being ON by default. Users can enable
++	 * it using power/control in sysfs.
++	 */
++	pm_runtime_forbid(dev);
++
++	ret = phy_pipe_clk_register(qmp, np);
++	if (ret)
++		goto err_node_put;
++
++	qmp->phy = devm_phy_create(dev, np, &qmp_usbc_phy_ops);
++	if (IS_ERR(qmp->phy)) {
++		ret = PTR_ERR(qmp->phy);
++		dev_err(dev, "failed to create PHY: %d\n", ret);
++		goto err_node_put;
++	}
++
++	phy_set_drvdata(qmp->phy, qmp);
++
++	of_node_put(np);
++
++	phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
++
++	return PTR_ERR_OR_ZERO(phy_provider);
++
++err_node_put:
++	of_node_put(np);
++	return ret;
++}
++
++static const struct of_device_id qmp_usbc_of_match_table[] = {
++	{
++		.compatible = "qcom,msm8998-qmp-usb3-phy",
++		.data = &msm8998_usb3phy_cfg,
++	}, {
++		.compatible = "qcom,qcm2290-qmp-usb3-phy",
++		.data = &qcm2290_usb3phy_cfg,
++	}, {
++		.compatible = "qcom,sm6115-qmp-usb3-phy",
++		.data = &qcm2290_usb3phy_cfg,
++	},
++	{ },
++};
++MODULE_DEVICE_TABLE(of, qmp_usbc_of_match_table);
++
++static struct platform_driver qmp_usbc_driver = {
++	.probe		= qmp_usbc_probe,
++	.driver = {
++		.name	= "qcom-qmp-usbc-phy",
++		.pm	= &qmp_usbc_pm_ops,
++		.of_match_table = qmp_usbc_of_match_table,
++	},
++};
++
++module_platform_driver(qmp_usbc_driver);
++
++MODULE_AUTHOR("Vivek Gautam <vivek.gautam@codeaurora.org>");
++MODULE_DESCRIPTION("Qualcomm QMP USB-C PHY driver");
++MODULE_LICENSE("GPL");
+-- 
+2.43.0
+
diff --git a/queue-6.8/phy-qcom-qmp-usbc-add-support-for-the-type-c-handlin.patch b/queue-6.8/phy-qcom-qmp-usbc-add-support-for-the-type-c-handlin.patch
new file mode 100644
index 00000000000..2e607d773d4
--- /dev/null
+++ b/queue-6.8/phy-qcom-qmp-usbc-add-support-for-the-type-c-handlin.patch
@@ -0,0 +1,205 @@
+From b2fe3f078935060d5dfc670ab4589f47c691ab36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 22:55:55 +0200
+Subject: phy: qcom: qmp-usbc: add support for the Type-C handling
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit dfdaba27b4660ec26de955cf4459499ddb005e2d ]
+
+The USB-C PHYs on the msm8998, QCM2290 and SM6115 platforms use special
+register to control which lanes of the Type-C port are used for the
+SuperSpeed USB connection. Mimic the qmp-combo driver and handle this
+register.
+
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240113-pmi632-typec-v2-12-182d9aa0a5b3@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Stable-dep-of: 01b086ccdeff ("phy: qcom: qmp-usbc: handle CLAMP register in a correct way")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-qmp-usbc.c | 97 +++++++++++++++++++++++-
+ 1 file changed, 94 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+index 52f1b3f7b81eb..214cf4203de41 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+@@ -18,6 +18,8 @@
+ #include <linux/regulator/consumer.h>
+ #include <linux/reset.h>
+ #include <linux/slab.h>
++#include <linux/usb/typec.h>
++#include <linux/usb/typec_mux.h>
+ 
+ #include "phy-qcom-qmp.h"
+ #include "phy-qcom-qmp-pcs-misc-v3.h"
+@@ -374,11 +376,17 @@ struct qmp_usbc {
+ 	struct reset_control_bulk_data *resets;
+ 	struct regulator_bulk_data *vregs;
+ 
++	struct mutex phy_mutex;
++
+ 	enum phy_mode mode;
++	unsigned int usb_init_count;
+ 
+ 	struct phy *phy;
+ 
+ 	struct clk_fixed_rate pipe_clk_fixed;
++
++	struct typec_switch_dev *sw;
++	enum typec_orientation orientation;
+ };
+ 
+ static inline void qphy_setbits(void __iomem *base, u32 offset, u32 val)
+@@ -497,6 +505,7 @@ static int qmp_usbc_init(struct phy *phy)
+ 	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+ 	const struct qmp_phy_cfg *cfg = qmp->cfg;
+ 	void __iomem *pcs = qmp->pcs;
++	u32 val = 0;
+ 	int ret;
+ 
+ 	ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
+@@ -523,6 +532,14 @@ static int qmp_usbc_init(struct phy *phy)
+ 
+ 	qphy_setbits(pcs, cfg->regs[QPHY_PCS_POWER_DOWN_CONTROL], SW_PWRDN);
+ 
++#define SW_PORTSELECT_VAL			BIT(0)
++#define SW_PORTSELECT_MUX			BIT(1)
++	/* Use software based port select and switch on typec orientation */
++	val = SW_PORTSELECT_MUX;
++	if (qmp->orientation == TYPEC_ORIENTATION_REVERSE)
++		val |= SW_PORTSELECT_VAL;
++	writel(val, qmp->pcs_misc);
++
+ 	return 0;
+ 
+ err_assert_reset:
+@@ -620,23 +637,34 @@ static int qmp_usbc_power_off(struct phy *phy)
+ 
+ static int qmp_usbc_enable(struct phy *phy)
+ {
++	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+ 	int ret;
+ 
++	mutex_lock(&qmp->phy_mutex);
++
+ 	ret = qmp_usbc_init(phy);
+ 	if (ret)
+-		return ret;
++		goto out_unlock;
+ 
+ 	ret = qmp_usbc_power_on(phy);
+-	if (ret)
++	if (ret) {
+ 		qmp_usbc_exit(phy);
++		goto out_unlock;
++	}
++
++	qmp->usb_init_count++;
++out_unlock:
++	mutex_unlock(&qmp->phy_mutex);
+ 
+ 	return ret;
+ }
+ 
+ static int qmp_usbc_disable(struct phy *phy)
+ {
++	struct qmp_usbc *qmp = phy_get_drvdata(phy);
+ 	int ret;
+ 
++	qmp->usb_init_count--;
+ 	ret = qmp_usbc_power_off(phy);
+ 	if (ret)
+ 		return ret;
+@@ -874,6 +902,61 @@ static int phy_pipe_clk_register(struct qmp_usbc *qmp, struct device_node *np)
+ 	return devm_add_action_or_reset(qmp->dev, phy_clk_release_provider, np);
+ }
+ 
++#if IS_ENABLED(CONFIG_TYPEC)
++static int qmp_usbc_typec_switch_set(struct typec_switch_dev *sw,
++				      enum typec_orientation orientation)
++{
++	struct qmp_usbc *qmp = typec_switch_get_drvdata(sw);
++
++	if (orientation == qmp->orientation || orientation == TYPEC_ORIENTATION_NONE)
++		return 0;
++
++	mutex_lock(&qmp->phy_mutex);
++	qmp->orientation = orientation;
++
++	if (qmp->usb_init_count) {
++		qmp_usbc_power_off(qmp->phy);
++		qmp_usbc_exit(qmp->phy);
++
++		qmp_usbc_init(qmp->phy);
++		qmp_usbc_power_on(qmp->phy);
++	}
++
++	mutex_unlock(&qmp->phy_mutex);
++
++	return 0;
++}
++
++static void qmp_usbc_typec_unregister(void *data)
++{
++	struct qmp_usbc *qmp = data;
++
++	typec_switch_unregister(qmp->sw);
++}
++
++static int qmp_usbc_typec_switch_register(struct qmp_usbc *qmp)
++{
++	struct typec_switch_desc sw_desc = {};
++	struct device *dev = qmp->dev;
++
++	sw_desc.drvdata = qmp;
++	sw_desc.fwnode = dev->fwnode;
++	sw_desc.set = qmp_usbc_typec_switch_set;
++	qmp->sw = typec_switch_register(dev, &sw_desc);
++	if (IS_ERR(qmp->sw)) {
++		dev_err(dev, "Unable to register typec switch: %pe\n", qmp->sw);
++		return PTR_ERR(qmp->sw);
++	}
++
++	return devm_add_action_or_reset(dev, qmp_usbc_typec_unregister, qmp);
++}
++#else
++static int qmp_usbc_typec_switch_register(struct qmp_usbc *qmp)
++{
++	return 0;
++}
++#endif
++
+ static int qmp_usbc_parse_dt_legacy(struct qmp_usbc *qmp, struct device_node *np)
+ {
+ 	struct platform_device *pdev = to_platform_device(qmp->dev);
+@@ -994,16 +1077,24 @@ static int qmp_usbc_probe(struct platform_device *pdev)
+ 
+ 	qmp->dev = dev;
+ 
++	qmp->orientation = TYPEC_ORIENTATION_NORMAL;
++
+ 	qmp->cfg = of_device_get_match_data(dev);
+ 	if (!qmp->cfg)
+ 		return -EINVAL;
+ 
++	mutex_init(&qmp->phy_mutex);
++
+ 	ret = qmp_usbc_vreg_init(qmp);
+ 	if (ret)
+ 		return ret;
+ 
++	ret = qmp_usbc_typec_switch_register(qmp);
++	if (ret)
++		return ret;
++
+ 	/* Check for legacy binding with child node. */
+-	np = of_get_next_available_child(dev->of_node, NULL);
++	np = of_get_child_by_name(dev->of_node, "phy");
+ 	if (np) {
+ 		ret = qmp_usbc_parse_dt_legacy(qmp, np);
+ 	} else {
+-- 
+2.43.0
+
diff --git a/queue-6.8/phy-qcom-qmp-usbc-handle-clamp-register-in-a-correct.patch b/queue-6.8/phy-qcom-qmp-usbc-handle-clamp-register-in-a-correct.patch
new file mode 100644
index 00000000000..1af293d574e
--- /dev/null
+++ b/queue-6.8/phy-qcom-qmp-usbc-handle-clamp-register-in-a-correct.patch
@@ -0,0 +1,157 @@
+From 5cca06d2f5c9a172bf414b266f5b1cbaffd388de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:04:24 +0200
+Subject: phy: qcom: qmp-usbc: handle CLAMP register in a correct way
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 01b086ccdeffac96f107228d581e0925e1c83f87 ]
+
+The QMP USB PHYs on msm8998, qcm2290 and some other platforms don't have
+the PCS_MISC_CLAMP_ENABLE register. Instead they need to toggle the
+register in the TCSR space. Make the new phy-qcom-qmp-usbc driver
+correctly handle the clamp register.
+
+Fixes: a51969fafc82 ("phy: qcom-qmp: Add QMP V3 USB3 PHY support for msm8998")
+Fixes: 8abe5e778b2c ("phy: qcom-qmp: Add QCM2290 USB3 PHY support")
+Cc: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240117-usbc-phy-vls-clamp-v2-3-a950c223f10f@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/qualcomm/phy-qcom-qmp-usbc.c | 48 ++++++++++++++++++------
+ 1 file changed, 37 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+index 214cf4203de41..3a4b4849db0f5 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-usbc.c
+@@ -10,11 +10,13 @@
+ #include <linux/io.h>
+ #include <linux/iopoll.h>
+ #include <linux/kernel.h>
++#include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ #include <linux/phy/phy.h>
+ #include <linux/platform_device.h>
++#include <linux/regmap.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/reset.h>
+ #include <linux/slab.h>
+@@ -56,9 +58,6 @@
+ /* QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR register bits */
+ #define IRQ_CLEAR				BIT(0)
+ 
+-/* QPHY_V3_PCS_MISC_CLAMP_ENABLE register bits */
+-#define CLAMP_EN				BIT(0) /* enables i/o clamp_n */
+-
+ #define PHY_INIT_COMPLETE_TIMEOUT		10000
+ 
+ struct qmp_phy_init_tbl {
+@@ -94,7 +93,6 @@ enum qphy_reg_layout {
+ 	QPHY_PCS_AUTONOMOUS_MODE_CTRL,
+ 	QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR,
+ 	QPHY_PCS_POWER_DOWN_CONTROL,
+-	QPHY_PCS_MISC_CLAMP_ENABLE,
+ 	/* Keep last to ensure regs_layout arrays are properly initialized */
+ 	QPHY_LAYOUT_SIZE
+ };
+@@ -106,7 +104,6 @@ static const unsigned int qmp_v3_usb3phy_regs_layout[QPHY_LAYOUT_SIZE] = {
+ 	[QPHY_PCS_AUTONOMOUS_MODE_CTRL]	= QPHY_V3_PCS_AUTONOMOUS_MODE_CTRL,
+ 	[QPHY_PCS_LFPS_RXTERM_IRQ_CLEAR] = QPHY_V3_PCS_LFPS_RXTERM_IRQ_CLEAR,
+ 	[QPHY_PCS_POWER_DOWN_CONTROL]	= QPHY_V3_PCS_POWER_DOWN_CONTROL,
+-	[QPHY_PCS_MISC_CLAMP_ENABLE]	= QPHY_V3_PCS_MISC_CLAMP_ENABLE,
+ };
+ 
+ static const unsigned int qmp_v3_usb3phy_regs_layout_qcm2290[QPHY_LAYOUT_SIZE] = {
+@@ -369,6 +366,9 @@ struct qmp_usbc {
+ 	void __iomem *tx2;
+ 	void __iomem *rx2;
+ 
++	struct regmap *tcsr_map;
++	u32 vls_clamp_reg;
++
+ 	struct clk *pipe_clk;
+ 	struct clk_bulk_data *clks;
+ 	int num_clks;
+@@ -691,7 +691,6 @@ static void qmp_usbc_enable_autonomous_mode(struct qmp_usbc *qmp)
+ {
+ 	const struct qmp_phy_cfg *cfg = qmp->cfg;
+ 	void __iomem *pcs = qmp->pcs;
+-	void __iomem *pcs_misc = qmp->pcs_misc;
+ 	u32 intr_mask;
+ 
+ 	if (qmp->mode == PHY_MODE_USB_HOST_SS ||
+@@ -712,19 +711,18 @@ static void qmp_usbc_enable_autonomous_mode(struct qmp_usbc *qmp)
+ 	qphy_setbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL], intr_mask);
+ 
+ 	/* Enable i/o clamp_n for autonomous mode */
+-	if (pcs_misc && cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE])
+-		qphy_clrbits(pcs_misc, cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE], CLAMP_EN);
++	if (qmp->tcsr_map && qmp->vls_clamp_reg)
++		regmap_write(qmp->tcsr_map, qmp->vls_clamp_reg, 1);
+ }
+ 
+ static void qmp_usbc_disable_autonomous_mode(struct qmp_usbc *qmp)
+ {
+ 	const struct qmp_phy_cfg *cfg = qmp->cfg;
+ 	void __iomem *pcs = qmp->pcs;
+-	void __iomem *pcs_misc = qmp->pcs_misc;
+ 
+ 	/* Disable i/o clamp_n on resume for normal mode */
+-	if (pcs_misc && cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE])
+-		qphy_setbits(pcs_misc, cfg->regs[QPHY_PCS_MISC_CLAMP_ENABLE], CLAMP_EN);
++	if (qmp->tcsr_map && qmp->vls_clamp_reg)
++		regmap_write(qmp->tcsr_map, qmp->vls_clamp_reg, 0);
+ 
+ 	qphy_clrbits(pcs, cfg->regs[QPHY_PCS_AUTONOMOUS_MODE_CTRL],
+ 		     ARCVR_DTCT_EN | ARCVR_DTCT_EVENT_SEL | ALFPS_DTCT_EN);
+@@ -1063,6 +1061,30 @@ static int qmp_usbc_parse_dt(struct qmp_usbc *qmp)
+ 	return 0;
+ }
+ 
++static int qmp_usbc_parse_vls_clamp(struct qmp_usbc *qmp)
++{
++	struct of_phandle_args tcsr_args;
++	struct device *dev = qmp->dev;
++	int ret;
++
++	/*  for backwards compatibility ignore if there is no property */
++	ret = of_parse_phandle_with_fixed_args(dev->of_node, "qcom,tcsr-reg", 1, 0,
++					       &tcsr_args);
++	if (ret == -ENOENT)
++		return 0;
++	else if (ret < 0)
++		return dev_err_probe(dev, ret, "Failed to parse qcom,tcsr-reg\n");
++
++	qmp->tcsr_map = syscon_node_to_regmap(tcsr_args.np);
++	of_node_put(tcsr_args.np);
++	if (IS_ERR(qmp->tcsr_map))
++		return PTR_ERR(qmp->tcsr_map);
++
++	qmp->vls_clamp_reg = tcsr_args.args[0];
++
++	return 0;
++}
++
+ static int qmp_usbc_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -1093,6 +1115,10 @@ static int qmp_usbc_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		return ret;
+ 
++	ret = qmp_usbc_parse_vls_clamp(qmp);
++	if (ret)
++		return ret;
++
+ 	/* Check for legacy binding with child node. */
+ 	np = of_get_child_by_name(dev->of_node, "phy");
+ 	if (np) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch b/queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
new file mode 100644
index 00000000000..7caee94d2b3
--- /dev/null
+++ b/queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
@@ -0,0 +1,40 @@
+From 2c7df990b8a3de327b41e4c033dd8fa09efcce0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 15:19:07 +0800
+Subject: pinctrl: mediatek: Drop bogus slew rate register range for MT8186
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 3a29c87548809405bcbc66acc69cbe6f15184d94 ]
+
+The MT8186 does not support configuring pin slew rate. This is evident
+from both the datasheet, and the fact that the driver points the slew
+rate register range at the GPIO direction register range.
+
+Drop the bogus setting.
+
+Fixes: 8b483bda1e46 ("pinctrl: add pinctrl driver on mt8186")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240131071910.3950450-1-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mt8186.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8186.c b/drivers/pinctrl/mediatek/pinctrl-mt8186.c
+index 7be591591cce5..dd19e74856a92 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8186.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8186.c
+@@ -1198,7 +1198,6 @@ static const struct mtk_pin_reg_calc mt8186_reg_cals[PINCTRL_PIN_REG_MAX] = {
+ 	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt8186_pin_dir_range),
+ 	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt8186_pin_di_range),
+ 	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt8186_pin_do_range),
+-	[PINCTRL_PIN_REG_SR] = MTK_RANGE(mt8186_pin_dir_range),
+ 	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt8186_pin_smt_range),
+ 	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt8186_pin_ies_range),
+ 	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt8186_pin_pu_range),
+-- 
+2.43.0
+
diff --git a/queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch-14189 b/queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch-14189
new file mode 100644
index 00000000000..08fd9123aa3
--- /dev/null
+++ b/queue-6.8/pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch-14189
@@ -0,0 +1,40 @@
+From 361f1a4c28fa4ac8aad02f9ef826ab4113faa2ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 15:19:08 +0800
+Subject: pinctrl: mediatek: Drop bogus slew rate register range for MT8192
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit e15ab05a6b3ed42f2f43f8bd1a1abdbde64afecd ]
+
+The MT8192 does not support configuring pin slew rate. This is evident
+from both the datasheet, and the fact that the driver points the slew
+rate register range at the GPIO direction register range.
+
+Drop the bogus setting.
+
+Fixes: d32f38f2a8fc ("pinctrl: mediatek: Add pinctrl driver for mt8192")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20240131071910.3950450-2-wenst@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/mediatek/pinctrl-mt8192.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8192.c b/drivers/pinctrl/mediatek/pinctrl-mt8192.c
+index e3a76381f7f4e..3f8a9dbcb7041 100644
+--- a/drivers/pinctrl/mediatek/pinctrl-mt8192.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt8192.c
+@@ -1379,7 +1379,6 @@ static const struct mtk_pin_reg_calc mt8192_reg_cals[PINCTRL_PIN_REG_MAX] = {
+ 	[PINCTRL_PIN_REG_DIR] = MTK_RANGE(mt8192_pin_dir_range),
+ 	[PINCTRL_PIN_REG_DI] = MTK_RANGE(mt8192_pin_di_range),
+ 	[PINCTRL_PIN_REG_DO] = MTK_RANGE(mt8192_pin_do_range),
+-	[PINCTRL_PIN_REG_SR] = MTK_RANGE(mt8192_pin_dir_range),
+ 	[PINCTRL_PIN_REG_SMT] = MTK_RANGE(mt8192_pin_smt_range),
+ 	[PINCTRL_PIN_REG_IES] = MTK_RANGE(mt8192_pin_ies_range),
+ 	[PINCTRL_PIN_REG_PU] = MTK_RANGE(mt8192_pin_pu_range),
+-- 
+2.43.0
+
diff --git a/queue-6.8/pinctrl-renesas-allow-the-compiler-to-optimize-away-.patch b/queue-6.8/pinctrl-renesas-allow-the-compiler-to-optimize-away-.patch
new file mode 100644
index 00000000000..1ac3207e6ac
--- /dev/null
+++ b/queue-6.8/pinctrl-renesas-allow-the-compiler-to-optimize-away-.patch
@@ -0,0 +1,53 @@
+From b307fcb2e03294740b3c985a58b76163e7368fbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 12:13:59 +0100
+Subject: pinctrl: renesas: Allow the compiler to optimize away sh_pfc_pm
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a6f06b909fee72c679c565adfa7f080f9595e336 ]
+
+The conversion to DEFINE_NOIRQ_DEV_PM_OPS() lost the ability of the
+compiler to optimize away the struct dev_pm_ops object when it is not
+needed.
+
+Fix this by replacing the use of pm_sleep_ptr() by a custom wrapper.
+
+Fixes: 727eb02eb753375e ("pinctrl: renesas: Switch to use DEFINE_NOIRQ_DEV_PM_OPS() helper")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/6238a78e32fa21f0c795406b6cba7bce7af92577.1708513940.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/renesas/core.c b/drivers/pinctrl/renesas/core.c
+index 93e51abbf519a..d1e92bbed33ad 100644
+--- a/drivers/pinctrl/renesas/core.c
++++ b/drivers/pinctrl/renesas/core.c
+@@ -731,10 +731,12 @@ static int sh_pfc_resume_noirq(struct device *dev)
+ 		sh_pfc_walk_regs(pfc, sh_pfc_restore_reg);
+ 	return 0;
+ }
++#define pm_psci_sleep_ptr(_ptr)	pm_sleep_ptr(_ptr)
+ #else
+ static int sh_pfc_suspend_init(struct sh_pfc *pfc) { return 0; }
+ static int sh_pfc_suspend_noirq(struct device *dev) { return 0; }
+ static int sh_pfc_resume_noirq(struct device *dev) { return 0; }
++#define pm_psci_sleep_ptr(_ptr)	PTR_IF(false, (_ptr))
+ #endif	/* CONFIG_ARM_PSCI_FW */
+ 
+ static DEFINE_NOIRQ_DEV_PM_OPS(sh_pfc_pm, sh_pfc_suspend_noirq, sh_pfc_resume_noirq);
+@@ -1415,7 +1417,7 @@ static struct platform_driver sh_pfc_driver = {
+ 	.driver		= {
+ 		.name	= DRV_NAME,
+ 		.of_match_table = of_match_ptr(sh_pfc_of_table),
+-		.pm	= pm_sleep_ptr(&sh_pfc_pm),
++		.pm	= pm_psci_sleep_ptr(&sh_pfc_pm),
+ 	},
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/pinctrl-renesas-r8a779g0-add-missing-scif_clk2-pin-g.patch b/queue-6.8/pinctrl-renesas-r8a779g0-add-missing-scif_clk2-pin-g.patch
new file mode 100644
index 00000000000..eeb4afef68a
--- /dev/null
+++ b/queue-6.8/pinctrl-renesas-r8a779g0-add-missing-scif_clk2-pin-g.patch
@@ -0,0 +1,69 @@
+From 5da89213902f52086b96caf3c1b18460f4ab295a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 17:32:36 +0100
+Subject: pinctrl: renesas: r8a779g0: Add missing SCIF_CLK2 pin group/function
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 68540257cdf1d07ff8a649aa94c21c5804bbb9b0 ]
+
+R-Car V4H actually has two SCIF_CLK pins.
+The second pin provides the SCIF_CLK signal for HSCIF2 and SCIF4.
+
+Fixes: 050442ae4c74f830 ("pinctrl: renesas: r8a779g0: Add pins, groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/6352ec9b63fdd38c2c70d8d203e46f21fbfeccdc.1705589612.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pfc-r8a779g0.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/pinctrl/renesas/pfc-r8a779g0.c b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+index acdea6ac15253..d2de526a3b588 100644
+--- a/drivers/pinctrl/renesas/pfc-r8a779g0.c
++++ b/drivers/pinctrl/renesas/pfc-r8a779g0.c
+@@ -2384,6 +2384,14 @@ static const unsigned int scif_clk_mux[] = {
+ 	SCIF_CLK_MARK,
+ };
+ 
++static const unsigned int scif_clk2_pins[] = {
++	/* SCIF_CLK2 */
++	RCAR_GP_PIN(8, 11),
++};
++static const unsigned int scif_clk2_mux[] = {
++	SCIF_CLK2_MARK,
++};
++
+ /* - SSI ------------------------------------------------- */
+ static const unsigned int ssi_data_pins[] = {
+ 	/* SSI_SD */
+@@ -2694,6 +2702,7 @@ static const struct sh_pfc_pin_group pinmux_groups[] = {
+ 	SH_PFC_PIN_GROUP(scif4_clk),
+ 	SH_PFC_PIN_GROUP(scif4_ctrl),
+ 	SH_PFC_PIN_GROUP(scif_clk),
++	SH_PFC_PIN_GROUP(scif_clk2),
+ 
+ 	SH_PFC_PIN_GROUP(ssi_data),
+ 	SH_PFC_PIN_GROUP(ssi_ctrl),
+@@ -3015,6 +3024,10 @@ static const char * const scif_clk_groups[] = {
+ 	"scif_clk",
+ };
+ 
++static const char * const scif_clk2_groups[] = {
++	"scif_clk2",
++};
++
+ static const char * const ssi_groups[] = {
+ 	"ssi_data",
+ 	"ssi_ctrl",
+@@ -3102,6 +3115,7 @@ static const struct sh_pfc_function pinmux_functions[] = {
+ 	SH_PFC_FUNCTION(scif3),
+ 	SH_PFC_FUNCTION(scif4),
+ 	SH_PFC_FUNCTION(scif_clk),
++	SH_PFC_FUNCTION(scif_clk2),
+ 
+ 	SH_PFC_FUNCTION(ssi),
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/pinctrl-renesas-rzg2l-fix-locking-in-rzg2l_dt_subnod.patch b/queue-6.8/pinctrl-renesas-rzg2l-fix-locking-in-rzg2l_dt_subnod.patch
new file mode 100644
index 00000000000..918865e8a06
--- /dev/null
+++ b/queue-6.8/pinctrl-renesas-rzg2l-fix-locking-in-rzg2l_dt_subnod.patch
@@ -0,0 +1,74 @@
+From 21cd10c7378ee17f8ec3b93b37e27b5949d3a7e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 17:34:53 +0200
+Subject: pinctrl: renesas: rzg2l: Fix locking in rzg2l_dt_subnode_to_map()
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit bd433c25ca81b2ac6dca7ea288a8474eea4fb8a0 ]
+
+Commit d3aaa7203a17 ("pinctrl: renesas: rzg2l: Add pin configuration
+support for pinmux groups") introduced the possibility to parse pin
+configuration for pinmux groups. It did that by calling
+rzg2l_map_add_config() at the end of rzg2l_dt_subnode_to_map() and
+jumping to the remove_group label in case rzg2l_map_add_config() failed.
+But if that happens, the mutex will already be unlocked, thus this it will
+lead to double mutex unlock operation. To fix this move the
+rzg2l_map_add_config() call just after all the name argument is ready and
+before the mutex is locked. There is no harm in doing this, as this only
+parses the data from device tree that will be further processed by
+pinctrl core code.
+
+Fixes: d3aaa7203a17 ("pinctrl: renesas: rzg2l: Add pin configuration support for pinmux groups")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/f8c3a3a0-7c48-4e40-8af0-ed4e9d9b049f@moroto.mountain
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240115153453.99226-1-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/renesas/pinctrl-rzg2l.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/pinctrl/renesas/pinctrl-rzg2l.c b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+index 80fb5011c7bbc..01ef6921cb35c 100644
+--- a/drivers/pinctrl/renesas/pinctrl-rzg2l.c
++++ b/drivers/pinctrl/renesas/pinctrl-rzg2l.c
+@@ -447,6 +447,16 @@ static int rzg2l_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ 		name = np->name;
+ 	}
+ 
++	if (num_configs) {
++		ret = rzg2l_map_add_config(&maps[idx], name,
++					   PIN_MAP_TYPE_CONFIGS_GROUP,
++					   configs, num_configs);
++		if (ret < 0)
++			goto done;
++
++		idx++;
++	}
++
+ 	mutex_lock(&pctrl->mutex);
+ 
+ 	/* Register a single pin group listing all the pins we read from DT */
+@@ -474,16 +484,6 @@ static int rzg2l_dt_subnode_to_map(struct pinctrl_dev *pctldev,
+ 	maps[idx].data.mux.function = name;
+ 	idx++;
+ 
+-	if (num_configs) {
+-		ret = rzg2l_map_add_config(&maps[idx], name,
+-					   PIN_MAP_TYPE_CONFIGS_GROUP,
+-					   configs, num_configs);
+-		if (ret < 0)
+-			goto remove_group;
+-
+-		idx++;
+-	}
+-
+ 	dev_dbg(pctrl->dev, "Parsed %pOF with %d pins\n", np, num_pinmux);
+ 	ret = 0;
+ 	goto done;
+-- 
+2.43.0
+
diff --git a/queue-6.8/platform-x86-amd-pmf-do-not-use-readl-for-policy-buf.patch b/queue-6.8/platform-x86-amd-pmf-do-not-use-readl-for-policy-buf.patch
new file mode 100644
index 00000000000..b6540ea2715
--- /dev/null
+++ b/queue-6.8/platform-x86-amd-pmf-do-not-use-readl-for-policy-buf.patch
@@ -0,0 +1,46 @@
+From 2330374cec72e5be37192ef4d178128618ad1e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 21:50:03 +0100
+Subject: platform/x86/amd/pmf: Do not use readl() for policy buffer access
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Armin Wolf <W_Armin@gmx.de>
+
+[ Upstream commit e42dddce83a0578a518cb7078930c8269a6083af ]
+
+The policy buffer is allocated using normal memory allocation
+functions, so readl() should not be used on it.
+
+Compile-tested only.
+
+Fixes: 7c45534afa44 ("platform/x86/amd/pmf: Add support for PMF Policy Binary")
+Signed-off-by: Armin Wolf <W_Armin@gmx.de>
+Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Link: https://lore.kernel.org/r/20240304205005.10078-3-W_Armin@gmx.de
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/amd/pmf/tee-if.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/amd/pmf/tee-if.c b/drivers/platform/x86/amd/pmf/tee-if.c
+index dcbe8f85e1229..4ebfe0f5a7fb2 100644
+--- a/drivers/platform/x86/amd/pmf/tee-if.c
++++ b/drivers/platform/x86/amd/pmf/tee-if.c
+@@ -249,8 +249,8 @@ static int amd_pmf_start_policy_engine(struct amd_pmf_dev *dev)
+ 	u32 cookie, length;
+ 	int res;
+ 
+-	cookie = readl(dev->policy_buf + POLICY_COOKIE_OFFSET);
+-	length = readl(dev->policy_buf + POLICY_COOKIE_LEN);
++	cookie = *(u32 *)(dev->policy_buf + POLICY_COOKIE_OFFSET);
++	length = *(u32 *)(dev->policy_buf + POLICY_COOKIE_LEN);
+ 
+ 	if (cookie != POLICY_SIGN_COOKIE || !length) {
+ 		dev_dbg(dev->dev, "cookie doesn't match\n");
+-- 
+2.43.0
+
diff --git a/queue-6.8/platform-x86-intel-pmc-arl-put-gna-device-in-d3.patch b/queue-6.8/platform-x86-intel-pmc-arl-put-gna-device-in-d3.patch
new file mode 100644
index 00000000000..828729f4f34
--- /dev/null
+++ b/queue-6.8/platform-x86-intel-pmc-arl-put-gna-device-in-d3.patch
@@ -0,0 +1,52 @@
+From 0d7f245c296e7e67067db19e5499398b8a8eb49d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 11:01:34 -0800
+Subject: platform/x86/intel/pmc/arl: Put GNA device in D3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit ac2d1fd9688fcdfba5acc815fb2b13fec83e5dad ]
+
+As is the case on Meteor Lake, the Gaussian & Neural Accelerator (GNA)
+device is powered by BIOS to D0 by default. If no driver is loaded, this
+will cause the Package C state to be limited to PC2, leading to
+significant power consumption and decrease in batter life.  Put the GNA
+device in D3 by default if no driver is loaded for it.
+
+Fixes: 83f168a1a437 ("platform/x86/intel/pmc: Add Arrow Lake S support to intel_pmc_core driver")
+Signed-off-by: "David E. Box" <david.e.box@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Link: https://lore.kernel.org/r/20240227190134.1592072-3-david.e.box@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/pmc/arl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/intel/pmc/arl.c b/drivers/platform/x86/intel/pmc/arl.c
+index 683ae828276b8..34b4cd23bfe59 100644
+--- a/drivers/platform/x86/intel/pmc/arl.c
++++ b/drivers/platform/x86/intel/pmc/arl.c
+@@ -673,6 +673,7 @@ static struct pmc_info arl_pmc_info_list[] = {
+ };
+ 
+ #define ARL_NPU_PCI_DEV			0xad1d
++#define ARL_GNA_PCI_DEV			0xae4c
+ /*
+  * Set power state of select devices that do not have drivers to D3
+  * so that they do not block Package C entry.
+@@ -680,6 +681,7 @@ static struct pmc_info arl_pmc_info_list[] = {
+ static void arl_d3_fixup(void)
+ {
+ 	pmc_core_set_device_d3(ARL_NPU_PCI_DEV);
++	pmc_core_set_device_d3(ARL_GNA_PCI_DEV);
+ }
+ 
+ static int arl_resume(struct pmc_dev *pmcdev)
+-- 
+2.43.0
+
diff --git a/queue-6.8/platform-x86-intel-pmc-lnl-remove-ssram-support.patch b/queue-6.8/platform-x86-intel-pmc-lnl-remove-ssram-support.patch
new file mode 100644
index 00000000000..cf2e46d36a5
--- /dev/null
+++ b/queue-6.8/platform-x86-intel-pmc-lnl-remove-ssram-support.patch
@@ -0,0 +1,105 @@
+From f79189a08cd9e9f4ecc0f19d5a8be5b2c35907ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 11:01:33 -0800
+Subject: platform/x86/intel/pmc/lnl: Remove SSRAM support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit e6ba4acde44957dc9bdc3222b5739217a102752d ]
+
+A recent PMC firmware change in Lunar Lake caused the pmc_core driver to
+fail to probe. This is due to a change in the GUID for PMC telemetry coming
+from the SSRAM device. Until a final release is ready this value may
+change again. In the meantime, disable the SSRAM support for Lunar Lake so
+the driver can load and provide some basic functionality.
+
+Fixes: 3748dfdae2a6 ("platform/x86/intel/pmc: Add Lunar Lake M support to intel_pmc_core driver")
+Signed-off-by: "David E. Box" <david.e.box@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20240227190134.1592072-2-david.e.box@linux.intel.com
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/pmc/lnl.c | 40 ++++------------------------
+ 1 file changed, 5 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/pmc/lnl.c b/drivers/platform/x86/intel/pmc/lnl.c
+index abad17cdd3d78..068d72504683f 100644
+--- a/drivers/platform/x86/intel/pmc/lnl.c
++++ b/drivers/platform/x86/intel/pmc/lnl.c
+@@ -13,21 +13,6 @@
+ 
+ #include "core.h"
+ 
+-#define SOCM_LPM_REQ_GUID	0x11594920
+-
+-#define PMC_DEVID_SOCM	0xa87f
+-
+-static const u8 LNL_LPM_REG_INDEX[] = {0, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16, 20};
+-
+-static struct pmc_info lnl_pmc_info_list[] = {
+-	{
+-		.guid	= SOCM_LPM_REQ_GUID,
+-		.devid	= PMC_DEVID_SOCM,
+-		.map	= &lnl_socm_reg_map,
+-	},
+-	{}
+-};
+-
+ const struct pmc_bit_map lnl_ltr_show_map[] = {
+ 	{"SOUTHPORT_A",		CNP_PMC_LTR_SPA},
+ 	{"SOUTHPORT_B",		CNP_PMC_LTR_SPB},
+@@ -490,7 +475,6 @@ const struct pmc_reg_map lnl_socm_reg_map = {
+ 	.lpm_sts = lnl_lpm_maps,
+ 	.lpm_status_offset = MTL_LPM_STATUS_OFFSET,
+ 	.lpm_live_status_offset = MTL_LPM_LIVE_STATUS_OFFSET,
+-	.lpm_reg_index = LNL_LPM_REG_INDEX,
+ };
+ 
+ #define LNL_NPU_PCI_DEV		0x643e
+@@ -517,33 +501,19 @@ static int lnl_resume(struct pmc_dev *pmcdev)
+ int lnl_core_init(struct pmc_dev *pmcdev)
+ {
+ 	int ret;
+-	int func = 2;
+-	bool ssram_init = true;
+ 	struct pmc *pmc = pmcdev->pmcs[PMC_IDX_SOC];
+ 
+ 	lnl_d3_fixup();
+ 
+ 	pmcdev->suspend = cnl_suspend;
+ 	pmcdev->resume = lnl_resume;
+-	pmcdev->regmap_list = lnl_pmc_info_list;
+-	ret = pmc_core_ssram_init(pmcdev, func);
+-
+-	/* If regbase not assigned, set map and discover using legacy method */
+-	if (ret) {
+-		ssram_init = false;
+-		pmc->map = &lnl_socm_reg_map;
+-		ret = get_primary_reg_base(pmc);
+-		if (ret)
+-			return ret;
+-	}
+ 
+-	pmc_core_get_low_power_modes(pmcdev);
++	pmc->map = &lnl_socm_reg_map;
++	ret = get_primary_reg_base(pmc);
++	if (ret)
++		return ret;
+ 
+-	if (ssram_init) {
+-		ret = pmc_core_ssram_get_lpm_reqs(pmcdev);
+-		if (ret)
+-			return ret;
+-	}
++	pmc_core_get_low_power_modes(pmcdev);
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/pmdomain-qcom-rpmhpd-drop-sa8540p-gfx.lvl.patch b/queue-6.8/pmdomain-qcom-rpmhpd-drop-sa8540p-gfx.lvl.patch
new file mode 100644
index 00000000000..9bba11f13e4
--- /dev/null
+++ b/queue-6.8/pmdomain-qcom-rpmhpd-drop-sa8540p-gfx.lvl.patch
@@ -0,0 +1,39 @@
+From 24713a1e85ecdb493c8f70c8318c2fc7d9539835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jan 2024 13:05:10 -0800
+Subject: pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit 883957bee580b723fd87d49ac73e0c84fc03a446 ]
+
+On SA8295P and SA8540P gfx.lvl is not provdied by rpmh, but rather is
+handled by an external regulator (max20411). Drop gfx.lvl from the list
+of power-domains exposed on this platform.
+
+Fixes: f68f1cb3437d ("soc: qcom: rpmhpd: add sc8280xp & sa8540p rpmh power-domains")
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20240125-sa8295p-gpu-v4-4-7011c2a63037@quicinc.com
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pmdomain/qcom/rpmhpd.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/pmdomain/qcom/rpmhpd.c b/drivers/pmdomain/qcom/rpmhpd.c
+index 47df910645f66..de9121ef4216b 100644
+--- a/drivers/pmdomain/qcom/rpmhpd.c
++++ b/drivers/pmdomain/qcom/rpmhpd.c
+@@ -217,7 +217,6 @@ static struct rpmhpd *sa8540p_rpmhpds[] = {
+ 	[SC8280XP_CX] = &cx,
+ 	[SC8280XP_CX_AO] = &cx_ao,
+ 	[SC8280XP_EBI] = &ebi,
+-	[SC8280XP_GFX] = &gfx,
+ 	[SC8280XP_LCX] = &lcx,
+ 	[SC8280XP_LMX] = &lmx,
+ 	[SC8280XP_MMCX] = &mmcx,
+-- 
+2.43.0
+
diff --git a/queue-6.8/power-supply-mm8013-fix-not-charging-detection.patch b/queue-6.8/power-supply-mm8013-fix-not-charging-detection.patch
new file mode 100644
index 00000000000..c85b88ad210
--- /dev/null
+++ b/queue-6.8/power-supply-mm8013-fix-not-charging-detection.patch
@@ -0,0 +1,78 @@
+From 5a61d404124fc139ce30627d36580de7d5538919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Mar 2024 16:31:13 +0100
+Subject: power: supply: mm8013: fix "not charging" detection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit cd38a0acca734a1117663d6f0da579d3965b6c93 ]
+
+The charge_behaviours property is meant as a control-knob that can be
+changed by the user.
+
+Page 23 of [0] which documents the flag CHG_INH as follows:
+
+  CHG_INH : Charge Inhibit      When the current is more than or equal to charge
+                                threshold current,
+                                charge inhibit temperature (upper/lower limit) ：1
+                                charge permission temperature or the current is
+                                less than charge threshold current ：0
+
+So this is pure read-only information which is better represented as
+POWER_SUPPLY_STATUS_NOT_CHARGING.
+
+[0] https://product.minebeamitsumi.com/en/product/category/ics/battery/fuel_gauge/parts/download/__icsFiles/afieldfile/2023/07/12/1_download_01_12.pdf
+
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Link: https://lore.kernel.org/r/20240303-power_supply-charge_behaviour_prop-v2-1-8ebb0a7c2409@weissschuh.net
+Fixes: e39257cde7e8 ("power: supply: mm8013: Add more properties")
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/mm8013.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/power/supply/mm8013.c b/drivers/power/supply/mm8013.c
+index caa272b035649..20c1651ca38e0 100644
+--- a/drivers/power/supply/mm8013.c
++++ b/drivers/power/supply/mm8013.c
+@@ -71,7 +71,6 @@ static int mm8013_checkdevice(struct mm8013_chip *chip)
+ 
+ static enum power_supply_property mm8013_battery_props[] = {
+ 	POWER_SUPPLY_PROP_CAPACITY,
+-	POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR,
+ 	POWER_SUPPLY_PROP_CHARGE_FULL,
+ 	POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN,
+ 	POWER_SUPPLY_PROP_CHARGE_NOW,
+@@ -103,16 +102,6 @@ static int mm8013_get_property(struct power_supply *psy,
+ 
+ 		val->intval = regval;
+ 		break;
+-	case POWER_SUPPLY_PROP_CHARGE_BEHAVIOUR:
+-		ret = regmap_read(chip->regmap, REG_FLAGS, &regval);
+-		if (ret < 0)
+-			return ret;
+-
+-		if (regval & MM8013_FLAG_CHG_INH)
+-			val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_INHIBIT_CHARGE;
+-		else
+-			val->intval = POWER_SUPPLY_CHARGE_BEHAVIOUR_AUTO;
+-		break;
+ 	case POWER_SUPPLY_PROP_CHARGE_FULL:
+ 		ret = regmap_read(chip->regmap, REG_FULL_CHARGE_CAPACITY, &regval);
+ 		if (ret < 0)
+@@ -187,6 +176,8 @@ static int mm8013_get_property(struct power_supply *psy,
+ 
+ 		if (regval & MM8013_FLAG_DSG)
+ 			val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
++		else if (regval & MM8013_FLAG_CHG_INH)
++			val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ 		else if (regval & MM8013_FLAG_CHG)
+ 			val->intval = POWER_SUPPLY_STATUS_CHARGING;
+ 		else if (regval & MM8013_FLAG_FC)
+-- 
+2.43.0
+
diff --git a/queue-6.8/powercap-dtpm_cpu-fix-error-check-against-freq_qos_a.patch b/queue-6.8/powercap-dtpm_cpu-fix-error-check-against-freq_qos_a.patch
new file mode 100644
index 00000000000..700bc76cae2
--- /dev/null
+++ b/queue-6.8/powercap-dtpm_cpu-fix-error-check-against-freq_qos_a.patch
@@ -0,0 +1,41 @@
+From 4e101462c6b1e382b5dbe7d2298e7f7175b16a2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 23:39:47 +0100
+Subject: powercap: dtpm_cpu: Fix error check against freq_qos_add_request()
+
+From: Daniel Lezcano <daniel.lezcano@linaro.org>
+
+[ Upstream commit b50155cb0d609437236c88201206267835c6f965 ]
+
+The caller of the function freq_qos_add_request() checks again a non
+zero value but freq_qos_add_request() can return '1' if the request
+already exists. Therefore, the setup function fails while the QoS
+request actually did not failed.
+
+Fix that by changing the check against a negative value like all the
+other callers of the function.
+
+Fixes: 0e8f68d7f0485 ("Add CPU energy model based support")
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/powercap/dtpm_cpu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/powercap/dtpm_cpu.c b/drivers/powercap/dtpm_cpu.c
+index 9193c3b8edebe..ae7ee611978ba 100644
+--- a/drivers/powercap/dtpm_cpu.c
++++ b/drivers/powercap/dtpm_cpu.c
+@@ -219,7 +219,7 @@ static int __dtpm_cpu_setup(int cpu, struct dtpm *parent)
+ 	ret = freq_qos_add_request(&policy->constraints,
+ 				   &dtpm_cpu->qos_req, FREQ_QOS_MAX,
+ 				   pd->table[pd->nr_perf_states - 1].frequency);
+-	if (ret)
++	if (ret < 0)
+ 		goto out_dtpm_unregister;
+ 
+ 	cpufreq_cpu_put(policy);
+-- 
+2.43.0
+
diff --git a/queue-6.8/powerpc-32-fix-adb_cuda-kconfig-warning.patch b/queue-6.8/powerpc-32-fix-adb_cuda-kconfig-warning.patch
new file mode 100644
index 00000000000..9f0a38d0fe5
--- /dev/null
+++ b/queue-6.8/powerpc-32-fix-adb_cuda-kconfig-warning.patch
@@ -0,0 +1,45 @@
+From d37e011236e03238766e45bc2cbb6c238eaec215 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Feb 2024 14:16:23 -0800
+Subject: powerpc/32: fix ADB_CUDA kconfig warning
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit b72c066ba85a131091498a15a62d6068997278a4 ]
+
+Fix a (randconfig) kconfig warning by correcting the select
+statement:
+
+WARNING: unmet direct dependencies detected for ADB_CUDA
+  Depends on [n]: MACINTOSH_DRIVERS [=n] && (ADB [=n] || PPC_PMAC [=y]) && !PPC_PMAC64 [=n]
+  Selected by [y]:
+  - PPC_PMAC [=y] && PPC_BOOK3S [=y] && CPU_BIG_ENDIAN [=y] && POWER_RESET [=y] && PPC32 [=y]
+
+The PPC32 isn't needed because ADB depends on (PPC_PMAC && PPC32).
+
+Fixes: a3ef2fef198c ("powerpc/32: Add dependencies of POWER_RESET for pmac32")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Tested: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240211221623.31112-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powermac/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/powermac/Kconfig b/arch/powerpc/platforms/powermac/Kconfig
+index 8bdae0caf21e5..84f101ec53a96 100644
+--- a/arch/powerpc/platforms/powermac/Kconfig
++++ b/arch/powerpc/platforms/powermac/Kconfig
+@@ -2,7 +2,7 @@
+ config PPC_PMAC
+ 	bool "Apple PowerMac based machines"
+ 	depends on PPC_BOOK3S && CPU_BIG_ENDIAN
+-	select ADB_CUDA if POWER_RESET && PPC32
++	select ADB_CUDA if POWER_RESET && ADB
+ 	select MPIC
+ 	select FORCE_PCI
+ 	select PPC_INDIRECT_PCI if PPC32
+-- 
+2.43.0
+
diff --git a/queue-6.8/powerpc-4xx-fix-warp_gpio_leds-build-failure.patch b/queue-6.8/powerpc-4xx-fix-warp_gpio_leds-build-failure.patch
new file mode 100644
index 00000000000..49ddc04181b
--- /dev/null
+++ b/queue-6.8/powerpc-4xx-fix-warp_gpio_leds-build-failure.patch
@@ -0,0 +1,43 @@
+From 6fa79fe981cc7e16e04da33df7f6f1c98425419d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 23:34:10 +1100
+Subject: powerpc/4xx: Fix warp_gpio_leds build failure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 5b9e00a6004cf837c43fdb8d5290df619de78024 ]
+
+The 44x/warp_defconfig build fails with:
+
+  arch/powerpc/platforms/44x/warp.c:109:15: error: variable ‘warp_gpio_leds’ has initializer but incomplete type
+    109 | static struct platform_device warp_gpio_leds = {
+        |               ^~~~~~~~~~~~~~~
+
+Fix it by including platform_device.h.
+
+Fixes: ef175b29a242 ("of: Stop circularly including of_device.h and of_platform.h")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240305123410.3306253-3-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/44x/warp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/44x/warp.c b/arch/powerpc/platforms/44x/warp.c
+index bf0188dcb9184..a5001d32f978d 100644
+--- a/arch/powerpc/platforms/44x/warp.c
++++ b/arch/powerpc/platforms/44x/warp.c
+@@ -8,6 +8,7 @@
+ #include <linux/err.h>
+ #include <linux/init.h>
+ #include <linux/of_platform.h>
++#include <linux/platform_device.h>
+ #include <linux/kthread.h>
+ #include <linux/leds.h>
+ #include <linux/i2c.h>
+-- 
+2.43.0
+
diff --git a/queue-6.8/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch b/queue-6.8/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
new file mode 100644
index 00000000000..84525b4e4a3
--- /dev/null
+++ b/queue-6.8/powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
@@ -0,0 +1,53 @@
+From a23fe4aed3c0f4a98baec4ebf24cd40ab295ee48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 23:34:08 +1100
+Subject: powerpc/embedded6xx: Fix no previous prototype for avr_uart_send()
+ etc.
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 20933531be0577cdd782216858c26150dbc7936f ]
+
+Move the prototypes into mpc10x.h which is included by all the relevant
+C files, fixes:
+
+  arch/powerpc/platforms/embedded6xx/ls_uart.c:59:6: error: no previous prototype for 'avr_uart_configure'
+  arch/powerpc/platforms/embedded6xx/ls_uart.c:82:6: error: no previous prototype for 'avr_uart_send'
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240305123410.3306253-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/embedded6xx/linkstation.c | 3 ---
+ arch/powerpc/platforms/embedded6xx/mpc10x.h      | 3 +++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/embedded6xx/linkstation.c b/arch/powerpc/platforms/embedded6xx/linkstation.c
+index 9c10aac40c7b1..e265f026eee2a 100644
+--- a/arch/powerpc/platforms/embedded6xx/linkstation.c
++++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
+@@ -99,9 +99,6 @@ static void __init linkstation_init_IRQ(void)
+ 	mpic_init(mpic);
+ }
+ 
+-extern void avr_uart_configure(void);
+-extern void avr_uart_send(const char);
+-
+ static void __noreturn linkstation_restart(char *cmd)
+ {
+ 	local_irq_disable();
+diff --git a/arch/powerpc/platforms/embedded6xx/mpc10x.h b/arch/powerpc/platforms/embedded6xx/mpc10x.h
+index 5ad12023e5628..ebc258fa4858d 100644
+--- a/arch/powerpc/platforms/embedded6xx/mpc10x.h
++++ b/arch/powerpc/platforms/embedded6xx/mpc10x.h
+@@ -156,4 +156,7 @@ int mpc10x_disable_store_gathering(struct pci_controller *hose);
+ /* For MPC107 boards that use the built-in openpic */
+ void mpc10x_set_openpic(void);
+ 
++void avr_uart_configure(void);
++void avr_uart_send(const char c);
++
+ #endif	/* __PPC_KERNEL_MPC10X_H */
+-- 
+2.43.0
+
diff --git a/queue-6.8/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch b/queue-6.8/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
new file mode 100644
index 00000000000..ff6119b7e05
--- /dev/null
+++ b/queue-6.8/powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
@@ -0,0 +1,65 @@
+From 1944c5011729a570f8b0a217ac69580bc66085f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 14:58:37 +0100
+Subject: powerpc: Force inlining of arch_vmap_p{u/m}d_supported()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c5aebb53b32460bc52680dd4e2a2f6b84d5ea521 ]
+
+arch_vmap_pud_supported() and arch_vmap_pmd_supported() are
+expected to constant-fold to false when RADIX is not enabled.
+
+Force inlining in order to avoid following failure which
+leads to unexpected call of non-existing pud_set_huge() and
+pmd_set_huge() on powerpc 8xx.
+
+In function 'pud_huge_tests',
+    inlined from 'debug_vm_pgtable' at mm/debug_vm_pgtable.c:1399:2:
+./arch/powerpc/include/asm/vmalloc.h:9:33: warning: inlining failed in call to 'arch_vmap_pud_supported.isra': call is unlikely and code size would grow [-Winline]
+    9 | #define arch_vmap_pud_supported arch_vmap_pud_supported
+      |                                 ^~~~~~~~~~~~~~~~~~~~~~~
+./arch/powerpc/include/asm/vmalloc.h:10:20: note: in expansion of macro 'arch_vmap_pud_supported'
+   10 | static inline bool arch_vmap_pud_supported(pgprot_t prot)
+      |                    ^~~~~~~~~~~~~~~~~~~~~~~
+./arch/powerpc/include/asm/vmalloc.h:9:33: note: called from here
+    9 | #define arch_vmap_pud_supported arch_vmap_pud_supported
+mm/debug_vm_pgtable.c:458:14: note: in expansion of macro 'arch_vmap_pud_supported'
+  458 |         if (!arch_vmap_pud_supported(args->page_prot) ||
+      |              ^~~~~~~~~~~~~~~~~~~~~~~
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402131836.OU1TDuoi-lkp@intel.com/
+Fixes: 8309c9d71702 ("powerpc: inline huge vmap supported functions")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/bbd84ad52bf377e8d3b5865a906f2dc5d99964ba.1707832677.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/vmalloc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/vmalloc.h b/arch/powerpc/include/asm/vmalloc.h
+index 4c69ece52a31e..59ed89890c902 100644
+--- a/arch/powerpc/include/asm/vmalloc.h
++++ b/arch/powerpc/include/asm/vmalloc.h
+@@ -7,14 +7,14 @@
+ #ifdef CONFIG_HAVE_ARCH_HUGE_VMAP
+ 
+ #define arch_vmap_pud_supported arch_vmap_pud_supported
+-static inline bool arch_vmap_pud_supported(pgprot_t prot)
++static __always_inline bool arch_vmap_pud_supported(pgprot_t prot)
+ {
+ 	/* HPT does not cope with large pages in the vmalloc area */
+ 	return radix_enabled();
+ }
+ 
+ #define arch_vmap_pmd_supported arch_vmap_pmd_supported
+-static inline bool arch_vmap_pmd_supported(pgprot_t prot)
++static __always_inline bool arch_vmap_pmd_supported(pgprot_t prot)
+ {
+ 	return radix_enabled();
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch b/queue-6.8/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
new file mode 100644
index 00000000000..6f1de2e0a38
--- /dev/null
+++ b/queue-6.8/powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
@@ -0,0 +1,118 @@
+From beb9a073d2368275227e46192315911b69c698b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 17:58:47 +0530
+Subject: powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value
+ checks
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit ad86d7ee43b22aa2ed60fb982ae94b285c1be671 ]
+
+Running event hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/
+in one of the system throws below error:
+
+ ---Logs---
+ # perf list | grep hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles
+  hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=?/[Kernel PMU event]
+
+ # perf stat -v -e hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ sleep 2
+Using CPUID 00800200
+Control descriptor is not initialized
+Warning:
+hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ event is not supported by the kernel.
+failed to read counter hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/
+
+ Performance counter stats for 'system wide':
+
+   <not supported>      hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/
+
+       2.000700771 seconds time elapsed
+
+The above error is because of the hcall failure as required
+permission "Enable Performance Information Collection" is not set.
+Based on current code, single_gpci_request function did not check the
+error type incase hcall fails and by default returns EINVAL. But we can
+have other reasons for hcall failures like H_AUTHORITY/H_PARAMETER with
+detail_rc as GEN_BUF_TOO_SMALL, for which we need to act accordingly.
+
+Fix this issue by adding new checks in the single_gpci_request and
+h_gpci_event_init functions.
+
+Result after fix patch changes:
+
+ # perf stat -e hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ sleep 2
+Error:
+No permission to enable hv_gpci/dispatch_timebase_by_processor_processor_time_in_timebase_cycles,phys_processor_idx=0/ event.
+
+Fixes: 220a0c609ad1 ("powerpc/perf: Add support for the hv gpci (get performance counter info) interface")
+Reported-by: Akanksha J N <akanksha@linux.ibm.com>
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20240229122847.101162-1-kjain@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/hv-gpci.c | 29 +++++++++++++++++++++++++++--
+ 1 file changed, 27 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
+index 27f18119fda17..241551d1282f8 100644
+--- a/arch/powerpc/perf/hv-gpci.c
++++ b/arch/powerpc/perf/hv-gpci.c
+@@ -695,6 +695,20 @@ static unsigned long single_gpci_request(u32 req, u32 starting_index,
+ 
+ 	ret = plpar_hcall_norets(H_GET_PERF_COUNTER_INFO,
+ 			virt_to_phys(arg), HGPCI_REQ_BUFFER_SIZE);
++
++	/*
++	 * ret value as 'H_PARAMETER' with detail_rc as 'GEN_BUF_TOO_SMALL',
++	 * specifies that the current buffer size cannot accommodate
++	 * all the information and a partial buffer returned.
++	 * Since in this function we are only accessing data for a given starting index,
++	 * we don't need to accommodate whole data and can get required count by
++	 * accessing first entry data.
++	 * Hence hcall fails only incase the ret value is other than H_SUCCESS or
++	 * H_PARAMETER with detail_rc value as GEN_BUF_TOO_SMALL(0x1B).
++	 */
++	if (ret == H_PARAMETER && be32_to_cpu(arg->params.detail_rc) == 0x1B)
++		ret = 0;
++
+ 	if (ret) {
+ 		pr_devel("hcall failed: 0x%lx\n", ret);
+ 		goto out;
+@@ -759,6 +773,7 @@ static int h_gpci_event_init(struct perf_event *event)
+ {
+ 	u64 count;
+ 	u8 length;
++	unsigned long ret;
+ 
+ 	/* Not our event */
+ 	if (event->attr.type != event->pmu->type)
+@@ -789,13 +804,23 @@ static int h_gpci_event_init(struct perf_event *event)
+ 	}
+ 
+ 	/* check if the request works... */
+-	if (single_gpci_request(event_get_request(event),
++	ret = single_gpci_request(event_get_request(event),
+ 				event_get_starting_index(event),
+ 				event_get_secondary_index(event),
+ 				event_get_counter_info_version(event),
+ 				event_get_offset(event),
+ 				length,
+-				&count)) {
++				&count);
++
++	/*
++	 * ret value as H_AUTHORITY implies that partition is not permitted to retrieve
++	 * performance information, and required to set
++	 * "Enable Performance Information Collection" option.
++	 */
++	if (ret == H_AUTHORITY)
++		return -EPERM;
++
++	if (ret) {
+ 		pr_devel("gpci hcall failed\n");
+ 		return -EINVAL;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/powerpc-ps3-fix-lv1-hcall-assembly-for-elfv2-calling.patch b/queue-6.8/powerpc-ps3-fix-lv1-hcall-assembly-for-elfv2-calling.patch
new file mode 100644
index 00000000000..e38b928c275
--- /dev/null
+++ b/queue-6.8/powerpc-ps3-fix-lv1-hcall-assembly-for-elfv2-calling.patch
@@ -0,0 +1,99 @@
+From 298cf5a37d20e6632e85d62aa4fda9346e923805 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Dec 2023 17:24:03 +1000
+Subject: powerpc/ps3: Fix lv1 hcall assembly for ELFv2 calling convention
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 6735fef14c1f089ae43fd6d43add818b7ff682a8 ]
+
+Stack-passed parameters begin at a different offset in the caller's
+stack in the ELFv2 ABI.
+
+Reported-by: Geoff Levand <geoff@infradead.org>
+Fixes: 8c5fa3b5c4df ("powerpc/64: Make ELFv2 the default for big-endian builds")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Tested-by: Geoff Levand <geoff@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231227072405.63751-2-npiggin@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/ppc_asm.h  |  6 ++++--
+ arch/powerpc/platforms/ps3/hvcall.S | 18 +++++++++---------
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
+index e7792aa135105..041ee25955205 100644
+--- a/arch/powerpc/include/asm/ppc_asm.h
++++ b/arch/powerpc/include/asm/ppc_asm.h
+@@ -201,11 +201,13 @@
+ 
+ #ifdef CONFIG_PPC64_ELF_ABI_V2
+ #define STK_GOT		24
+-#define __STK_PARAM(i)	(32 + ((i)-3)*8)
++#define STK_PARAM_AREA	32
+ #else
+ #define STK_GOT		40
+-#define __STK_PARAM(i)	(48 + ((i)-3)*8)
++#define STK_PARAM_AREA	48
+ #endif
++
++#define __STK_PARAM(i)	(STK_PARAM_AREA + ((i)-3)*8)
+ #define STK_PARAM(i)	__STK_PARAM(__REG_##i)
+ 
+ #ifdef CONFIG_PPC64_ELF_ABI_V2
+diff --git a/arch/powerpc/platforms/ps3/hvcall.S b/arch/powerpc/platforms/ps3/hvcall.S
+index 509e30ad01bb4..59ea569debf47 100644
+--- a/arch/powerpc/platforms/ps3/hvcall.S
++++ b/arch/powerpc/platforms/ps3/hvcall.S
+@@ -714,7 +714,7 @@ _GLOBAL(_##API_NAME)				\
+ 	std	r4, 0(r11);			\
+ 	ld	r11, -16(r1);			\
+ 	std	r5, 0(r11);			\
+-	ld	r11, 48+8*8(r1);		\
++	ld	r11, STK_PARAM_AREA+8*8(r1);	\
+ 	std	r6, 0(r11);			\
+ 						\
+ 	ld	r0, 16(r1);			\
+@@ -746,22 +746,22 @@ _GLOBAL(_##API_NAME)				\
+ 	mflr	r0;				\
+ 	std	r0, 16(r1);			\
+ 						\
+-	std	r10, 48+8*7(r1);		\
++	std	r10, STK_PARAM_AREA+8*7(r1);	\
+ 						\
+ 	li	r11, API_NUMBER;		\
+ 	lv1call;				\
+ 						\
+-	ld	r11, 48+8*7(r1);		\
++	ld	r11, STK_PARAM_AREA+8*7(r1);	\
+ 	std	r4, 0(r11);			\
+-	ld	r11, 48+8*8(r1);		\
++	ld	r11, STK_PARAM_AREA+8*8(r1);	\
+ 	std	r5, 0(r11);			\
+-	ld	r11, 48+8*9(r1);		\
++	ld	r11, STK_PARAM_AREA+8*9(r1);	\
+ 	std	r6, 0(r11);			\
+-	ld	r11, 48+8*10(r1);		\
++	ld	r11, STK_PARAM_AREA+8*10(r1);	\
+ 	std	r7, 0(r11);			\
+-	ld	r11, 48+8*11(r1);		\
++	ld	r11, STK_PARAM_AREA+8*11(r1);	\
+ 	std	r8, 0(r11);			\
+-	ld	r11, 48+8*12(r1);		\
++	ld	r11, STK_PARAM_AREA+8*12(r1);	\
+ 	std	r9, 0(r11);			\
+ 						\
+ 	ld	r0, 16(r1);			\
+@@ -777,7 +777,7 @@ _GLOBAL(_##API_NAME)				\
+ 	li      r11, API_NUMBER;		\
+ 	lv1call;				\
+ 						\
+-	ld	r11, 48+8*8(r1);		\
++	ld	r11, STK_PARAM_AREA+8*8(r1);	\
+ 	std	r4, 0(r11);			\
+ 						\
+ 	ld	r0, 16(r1);			\
+-- 
+2.43.0
+
diff --git a/queue-6.8/powerpc-pseries-fix-potential-memleak-in-papr_get_at.patch b/queue-6.8/powerpc-pseries-fix-potential-memleak-in-papr_get_at.patch
new file mode 100644
index 00000000000..5f35a0f26b1
--- /dev/null
+++ b/queue-6.8/powerpc-pseries-fix-potential-memleak-in-papr_get_at.patch
@@ -0,0 +1,44 @@
+From 9d10279974da04240b0b55dac1c0c6da1db3b85e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Dec 2022 21:34:49 +0800
+Subject: powerpc/pseries: Fix potential memleak in papr_get_attr()
+
+From: Qiheng Lin <linqiheng@huawei.com>
+
+[ Upstream commit cda9c0d556283e2d4adaa9960b2dc19b16156bae ]
+
+`buf` is allocated in papr_get_attr(), and krealloc() of `buf`
+could fail. We need to free the original `buf` in the case of failure.
+
+Fixes: 3c14b73454cf ("powerpc/pseries: Interface to represent PAPR firmware attributes")
+Signed-off-by: Qiheng Lin <linqiheng@huawei.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20221208133449.16284-1-linqiheng@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/papr_platform_attributes.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/papr_platform_attributes.c b/arch/powerpc/platforms/pseries/papr_platform_attributes.c
+index 526c621b098be..eea2041b270b5 100644
+--- a/arch/powerpc/platforms/pseries/papr_platform_attributes.c
++++ b/arch/powerpc/platforms/pseries/papr_platform_attributes.c
+@@ -101,10 +101,12 @@ static int papr_get_attr(u64 id, struct energy_scale_attribute *esi)
+ 		esi_buf_size = ESI_HDR_SIZE + (CURR_MAX_ESI_ATTRS * max_esi_attrs);
+ 
+ 		temp_buf = krealloc(buf, esi_buf_size, GFP_KERNEL);
+-		if (temp_buf)
++		if (temp_buf) {
+ 			buf = temp_buf;
+-		else
+-			return -ENOMEM;
++		} else {
++			ret = -ENOMEM;
++			goto out_buf;
++		}
+ 
+ 		goto retry;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/printk-add-this_cpu_in_panic.patch b/queue-6.8/printk-add-this_cpu_in_panic.patch
new file mode 100644
index 00000000000..e320a152f03
--- /dev/null
+++ b/queue-6.8/printk-add-this_cpu_in_panic.patch
@@ -0,0 +1,102 @@
+From cbac1d15a2a79b97dc15bb64bc1428742a7623c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:46:56 +0106
+Subject: printk: Add this_cpu_in_panic()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 36652d0f3bf34899e82d31a5fa9e2bdd02fd6381 ]
+
+There is already panic_in_progress() and other_cpu_in_panic(),
+but checking if the current CPU is the panic CPU must still be
+open coded.
+
+Add this_cpu_in_panic() to complete the set.
+
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20240207134103.1357162-8-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Stable-dep-of: b1c4c67a5e90 ("printk: ringbuffer: Skip non-finalized records in panic")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/internal.h |  1 +
+ kernel/printk/printk.c   | 43 +++++++++++++++++++++-------------------
+ 2 files changed, 24 insertions(+), 20 deletions(-)
+
+diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h
+index 6c2afee5ef620..ac2d9750e5f81 100644
+--- a/kernel/printk/internal.h
++++ b/kernel/printk/internal.h
+@@ -130,6 +130,7 @@ struct printk_message {
+ };
+ 
+ bool other_cpu_in_panic(void);
++bool this_cpu_in_panic(void);
+ bool printk_get_next_message(struct printk_message *pmsg, u64 seq,
+ 			     bool is_extended, bool may_supress);
+ 
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index d9420207282ac..b7e50f8438df3 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -347,6 +347,29 @@ static bool panic_in_progress(void)
+ 	return unlikely(atomic_read(&panic_cpu) != PANIC_CPU_INVALID);
+ }
+ 
++/* Return true if a panic is in progress on the current CPU. */
++bool this_cpu_in_panic(void)
++{
++	/*
++	 * We can use raw_smp_processor_id() here because it is impossible for
++	 * the task to be migrated to the panic_cpu, or away from it. If
++	 * panic_cpu has already been set, and we're not currently executing on
++	 * that CPU, then we never will be.
++	 */
++	return unlikely(atomic_read(&panic_cpu) == raw_smp_processor_id());
++}
++
++/*
++ * Return true if a panic is in progress on a remote CPU.
++ *
++ * On true, the local CPU should immediately release any printing resources
++ * that may be needed by the panic CPU.
++ */
++bool other_cpu_in_panic(void)
++{
++	return (panic_in_progress() && !this_cpu_in_panic());
++}
++
+ /*
+  * This is used for debugging the mess that is the VT code by
+  * keeping track if we have the console semaphore held. It's
+@@ -2601,26 +2624,6 @@ static int console_cpu_notify(unsigned int cpu)
+ 	return 0;
+ }
+ 
+-/*
+- * Return true if a panic is in progress on a remote CPU.
+- *
+- * On true, the local CPU should immediately release any printing resources
+- * that may be needed by the panic CPU.
+- */
+-bool other_cpu_in_panic(void)
+-{
+-	if (!panic_in_progress())
+-		return false;
+-
+-	/*
+-	 * We can use raw_smp_processor_id() here because it is impossible for
+-	 * the task to be migrated to the panic_cpu, or away from it. If
+-	 * panic_cpu has already been set, and we're not currently executing on
+-	 * that CPU, then we never will be.
+-	 */
+-	return atomic_read(&panic_cpu) != raw_smp_processor_id();
+-}
+-
+ /**
+  * console_lock - block the console subsystem from printing
+  *
+-- 
+2.43.0
+
diff --git a/queue-6.8/printk-disable-passing-console-lock-owner-completely.patch b/queue-6.8/printk-disable-passing-console-lock-owner-completely.patch
new file mode 100644
index 00000000000..764e9e80c2c
--- /dev/null
+++ b/queue-6.8/printk-disable-passing-console-lock-owner-completely.patch
@@ -0,0 +1,116 @@
+From 15ea40ccb85baa22b830b1b30f70a1abcbf7940a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:47:00 +0106
+Subject: printk: Disable passing console lock owner completely during panic()
+
+From: Petr Mladek <pmladek@suse.com>
+
+[ Upstream commit d04d5882cd678b898a9d7c5aee6afbe9e6e77fcd ]
+
+The commit d51507098ff91 ("printk: disable optimistic spin
+during panic") added checks to avoid becoming a console waiter
+if a panic is in progress.
+
+However, the transition to panic can occur while there is
+already a waiter. The current owner should not pass the lock to
+the waiter because it might get stopped or blocked anytime.
+
+Also the panic context might pass the console lock owner to an
+already stopped waiter by mistake. It might happen when
+console_flush_on_panic() ignores the current lock owner, for
+example:
+
+CPU0                                CPU1
+----                                ----
+console_lock_spinning_enable()
+                                    console_trylock_spinning()
+                                      [CPU1 now console waiter]
+NMI: panic()
+  panic_other_cpus_shutdown()
+                                    [stopped as console waiter]
+  console_flush_on_panic()
+    console_lock_spinning_enable()
+    [print 1 record]
+    console_lock_spinning_disable_and_check()
+      [handover to stopped CPU1]
+
+This results in panic() not flushing the panic messages.
+
+Fix these problems by disabling all spinning operations
+completely during panic().
+
+Another advantage is that it prevents possible deadlocks caused
+by "console_owner_lock". The panic() context does not need to
+take it any longer. The lockless checks are safe because the
+functions become NOPs when they see the panic in progress. All
+operations manipulating the state are still synchronized by the
+lock even when non-panic CPUs would notice the panic
+synchronously.
+
+The current owner might stay spinning. But non-panic() CPUs
+would get stopped anyway and the panic context will never start
+spinning.
+
+Fixes: dbdda842fe96 ("printk: Add console owner and waiter logic to load balance console writes")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Link: https://lore.kernel.org/r/20240207134103.1357162-12-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index b7e50f8438df3..72f6a564e832f 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1869,10 +1869,23 @@ static bool console_waiter;
+  */
+ static void console_lock_spinning_enable(void)
+ {
++	/*
++	 * Do not use spinning in panic(). The panic CPU wants to keep the lock.
++	 * Non-panic CPUs abandon the flush anyway.
++	 *
++	 * Just keep the lockdep annotation. The panic-CPU should avoid
++	 * taking console_owner_lock because it might cause a deadlock.
++	 * This looks like the easiest way how to prevent false lockdep
++	 * reports without handling races a lockless way.
++	 */
++	if (panic_in_progress())
++		goto lockdep;
++
+ 	raw_spin_lock(&console_owner_lock);
+ 	console_owner = current;
+ 	raw_spin_unlock(&console_owner_lock);
+ 
++lockdep:
+ 	/* The waiter may spin on us after setting console_owner */
+ 	spin_acquire(&console_owner_dep_map, 0, 0, _THIS_IP_);
+ }
+@@ -1897,6 +1910,22 @@ static int console_lock_spinning_disable_and_check(int cookie)
+ {
+ 	int waiter;
+ 
++	/*
++	 * Ignore spinning waiters during panic() because they might get stopped
++	 * or blocked at any time,
++	 *
++	 * It is safe because nobody is allowed to start spinning during panic
++	 * in the first place. If there has been a waiter then non panic CPUs
++	 * might stay spinning. They would get stopped anyway. The panic context
++	 * will never start spinning and an interrupted spin on panic CPU will
++	 * never continue.
++	 */
++	if (panic_in_progress()) {
++		/* Keep lockdep happy. */
++		spin_release(&console_owner_dep_map, _THIS_IP_);
++		return 0;
++	}
++
+ 	raw_spin_lock(&console_owner_lock);
+ 	waiter = READ_ONCE(console_waiter);
+ 	console_owner = NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.8/printk-nbcon-relocate-32bit-seq-macros.patch b/queue-6.8/printk-nbcon-relocate-32bit-seq-macros.patch
new file mode 100644
index 00000000000..24eaa61bcf9
--- /dev/null
+++ b/queue-6.8/printk-nbcon-relocate-32bit-seq-macros.patch
@@ -0,0 +1,156 @@
+From 395f3147221dcdd1b19195dc5b6e96b21e7a9b2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:46:50 +0106
+Subject: printk: nbcon: Relocate 32bit seq macros
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 5b73e706f00f3553e1a4efbb31951ce9fe18f2dc ]
+
+The macros __seq_to_nbcon_seq() and __nbcon_seq_to_seq() are
+used to provide support for atomic handling of sequence numbers
+on 32bit systems. Until now this was only used by nbcon.c,
+which is why they were located in nbcon.c and include nbcon in
+the name.
+
+In a follow-up commit this functionality is also needed by
+printk_ringbuffer. Rather than duplicating the functionality,
+relocate the macros to printk_ringbuffer.h.
+
+Also, since the macros will be no longer nbcon-specific, rename
+them to __u64seq_to_ulseq() and __ulseq_to_u64seq().
+
+This does not result in any functional change.
+
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20240207134103.1357162-2-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Stable-dep-of: 5f72e52ba959 ("printk: ringbuffer: Do not skip non-finalized records with prb_next_seq()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/nbcon.c             | 41 +++----------------------------
+ kernel/printk/printk_ringbuffer.h | 33 +++++++++++++++++++++++++
+ 2 files changed, 37 insertions(+), 37 deletions(-)
+
+diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c
+index b96077152f49d..c8093bcc01fe6 100644
+--- a/kernel/printk/nbcon.c
++++ b/kernel/printk/nbcon.c
+@@ -140,39 +140,6 @@ static inline bool nbcon_state_try_cmpxchg(struct console *con, struct nbcon_sta
+ 	return atomic_try_cmpxchg(&ACCESS_PRIVATE(con, nbcon_state), &cur->atom, new->atom);
+ }
+ 
+-#ifdef CONFIG_64BIT
+-
+-#define __seq_to_nbcon_seq(seq) (seq)
+-#define __nbcon_seq_to_seq(seq) (seq)
+-
+-#else /* CONFIG_64BIT */
+-
+-#define __seq_to_nbcon_seq(seq) ((u32)seq)
+-
+-static inline u64 __nbcon_seq_to_seq(u32 nbcon_seq)
+-{
+-	u64 seq;
+-	u64 rb_next_seq;
+-
+-	/*
+-	 * The provided sequence is only the lower 32 bits of the ringbuffer
+-	 * sequence. It needs to be expanded to 64bit. Get the next sequence
+-	 * number from the ringbuffer and fold it.
+-	 *
+-	 * Having a 32bit representation in the console is sufficient.
+-	 * If a console ever gets more than 2^31 records behind
+-	 * the ringbuffer then this is the least of the problems.
+-	 *
+-	 * Also the access to the ring buffer is always safe.
+-	 */
+-	rb_next_seq = prb_next_seq(prb);
+-	seq = rb_next_seq - ((u32)rb_next_seq - nbcon_seq);
+-
+-	return seq;
+-}
+-
+-#endif /* CONFIG_64BIT */
+-
+ /**
+  * nbcon_seq_read - Read the current console sequence
+  * @con:	Console to read the sequence of
+@@ -183,7 +150,7 @@ u64 nbcon_seq_read(struct console *con)
+ {
+ 	unsigned long nbcon_seq = atomic_long_read(&ACCESS_PRIVATE(con, nbcon_seq));
+ 
+-	return __nbcon_seq_to_seq(nbcon_seq);
++	return __ulseq_to_u64seq(prb, nbcon_seq);
+ }
+ 
+ /**
+@@ -204,7 +171,7 @@ void nbcon_seq_force(struct console *con, u64 seq)
+ 	 */
+ 	u64 valid_seq = max_t(u64, seq, prb_first_valid_seq(prb));
+ 
+-	atomic_long_set(&ACCESS_PRIVATE(con, nbcon_seq), __seq_to_nbcon_seq(valid_seq));
++	atomic_long_set(&ACCESS_PRIVATE(con, nbcon_seq), __u64seq_to_ulseq(valid_seq));
+ 
+ 	/* Clear con->seq since nbcon consoles use con->nbcon_seq instead. */
+ 	con->seq = 0;
+@@ -223,11 +190,11 @@ void nbcon_seq_force(struct console *con, u64 seq)
+  */
+ static void nbcon_seq_try_update(struct nbcon_context *ctxt, u64 new_seq)
+ {
+-	unsigned long nbcon_seq = __seq_to_nbcon_seq(ctxt->seq);
++	unsigned long nbcon_seq = __u64seq_to_ulseq(ctxt->seq);
+ 	struct console *con = ctxt->console;
+ 
+ 	if (atomic_long_try_cmpxchg(&ACCESS_PRIVATE(con, nbcon_seq), &nbcon_seq,
+-				    __seq_to_nbcon_seq(new_seq))) {
++				    __u64seq_to_ulseq(new_seq))) {
+ 		ctxt->seq = new_seq;
+ 	} else {
+ 		ctxt->seq = nbcon_seq_read(con);
+diff --git a/kernel/printk/printk_ringbuffer.h b/kernel/printk/printk_ringbuffer.h
+index 18cd25e489b89..b82a96dc2ea2b 100644
+--- a/kernel/printk/printk_ringbuffer.h
++++ b/kernel/printk/printk_ringbuffer.h
+@@ -381,4 +381,37 @@ bool prb_read_valid_info(struct printk_ringbuffer *rb, u64 seq,
+ u64 prb_first_valid_seq(struct printk_ringbuffer *rb);
+ u64 prb_next_seq(struct printk_ringbuffer *rb);
+ 
++#ifdef CONFIG_64BIT
++
++#define __u64seq_to_ulseq(u64seq) (u64seq)
++#define __ulseq_to_u64seq(rb, ulseq) (ulseq)
++
++#else /* CONFIG_64BIT */
++
++#define __u64seq_to_ulseq(u64seq) ((u32)u64seq)
++
++static inline u64 __ulseq_to_u64seq(struct printk_ringbuffer *rb, u32 ulseq)
++{
++	u64 seq;
++	u64 rb_next_seq;
++
++	/*
++	 * The provided sequence is only the lower 32 bits of the ringbuffer
++	 * sequence. It needs to be expanded to 64bit. Get the next sequence
++	 * number from the ringbuffer and fold it.
++	 *
++	 * Having a 32bit representation in the console is sufficient.
++	 * If a console ever gets more than 2^31 records behind
++	 * the ringbuffer then this is the least of the problems.
++	 *
++	 * Also the access to the ring buffer is always safe.
++	 */
++	rb_next_seq = prb_next_seq(rb);
++	seq = rb_next_seq - ((u32)rb_next_seq - ulseq);
++
++	return seq;
++}
++
++#endif /* CONFIG_64BIT */
++
+ #endif /* _KERNEL_PRINTK_RINGBUFFER_H */
+-- 
+2.43.0
+
diff --git a/queue-6.8/printk-ringbuffer-cleanup-reader-terminology.patch b/queue-6.8/printk-ringbuffer-cleanup-reader-terminology.patch
new file mode 100644
index 00000000000..1e9c5fa6a8b
--- /dev/null
+++ b/queue-6.8/printk-ringbuffer-cleanup-reader-terminology.patch
@@ -0,0 +1,80 @@
+From afc7aef2ab936e21ab023a5625079e8ed9c84f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:46:57 +0106
+Subject: printk: ringbuffer: Cleanup reader terminology
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 584528d621459d1a5c31da7a591218ad3bb96d6c ]
+
+With the lockless ringbuffer, it is allowed that multiple
+CPUs/contexts write simultaneously into the buffer. This creates
+an ambiguity as some writers will finalize sooner.
+
+The documentation for the prb_read functions is not clear as it
+refers to "not yet written" and "no data available". Clarify the
+return values and language to be in terms of the reader: records
+available for reading.
+
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20240207134103.1357162-9-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Stable-dep-of: b1c4c67a5e90 ("printk: ringbuffer: Skip non-finalized records in panic")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk_ringbuffer.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
+index d152b6bd35c9a..97ec25d227976 100644
+--- a/kernel/printk/printk_ringbuffer.c
++++ b/kernel/printk/printk_ringbuffer.c
+@@ -2080,11 +2080,13 @@ u64 prb_next_reserve_seq(struct printk_ringbuffer *rb)
+ }
+ 
+ /*
+- * Non-blocking read of a record. Updates @seq to the last finalized record
+- * (which may have no data available).
++ * Non-blocking read of a record.
+  *
+- * See the description of prb_read_valid() and prb_read_valid_info()
+- * for details.
++ * On success @seq is updated to the record that was read and (if provided)
++ * @r and @line_count will contain the read/calculated data.
++ *
++ * On failure @seq is updated to a record that is not yet available to the
++ * reader, but it will be the next record available to the reader.
+  */
+ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
+ 			    struct printk_record *r, unsigned int *line_count)
+@@ -2103,7 +2105,7 @@ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
+ 			*seq = tail_seq;
+ 
+ 		} else if (err == -ENOENT) {
+-			/* Record exists, but no data available. Skip. */
++			/* Record exists, but the data was lost. Skip. */
+ 			(*seq)++;
+ 
+ 		} else {
+@@ -2136,7 +2138,7 @@ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
+  * On success, the reader must check r->info.seq to see which record was
+  * actually read. This allows the reader to detect dropped records.
+  *
+- * Failure means @seq refers to a not yet written record.
++ * Failure means @seq refers to a record not yet available to the reader.
+  */
+ bool prb_read_valid(struct printk_ringbuffer *rb, u64 seq,
+ 		    struct printk_record *r)
+@@ -2166,7 +2168,7 @@ bool prb_read_valid(struct printk_ringbuffer *rb, u64 seq,
+  * On success, the reader must check info->seq to see which record meta data
+  * was actually read. This allows the reader to detect dropped records.
+  *
+- * Failure means @seq refers to a not yet written record.
++ * Failure means @seq refers to a record not yet available to the reader.
+  */
+ bool prb_read_valid_info(struct printk_ringbuffer *rb, u64 seq,
+ 			 struct printk_info *info, unsigned int *line_count)
+-- 
+2.43.0
+
diff --git a/queue-6.8/printk-ringbuffer-do-not-skip-non-finalized-records-.patch b/queue-6.8/printk-ringbuffer-do-not-skip-non-finalized-records-.patch
new file mode 100644
index 00000000000..2cf8ac96586
--- /dev/null
+++ b/queue-6.8/printk-ringbuffer-do-not-skip-non-finalized-records-.patch
@@ -0,0 +1,319 @@
+From e5f61160a2cc6fb12919468a01d137761a41c8bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:46:53 +0106
+Subject: printk: ringbuffer: Do not skip non-finalized records with
+ prb_next_seq()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit 5f72e52ba959e50680b8d83599da1368cd7a6ee2 ]
+
+Commit f244b4dc53e5 ("printk: ringbuffer: Improve
+prb_next_seq() performance") introduced an optimization for
+prb_next_seq() by using best-effort to track recently finalized
+records. However, the order of finalization does not
+necessarily match the order of the records. The optimization
+changed prb_next_seq() to return inconsistent results, possibly
+yielding sequence numbers that are not available to readers
+because they are preceded by non-finalized records or they are
+not yet visible to the reader CPU.
+
+Rather than simply best-effort tracking recently finalized
+records, force the committing writer to read records and
+increment the last "contiguous block" of finalized records. In
+order to do this, the sequence number instead of ID must be
+stored because ID's cannot be directly compared.
+
+A new memory barrier pair is introduced to guarantee that a
+reader can always read the records up until the sequence number
+returned by prb_next_seq() (unless the records have since
+been overwritten in the ringbuffer).
+
+This restores the original functionality of prb_next_seq()
+while also keeping the optimization.
+
+For 32bit systems, only the lower 32 bits of the sequence
+number are stored. When reading the value, it is expanded to
+the full 64bit sequence number using the 32bit seq macros,
+which fold in the value returned by prb_first_seq().
+
+Fixes: f244b4dc53e5 ("printk: ringbuffer: Improve prb_next_seq() performance")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20240207134103.1357162-5-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk_ringbuffer.c | 164 +++++++++++++++++++++++-------
+ kernel/printk/printk_ringbuffer.h |   4 +-
+ 2 files changed, 127 insertions(+), 41 deletions(-)
+
+diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
+index fde338606ce83..4ce1826dc9426 100644
+--- a/kernel/printk/printk_ringbuffer.c
++++ b/kernel/printk/printk_ringbuffer.c
+@@ -6,6 +6,7 @@
+ #include <linux/errno.h>
+ #include <linux/bug.h>
+ #include "printk_ringbuffer.h"
++#include "internal.h"
+ 
+ /**
+  * DOC: printk_ringbuffer overview
+@@ -303,6 +304,9 @@
+  *
+  *   desc_push_tail:B / desc_reserve:D
+  *     set descriptor reusable (state), then push descriptor tail (id)
++ *
++ *   desc_update_last_finalized:A / desc_last_finalized_seq:A
++ *     store finalized record, then set new highest finalized sequence number
+  */
+ 
+ #define DATA_SIZE(data_ring)		_DATA_SIZE((data_ring)->size_bits)
+@@ -1441,20 +1445,118 @@ bool prb_reserve_in_last(struct prb_reserved_entry *e, struct printk_ringbuffer
+ 	return false;
+ }
+ 
++/*
++ * @last_finalized_seq value guarantees that all records up to and including
++ * this sequence number are finalized and can be read. The only exception are
++ * too old records which have already been overwritten.
++ *
++ * It is also guaranteed that @last_finalized_seq only increases.
++ *
++ * Be aware that finalized records following non-finalized records are not
++ * reported because they are not yet available to the reader. For example,
++ * a new record stored via printk() will not be available to a printer if
++ * it follows a record that has not been finalized yet. However, once that
++ * non-finalized record becomes finalized, @last_finalized_seq will be
++ * appropriately updated and the full set of finalized records will be
++ * available to the printer. And since each printk() caller will either
++ * directly print or trigger deferred printing of all available unprinted
++ * records, all printk() messages will get printed.
++ */
++static u64 desc_last_finalized_seq(struct printk_ringbuffer *rb)
++{
++	struct prb_desc_ring *desc_ring = &rb->desc_ring;
++	unsigned long ulseq;
++
++	/*
++	 * Guarantee the sequence number is loaded before loading the
++	 * associated record in order to guarantee that the record can be
++	 * seen by this CPU. This pairs with desc_update_last_finalized:A.
++	 */
++	ulseq = atomic_long_read_acquire(&desc_ring->last_finalized_seq
++					); /* LMM(desc_last_finalized_seq:A) */
++
++	return __ulseq_to_u64seq(rb, ulseq);
++}
++
++static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
++			    struct printk_record *r, unsigned int *line_count);
++
++/*
++ * Check if there are records directly following @last_finalized_seq that are
++ * finalized. If so, update @last_finalized_seq to the latest of these
++ * records. It is not allowed to skip over records that are not yet finalized.
++ */
++static void desc_update_last_finalized(struct printk_ringbuffer *rb)
++{
++	struct prb_desc_ring *desc_ring = &rb->desc_ring;
++	u64 old_seq = desc_last_finalized_seq(rb);
++	unsigned long oldval;
++	unsigned long newval;
++	u64 finalized_seq;
++	u64 try_seq;
++
++try_again:
++	finalized_seq = old_seq;
++	try_seq = finalized_seq + 1;
++
++	/* Try to find later finalized records. */
++	while (_prb_read_valid(rb, &try_seq, NULL, NULL)) {
++		finalized_seq = try_seq;
++		try_seq++;
++	}
++
++	/* No update needed if no later finalized record was found. */
++	if (finalized_seq == old_seq)
++		return;
++
++	oldval = __u64seq_to_ulseq(old_seq);
++	newval = __u64seq_to_ulseq(finalized_seq);
++
++	/*
++	 * Set the sequence number of a later finalized record that has been
++	 * seen.
++	 *
++	 * Guarantee the record data is visible to other CPUs before storing
++	 * its sequence number. This pairs with desc_last_finalized_seq:A.
++	 *
++	 * Memory barrier involvement:
++	 *
++	 * If desc_last_finalized_seq:A reads from
++	 * desc_update_last_finalized:A, then desc_read:A reads from
++	 * _prb_commit:B.
++	 *
++	 * Relies on:
++	 *
++	 * RELEASE from _prb_commit:B to desc_update_last_finalized:A
++	 *    matching
++	 * ACQUIRE from desc_last_finalized_seq:A to desc_read:A
++	 *
++	 * Note: _prb_commit:B and desc_update_last_finalized:A can be
++	 *       different CPUs. However, the desc_update_last_finalized:A
++	 *       CPU (which performs the release) must have previously seen
++	 *       _prb_commit:B.
++	 */
++	if (!atomic_long_try_cmpxchg_release(&desc_ring->last_finalized_seq,
++				&oldval, newval)) { /* LMM(desc_update_last_finalized:A) */
++		old_seq = __ulseq_to_u64seq(rb, oldval);
++		goto try_again;
++	}
++}
++
+ /*
+  * Attempt to finalize a specified descriptor. If this fails, the descriptor
+  * is either already final or it will finalize itself when the writer commits.
+  */
+-static void desc_make_final(struct prb_desc_ring *desc_ring, unsigned long id)
++static void desc_make_final(struct printk_ringbuffer *rb, unsigned long id)
+ {
++	struct prb_desc_ring *desc_ring = &rb->desc_ring;
+ 	unsigned long prev_state_val = DESC_SV(id, desc_committed);
+ 	struct prb_desc *d = to_desc(desc_ring, id);
+ 
+-	atomic_long_cmpxchg_relaxed(&d->state_var, prev_state_val,
+-			DESC_SV(id, desc_finalized)); /* LMM(desc_make_final:A) */
+-
+-	/* Best effort to remember the last finalized @id. */
+-	atomic_long_set(&desc_ring->last_finalized_id, id);
++	if (atomic_long_try_cmpxchg_relaxed(&d->state_var, &prev_state_val,
++			DESC_SV(id, desc_finalized))) { /* LMM(desc_make_final:A) */
++		desc_update_last_finalized(rb);
++	}
+ }
+ 
+ /**
+@@ -1550,7 +1652,7 @@ bool prb_reserve(struct prb_reserved_entry *e, struct printk_ringbuffer *rb,
+ 	 * readers. (For seq==0 there is no previous descriptor.)
+ 	 */
+ 	if (info->seq > 0)
+-		desc_make_final(desc_ring, DESC_ID(id - 1));
++		desc_make_final(rb, DESC_ID(id - 1));
+ 
+ 	r->text_buf = data_alloc(rb, r->text_buf_size, &d->text_blk_lpos, id);
+ 	/* If text data allocation fails, a data-less record is committed. */
+@@ -1643,7 +1745,7 @@ void prb_commit(struct prb_reserved_entry *e)
+ 	 */
+ 	head_id = atomic_long_read(&desc_ring->head_id); /* LMM(prb_commit:A) */
+ 	if (head_id != e->id)
+-		desc_make_final(desc_ring, e->id);
++		desc_make_final(e->rb, e->id);
+ }
+ 
+ /**
+@@ -1663,12 +1765,9 @@ void prb_commit(struct prb_reserved_entry *e)
+  */
+ void prb_final_commit(struct prb_reserved_entry *e)
+ {
+-	struct prb_desc_ring *desc_ring = &e->rb->desc_ring;
+-
+ 	_prb_commit(e, desc_finalized);
+ 
+-	/* Best effort to remember the last finalized @id. */
+-	atomic_long_set(&desc_ring->last_finalized_id, e->id);
++	desc_update_last_finalized(e->rb);
+ }
+ 
+ /*
+@@ -2008,7 +2107,9 @@ u64 prb_first_valid_seq(struct printk_ringbuffer *rb)
+  * newest sequence number available to readers will be.
+  *
+  * This provides readers a sequence number to jump to if all currently
+- * available records should be skipped.
++ * available records should be skipped. It is guaranteed that all records
++ * previous to the returned value have been finalized and are (or were)
++ * available to the reader.
+  *
+  * Context: Any context.
+  * Return: The sequence number of the next newest (not yet available) record
+@@ -2016,34 +2117,19 @@ u64 prb_first_valid_seq(struct printk_ringbuffer *rb)
+  */
+ u64 prb_next_seq(struct printk_ringbuffer *rb)
+ {
+-	struct prb_desc_ring *desc_ring = &rb->desc_ring;
+-	enum desc_state d_state;
+-	unsigned long id;
+ 	u64 seq;
+ 
+-	/* Check if the cached @id still points to a valid @seq. */
+-	id = atomic_long_read(&desc_ring->last_finalized_id);
+-	d_state = desc_read(desc_ring, id, NULL, &seq, NULL);
++	seq = desc_last_finalized_seq(rb);
+ 
+-	if (d_state == desc_finalized || d_state == desc_reusable) {
+-		/*
+-		 * Begin searching after the last finalized record.
+-		 *
+-		 * On 0, the search must begin at 0 because of hack#2
+-		 * of the bootstrapping phase it is not known if a
+-		 * record at index 0 exists.
+-		 */
+-		if (seq != 0)
+-			seq++;
+-	} else {
+-		/*
+-		 * The information about the last finalized sequence number
+-		 * has gone. It should happen only when there is a flood of
+-		 * new messages and the ringbuffer is rapidly recycled.
+-		 * Give up and start from the beginning.
+-		 */
+-		seq = 0;
+-	}
++	/*
++	 * Begin searching after the last finalized record.
++	 *
++	 * On 0, the search must begin at 0 because of hack#2
++	 * of the bootstrapping phase it is not known if a
++	 * record at index 0 exists.
++	 */
++	if (seq != 0)
++		seq++;
+ 
+ 	/*
+ 	 * The information about the last finalized @seq might be inaccurate.
+@@ -2085,7 +2171,7 @@ void prb_init(struct printk_ringbuffer *rb,
+ 	rb->desc_ring.infos = infos;
+ 	atomic_long_set(&rb->desc_ring.head_id, DESC0_ID(descbits));
+ 	atomic_long_set(&rb->desc_ring.tail_id, DESC0_ID(descbits));
+-	atomic_long_set(&rb->desc_ring.last_finalized_id, DESC0_ID(descbits));
++	atomic_long_set(&rb->desc_ring.last_finalized_seq, 0);
+ 
+ 	rb->text_data_ring.size_bits = textbits;
+ 	rb->text_data_ring.data = text_buf;
+diff --git a/kernel/printk/printk_ringbuffer.h b/kernel/printk/printk_ringbuffer.h
+index b82a96dc2ea2b..70457916d577d 100644
+--- a/kernel/printk/printk_ringbuffer.h
++++ b/kernel/printk/printk_ringbuffer.h
+@@ -75,7 +75,7 @@ struct prb_desc_ring {
+ 	struct printk_info	*infos;
+ 	atomic_long_t		head_id;
+ 	atomic_long_t		tail_id;
+-	atomic_long_t		last_finalized_id;
++	atomic_long_t		last_finalized_seq;
+ };
+ 
+ /*
+@@ -259,7 +259,7 @@ static struct printk_ringbuffer name = {							\
+ 		.infos		= &_##name##_infos[0],						\
+ 		.head_id	= ATOMIC_INIT(DESC0_ID(descbits)),				\
+ 		.tail_id	= ATOMIC_INIT(DESC0_ID(descbits)),				\
+-		.last_finalized_id = ATOMIC_INIT(DESC0_ID(descbits)),				\
++		.last_finalized_seq = ATOMIC_INIT(0),						\
+ 	},											\
+ 	.text_data_ring = {									\
+ 		.size_bits	= (avgtextbits) + (descbits),					\
+-- 
+2.43.0
+
diff --git a/queue-6.8/printk-ringbuffer-skip-non-finalized-records-in-pani.patch b/queue-6.8/printk-ringbuffer-skip-non-finalized-records-in-pani.patch
new file mode 100644
index 00000000000..c5a63d7b310
--- /dev/null
+++ b/queue-6.8/printk-ringbuffer-skip-non-finalized-records-in-pani.patch
@@ -0,0 +1,79 @@
+From 4192bebb0d30ce796c111ccd41c31e72c964ebbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:46:59 +0106
+Subject: printk: ringbuffer: Skip non-finalized records in panic
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit b1c4c67a5e90db8fbdb5b5504fe16e17b564cca8 ]
+
+Normally a reader will stop once reaching a non-finalized
+record. However, when a panic happens, writers from other CPUs
+(or an interrupted context on the panic CPU) may have been
+writing a record and were unable to finalize it. The panic CPU
+will reserve/commit/finalize its panic records, but these will
+be located after the non-finalized records. This results in
+panic() not flushing the panic messages.
+
+Extend _prb_read_valid() to skip over non-finalized records if
+on the panic CPU.
+
+Fixes: 896fbe20b4e2 ("printk: use the lockless ringbuffer")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20240207134103.1357162-11-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk_ringbuffer.c | 28 ++++++++++++++++++++++++++--
+ 1 file changed, 26 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
+index 97ec25d227976..3d98232902cfd 100644
+--- a/kernel/printk/printk_ringbuffer.c
++++ b/kernel/printk/printk_ringbuffer.c
+@@ -2087,6 +2087,10 @@ u64 prb_next_reserve_seq(struct printk_ringbuffer *rb)
+  *
+  * On failure @seq is updated to a record that is not yet available to the
+  * reader, but it will be the next record available to the reader.
++ *
++ * Note: When the current CPU is in panic, this function will skip over any
++ *       non-existent/non-finalized records in order to allow the panic CPU
++ *       to print any and all records that have been finalized.
+  */
+ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
+ 			    struct printk_record *r, unsigned int *line_count)
+@@ -2109,8 +2113,28 @@ static bool _prb_read_valid(struct printk_ringbuffer *rb, u64 *seq,
+ 			(*seq)++;
+ 
+ 		} else {
+-			/* Non-existent/non-finalized record. Must stop. */
+-			return false;
++			/*
++			 * Non-existent/non-finalized record. Must stop.
++			 *
++			 * For panic situations it cannot be expected that
++			 * non-finalized records will become finalized. But
++			 * there may be other finalized records beyond that
++			 * need to be printed for a panic situation. If this
++			 * is the panic CPU, skip this
++			 * non-existent/non-finalized record unless it is
++			 * at or beyond the head, in which case it is not
++			 * possible to continue.
++			 *
++			 * Note that new messages printed on panic CPU are
++			 * finalized when we are here. The only exception
++			 * might be the last message without trailing newline.
++			 * But it would have the sequence number returned
++			 * by "prb_next_reserve_seq() - 1".
++			 */
++			if (this_cpu_in_panic() && ((*seq + 1) < prb_next_reserve_seq(rb)))
++				(*seq)++;
++			else
++				return false;
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/printk-wait-for-all-reserved-records-with-pr_flush.patch b/queue-6.8/printk-wait-for-all-reserved-records-with-pr_flush.patch
new file mode 100644
index 00000000000..caf1592bc39
--- /dev/null
+++ b/queue-6.8/printk-wait-for-all-reserved-records-with-pr_flush.patch
@@ -0,0 +1,178 @@
+From 5cec432f09509a7b15e0f5d46af10fd36e530b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 14:46:58 +0106
+Subject: printk: Wait for all reserved records with pr_flush()
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit ac7d7844c64d15603daa3e905a311ddcfbb4bc91 ]
+
+Currently pr_flush() will only wait for records that were
+available to readers at the time of the call (using
+prb_next_seq()). But there may be more records (non-finalized)
+that have following finalized records. pr_flush() should wait
+for these to print as well. Particularly because any trailing
+finalized records may be the messages that the calling context
+wants to ensure are printed.
+
+Add a new ringbuffer function prb_next_reserve_seq() to return
+the sequence number following the most recently reserved record.
+This guarantees that pr_flush() will wait until all current
+printk() messages (completed or in progress) have been printed.
+
+Fixes: 3b604ca81202 ("printk: add pr_flush()")
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Link: https://lore.kernel.org/r/20240207134103.1357162-10-john.ogness@linutronix.de
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c            |   2 +-
+ kernel/printk/printk_ringbuffer.c | 105 ++++++++++++++++++++++++++++++
+ kernel/printk/printk_ringbuffer.h |   1 +
+ 3 files changed, 107 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index f2444b581e16c..d9420207282ac 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -3761,7 +3761,7 @@ static bool __pr_flush(struct console *con, int timeout_ms, bool reset_on_progre
+ 
+ 	might_sleep();
+ 
+-	seq = prb_next_seq(prb);
++	seq = prb_next_reserve_seq(prb);
+ 
+ 	/* Flush the consoles so that records up to @seq are printed. */
+ 	console_lock();
+diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
+index 4ce1826dc9426..d152b6bd35c9a 100644
+--- a/kernel/printk/printk_ringbuffer.c
++++ b/kernel/printk/printk_ringbuffer.c
+@@ -1974,6 +1974,111 @@ static u64 prb_first_seq(struct printk_ringbuffer *rb)
+ 	return seq;
+ }
+ 
++/**
++ * prb_next_reserve_seq() - Get the sequence number after the most recently
++ *                  reserved record.
++ *
++ * @rb:  The ringbuffer to get the sequence number from.
++ *
++ * This is the public function available to readers to see what sequence
++ * number will be assigned to the next reserved record.
++ *
++ * Note that depending on the situation, this value can be equal to or
++ * higher than the sequence number returned by prb_next_seq().
++ *
++ * Context: Any context.
++ * Return: The sequence number that will be assigned to the next record
++ *         reserved.
++ */
++u64 prb_next_reserve_seq(struct printk_ringbuffer *rb)
++{
++	struct prb_desc_ring *desc_ring = &rb->desc_ring;
++	unsigned long last_finalized_id;
++	atomic_long_t *state_var;
++	u64 last_finalized_seq;
++	unsigned long head_id;
++	struct prb_desc desc;
++	unsigned long diff;
++	struct prb_desc *d;
++	int err;
++
++	/*
++	 * It may not be possible to read a sequence number for @head_id.
++	 * So the ID of @last_finailzed_seq is used to calculate what the
++	 * sequence number of @head_id will be.
++	 */
++
++try_again:
++	last_finalized_seq = desc_last_finalized_seq(rb);
++
++	/*
++	 * @head_id is loaded after @last_finalized_seq to ensure that
++	 * it points to the record with @last_finalized_seq or newer.
++	 *
++	 * Memory barrier involvement:
++	 *
++	 * If desc_last_finalized_seq:A reads from
++	 * desc_update_last_finalized:A, then
++	 * prb_next_reserve_seq:A reads from desc_reserve:D.
++	 *
++	 * Relies on:
++	 *
++	 * RELEASE from desc_reserve:D to desc_update_last_finalized:A
++	 *    matching
++	 * ACQUIRE from desc_last_finalized_seq:A to prb_next_reserve_seq:A
++	 *
++	 * Note: desc_reserve:D and desc_update_last_finalized:A can be
++	 *       different CPUs. However, the desc_update_last_finalized:A CPU
++	 *       (which performs the release) must have previously seen
++	 *       desc_read:C, which implies desc_reserve:D can be seen.
++	 */
++	head_id = atomic_long_read(&desc_ring->head_id); /* LMM(prb_next_reserve_seq:A) */
++
++	d = to_desc(desc_ring, last_finalized_seq);
++	state_var = &d->state_var;
++
++	/* Extract the ID, used to specify the descriptor to read. */
++	last_finalized_id = DESC_ID(atomic_long_read(state_var));
++
++	/* Ensure @last_finalized_id is correct. */
++	err = desc_read_finalized_seq(desc_ring, last_finalized_id, last_finalized_seq, &desc);
++
++	if (err == -EINVAL) {
++		if (last_finalized_seq == 0) {
++			/*
++			 * No record has been finalized or even reserved yet.
++			 *
++			 * The @head_id is initialized such that the first
++			 * increment will yield the first record (seq=0).
++			 * Handle it separately to avoid a negative @diff
++			 * below.
++			 */
++			if (head_id == DESC0_ID(desc_ring->count_bits))
++				return 0;
++
++			/*
++			 * One or more descriptors are already reserved. Use
++			 * the descriptor ID of the first one (@seq=0) for
++			 * the @diff below.
++			 */
++			last_finalized_id = DESC0_ID(desc_ring->count_bits) + 1;
++		} else {
++			/* Record must have been overwritten. Try again. */
++			goto try_again;
++		}
++	}
++
++	/* Diff of known descriptor IDs to compute related sequence numbers. */
++	diff = head_id - last_finalized_id;
++
++	/*
++	 * @head_id points to the most recently reserved record, but this
++	 * function returns the sequence number that will be assigned to the
++	 * next (not yet reserved) record. Thus +1 is needed.
++	 */
++	return (last_finalized_seq + diff + 1);
++}
++
+ /*
+  * Non-blocking read of a record. Updates @seq to the last finalized record
+  * (which may have no data available).
+diff --git a/kernel/printk/printk_ringbuffer.h b/kernel/printk/printk_ringbuffer.h
+index 70457916d577d..5aebe97bd4afc 100644
+--- a/kernel/printk/printk_ringbuffer.h
++++ b/kernel/printk/printk_ringbuffer.h
+@@ -380,6 +380,7 @@ bool prb_read_valid_info(struct printk_ringbuffer *rb, u64 seq,
+ 
+ u64 prb_first_valid_seq(struct printk_ringbuffer *rb);
+ u64 prb_next_seq(struct printk_ringbuffer *rb);
++u64 prb_next_reserve_seq(struct printk_ringbuffer *rb);
+ 
+ #ifdef CONFIG_64BIT
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/pstore-inode-only-d_invalidate-is-needed.patch b/queue-6.8/pstore-inode-only-d_invalidate-is-needed.patch
new file mode 100644
index 00000000000..09fe8a5796f
--- /dev/null
+++ b/queue-6.8/pstore-inode-only-d_invalidate-is-needed.patch
@@ -0,0 +1,70 @@
+From c2143433e0e132250f74c160ec3b83c89d661681 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 09:48:46 -0800
+Subject: pstore: inode: Only d_invalidate() is needed
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit a43e0fc5e9134a46515de2f2f8d4100b74e50de3 ]
+
+Unloading a modular pstore backend with records in pstorefs would
+trigger the dput() double-drop warning:
+
+  WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410
+
+Using the combo of d_drop()/dput() (as mentioned in
+Documentation/filesystems/vfs.rst) isn't the right approach here, and
+leads to the reference counting problem seen above. Use d_invalidate()
+and update the code to not bother checking for error codes that can
+never happen.
+
+Suggested-by: Alexander Viro <viro@zeniv.linux.org.uk>
+Fixes: 609e28bb139e ("pstore: Remove filesystem records when backend is unregistered")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+---
+Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: linux-hardening@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/inode.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
+index d0d9bfdad30cc..56815799ce798 100644
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -307,7 +307,6 @@ int pstore_put_backend_records(struct pstore_info *psi)
+ {
+ 	struct pstore_private *pos, *tmp;
+ 	struct dentry *root;
+-	int rc = 0;
+ 
+ 	root = psinfo_lock_root();
+ 	if (!root)
+@@ -317,11 +316,8 @@ int pstore_put_backend_records(struct pstore_info *psi)
+ 		list_for_each_entry_safe(pos, tmp, &records_list, list) {
+ 			if (pos->record->psi == psi) {
+ 				list_del_init(&pos->list);
+-				rc = simple_unlink(d_inode(root), pos->dentry);
+-				if (WARN_ON(rc))
+-					break;
+-				d_drop(pos->dentry);
+-				dput(pos->dentry);
++				d_invalidate(pos->dentry);
++				simple_unlink(d_inode(root), pos->dentry);
+ 				pos->dentry = NULL;
+ 			}
+ 		}
+@@ -329,7 +325,7 @@ int pstore_put_backend_records(struct pstore_info *psi)
+ 
+ 	inode_unlock(d_inode(root));
+ 
+-	return rc;
++	return 0;
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.8/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch b/queue-6.8/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
new file mode 100644
index 00000000000..e10eb9cc700
--- /dev/null
+++ b/queue-6.8/pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
@@ -0,0 +1,41 @@
+From 3a32d4ed21274c5dd1355ff4360d509dbb711608 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 13:04:33 +0100
+Subject: pwm: atmel-hlcdc: Fix clock imbalance related to suspend support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit e25ac87d3f831fed002c34aadddaf4ebb4ea45ec ]
+
+The suspend callback disables the periph clock when the PWM is enabled
+and resume reenables this clock if the PWM was disabled before. Judging
+from the code comment it's suspend that is wrong here. Fix accordingly.
+
+Fixes: f9bb9da7c09d ("pwm: atmel-hlcdc: Implement the suspend/resume hooks")
+Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Link: https://lore.kernel.org/r/b51ea92b0a45eff3dc83b08adefd43d930df996c.1706269232.git.u.kleine-koenig@pengutronix.de
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-atmel-hlcdc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-atmel-hlcdc.c b/drivers/pwm/pwm-atmel-hlcdc.c
+index 3f2c5031a3ba8..1f6fc9a9fcf3e 100644
+--- a/drivers/pwm/pwm-atmel-hlcdc.c
++++ b/drivers/pwm/pwm-atmel-hlcdc.c
+@@ -185,7 +185,7 @@ static int atmel_hlcdc_pwm_suspend(struct device *dev)
+ 	struct atmel_hlcdc_pwm *atmel = dev_get_drvdata(dev);
+ 
+ 	/* Keep the periph clock enabled if the PWM is still running. */
+-	if (pwm_is_enabled(&atmel->chip.pwms[0]))
++	if (!pwm_is_enabled(&atmel->chip.pwms[0]))
+ 		clk_disable_unprepare(atmel->hlcdc->periph_clk);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.8/pwm-dwc-use-pm_sleep_ptr-macro.patch b/queue-6.8/pwm-dwc-use-pm_sleep_ptr-macro.patch
new file mode 100644
index 00000000000..ab29c0deffd
--- /dev/null
+++ b/queue-6.8/pwm-dwc-use-pm_sleep_ptr-macro.patch
@@ -0,0 +1,42 @@
+From 6f38066994344806e0938f6adcf344ee83e726ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 12:35:29 +0530
+Subject: pwm: dwc: use pm_sleep_ptr() macro
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Raag Jadav <raag.jadav@intel.com>
+
+[ Upstream commit 7cfce2b80d5ff7aa713a7710bfe3a562707cb226 ]
+
+Since we don't have runtime PM handles here, we should be using
+pm_sleep_ptr() macro, so that the compiler can discard it in case
+CONFIG_PM_SLEEP=n.
+
+Fixes: 30b5b066fa83 ("pwm: dwc: Use DEFINE_SIMPLE_DEV_PM_OPS for PM functions")
+Signed-off-by: Raag Jadav <raag.jadav@intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20240212130247.9985-2-raag.jadav@intel.com
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-dwc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-dwc.c b/drivers/pwm/pwm-dwc.c
+index 4929354f8cd95..a4a057ae03ea2 100644
+--- a/drivers/pwm/pwm-dwc.c
++++ b/drivers/pwm/pwm-dwc.c
+@@ -120,7 +120,7 @@ static struct pci_driver dwc_pwm_driver = {
+ 	.remove = dwc_pwm_remove,
+ 	.id_table = dwc_pwm_id_table,
+ 	.driver = {
+-		.pm = pm_ptr(&dwc_pwm_pm_ops),
++		.pm = pm_sleep_ptr(&dwc_pwm_pm_ops),
+ 	},
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch b/queue-6.8/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
new file mode 100644
index 00000000000..a8bdeff67b0
--- /dev/null
+++ b/queue-6.8/pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
@@ -0,0 +1,62 @@
+From a2c97181af5185a67f565380a28505bf060d91a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Feb 2024 22:20:43 +0100
+Subject: pwm: sti: Fix capture for st,pwm-num-chan < st,capture-num-chan
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 5f623835584f1c8d1030666796f40c47a448ce0b ]
+
+The driver only used the number of pwm channels to set the pwm_chip's
+npwm member. The result is that if there are more capture channels than
+PWM channels specified in the device tree, only a part of the capture
+channel is usable. Fix that by passing the bigger channel count to the
+pwm framework. This makes it possible that the .apply() callback is
+called with .hwpwm >= pwm_num_devs, catch that case and return an error
+code.
+
+Fixes: c97267ae831d ("pwm: sti: Add PWM capture callback")
+Link: https://lore.kernel.org/r/20240204212043.2951852-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-sti.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-sti.c b/drivers/pwm/pwm-sti.c
+index 6cf55cf34d39f..69b1113c6b821 100644
+--- a/drivers/pwm/pwm-sti.c
++++ b/drivers/pwm/pwm-sti.c
+@@ -395,8 +395,17 @@ static int sti_pwm_capture(struct pwm_chip *chip, struct pwm_device *pwm,
+ static int sti_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ 			 const struct pwm_state *state)
+ {
++	struct sti_pwm_chip *pc = to_sti_pwmchip(chip);
++	struct sti_pwm_compat_data *cdata = pc->cdata;
++	struct device *dev = pc->dev;
+ 	int err;
+ 
++	if (pwm->hwpwm >= cdata->pwm_num_devs) {
++		dev_err(dev, "device %u is not valid for pwm mode\n",
++			pwm->hwpwm);
++		return -EINVAL;
++	}
++
+ 	if (state->polarity != PWM_POLARITY_NORMAL)
+ 		return -EINVAL;
+ 
+@@ -646,7 +655,7 @@ static int sti_pwm_probe(struct platform_device *pdev)
+ 
+ 	pc->chip.dev = dev;
+ 	pc->chip.ops = &sti_pwm_ops;
+-	pc->chip.npwm = pc->cdata->pwm_num_devs;
++	pc->chip.npwm = max(cdata->pwm_num_devs, cdata->cpt_num_devs);
+ 
+ 	for (i = 0; i < cdata->cpt_num_devs; i++) {
+ 		struct sti_cpt_ddata *ddata = &cdata->ddata[i];
+-- 
+2.43.0
+
diff --git a/queue-6.8/quota-fix-potential-null-pointer-dereference.patch b/queue-6.8/quota-fix-potential-null-pointer-dereference.patch
new file mode 100644
index 00000000000..565d248f418
--- /dev/null
+++ b/queue-6.8/quota-fix-potential-null-pointer-dereference.patch
@@ -0,0 +1,278 @@
+From 141fecc6d8db3949cbb6e92c1ec5d66b189d620d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 16:18:52 +0800
+Subject: quota: Fix potential NULL pointer dereference
+
+From: Wang Jianjian <wangjianjian3@huawei.com>
+
+[ Upstream commit d0aa72604fbd80c8aabb46eda00535ed35570f1f ]
+
+Below race may cause NULL pointer dereference
+
+P1					P2
+dquot_free_inode			quota_off
+					  drop_dquot_ref
+					   remove_dquot_ref
+					   dquots = i_dquot(inode)
+  dquots = i_dquot(inode)
+  srcu_read_lock
+  dquots[cnt]) != NULL (1)
+					     dquots[type] = NULL (2)
+  spin_lock(&dquots[cnt]->dq_dqb_lock) (3)
+   ....
+
+If dquot_free_inode(or other routines) checks inode's quota pointers (1)
+before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer
+dereference will be triggered.
+
+So let's fix it by using a temporary pointer to avoid this issue.
+
+Signed-off-by: Wang Jianjian <wangjianjian3@huawei.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Message-Id: <20240202081852.2514092-1-wangjianjian3@huawei.com>
+Stable-dep-of: 179b8c97ebf6 ("quota: Fix rcu annotations of inode dquot pointers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 98 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 57 insertions(+), 41 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 1f0c754416b64..cafe65a03f6dc 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -399,15 +399,17 @@ int dquot_mark_dquot_dirty(struct dquot *dquot)
+ EXPORT_SYMBOL(dquot_mark_dquot_dirty);
+ 
+ /* Dirtify all the dquots - this can block when journalling */
+-static inline int mark_all_dquot_dirty(struct dquot * const *dquot)
++static inline int mark_all_dquot_dirty(struct dquot * const *dquots)
+ {
+ 	int ret, err, cnt;
++	struct dquot *dquot;
+ 
+ 	ret = err = 0;
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (dquot[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (dquot)
+ 			/* Even in case of error we have to continue */
+-			ret = mark_dquot_dirty(dquot[cnt]);
++			ret = mark_dquot_dirty(dquot);
+ 		if (!err)
+ 			err = ret;
+ 	}
+@@ -1678,6 +1680,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	int reserve = flags & DQUOT_SPACE_RESERVE;
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode)) {
+ 		if (reserve) {
+@@ -1697,27 +1700,26 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ 	index = srcu_read_lock(&dquot_srcu);
+ 	spin_lock(&inode->i_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+ 		if (reserve) {
+-			ret = dquot_add_space(dquots[cnt], 0, number, flags,
+-					      &warn[cnt]);
++			ret = dquot_add_space(dquot, 0, number, flags, &warn[cnt]);
+ 		} else {
+-			ret = dquot_add_space(dquots[cnt], number, 0, flags,
+-					      &warn[cnt]);
++			ret = dquot_add_space(dquot, number, 0, flags, &warn[cnt]);
+ 		}
+ 		if (ret) {
+ 			/* Back out changes we already did */
+ 			for (cnt--; cnt >= 0; cnt--) {
+-				if (!dquots[cnt])
++				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++				if (!dquot)
+ 					continue;
+-				spin_lock(&dquots[cnt]->dq_dqb_lock);
++				spin_lock(&dquot->dq_dqb_lock);
+ 				if (reserve)
+-					dquot_free_reserved_space(dquots[cnt],
+-								  number);
++					dquot_free_reserved_space(dquot, number);
+ 				else
+-					dquot_decr_space(dquots[cnt], number);
+-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
++					dquot_decr_space(dquot, number);
++				spin_unlock(&dquot->dq_dqb_lock);
+ 			}
+ 			spin_unlock(&inode->i_lock);
+ 			goto out_flush_warn;
+@@ -1748,6 +1750,7 @@ int dquot_alloc_inode(struct inode *inode)
+ 	int cnt, ret = 0, index;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	struct dquot * const *dquots;
++	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode))
+ 		return 0;
+@@ -1758,17 +1761,19 @@ int dquot_alloc_inode(struct inode *inode)
+ 	index = srcu_read_lock(&dquot_srcu);
+ 	spin_lock(&inode->i_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+-		ret = dquot_add_inodes(dquots[cnt], 1, &warn[cnt]);
++		ret = dquot_add_inodes(dquot, 1, &warn[cnt]);
+ 		if (ret) {
+ 			for (cnt--; cnt >= 0; cnt--) {
+-				if (!dquots[cnt])
++				dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++				if (!dquot)
+ 					continue;
+ 				/* Back out changes we already did */
+-				spin_lock(&dquots[cnt]->dq_dqb_lock);
+-				dquot_decr_inodes(dquots[cnt], 1);
+-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
++				spin_lock(&dquot->dq_dqb_lock);
++				dquot_decr_inodes(dquot, 1);
++				spin_unlock(&dquot->dq_dqb_lock);
+ 			}
+ 			goto warn_put_all;
+ 		}
+@@ -1790,6 +1795,7 @@ EXPORT_SYMBOL(dquot_alloc_inode);
+ void dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 	int cnt, index;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1805,9 +1811,8 @@ void dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ 	spin_lock(&inode->i_lock);
+ 	/* Claim reserved quotas to allocated quotas */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (dquots[cnt]) {
+-			struct dquot *dquot = dquots[cnt];
+-
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (dquot) {
+ 			spin_lock(&dquot->dq_dqb_lock);
+ 			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_rsvspace < number))
+ 				number = dquot->dq_dqb.dqb_rsvspace;
+@@ -1832,6 +1837,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty);
+ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 	int cnt, index;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1847,9 +1853,8 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ 	spin_lock(&inode->i_lock);
+ 	/* Claim reserved quotas to allocated quotas */
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		if (dquots[cnt]) {
+-			struct dquot *dquot = dquots[cnt];
+-
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (dquot) {
+ 			spin_lock(&dquot->dq_dqb_lock);
+ 			if (WARN_ON_ONCE(dquot->dq_dqb.dqb_curspace < number))
+ 				number = dquot->dq_dqb.dqb_curspace;
+@@ -1876,6 +1881,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	struct dquot **dquots;
++	struct dquot *dquot;
+ 	int reserve = flags & DQUOT_SPACE_RESERVE, index;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1896,17 +1902,18 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ 		int wtype;
+ 
+ 		warn[cnt].w_type = QUOTA_NL_NOWARN;
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+-		spin_lock(&dquots[cnt]->dq_dqb_lock);
+-		wtype = info_bdq_free(dquots[cnt], number);
++		spin_lock(&dquot->dq_dqb_lock);
++		wtype = info_bdq_free(dquot, number);
+ 		if (wtype != QUOTA_NL_NOWARN)
+-			prepare_warning(&warn[cnt], dquots[cnt], wtype);
++			prepare_warning(&warn[cnt], dquot, wtype);
+ 		if (reserve)
+-			dquot_free_reserved_space(dquots[cnt], number);
++			dquot_free_reserved_space(dquot, number);
+ 		else
+-			dquot_decr_space(dquots[cnt], number);
+-		spin_unlock(&dquots[cnt]->dq_dqb_lock);
++			dquot_decr_space(dquot, number);
++		spin_unlock(&dquot->dq_dqb_lock);
+ 	}
+ 	if (reserve)
+ 		*inode_reserved_space(inode) -= number;
+@@ -1931,6 +1938,7 @@ void dquot_free_inode(struct inode *inode)
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	struct dquot * const *dquots;
++	struct dquot *dquot;
+ 	int index;
+ 
+ 	if (!inode_quota_active(inode))
+@@ -1941,16 +1949,16 @@ void dquot_free_inode(struct inode *inode)
+ 	spin_lock(&inode->i_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+ 		int wtype;
+-
+ 		warn[cnt].w_type = QUOTA_NL_NOWARN;
+-		if (!dquots[cnt])
++		dquot = srcu_dereference(dquots[cnt], &dquot_srcu);
++		if (!dquot)
+ 			continue;
+-		spin_lock(&dquots[cnt]->dq_dqb_lock);
+-		wtype = info_idq_free(dquots[cnt], 1);
++		spin_lock(&dquot->dq_dqb_lock);
++		wtype = info_idq_free(dquot, 1);
+ 		if (wtype != QUOTA_NL_NOWARN)
+-			prepare_warning(&warn[cnt], dquots[cnt], wtype);
+-		dquot_decr_inodes(dquots[cnt], 1);
+-		spin_unlock(&dquots[cnt]->dq_dqb_lock);
++			prepare_warning(&warn[cnt], dquot, wtype);
++		dquot_decr_inodes(dquot, 1);
++		spin_unlock(&dquot->dq_dqb_lock);
+ 	}
+ 	spin_unlock(&inode->i_lock);
+ 	mark_all_dquot_dirty(dquots);
+@@ -1977,7 +1985,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	qsize_t rsv_space = 0;
+ 	qsize_t inode_usage = 1;
+ 	struct dquot *transfer_from[MAXQUOTAS] = {};
+-	int cnt, ret = 0;
++	int cnt, index, ret = 0;
+ 	char is_valid[MAXQUOTAS] = {};
+ 	struct dquot_warn warn_to[MAXQUOTAS];
+ 	struct dquot_warn warn_from_inodes[MAXQUOTAS];
+@@ -2066,8 +2074,16 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	spin_unlock(&inode->i_lock);
+ 	spin_unlock(&dq_data_lock);
+ 
++	/*
++	 * These arrays are local and we hold dquot references so we don't need
++	 * the srcu protection but still take dquot_srcu to avoid warning in
++	 * mark_all_dquot_dirty().
++	 */
++	index = srcu_read_lock(&dquot_srcu);
+ 	mark_all_dquot_dirty(transfer_from);
+ 	mark_all_dquot_dirty(transfer_to);
++	srcu_read_unlock(&dquot_srcu, index);
++
+ 	flush_warnings(warn_to);
+ 	flush_warnings(warn_from_inodes);
+ 	flush_warnings(warn_from_space);
+-- 
+2.43.0
+
diff --git a/queue-6.8/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch b/queue-6.8/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
new file mode 100644
index 00000000000..da4bf6b979b
--- /dev/null
+++ b/queue-6.8/quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
@@ -0,0 +1,253 @@
+From e4c78eff8d3c41d748f3bef8c189fdb80589151e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 15:32:09 +0100
+Subject: quota: Fix rcu annotations of inode dquot pointers
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 179b8c97ebf63429589f5afeba59a181fe70603e ]
+
+Dquot pointers in i_dquot array in the inode are protected by
+dquot_srcu. Annotate the array pointers with __rcu, perform the locked
+dereferences with srcu_dereference_check() instead of plain reads, and
+set the array elements with rcu_assign_pointer().
+
+Fixes: b9ba6f94b238 ("quota: remove dqptr_sem")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202402061900.rTuYDlo6-lkp@intel.com/
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/quota/dquot.c | 66 ++++++++++++++++++++++++++++--------------------
+ 1 file changed, 39 insertions(+), 27 deletions(-)
+
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index cafe65a03f6dc..3a16867a6fbde 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -399,7 +399,7 @@ int dquot_mark_dquot_dirty(struct dquot *dquot)
+ EXPORT_SYMBOL(dquot_mark_dquot_dirty);
+ 
+ /* Dirtify all the dquots - this can block when journalling */
+-static inline int mark_all_dquot_dirty(struct dquot * const *dquots)
++static inline int mark_all_dquot_dirty(struct dquot __rcu * const *dquots)
+ {
+ 	int ret, err, cnt;
+ 	struct dquot *dquot;
+@@ -1000,14 +1000,15 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)
+ }
+ EXPORT_SYMBOL(dqget);
+ 
+-static inline struct dquot **i_dquot(struct inode *inode)
++static inline struct dquot __rcu **i_dquot(struct inode *inode)
+ {
+-	return inode->i_sb->s_op->get_dquots(inode);
++	/* Force __rcu for now until filesystems are fixed */
++	return (struct dquot __rcu **)inode->i_sb->s_op->get_dquots(inode);
+ }
+ 
+ static int dqinit_needed(struct inode *inode, int type)
+ {
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	int cnt;
+ 
+ 	if (IS_NOQUOTA(inode))
+@@ -1097,14 +1098,16 @@ static void remove_dquot_ref(struct super_block *sb, int type)
+ 		 */
+ 		spin_lock(&dq_data_lock);
+ 		if (!IS_NOQUOTA(inode)) {
+-			struct dquot **dquots = i_dquot(inode);
+-			struct dquot *dquot = dquots[type];
++			struct dquot __rcu **dquots = i_dquot(inode);
++			struct dquot *dquot = srcu_dereference_check(
++				dquots[type], &dquot_srcu,
++				lockdep_is_held(&dq_data_lock));
+ 
+ #ifdef CONFIG_QUOTA_DEBUG
+ 			if (unlikely(inode_get_rsv_space(inode) > 0))
+ 				reserved = 1;
+ #endif
+-			dquots[type] = NULL;
++			rcu_assign_pointer(dquots[type], NULL);
+ 			if (dquot)
+ 				dqput(dquot);
+ 		}
+@@ -1457,7 +1460,8 @@ static int inode_quota_active(const struct inode *inode)
+ static int __dquot_initialize(struct inode *inode, int type)
+ {
+ 	int cnt, init_needed = 0;
+-	struct dquot **dquots, *got[MAXQUOTAS] = {};
++	struct dquot __rcu **dquots;
++	struct dquot *got[MAXQUOTAS] = {};
+ 	struct super_block *sb = inode->i_sb;
+ 	qsize_t rsv;
+ 	int ret = 0;
+@@ -1532,7 +1536,7 @@ static int __dquot_initialize(struct inode *inode, int type)
+ 		if (!got[cnt])
+ 			continue;
+ 		if (!dquots[cnt]) {
+-			dquots[cnt] = got[cnt];
++			rcu_assign_pointer(dquots[cnt], got[cnt]);
+ 			got[cnt] = NULL;
+ 			/*
+ 			 * Make quota reservation system happy if someone
+@@ -1540,12 +1544,16 @@ static int __dquot_initialize(struct inode *inode, int type)
+ 			 */
+ 			rsv = inode_get_rsv_space(inode);
+ 			if (unlikely(rsv)) {
++				struct dquot *dquot = srcu_dereference_check(
++					dquots[cnt], &dquot_srcu,
++					lockdep_is_held(&dq_data_lock));
++
+ 				spin_lock(&inode->i_lock);
+ 				/* Get reservation again under proper lock */
+ 				rsv = __inode_get_rsv_space(inode);
+-				spin_lock(&dquots[cnt]->dq_dqb_lock);
+-				dquots[cnt]->dq_dqb.dqb_rsvspace += rsv;
+-				spin_unlock(&dquots[cnt]->dq_dqb_lock);
++				spin_lock(&dquot->dq_dqb_lock);
++				dquot->dq_dqb.dqb_rsvspace += rsv;
++				spin_unlock(&dquot->dq_dqb_lock);
+ 				spin_unlock(&inode->i_lock);
+ 			}
+ 		}
+@@ -1567,7 +1575,7 @@ EXPORT_SYMBOL(dquot_initialize);
+ 
+ bool dquot_initialize_needed(struct inode *inode)
+ {
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	int i;
+ 
+ 	if (!inode_quota_active(inode))
+@@ -1592,13 +1600,14 @@ EXPORT_SYMBOL(dquot_initialize_needed);
+ static void __dquot_drop(struct inode *inode)
+ {
+ 	int cnt;
+-	struct dquot **dquots = i_dquot(inode);
++	struct dquot __rcu **dquots = i_dquot(inode);
+ 	struct dquot *put[MAXQUOTAS];
+ 
+ 	spin_lock(&dq_data_lock);
+ 	for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
+-		put[cnt] = dquots[cnt];
+-		dquots[cnt] = NULL;
++		put[cnt] = srcu_dereference_check(dquots[cnt], &dquot_srcu,
++					lockdep_is_held(&dq_data_lock));
++		rcu_assign_pointer(dquots[cnt], NULL);
+ 	}
+ 	spin_unlock(&dq_data_lock);
+ 	dqput_all(put);
+@@ -1606,7 +1615,7 @@ static void __dquot_drop(struct inode *inode)
+ 
+ void dquot_drop(struct inode *inode)
+ {
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	int cnt;
+ 
+ 	if (IS_NOQUOTA(inode))
+@@ -1679,7 +1688,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
+ 	int cnt, ret = 0, index;
+ 	struct dquot_warn warn[MAXQUOTAS];
+ 	int reserve = flags & DQUOT_SPACE_RESERVE;
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode)) {
+@@ -1749,7 +1758,7 @@ int dquot_alloc_inode(struct inode *inode)
+ {
+ 	int cnt, ret = 0, index;
+ 	struct dquot_warn warn[MAXQUOTAS];
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	struct dquot *dquot;
+ 
+ 	if (!inode_quota_active(inode))
+@@ -1794,7 +1803,7 @@ EXPORT_SYMBOL(dquot_alloc_inode);
+  */
+ void dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 	int cnt, index;
+ 
+@@ -1836,7 +1845,7 @@ EXPORT_SYMBOL(dquot_claim_space_nodirty);
+  */
+ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
+ {
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 	int cnt, index;
+ 
+@@ -1880,7 +1889,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
+ {
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+-	struct dquot **dquots;
++	struct dquot __rcu **dquots;
+ 	struct dquot *dquot;
+ 	int reserve = flags & DQUOT_SPACE_RESERVE, index;
+ 
+@@ -1937,7 +1946,7 @@ void dquot_free_inode(struct inode *inode)
+ {
+ 	unsigned int cnt;
+ 	struct dquot_warn warn[MAXQUOTAS];
+-	struct dquot * const *dquots;
++	struct dquot __rcu * const *dquots;
+ 	struct dquot *dquot;
+ 	int index;
+ 
+@@ -1984,6 +1993,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	qsize_t cur_space;
+ 	qsize_t rsv_space = 0;
+ 	qsize_t inode_usage = 1;
++	struct dquot __rcu **dquots;
+ 	struct dquot *transfer_from[MAXQUOTAS] = {};
+ 	int cnt, index, ret = 0;
+ 	char is_valid[MAXQUOTAS] = {};
+@@ -2016,6 +2026,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	}
+ 	cur_space = __inode_get_bytes(inode);
+ 	rsv_space = __inode_get_rsv_space(inode);
++	dquots = i_dquot(inode);
+ 	/*
+ 	 * Build the transfer_from list, check limits, and update usage in
+ 	 * the target structures.
+@@ -2030,7 +2041,8 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 		if (!sb_has_quota_active(inode->i_sb, cnt))
+ 			continue;
+ 		is_valid[cnt] = 1;
+-		transfer_from[cnt] = i_dquot(inode)[cnt];
++		transfer_from[cnt] = srcu_dereference_check(dquots[cnt],
++				&dquot_srcu, lockdep_is_held(&dq_data_lock));
+ 		ret = dquot_add_inodes(transfer_to[cnt], inode_usage,
+ 				       &warn_to[cnt]);
+ 		if (ret)
+@@ -2069,7 +2081,7 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 						  rsv_space);
+ 			spin_unlock(&transfer_from[cnt]->dq_dqb_lock);
+ 		}
+-		i_dquot(inode)[cnt] = transfer_to[cnt];
++		rcu_assign_pointer(dquots[cnt], transfer_to[cnt]);
+ 	}
+ 	spin_unlock(&inode->i_lock);
+ 	spin_unlock(&dq_data_lock);
+@@ -2080,8 +2092,8 @@ int __dquot_transfer(struct inode *inode, struct dquot **transfer_to)
+ 	 * mark_all_dquot_dirty().
+ 	 */
+ 	index = srcu_read_lock(&dquot_srcu);
+-	mark_all_dquot_dirty(transfer_from);
+-	mark_all_dquot_dirty(transfer_to);
++	mark_all_dquot_dirty((struct dquot __rcu **)transfer_from);
++	mark_all_dquot_dirty((struct dquot __rcu **)transfer_to);
+ 	srcu_read_unlock(&dquot_srcu, index);
+ 
+ 	flush_warnings(warn_to);
+-- 
+2.43.0
+
diff --git a/queue-6.8/quota-properly-annotate-i_dquot-arrays-with-__rcu.patch b/queue-6.8/quota-properly-annotate-i_dquot-arrays-with-__rcu.patch
new file mode 100644
index 00000000000..42abc283fa1
--- /dev/null
+++ b/queue-6.8/quota-properly-annotate-i_dquot-arrays-with-__rcu.patch
@@ -0,0 +1,247 @@
+From 319c81daf22322244b3f9f25712d08561a2a14bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 15:08:19 +0100
+Subject: quota: Properly annotate i_dquot arrays with __rcu
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit ccb49011bb2ebfd66164dbf68c5bff48917bb5ef ]
+
+Dquots pointed to from i_dquot arrays in inodes are protected by
+dquot_srcu. Annotate them as such and change .get_dquots callback to
+return properly annotated pointer to make sparse happy.
+
+Fixes: b9ba6f94b238 ("quota: remove dqptr_sem")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext2/ext2.h           | 2 +-
+ fs/ext2/super.c          | 2 +-
+ fs/ext4/ext4.h           | 2 +-
+ fs/ext4/super.c          | 2 +-
+ fs/f2fs/f2fs.h           | 2 +-
+ fs/f2fs/super.c          | 2 +-
+ fs/jfs/jfs_incore.h      | 2 +-
+ fs/jfs/super.c           | 2 +-
+ fs/ocfs2/inode.h         | 2 +-
+ fs/ocfs2/super.c         | 2 +-
+ fs/quota/dquot.c         | 3 +--
+ fs/reiserfs/reiserfs.h   | 2 +-
+ fs/reiserfs/super.c      | 2 +-
+ include/linux/fs.h       | 2 +-
+ include/linux/shmem_fs.h | 2 +-
+ mm/shmem.c               | 2 +-
+ 16 files changed, 16 insertions(+), 17 deletions(-)
+
+diff --git a/fs/ext2/ext2.h b/fs/ext2/ext2.h
+index 677a9ad45dcb7..f38bdd46e4f77 100644
+--- a/fs/ext2/ext2.h
++++ b/fs/ext2/ext2.h
+@@ -674,7 +674,7 @@ struct ext2_inode_info {
+ 	struct inode	vfs_inode;
+ 	struct list_head i_orphan;	/* unlinked but open inodes */
+ #ifdef CONFIG_QUOTA
+-	struct dquot *i_dquot[MAXQUOTAS];
++	struct dquot __rcu *i_dquot[MAXQUOTAS];
+ #endif
+ };
+ 
+diff --git a/fs/ext2/super.c b/fs/ext2/super.c
+index 01f9addc8b1f6..6d8587505cea3 100644
+--- a/fs/ext2/super.c
++++ b/fs/ext2/super.c
+@@ -320,7 +320,7 @@ static ssize_t ext2_quota_read(struct super_block *sb, int type, char *data, siz
+ static ssize_t ext2_quota_write(struct super_block *sb, int type, const char *data, size_t len, loff_t off);
+ static int ext2_quota_on(struct super_block *sb, int type, int format_id,
+ 			 const struct path *path);
+-static struct dquot **ext2_get_dquots(struct inode *inode)
++static struct dquot __rcu **ext2_get_dquots(struct inode *inode)
+ {
+ 	return EXT2_I(inode)->i_dquot;
+ }
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 023571f8dd1b4..4fb938ba3f359 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1158,7 +1158,7 @@ struct ext4_inode_info {
+ 	tid_t i_datasync_tid;
+ 
+ #ifdef CONFIG_QUOTA
+-	struct dquot *i_dquot[MAXQUOTAS];
++	struct dquot __rcu *i_dquot[MAXQUOTAS];
+ #endif
+ 
+ 	/* Precomputed uuid+inum+igen checksum for seeding inode checksums */
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 0f931d0c227da..32bd83adf0bb8 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1600,7 +1600,7 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
+ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+ 			     unsigned int flags);
+ 
+-static struct dquot **ext4_get_dquots(struct inode *inode)
++static struct dquot __rcu **ext4_get_dquots(struct inode *inode)
+ {
+ 	return EXT4_I(inode)->i_dquot;
+ }
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 65294e3b0bef8..31554e2a0a320 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -829,7 +829,7 @@ struct f2fs_inode_info {
+ 	spinlock_t i_size_lock;		/* protect last_disk_size */
+ 
+ #ifdef CONFIG_QUOTA
+-	struct dquot *i_dquot[MAXQUOTAS];
++	struct dquot __rcu *i_dquot[MAXQUOTAS];
+ 
+ 	/* quota space reservation, managed internally by quota code */
+ 	qsize_t i_reserved_quota;
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index d45ab0992ae59..18cc4829f7e82 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -2768,7 +2768,7 @@ int f2fs_dquot_initialize(struct inode *inode)
+ 	return dquot_initialize(inode);
+ }
+ 
+-static struct dquot **f2fs_get_dquots(struct inode *inode)
++static struct dquot __rcu **f2fs_get_dquots(struct inode *inode)
+ {
+ 	return F2FS_I(inode)->i_dquot;
+ }
+diff --git a/fs/jfs/jfs_incore.h b/fs/jfs/jfs_incore.h
+index dd4264aa9bedd..10934f9a11be3 100644
+--- a/fs/jfs/jfs_incore.h
++++ b/fs/jfs/jfs_incore.h
+@@ -92,7 +92,7 @@ struct jfs_inode_info {
+ 		} link;
+ 	} u;
+ #ifdef CONFIG_QUOTA
+-	struct dquot *i_dquot[MAXQUOTAS];
++	struct dquot __rcu *i_dquot[MAXQUOTAS];
+ #endif
+ 	u32 dev;	/* will die when we get wide dev_t */
+ 	struct inode	vfs_inode;
+diff --git a/fs/jfs/super.c b/fs/jfs/super.c
+index 8d8e556bd6104..ff135a43b5b7b 100644
+--- a/fs/jfs/super.c
++++ b/fs/jfs/super.c
+@@ -824,7 +824,7 @@ static ssize_t jfs_quota_write(struct super_block *sb, int type,
+ 	return len - towrite;
+ }
+ 
+-static struct dquot **jfs_get_dquots(struct inode *inode)
++static struct dquot __rcu **jfs_get_dquots(struct inode *inode)
+ {
+ 	return JFS_IP(inode)->i_dquot;
+ }
+diff --git a/fs/ocfs2/inode.h b/fs/ocfs2/inode.h
+index 82b28fdacc7e9..accf03d4765ed 100644
+--- a/fs/ocfs2/inode.h
++++ b/fs/ocfs2/inode.h
+@@ -65,7 +65,7 @@ struct ocfs2_inode_info
+ 	tid_t i_sync_tid;
+ 	tid_t i_datasync_tid;
+ 
+-	struct dquot *i_dquot[MAXQUOTAS];
++	struct dquot __rcu *i_dquot[MAXQUOTAS];
+ };
+ 
+ /*
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index 6b906424902b4..1259fe02cd53b 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -122,7 +122,7 @@ static int ocfs2_susp_quotas(struct ocfs2_super *osb, int unsuspend);
+ static int ocfs2_enable_quotas(struct ocfs2_super *osb);
+ static void ocfs2_disable_quotas(struct ocfs2_super *osb);
+ 
+-static struct dquot **ocfs2_get_dquots(struct inode *inode)
++static struct dquot __rcu **ocfs2_get_dquots(struct inode *inode)
+ {
+ 	return OCFS2_I(inode)->i_dquot;
+ }
+diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
+index 3a16867a6fbde..51ff554dc875a 100644
+--- a/fs/quota/dquot.c
++++ b/fs/quota/dquot.c
+@@ -1002,8 +1002,7 @@ EXPORT_SYMBOL(dqget);
+ 
+ static inline struct dquot __rcu **i_dquot(struct inode *inode)
+ {
+-	/* Force __rcu for now until filesystems are fixed */
+-	return (struct dquot __rcu **)inode->i_sb->s_op->get_dquots(inode);
++	return inode->i_sb->s_op->get_dquots(inode);
+ }
+ 
+ static int dqinit_needed(struct inode *inode, int type)
+diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
+index 725667880e626..b65549164590c 100644
+--- a/fs/reiserfs/reiserfs.h
++++ b/fs/reiserfs/reiserfs.h
+@@ -97,7 +97,7 @@ struct reiserfs_inode_info {
+ 	struct rw_semaphore i_xattr_sem;
+ #endif
+ #ifdef CONFIG_QUOTA
+-	struct dquot *i_dquot[MAXQUOTAS];
++	struct dquot __rcu *i_dquot[MAXQUOTAS];
+ #endif
+ 
+ 	struct inode vfs_inode;
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 67b5510beded2..7b3d5aeb2a6fe 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -802,7 +802,7 @@ static ssize_t reiserfs_quota_write(struct super_block *, int, const char *,
+ static ssize_t reiserfs_quota_read(struct super_block *, int, char *, size_t,
+ 				   loff_t);
+ 
+-static struct dquot **reiserfs_get_dquots(struct inode *inode)
++static struct dquot __rcu **reiserfs_get_dquots(struct inode *inode)
+ {
+ 	return REISERFS_I(inode)->i_dquot;
+ }
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 630468c005040..08ecac9d7b8ba 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2158,7 +2158,7 @@ struct super_operations {
+ #ifdef CONFIG_QUOTA
+ 	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
+ 	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+-	struct dquot **(*get_dquots)(struct inode *);
++	struct dquot __rcu **(*get_dquots)(struct inode *);
+ #endif
+ 	long (*nr_cached_objects)(struct super_block *,
+ 				  struct shrink_control *);
+diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
+index 2caa6b86106aa..66828dfc6e74e 100644
+--- a/include/linux/shmem_fs.h
++++ b/include/linux/shmem_fs.h
+@@ -37,7 +37,7 @@ struct shmem_inode_info {
+ 	unsigned int		fsflags;	/* for FS_IOC_[SG]ETFLAGS */
+ 	atomic_t		stop_eviction;	/* hold when working on inode */
+ #ifdef CONFIG_TMPFS_QUOTA
+-	struct dquot		*i_dquot[MAXQUOTAS];
++	struct dquot __rcu	*i_dquot[MAXQUOTAS];
+ #endif
+ 	struct inode		vfs_inode;
+ };
+diff --git a/mm/shmem.c b/mm/shmem.c
+index d7c84ff621860..791a6dc163244 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -311,7 +311,7 @@ static void shmem_disable_quotas(struct super_block *sb)
+ 		dquot_quota_off(sb, type);
+ }
+ 
+-static struct dquot **shmem_get_dquots(struct inode *inode)
++static struct dquot __rcu **shmem_get_dquots(struct inode *inode)
+ {
+ 	return SHMEM_I(inode)->i_dquot;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/r8152-fix-unknown-device-for-choose_configuration.patch b/queue-6.8/r8152-fix-unknown-device-for-choose_configuration.patch
new file mode 100644
index 00000000000..063453c7f00
--- /dev/null
+++ b/queue-6.8/r8152-fix-unknown-device-for-choose_configuration.patch
@@ -0,0 +1,39 @@
+From deb2c6e934137783c8dcdc5b3b67c2be3ceaa79d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Mar 2024 15:52:06 +0800
+Subject: r8152: fix unknown device for choose_configuration
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 46590b545df636aea0f9f7f2100d9963c0af5824 ]
+
+For the unknown device, rtl8152_cfgselector_choose_configuration()
+should return a negative value. Then, usb_choose_configuration() would
+set a configuration for CDC ECM or NCM mode. Otherwise, there is no
+usb interface driver for the device.
+
+Fixes: aa4f2b3e418e ("r8152: Choose our USB config with choose_configuration() rather than probe()")
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Link: https://lore.kernel.org/r/20240308075206.33553-436-nic_swsd@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 0d0672d2a6545..51fe00c2b896e 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -10078,7 +10078,7 @@ static int rtl8152_cfgselector_choose_configuration(struct usb_device *udev)
+ 	 * driver supports it.
+ 	 */
+ 	if (__rtl_get_hw_ver(udev) == RTL_VER_UNKNOWN)
+-		return 0;
++		return -ENODEV;
+ 
+ 	/* The vendor mode is not always config #1, so to find it out. */
+ 	c = udev->config;
+-- 
+2.43.0
+
diff --git a/queue-6.8/rcu-exp-fix-rcu-expedited-parallel-grace-period-kwor.patch b/queue-6.8/rcu-exp-fix-rcu-expedited-parallel-grace-period-kwor.patch
new file mode 100644
index 00000000000..4842b60fd77
--- /dev/null
+++ b/queue-6.8/rcu-exp-fix-rcu-expedited-parallel-grace-period-kwor.patch
@@ -0,0 +1,46 @@
+From 7e451bf9f4ee02b215a867155bbf0491eb3ab452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 16:46:15 +0100
+Subject: rcu/exp: Fix RCU expedited parallel grace period kworker allocation
+ failure recovery
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit a636c5e6f8fc34be520277e69c7c6ee1d4fc1d17 ]
+
+Under CONFIG_RCU_EXP_KTHREAD=y, the nodes initialization for expedited
+grace periods is queued to a kworker. However if the allocation of that
+kworker failed, the nodes initialization is performed synchronously by
+the caller instead.
+
+Now the check for kworker initialization failure relies on the kworker
+pointer to be NULL while its value might actually encapsulate an
+allocation failure error.
+
+Make sure to handle this case.
+
+Reviewed-by: Kalesh Singh <kaleshsingh@google.com>
+Fixes: 9621fbee44df ("rcu: Move expedited grace period (GP) work to RT kthread_worker")
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index b2bccfd37c383..38c86f2c040b5 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -4749,6 +4749,7 @@ static void __init rcu_start_exp_gp_kworkers(void)
+ 	rcu_exp_par_gp_kworker = kthread_create_worker(0, par_gp_kworker_name);
+ 	if (IS_ERR_OR_NULL(rcu_exp_par_gp_kworker)) {
+ 		pr_err("Failed to create %s!\n", par_gp_kworker_name);
++		rcu_exp_par_gp_kworker = NULL;
+ 		kthread_destroy_worker(rcu_exp_gp_kworker);
+ 		return;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/rcu-exp-handle-rcu-expedited-grace-period-kworker-al.patch b/queue-6.8/rcu-exp-handle-rcu-expedited-grace-period-kworker-al.patch
new file mode 100644
index 00000000000..cda68bfc64e
--- /dev/null
+++ b/queue-6.8/rcu-exp-handle-rcu-expedited-grace-period-kworker-al.patch
@@ -0,0 +1,128 @@
+From 9c43e574a86994727485c72002bfd6d1042c0b35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jan 2024 16:46:16 +0100
+Subject: rcu/exp: Handle RCU expedited grace period kworker allocation failure
+
+From: Frederic Weisbecker <frederic@kernel.org>
+
+[ Upstream commit e7539ffc9a770f36bacedcf0fbfb4bf2f244f4a5 ]
+
+Just like is done for the kworker performing nodes initialization,
+gracefully handle the possible allocation failure of the RCU expedited
+grace period main kworker.
+
+While at it perform a rename of the related checking functions to better
+reflect the expedited specifics.
+
+Reviewed-by: Kalesh Singh <kaleshsingh@google.com>
+Fixes: 9621fbee44df ("rcu: Move expedited grace period (GP) work to RT kthread_worker")
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree.c     |  2 ++
+ kernel/rcu/tree_exp.h | 25 +++++++++++++++++++------
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 38c86f2c040b5..f2c10d351b597 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -4743,6 +4743,7 @@ static void __init rcu_start_exp_gp_kworkers(void)
+ 	rcu_exp_gp_kworker = kthread_create_worker(0, gp_kworker_name);
+ 	if (IS_ERR_OR_NULL(rcu_exp_gp_kworker)) {
+ 		pr_err("Failed to create %s!\n", gp_kworker_name);
++		rcu_exp_gp_kworker = NULL;
+ 		return;
+ 	}
+ 
+@@ -4751,6 +4752,7 @@ static void __init rcu_start_exp_gp_kworkers(void)
+ 		pr_err("Failed to create %s!\n", par_gp_kworker_name);
+ 		rcu_exp_par_gp_kworker = NULL;
+ 		kthread_destroy_worker(rcu_exp_gp_kworker);
++		rcu_exp_gp_kworker = NULL;
+ 		return;
+ 	}
+ 
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index 2ac440bc7e10b..8107f818455da 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -428,7 +428,12 @@ static void sync_rcu_exp_select_node_cpus(struct kthread_work *wp)
+ 	__sync_rcu_exp_select_node_cpus(rewp);
+ }
+ 
+-static inline bool rcu_gp_par_worker_started(void)
++static inline bool rcu_exp_worker_started(void)
++{
++	return !!READ_ONCE(rcu_exp_gp_kworker);
++}
++
++static inline bool rcu_exp_par_worker_started(void)
+ {
+ 	return !!READ_ONCE(rcu_exp_par_gp_kworker);
+ }
+@@ -478,7 +483,12 @@ static void sync_rcu_exp_select_node_cpus(struct work_struct *wp)
+ 	__sync_rcu_exp_select_node_cpus(rewp);
+ }
+ 
+-static inline bool rcu_gp_par_worker_started(void)
++static inline bool rcu_exp_worker_started(void)
++{
++	return !!READ_ONCE(rcu_gp_wq);
++}
++
++static inline bool rcu_exp_par_worker_started(void)
+ {
+ 	return !!READ_ONCE(rcu_par_gp_wq);
+ }
+@@ -541,7 +551,7 @@ static void sync_rcu_exp_select_cpus(void)
+ 		rnp->exp_need_flush = false;
+ 		if (!READ_ONCE(rnp->expmask))
+ 			continue; /* Avoid early boot non-existent wq. */
+-		if (!rcu_gp_par_worker_started() ||
++		if (!rcu_exp_par_worker_started() ||
+ 		    rcu_scheduler_active != RCU_SCHEDULER_RUNNING ||
+ 		    rcu_is_last_leaf_node(rnp)) {
+ 			/* No worker started yet or last leaf, do direct call. */
+@@ -956,7 +966,7 @@ static void rcu_exp_print_detail_task_stall_rnp(struct rcu_node *rnp)
+  */
+ void synchronize_rcu_expedited(void)
+ {
+-	bool boottime = (rcu_scheduler_active == RCU_SCHEDULER_INIT);
++	bool use_worker;
+ 	unsigned long flags;
+ 	struct rcu_exp_work rew;
+ 	struct rcu_node *rnp;
+@@ -967,6 +977,9 @@ void synchronize_rcu_expedited(void)
+ 			 lock_is_held(&rcu_sched_lock_map),
+ 			 "Illegal synchronize_rcu_expedited() in RCU read-side critical section");
+ 
++	use_worker = (rcu_scheduler_active != RCU_SCHEDULER_INIT) &&
++		      rcu_exp_worker_started();
++
+ 	/* Is the state is such that the call is a grace period? */
+ 	if (rcu_blocking_is_gp()) {
+ 		// Note well that this code runs with !PREEMPT && !SMP.
+@@ -996,7 +1009,7 @@ void synchronize_rcu_expedited(void)
+ 		return;  /* Someone else did our work for us. */
+ 
+ 	/* Ensure that load happens before action based on it. */
+-	if (unlikely(boottime)) {
++	if (unlikely(!use_worker)) {
+ 		/* Direct call during scheduler init and early_initcalls(). */
+ 		rcu_exp_sel_wait_wake(s);
+ 	} else {
+@@ -1014,7 +1027,7 @@ void synchronize_rcu_expedited(void)
+ 	/* Let the next expedited grace period start. */
+ 	mutex_unlock(&rcu_state.exp_mutex);
+ 
+-	if (likely(!boottime))
++	if (likely(use_worker))
+ 		synchronize_rcu_expedited_destroy_work(&rew);
+ }
+ EXPORT_SYMBOL_GPL(synchronize_rcu_expedited);
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch b/queue-6.8/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
new file mode 100644
index 00000000000..13e49323ddd
--- /dev/null
+++ b/queue-6.8/rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
@@ -0,0 +1,133 @@
+From 323b57e31659936a5aa3b48f880d27d4db149d19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 19:53:13 -0800
+Subject: RDMA/device: Fix a race between mad_client and cm_client init
+
+From: Shifeng Li <lishifeng@sangfor.com.cn>
+
+[ Upstream commit 7a8bccd8b29c321ac181369b42b04fecf05f98e2 ]
+
+The mad_client will be initialized in enable_device_and_get(), while the
+devices_rwsem will be downgraded to a read semaphore. There is a window
+that leads to the failed initialization for cm_client, since it can not
+get matched mad port from ib_mad_port_list, and the matched mad port will
+be added to the list after that.
+
+    mad_client    |                       cm_client
+------------------|--------------------------------------------------------
+ib_register_device|
+enable_device_and_get
+down_write(&devices_rwsem)
+xa_set_mark(&devices, DEVICE_REGISTERED)
+downgrade_write(&devices_rwsem)
+                  |
+                  |ib_cm_init
+                  |ib_register_client(&cm_client)
+                  |down_read(&devices_rwsem)
+                  |xa_for_each_marked (&devices, DEVICE_REGISTERED)
+                  |add_client_context
+                  |cm_add_one
+                  |ib_register_mad_agent
+                  |ib_get_mad_port
+                  |__ib_get_mad_port
+                  |list_for_each_entry(entry, &ib_mad_port_list, port_list)
+                  |return NULL
+                  |up_read(&devices_rwsem)
+                  |
+add_client_context|
+ib_mad_init_device|
+ib_mad_port_open  |
+list_add_tail(&port_priv->port_list, &ib_mad_port_list)
+up_read(&devices_rwsem)
+                  |
+
+Fix it by using down_write(&devices_rwsem) in ib_register_client().
+
+Fixes: d0899892edd0 ("RDMA/device: Provide APIs from the core code to help unregistration")
+Link: https://lore.kernel.org/r/20240203035313.98991-1-lishifeng@sangfor.com.cn
+Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
+Signed-off-by: Shifeng Li <lishifeng@sangfor.com.cn>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/device.c | 37 +++++++++++++++++++-------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 67bcea7a153c6..07cb6c5ffda00 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1730,7 +1730,7 @@ static int assign_client_id(struct ib_client *client)
+ {
+ 	int ret;
+ 
+-	down_write(&clients_rwsem);
++	lockdep_assert_held(&clients_rwsem);
+ 	/*
+ 	 * The add/remove callbacks must be called in FIFO/LIFO order. To
+ 	 * achieve this we assign client_ids so they are sorted in
+@@ -1739,14 +1739,11 @@ static int assign_client_id(struct ib_client *client)
+ 	client->client_id = highest_client_id;
+ 	ret = xa_insert(&clients, client->client_id, client, GFP_KERNEL);
+ 	if (ret)
+-		goto out;
++		return ret;
+ 
+ 	highest_client_id++;
+ 	xa_set_mark(&clients, client->client_id, CLIENT_REGISTERED);
+-
+-out:
+-	up_write(&clients_rwsem);
+-	return ret;
++	return 0;
+ }
+ 
+ static void remove_client_id(struct ib_client *client)
+@@ -1776,25 +1773,35 @@ int ib_register_client(struct ib_client *client)
+ {
+ 	struct ib_device *device;
+ 	unsigned long index;
++	bool need_unreg = false;
+ 	int ret;
+ 
+ 	refcount_set(&client->uses, 1);
+ 	init_completion(&client->uses_zero);
++
++	/*
++	 * The devices_rwsem is held in write mode to ensure that a racing
++	 * ib_register_device() sees a consisent view of clients and devices.
++	 */
++	down_write(&devices_rwsem);
++	down_write(&clients_rwsem);
+ 	ret = assign_client_id(client);
+ 	if (ret)
+-		return ret;
++		goto out;
+ 
+-	down_read(&devices_rwsem);
++	need_unreg = true;
+ 	xa_for_each_marked (&devices, index, device, DEVICE_REGISTERED) {
+ 		ret = add_client_context(device, client);
+-		if (ret) {
+-			up_read(&devices_rwsem);
+-			ib_unregister_client(client);
+-			return ret;
+-		}
++		if (ret)
++			goto out;
+ 	}
+-	up_read(&devices_rwsem);
+-	return 0;
++	ret = 0;
++out:
++	up_write(&clients_rwsem);
++	up_write(&devices_rwsem);
++	if (need_unreg && ret)
++		ib_unregister_client(client);
++	return ret;
+ }
+ EXPORT_SYMBOL(ib_register_client);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-hns-fix-mis-modifying-default-congestion-contro.patch b/queue-6.8/rdma-hns-fix-mis-modifying-default-congestion-contro.patch
new file mode 100644
index 00000000000..7c8cf89777b
--- /dev/null
+++ b/queue-6.8/rdma-hns-fix-mis-modifying-default-congestion-contro.patch
@@ -0,0 +1,134 @@
+From 4135af50a8fe07e46e589f1148f2fa22a755a287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Feb 2024 14:18:05 +0800
+Subject: RDMA/hns: Fix mis-modifying default congestion control algorithm
+
+From: Luoyouming <luoyouming@huawei.com>
+
+[ Upstream commit d20a7cf9f714f0763efb56f0f2eeca1cb91315ed ]
+
+Commit 27c5fd271d8b ("RDMA/hns: The UD mode can only be configured
+with DCQCN") adds a check of congest control alorithm for UD. But
+that patch causes a problem: hr_dev->caps.congest_type is global,
+used by all QPs, so modifying this field to DCQCN for UD QPs causes
+other QPs unable to use any other algorithm except DCQCN.
+
+Revert the modification in commit 27c5fd271d8b ("RDMA/hns: The UD
+mode can only be configured with DCQCN"). Add a new field cong_type
+to struct hns_roce_qp and configure DCQCN for UD QPs.
+
+Fixes: 27c5fd271d8b ("RDMA/hns: The UD mode can only be configured with DCQCN")
+Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW")
+Signed-off-by: Luoyouming <luoyouming@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20240219061805.668170-1-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_device.h | 17 +++++++++--------
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c  | 16 ++++++++++------
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h
+index b1fce5ddf6316..46f8a631093ba 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_device.h
++++ b/drivers/infiniband/hw/hns/hns_roce_device.h
+@@ -585,6 +585,13 @@ struct hns_roce_work {
+ 	u32 queue_num;
+ };
+ 
++enum hns_roce_cong_type {
++	CONG_TYPE_DCQCN,
++	CONG_TYPE_LDCP,
++	CONG_TYPE_HC3,
++	CONG_TYPE_DIP,
++};
++
+ struct hns_roce_qp {
+ 	struct ib_qp		ibqp;
+ 	struct hns_roce_wq	rq;
+@@ -628,6 +635,7 @@ struct hns_roce_qp {
+ 	struct list_head	sq_node; /* all send qps are on a list */
+ 	struct hns_user_mmap_entry *dwqe_mmap_entry;
+ 	u32			config;
++	enum hns_roce_cong_type	cong_type;
+ };
+ 
+ struct hns_roce_ib_iboe {
+@@ -699,13 +707,6 @@ struct hns_roce_eq_table {
+ 	struct hns_roce_eq	*eq;
+ };
+ 
+-enum cong_type {
+-	CONG_TYPE_DCQCN,
+-	CONG_TYPE_LDCP,
+-	CONG_TYPE_HC3,
+-	CONG_TYPE_DIP,
+-};
+-
+ struct hns_roce_caps {
+ 	u64		fw_ver;
+ 	u8		num_ports;
+@@ -835,7 +836,7 @@ struct hns_roce_caps {
+ 	u16		default_aeq_period;
+ 	u16		default_aeq_arm_st;
+ 	u16		default_ceq_arm_st;
+-	enum cong_type	cong_type;
++	enum hns_roce_cong_type cong_type;
+ };
+ 
+ enum hns_roce_device_state {
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 8206daea6767d..34e58e09b15d8 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4745,12 +4745,15 @@ static int check_cong_type(struct ib_qp *ibqp,
+ 			   struct hns_roce_congestion_algorithm *cong_alg)
+ {
+ 	struct hns_roce_dev *hr_dev = to_hr_dev(ibqp->device);
++	struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
+ 
+-	if (ibqp->qp_type == IB_QPT_UD)
+-		hr_dev->caps.cong_type = CONG_TYPE_DCQCN;
++	if (ibqp->qp_type == IB_QPT_UD || ibqp->qp_type == IB_QPT_GSI)
++		hr_qp->cong_type = CONG_TYPE_DCQCN;
++	else
++		hr_qp->cong_type = hr_dev->caps.cong_type;
+ 
+ 	/* different congestion types match different configurations */
+-	switch (hr_dev->caps.cong_type) {
++	switch (hr_qp->cong_type) {
+ 	case CONG_TYPE_DCQCN:
+ 		cong_alg->alg_sel = CONG_DCQCN;
+ 		cong_alg->alg_sub_sel = UNSUPPORT_CONG_LEVEL;
+@@ -4778,8 +4781,8 @@ static int check_cong_type(struct ib_qp *ibqp,
+ 	default:
+ 		ibdev_warn(&hr_dev->ib_dev,
+ 			   "invalid type(%u) for congestion selection.\n",
+-			   hr_dev->caps.cong_type);
+-		hr_dev->caps.cong_type = CONG_TYPE_DCQCN;
++			   hr_qp->cong_type);
++		hr_qp->cong_type = CONG_TYPE_DCQCN;
+ 		cong_alg->alg_sel = CONG_DCQCN;
+ 		cong_alg->alg_sub_sel = UNSUPPORT_CONG_LEVEL;
+ 		cong_alg->dip_vld = DIP_INVALID;
+@@ -4798,6 +4801,7 @@ static int fill_cong_field(struct ib_qp *ibqp, const struct ib_qp_attr *attr,
+ 	struct hns_roce_congestion_algorithm cong_field;
+ 	struct ib_device *ibdev = ibqp->device;
+ 	struct hns_roce_dev *hr_dev = to_hr_dev(ibdev);
++	struct hns_roce_qp *hr_qp = to_hr_qp(ibqp);
+ 	u32 dip_idx = 0;
+ 	int ret;
+ 
+@@ -4810,7 +4814,7 @@ static int fill_cong_field(struct ib_qp *ibqp, const struct ib_qp_attr *attr,
+ 		return ret;
+ 
+ 	hr_reg_write(context, QPC_CONG_ALGO_TMPL_ID, hr_dev->cong_algo_tmpl_id +
+-		     hr_dev->caps.cong_type * HNS_ROCE_CONG_SIZE);
++		     hr_qp->cong_type * HNS_ROCE_CONG_SIZE);
+ 	hr_reg_clear(qpc_mask, QPC_CONG_ALGO_TMPL_ID);
+ 	hr_reg_write(&context->ext, QPCEX_CONG_ALG_SEL, cong_field.alg_sel);
+ 	hr_reg_clear(&qpc_mask->ext, QPCEX_CONG_ALG_SEL);
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-irdma-remove-duplicate-assignment.patch b/queue-6.8/rdma-irdma-remove-duplicate-assignment.patch
new file mode 100644
index 00000000000..653de289c7c
--- /dev/null
+++ b/queue-6.8/rdma-irdma-remove-duplicate-assignment.patch
@@ -0,0 +1,47 @@
+From 3948ebf65e34ec6251e9bd0bb0bb785eec8b8780 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 17:39:53 -0600
+Subject: RDMA/irdma: Remove duplicate assignment
+
+From: Mustafa Ismail <mustafa.ismail@intel.com>
+
+[ Upstream commit 926e8ea4b8dac84f6d14a4b60d0653f1f2ba9431 ]
+
+Remove the unneeded assignment of the qp_num which is already
+set in irdma_create_qp().
+
+Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
+Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Sindhu Devale <sindhu.devale@intel.com>
+Link: https://lore.kernel.org/r/20240131233953.400483-1-sindhu.devale@intel.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/irdma/verbs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
+index 0b046c061742b..12704efb7b19a 100644
+--- a/drivers/infiniband/hw/irdma/verbs.c
++++ b/drivers/infiniband/hw/irdma/verbs.c
+@@ -719,7 +719,6 @@ static int irdma_setup_kmode_qp(struct irdma_device *iwdev,
+ 		info->rq_pa + (ukinfo->rq_depth * IRDMA_QP_WQE_MIN_SIZE);
+ 	ukinfo->sq_size = ukinfo->sq_depth >> ukinfo->sq_shift;
+ 	ukinfo->rq_size = ukinfo->rq_depth >> ukinfo->rq_shift;
+-	ukinfo->qp_id = iwqp->ibqp.qp_num;
+ 
+ 	iwqp->max_send_wr = (ukinfo->sq_depth - IRDMA_SQ_RSVD) >> ukinfo->sq_shift;
+ 	iwqp->max_recv_wr = (ukinfo->rq_depth - IRDMA_RQ_RSVD) >> ukinfo->rq_shift;
+@@ -944,7 +943,7 @@ static int irdma_create_qp(struct ib_qp *ibqp,
+ 	iwqp->host_ctx.size = IRDMA_QP_CTX_SIZE;
+ 
+ 	init_info.pd = &iwpd->sc_pd;
+-	init_info.qp_uk_init_info.qp_id = iwqp->ibqp.qp_num;
++	init_info.qp_uk_init_info.qp_id = qp_num;
+ 	if (!rdma_protocol_roce(&iwdev->ibdev, 1))
+ 		init_info.qp_uk_init_info.first_sq_wq = 1;
+ 	iwqp->ctx_info.qp_compl_ctx = (uintptr_t)qp;
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-mana_ib-fix-bug-in-creation-of-dma-regions.patch b/queue-6.8/rdma-mana_ib-fix-bug-in-creation-of-dma-regions.patch
new file mode 100644
index 00000000000..9d0a77401db
--- /dev/null
+++ b/queue-6.8/rdma-mana_ib-fix-bug-in-creation-of-dma-regions.patch
@@ -0,0 +1,36 @@
+From f70391ae23933e3502601ec2084dd814e75ff2fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 05:52:40 -0800
+Subject: RDMA/mana_ib: Fix bug in creation of dma regions
+
+From: Konstantin Taranov <kotaranov@microsoft.com>
+
+[ Upstream commit e02497fb654689049ba8b46f098f17d5f19e0b3c ]
+
+Use ib_umem_dma_offset() helper to calculate correct dma offset.
+
+Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter")
+Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com>
+Link: https://lore.kernel.org/r/1709560361-26393-2-git-send-email-kotaranov@linux.microsoft.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
+index faca092456fa3..7840c9e2631cc 100644
+--- a/drivers/infiniband/hw/mana/main.c
++++ b/drivers/infiniband/hw/mana/main.c
+@@ -358,7 +358,7 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 			     sizeof(struct gdma_create_dma_region_resp));
+ 
+ 	create_req->length = umem->length;
+-	create_req->offset_in_page = umem->address & (page_sz - 1);
++	create_req->offset_in_page = ib_umem_dma_offset(umem, page_sz);
+ 	create_req->gdma_page_type = order_base_2(page_sz) - PAGE_SHIFT;
+ 	create_req->page_count = num_pages_total;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-mana_ib-introduce-mana_ib_get_netdev-helper-fun.patch b/queue-6.8/rdma-mana_ib-introduce-mana_ib_get_netdev-helper-fun.patch
new file mode 100644
index 00000000000..22232ace407
--- /dev/null
+++ b/queue-6.8/rdma-mana_ib-introduce-mana_ib_get_netdev-helper-fun.patch
@@ -0,0 +1,273 @@
+From 64367bbce7718695192315320f86ece2c3c7160d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 15:23:00 -0800
+Subject: RDMA/mana_ib: Introduce mana_ib_get_netdev helper function
+
+From: Konstantin Taranov <kotaranov@microsoft.com>
+
+[ Upstream commit 3b73eb3a4acdf563de49d825968bb5f10300acd4 ]
+
+Use a helper function to access netdevs using a port number.
+This patch removes code repetitions as well as removes the need
+to explicitly use gdma_dev, which was error-prone.
+
+Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com>
+Link: https://lore.kernel.org/r/1705965781-3235-3-git-send-email-kotaranov@linux.microsoft.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Stable-dep-of: 2d5c00815778 ("RDMA/mana_ib: Use virtual address in dma regions for MRs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/main.c    | 10 ++----
+ drivers/infiniband/hw/mana/mana_ib.h | 11 ++++++
+ drivers/infiniband/hw/mana/qp.c      | 52 ++++++++++------------------
+ 3 files changed, 32 insertions(+), 41 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
+index 233ee76402641..dd570832d61ea 100644
+--- a/drivers/infiniband/hw/mana/main.c
++++ b/drivers/infiniband/hw/mana/main.c
+@@ -8,13 +8,10 @@
+ void mana_ib_uncfg_vport(struct mana_ib_dev *dev, struct mana_ib_pd *pd,
+ 			 u32 port)
+ {
+-	struct gdma_dev *gd = &dev->gdma_dev->gdma_context->mana;
+ 	struct mana_port_context *mpc;
+ 	struct net_device *ndev;
+-	struct mana_context *mc;
+ 
+-	mc = gd->driver_data;
+-	ndev = mc->ports[port];
++	ndev = mana_ib_get_netdev(&dev->ib_dev, port);
+ 	mpc = netdev_priv(ndev);
+ 
+ 	mutex_lock(&pd->vport_mutex);
+@@ -31,14 +28,11 @@ void mana_ib_uncfg_vport(struct mana_ib_dev *dev, struct mana_ib_pd *pd,
+ int mana_ib_cfg_vport(struct mana_ib_dev *dev, u32 port, struct mana_ib_pd *pd,
+ 		      u32 doorbell_id)
+ {
+-	struct gdma_dev *mdev = &dev->gdma_dev->gdma_context->mana;
+ 	struct mana_port_context *mpc;
+-	struct mana_context *mc;
+ 	struct net_device *ndev;
+ 	int err;
+ 
+-	mc = mdev->driver_data;
+-	ndev = mc->ports[port];
++	ndev = mana_ib_get_netdev(&dev->ib_dev, port);
+ 	mpc = netdev_priv(ndev);
+ 
+ 	mutex_lock(&pd->vport_mutex);
+diff --git a/drivers/infiniband/hw/mana/mana_ib.h b/drivers/infiniband/hw/mana/mana_ib.h
+index ebb6537620eea..d373639e25d4a 100644
+--- a/drivers/infiniband/hw/mana/mana_ib.h
++++ b/drivers/infiniband/hw/mana/mana_ib.h
+@@ -147,6 +147,17 @@ static inline struct gdma_context *mdev_to_gc(struct mana_ib_dev *mdev)
+ 	return mdev->gdma_dev->gdma_context;
+ }
+ 
++static inline struct net_device *mana_ib_get_netdev(struct ib_device *ibdev, u32 port)
++{
++	struct mana_ib_dev *mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
++	struct gdma_context *gc = mdev_to_gc(mdev);
++	struct mana_context *mc = gc->mana.driver_data;
++
++	if (port < 1 || port > mc->num_ports)
++		return NULL;
++	return mc->ports[port - 1];
++}
++
+ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 				 mana_handle_t *gdma_region);
+ 
+diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
+index 0c8d6ecfbb2a3..f5427599e0336 100644
+--- a/drivers/infiniband/hw/mana/qp.c
++++ b/drivers/infiniband/hw/mana/qp.c
+@@ -106,11 +106,9 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 	struct mana_port_context *mpc;
+ 	struct gdma_queue *gdma_cq;
+ 	unsigned int ind_tbl_size;
+-	struct mana_context *mc;
+ 	struct net_device *ndev;
+ 	struct mana_ib_cq *cq;
+ 	struct mana_ib_wq *wq;
+-	struct gdma_dev *gd;
+ 	struct mana_eq *eq;
+ 	struct ib_cq *ibcq;
+ 	struct ib_wq *ibwq;
+@@ -118,9 +116,6 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 	u32 port;
+ 	int ret;
+ 
+-	gd = &gc->mana;
+-	mc = gd->driver_data;
+-
+ 	if (!udata || udata->inlen < sizeof(ucmd))
+ 		return -EINVAL;
+ 
+@@ -163,12 +158,12 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 
+ 	/* IB ports start with 1, MANA start with 0 */
+ 	port = ucmd.port;
+-	if (port < 1 || port > mc->num_ports) {
++	ndev = mana_ib_get_netdev(pd->device, port);
++	if (!ndev) {
+ 		ibdev_dbg(&mdev->ib_dev, "Invalid port %u in creating qp\n",
+ 			  port);
+ 		return -EINVAL;
+ 	}
+-	ndev = mc->ports[port - 1];
+ 	mpc = netdev_priv(ndev);
+ 
+ 	ibdev_dbg(&mdev->ib_dev, "rx_hash_function %d port %d\n",
+@@ -206,7 +201,7 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 		cq_spec.gdma_region = cq->gdma_region;
+ 		cq_spec.queue_size = cq->cqe * COMP_ENTRY_SIZE;
+ 		cq_spec.modr_ctx_id = 0;
+-		eq = &mc->eqs[cq->comp_vector % gc->max_num_queues];
++		eq = &mpc->ac->eqs[cq->comp_vector % gc->max_num_queues];
+ 		cq_spec.attached_eq = eq->eq->id;
+ 
+ 		ret = mana_create_wq_obj(mpc, mpc->port_handle, GDMA_RQ,
+@@ -303,7 +298,6 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	struct mana_ib_ucontext *mana_ucontext =
+ 		rdma_udata_to_drv_context(udata, struct mana_ib_ucontext,
+ 					  ibucontext);
+-	struct gdma_dev *gd = &mdev->gdma_dev->gdma_context->mana;
+ 	struct gdma_context *gc = mdev_to_gc(mdev);
+ 	struct mana_ib_create_qp_resp resp = {};
+ 	struct mana_ib_create_qp ucmd = {};
+@@ -311,7 +305,6 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	struct mana_obj_spec wq_spec = {};
+ 	struct mana_obj_spec cq_spec = {};
+ 	struct mana_port_context *mpc;
+-	struct mana_context *mc;
+ 	struct net_device *ndev;
+ 	struct ib_umem *umem;
+ 	struct mana_eq *eq;
+@@ -319,8 +312,6 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	u32 port;
+ 	int err;
+ 
+-	mc = gd->driver_data;
+-
+ 	if (!mana_ucontext || udata->inlen < sizeof(ucmd))
+ 		return -EINVAL;
+ 
+@@ -331,11 +322,6 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 		return err;
+ 	}
+ 
+-	/* IB ports start with 1, MANA Ethernet ports start with 0 */
+-	port = ucmd.port;
+-	if (port < 1 || port > mc->num_ports)
+-		return -EINVAL;
+-
+ 	if (attr->cap.max_send_wr > mdev->adapter_caps.max_qp_wr) {
+ 		ibdev_dbg(&mdev->ib_dev,
+ 			  "Requested max_send_wr %d exceeding limit\n",
+@@ -350,11 +336,17 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 		return -EINVAL;
+ 	}
+ 
+-	ndev = mc->ports[port - 1];
++	port = ucmd.port;
++	ndev = mana_ib_get_netdev(ibpd->device, port);
++	if (!ndev) {
++		ibdev_dbg(&mdev->ib_dev, "Invalid port %u in creating qp\n",
++			  port);
++		return -EINVAL;
++	}
+ 	mpc = netdev_priv(ndev);
+ 	ibdev_dbg(&mdev->ib_dev, "port %u ndev %p mpc %p\n", port, ndev, mpc);
+ 
+-	err = mana_ib_cfg_vport(mdev, port - 1, pd, mana_ucontext->doorbell);
++	err = mana_ib_cfg_vport(mdev, port, pd, mana_ucontext->doorbell);
+ 	if (err)
+ 		return -ENODEV;
+ 
+@@ -394,8 +386,8 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	cq_spec.gdma_region = send_cq->gdma_region;
+ 	cq_spec.queue_size = send_cq->cqe * COMP_ENTRY_SIZE;
+ 	cq_spec.modr_ctx_id = 0;
+-	eq_vec = send_cq->comp_vector % gd->gdma_context->max_num_queues;
+-	eq = &mc->eqs[eq_vec];
++	eq_vec = send_cq->comp_vector % gc->max_num_queues;
++	eq = &mpc->ac->eqs[eq_vec];
+ 	cq_spec.attached_eq = eq->eq->id;
+ 
+ 	err = mana_create_wq_obj(mpc, mpc->port_handle, GDMA_SQ, &wq_spec,
+@@ -415,7 +407,7 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	send_cq->id = cq_spec.queue_index;
+ 
+ 	/* Create CQ table entry */
+-	WARN_ON(gd->gdma_context->cq_table[send_cq->id]);
++	WARN_ON(gc->cq_table[send_cq->id]);
+ 	gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
+ 	if (!gdma_cq) {
+ 		err = -ENOMEM;
+@@ -426,7 +418,7 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	gdma_cq->type = GDMA_CQ;
+ 	gdma_cq->cq.callback = mana_ib_cq_handler;
+ 	gdma_cq->id = send_cq->id;
+-	gd->gdma_context->cq_table[send_cq->id] = gdma_cq;
++	gc->cq_table[send_cq->id] = gdma_cq;
+ 
+ 	ibdev_dbg(&mdev->ib_dev,
+ 		  "ret %d qp->tx_object 0x%llx sq id %llu cq id %llu\n", err,
+@@ -460,7 +452,7 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	ib_umem_release(umem);
+ 
+ err_free_vport:
+-	mana_ib_uncfg_vport(mdev, pd, port - 1);
++	mana_ib_uncfg_vport(mdev, pd, port);
+ 
+ 	return err;
+ }
+@@ -498,16 +490,13 @@ static int mana_ib_destroy_qp_rss(struct mana_ib_qp *qp,
+ {
+ 	struct mana_ib_dev *mdev =
+ 		container_of(qp->ibqp.device, struct mana_ib_dev, ib_dev);
+-	struct gdma_dev *gd = &mdev->gdma_dev->gdma_context->mana;
+ 	struct mana_port_context *mpc;
+-	struct mana_context *mc;
+ 	struct net_device *ndev;
+ 	struct mana_ib_wq *wq;
+ 	struct ib_wq *ibwq;
+ 	int i;
+ 
+-	mc = gd->driver_data;
+-	ndev = mc->ports[qp->port - 1];
++	ndev = mana_ib_get_netdev(qp->ibqp.device, qp->port);
+ 	mpc = netdev_priv(ndev);
+ 
+ 	for (i = 0; i < (1 << ind_tbl->log_ind_tbl_size); i++) {
+@@ -525,15 +514,12 @@ static int mana_ib_destroy_qp_raw(struct mana_ib_qp *qp, struct ib_udata *udata)
+ {
+ 	struct mana_ib_dev *mdev =
+ 		container_of(qp->ibqp.device, struct mana_ib_dev, ib_dev);
+-	struct gdma_dev *gd = &mdev->gdma_dev->gdma_context->mana;
+ 	struct ib_pd *ibpd = qp->ibqp.pd;
+ 	struct mana_port_context *mpc;
+-	struct mana_context *mc;
+ 	struct net_device *ndev;
+ 	struct mana_ib_pd *pd;
+ 
+-	mc = gd->driver_data;
+-	ndev = mc->ports[qp->port - 1];
++	ndev = mana_ib_get_netdev(qp->ibqp.device, qp->port);
+ 	mpc = netdev_priv(ndev);
+ 	pd = container_of(ibpd, struct mana_ib_pd, ibpd);
+ 
+@@ -544,7 +530,7 @@ static int mana_ib_destroy_qp_raw(struct mana_ib_qp *qp, struct ib_udata *udata)
+ 		ib_umem_release(qp->sq_umem);
+ 	}
+ 
+-	mana_ib_uncfg_vport(mdev, pd, qp->port - 1);
++	mana_ib_uncfg_vport(mdev, pd, qp->port);
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-mana_ib-introduce-mana_ib_install_cq_cb-helper-.patch b/queue-6.8/rdma-mana_ib-introduce-mana_ib_install_cq_cb-helper-.patch
new file mode 100644
index 00000000000..9036aef6aeb
--- /dev/null
+++ b/queue-6.8/rdma-mana_ib-introduce-mana_ib_install_cq_cb-helper-.patch
@@ -0,0 +1,137 @@
+From 8de1ac778964fed5f16a86bbffdad2a1fb9a3751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 15:23:01 -0800
+Subject: RDMA/mana_ib: Introduce mana_ib_install_cq_cb helper function
+
+From: Konstantin Taranov <kotaranov@microsoft.com>
+
+[ Upstream commit 2a31c5a7e0d87959a03e846523013c75f4395a91 ]
+
+Use a helper function to install callbacks to CQs.
+This patch removes code repetition.
+
+Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com>
+Link: https://lore.kernel.org/r/1705965781-3235-4-git-send-email-kotaranov@linux.microsoft.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Stable-dep-of: 2d5c00815778 ("RDMA/mana_ib: Use virtual address in dma regions for MRs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/cq.c      | 21 ++++++++++++++++++++-
+ drivers/infiniband/hw/mana/mana_ib.h |  4 ++--
+ drivers/infiniband/hw/mana/qp.c      | 28 +++++-----------------------
+ 3 files changed, 27 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
+index 3369e7b665f9f..83d20c3f048df 100644
+--- a/drivers/infiniband/hw/mana/cq.c
++++ b/drivers/infiniband/hw/mana/cq.c
+@@ -100,10 +100,29 @@ int mana_ib_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
+ 	return 0;
+ }
+ 
+-void mana_ib_cq_handler(void *ctx, struct gdma_queue *gdma_cq)
++static void mana_ib_cq_handler(void *ctx, struct gdma_queue *gdma_cq)
+ {
+ 	struct mana_ib_cq *cq = ctx;
+ 
+ 	if (cq->ibcq.comp_handler)
+ 		cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
+ }
++
++int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq)
++{
++	struct gdma_context *gc = mdev_to_gc(mdev);
++	struct gdma_queue *gdma_cq;
++
++	/* Create CQ table entry */
++	WARN_ON(gc->cq_table[cq->id]);
++	gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
++	if (!gdma_cq)
++		return -ENOMEM;
++
++	gdma_cq->cq.context = cq;
++	gdma_cq->type = GDMA_CQ;
++	gdma_cq->cq.callback = mana_ib_cq_handler;
++	gdma_cq->id = cq->id;
++	gc->cq_table[cq->id] = gdma_cq;
++	return 0;
++}
+diff --git a/drivers/infiniband/hw/mana/mana_ib.h b/drivers/infiniband/hw/mana/mana_ib.h
+index d373639e25d4a..6a03ae645c012 100644
+--- a/drivers/infiniband/hw/mana/mana_ib.h
++++ b/drivers/infiniband/hw/mana/mana_ib.h
+@@ -158,6 +158,8 @@ static inline struct net_device *mana_ib_get_netdev(struct ib_device *ibdev, u32
+ 	return mc->ports[port - 1];
+ }
+ 
++int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq);
++
+ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 				 mana_handle_t *gdma_region);
+ 
+@@ -226,6 +228,4 @@ int mana_ib_query_gid(struct ib_device *ibdev, u32 port, int index,
+ void mana_ib_disassociate_ucontext(struct ib_ucontext *ibcontext);
+ 
+ int mana_ib_gd_query_adapter_caps(struct mana_ib_dev *mdev);
+-
+-void mana_ib_cq_handler(void *ctx, struct gdma_queue *gdma_cq);
+ #endif
+diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
+index f5427599e0336..5d4c05dcd0032 100644
+--- a/drivers/infiniband/hw/mana/qp.c
++++ b/drivers/infiniband/hw/mana/qp.c
+@@ -104,7 +104,6 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 	struct gdma_queue **gdma_cq_allocated;
+ 	mana_handle_t *mana_ind_table;
+ 	struct mana_port_context *mpc;
+-	struct gdma_queue *gdma_cq;
+ 	unsigned int ind_tbl_size;
+ 	struct net_device *ndev;
+ 	struct mana_ib_cq *cq;
+@@ -229,19 +228,11 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 		mana_ind_table[i] = wq->rx_object;
+ 
+ 		/* Create CQ table entry */
+-		WARN_ON(gc->cq_table[cq->id]);
+-		gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
+-		if (!gdma_cq) {
+-			ret = -ENOMEM;
++		ret = mana_ib_install_cq_cb(mdev, cq);
++		if (ret)
+ 			goto fail;
+-		}
+-		gdma_cq_allocated[i] = gdma_cq;
+ 
+-		gdma_cq->cq.context = cq;
+-		gdma_cq->type = GDMA_CQ;
+-		gdma_cq->cq.callback = mana_ib_cq_handler;
+-		gdma_cq->id = cq->id;
+-		gc->cq_table[cq->id] = gdma_cq;
++		gdma_cq_allocated[i] = gc->cq_table[cq->id];
+ 	}
+ 	resp.num_entries = i;
+ 
+@@ -407,18 +398,9 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	send_cq->id = cq_spec.queue_index;
+ 
+ 	/* Create CQ table entry */
+-	WARN_ON(gc->cq_table[send_cq->id]);
+-	gdma_cq = kzalloc(sizeof(*gdma_cq), GFP_KERNEL);
+-	if (!gdma_cq) {
+-		err = -ENOMEM;
++	err = mana_ib_install_cq_cb(mdev, send_cq);
++	if (err)
+ 		goto err_destroy_wq_obj;
+-	}
+-
+-	gdma_cq->cq.context = send_cq;
+-	gdma_cq->type = GDMA_CQ;
+-	gdma_cq->cq.callback = mana_ib_cq_handler;
+-	gdma_cq->id = send_cq->id;
+-	gc->cq_table[send_cq->id] = gdma_cq;
+ 
+ 	ibdev_dbg(&mdev->ib_dev,
+ 		  "ret %d qp->tx_object 0x%llx sq id %llu cq id %llu\n", err,
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-mana_ib-introduce-mdev_to_gc-helper-function.patch b/queue-6.8/rdma-mana_ib-introduce-mdev_to_gc-helper-function.patch
new file mode 100644
index 00000000000..ed487647fc5
--- /dev/null
+++ b/queue-6.8/rdma-mana_ib-introduce-mdev_to_gc-helper-function.patch
@@ -0,0 +1,294 @@
+From ee3a39a93db60c9dcfa8bd2ffa2d490cddabfd72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 15:22:59 -0800
+Subject: RDMA/mana_ib: Introduce mdev_to_gc helper function
+
+From: Konstantin Taranov <kotaranov@microsoft.com>
+
+[ Upstream commit 71c8cbfcdc8f1dc651b976d4c12dc9b9fce675c1 ]
+
+Use a helper function to access gdma_context from mana_ib_dev.
+This patch removes code repetitions as well as removes the need
+to explicitly use gdma_dev, which was error-prone.
+
+Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com>
+Link: https://lore.kernel.org/r/1705965781-3235-2-git-send-email-kotaranov@linux.microsoft.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Stable-dep-of: 2d5c00815778 ("RDMA/mana_ib: Use virtual address in dma regions for MRs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/cq.c      |  4 ++--
+ drivers/infiniband/hw/mana/main.c    | 30 +++++++++++-----------------
+ drivers/infiniband/hw/mana/mana_ib.h |  5 +++++
+ drivers/infiniband/hw/mana/mr.c      | 13 +++---------
+ drivers/infiniband/hw/mana/qp.c      | 12 +++++------
+ 5 files changed, 27 insertions(+), 37 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
+index 83ebd070535ab..3369e7b665f9f 100644
+--- a/drivers/infiniband/hw/mana/cq.c
++++ b/drivers/infiniband/hw/mana/cq.c
+@@ -16,7 +16,7 @@ int mana_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
+ 	int err;
+ 
+ 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+-	gc = mdev->gdma_dev->gdma_context;
++	gc = mdev_to_gc(mdev);
+ 
+ 	if (udata->inlen < sizeof(ucmd))
+ 		return -EINVAL;
+@@ -81,7 +81,7 @@ int mana_ib_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
+ 	int err;
+ 
+ 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+-	gc = mdev->gdma_dev->gdma_context;
++	gc = mdev_to_gc(mdev);
+ 
+ 	err = mana_ib_gd_destroy_dma_region(mdev, cq->gdma_region);
+ 	if (err) {
+diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
+index 7840c9e2631cc..233ee76402641 100644
+--- a/drivers/infiniband/hw/mana/main.c
++++ b/drivers/infiniband/hw/mana/main.c
+@@ -79,17 +79,17 @@ int mana_ib_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
+ 	struct gdma_create_pd_req req = {};
+ 	enum gdma_pd_flags flags = 0;
+ 	struct mana_ib_dev *dev;
+-	struct gdma_dev *mdev;
++	struct gdma_context *gc;
+ 	int err;
+ 
+ 	dev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+-	mdev = dev->gdma_dev;
++	gc = mdev_to_gc(dev);
+ 
+ 	mana_gd_init_req_hdr(&req.hdr, GDMA_CREATE_PD, sizeof(req),
+ 			     sizeof(resp));
+ 
+ 	req.flags = flags;
+-	err = mana_gd_send_request(mdev->gdma_context, sizeof(req), &req,
++	err = mana_gd_send_request(gc, sizeof(req), &req,
+ 				   sizeof(resp), &resp);
+ 
+ 	if (err || resp.hdr.status) {
+@@ -119,17 +119,17 @@ int mana_ib_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
+ 	struct gdma_destory_pd_resp resp = {};
+ 	struct gdma_destroy_pd_req req = {};
+ 	struct mana_ib_dev *dev;
+-	struct gdma_dev *mdev;
++	struct gdma_context *gc;
+ 	int err;
+ 
+ 	dev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+-	mdev = dev->gdma_dev;
++	gc = mdev_to_gc(dev);
+ 
+ 	mana_gd_init_req_hdr(&req.hdr, GDMA_DESTROY_PD, sizeof(req),
+ 			     sizeof(resp));
+ 
+ 	req.pd_handle = pd->pd_handle;
+-	err = mana_gd_send_request(mdev->gdma_context, sizeof(req), &req,
++	err = mana_gd_send_request(gc, sizeof(req), &req,
+ 				   sizeof(resp), &resp);
+ 
+ 	if (err || resp.hdr.status) {
+@@ -206,13 +206,11 @@ int mana_ib_alloc_ucontext(struct ib_ucontext *ibcontext,
+ 	struct ib_device *ibdev = ibcontext->device;
+ 	struct mana_ib_dev *mdev;
+ 	struct gdma_context *gc;
+-	struct gdma_dev *dev;
+ 	int doorbell_page;
+ 	int ret;
+ 
+ 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+-	dev = mdev->gdma_dev;
+-	gc = dev->gdma_context;
++	gc = mdev_to_gc(mdev);
+ 
+ 	/* Allocate a doorbell page index */
+ 	ret = mana_gd_allocate_doorbell_page(gc, &doorbell_page);
+@@ -238,7 +236,7 @@ void mana_ib_dealloc_ucontext(struct ib_ucontext *ibcontext)
+ 	int ret;
+ 
+ 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+-	gc = mdev->gdma_dev->gdma_context;
++	gc = mdev_to_gc(mdev);
+ 
+ 	ret = mana_gd_destroy_doorbell_page(gc, mana_ucontext->doorbell);
+ 	if (ret)
+@@ -322,15 +320,13 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 	size_t max_pgs_create_cmd;
+ 	struct gdma_context *gc;
+ 	size_t num_pages_total;
+-	struct gdma_dev *mdev;
+ 	unsigned long page_sz;
+ 	unsigned int tail = 0;
+ 	u64 *page_addr_list;
+ 	void *request_buf;
+ 	int err;
+ 
+-	mdev = dev->gdma_dev;
+-	gc = mdev->gdma_context;
++	gc = mdev_to_gc(dev);
+ 	hwc = gc->hwc.driver_data;
+ 
+ 	/* Hardware requires dma region to align to chosen page size */
+@@ -426,10 +422,8 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 
+ int mana_ib_gd_destroy_dma_region(struct mana_ib_dev *dev, u64 gdma_region)
+ {
+-	struct gdma_dev *mdev = dev->gdma_dev;
+-	struct gdma_context *gc;
++	struct gdma_context *gc = mdev_to_gc(dev);
+ 
+-	gc = mdev->gdma_context;
+ 	ibdev_dbg(&dev->ib_dev, "destroy dma region 0x%llx\n", gdma_region);
+ 
+ 	return mana_gd_destroy_dma_region(gc, gdma_region);
+@@ -447,7 +441,7 @@ int mana_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vma)
+ 	int ret;
+ 
+ 	mdev = container_of(ibdev, struct mana_ib_dev, ib_dev);
+-	gc = mdev->gdma_dev->gdma_context;
++	gc = mdev_to_gc(mdev);
+ 
+ 	if (vma->vm_pgoff != 0) {
+ 		ibdev_dbg(ibdev, "Unexpected vm_pgoff %lu\n", vma->vm_pgoff);
+@@ -531,7 +525,7 @@ int mana_ib_gd_query_adapter_caps(struct mana_ib_dev *dev)
+ 	req.hdr.resp.msg_version = GDMA_MESSAGE_V3;
+ 	req.hdr.dev_id = dev->gdma_dev->dev_id;
+ 
+-	err = mana_gd_send_request(dev->gdma_dev->gdma_context, sizeof(req),
++	err = mana_gd_send_request(mdev_to_gc(dev), sizeof(req),
+ 				   &req, sizeof(resp), &resp);
+ 
+ 	if (err) {
+diff --git a/drivers/infiniband/hw/mana/mana_ib.h b/drivers/infiniband/hw/mana/mana_ib.h
+index 6bdc0f5498d5b..ebb6537620eea 100644
+--- a/drivers/infiniband/hw/mana/mana_ib.h
++++ b/drivers/infiniband/hw/mana/mana_ib.h
+@@ -142,6 +142,11 @@ struct mana_ib_query_adapter_caps_resp {
+ 	u32 max_inline_data_size;
+ }; /* HW Data */
+ 
++static inline struct gdma_context *mdev_to_gc(struct mana_ib_dev *mdev)
++{
++	return mdev->gdma_dev->gdma_context;
++}
++
+ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 				 mana_handle_t *gdma_region);
+ 
+diff --git a/drivers/infiniband/hw/mana/mr.c b/drivers/infiniband/hw/mana/mr.c
+index 351207c60eb65..ee4d4f83467c8 100644
+--- a/drivers/infiniband/hw/mana/mr.c
++++ b/drivers/infiniband/hw/mana/mr.c
+@@ -30,12 +30,9 @@ static int mana_ib_gd_create_mr(struct mana_ib_dev *dev, struct mana_ib_mr *mr,
+ {
+ 	struct gdma_create_mr_response resp = {};
+ 	struct gdma_create_mr_request req = {};
+-	struct gdma_dev *mdev = dev->gdma_dev;
+-	struct gdma_context *gc;
++	struct gdma_context *gc = mdev_to_gc(dev);
+ 	int err;
+ 
+-	gc = mdev->gdma_context;
+-
+ 	mana_gd_init_req_hdr(&req.hdr, GDMA_CREATE_MR, sizeof(req),
+ 			     sizeof(resp));
+ 	req.pd_handle = mr_params->pd_handle;
+@@ -77,12 +74,9 @@ static int mana_ib_gd_destroy_mr(struct mana_ib_dev *dev, u64 mr_handle)
+ {
+ 	struct gdma_destroy_mr_response resp = {};
+ 	struct gdma_destroy_mr_request req = {};
+-	struct gdma_dev *mdev = dev->gdma_dev;
+-	struct gdma_context *gc;
++	struct gdma_context *gc = mdev_to_gc(dev);
+ 	int err;
+ 
+-	gc = mdev->gdma_context;
+-
+ 	mana_gd_init_req_hdr(&req.hdr, GDMA_DESTROY_MR, sizeof(req),
+ 			     sizeof(resp));
+ 
+@@ -164,8 +158,7 @@ struct ib_mr *mana_ib_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 length,
+ 	return &mr->ibmr;
+ 
+ err_dma_region:
+-	mana_gd_destroy_dma_region(dev->gdma_dev->gdma_context,
+-				   dma_region_handle);
++	mana_gd_destroy_dma_region(mdev_to_gc(dev), dma_region_handle);
+ 
+ err_umem:
+ 	ib_umem_release(mr->umem);
+diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
+index 21ac9fcadf3f2..0c8d6ecfbb2a3 100644
+--- a/drivers/infiniband/hw/mana/qp.c
++++ b/drivers/infiniband/hw/mana/qp.c
+@@ -17,12 +17,10 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
+ 	struct mana_cfg_rx_steer_resp resp = {};
+ 	mana_handle_t *req_indir_tab;
+ 	struct gdma_context *gc;
+-	struct gdma_dev *mdev;
+ 	u32 req_buf_size;
+ 	int i, err;
+ 
+-	gc = dev->gdma_dev->gdma_context;
+-	mdev = &gc->mana;
++	gc = mdev_to_gc(dev);
+ 
+ 	req_buf_size =
+ 		sizeof(*req) + sizeof(mana_handle_t) * MANA_INDIRECT_TABLE_SIZE;
+@@ -39,7 +37,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
+ 	req->rx_enable = 1;
+ 	req->update_default_rxobj = 1;
+ 	req->default_rxobj = default_rxobj;
+-	req->hdr.dev_id = mdev->dev_id;
++	req->hdr.dev_id = gc->mana.dev_id;
+ 
+ 	/* If there are more than 1 entries in indirection table, enable RSS */
+ 	if (log_ind_tbl_size)
+@@ -99,6 +97,7 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 	struct mana_ib_qp *qp = container_of(ibqp, struct mana_ib_qp, ibqp);
+ 	struct mana_ib_dev *mdev =
+ 		container_of(pd->device, struct mana_ib_dev, ib_dev);
++	struct gdma_context *gc = mdev_to_gc(mdev);
+ 	struct ib_rwq_ind_table *ind_tbl = attr->rwq_ind_tbl;
+ 	struct mana_ib_create_qp_rss_resp resp = {};
+ 	struct mana_ib_create_qp_rss ucmd = {};
+@@ -109,7 +108,6 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 	unsigned int ind_tbl_size;
+ 	struct mana_context *mc;
+ 	struct net_device *ndev;
+-	struct gdma_context *gc;
+ 	struct mana_ib_cq *cq;
+ 	struct mana_ib_wq *wq;
+ 	struct gdma_dev *gd;
+@@ -120,7 +118,6 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
+ 	u32 port;
+ 	int ret;
+ 
+-	gc = mdev->gdma_dev->gdma_context;
+ 	gd = &gc->mana;
+ 	mc = gd->driver_data;
+ 
+@@ -307,6 +304,7 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 		rdma_udata_to_drv_context(udata, struct mana_ib_ucontext,
+ 					  ibucontext);
+ 	struct gdma_dev *gd = &mdev->gdma_dev->gdma_context->mana;
++	struct gdma_context *gc = mdev_to_gc(mdev);
+ 	struct mana_ib_create_qp_resp resp = {};
+ 	struct mana_ib_create_qp ucmd = {};
+ 	struct gdma_queue *gdma_cq = NULL;
+@@ -450,7 +448,7 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 
+ err_release_gdma_cq:
+ 	kfree(gdma_cq);
+-	gd->gdma_context->cq_table[send_cq->id] = NULL;
++	gc->cq_table[send_cq->id] = NULL;
+ 
+ err_destroy_wq_obj:
+ 	mana_destroy_wq_obj(mpc, GDMA_SQ, qp->tx_object);
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-mana_ib-use-virtual-address-in-dma-regions-for-.patch b/queue-6.8/rdma-mana_ib-use-virtual-address-in-dma-regions-for-.patch
new file mode 100644
index 00000000000..d592b174883
--- /dev/null
+++ b/queue-6.8/rdma-mana_ib-use-virtual-address-in-dma-regions-for-.patch
@@ -0,0 +1,216 @@
+From 8aec5c312e8586cfeebce46636fdcde935d0f912 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2024 05:52:41 -0800
+Subject: RDMA/mana_ib: Use virtual address in dma regions for MRs
+
+From: Konstantin Taranov <kotaranov@microsoft.com>
+
+[ Upstream commit 2d5c00815778ec4f4e0a84e405e3e157b7815db1 ]
+
+Introduce mana_ib_create_dma_region() to create dma regions with iova
+for MRs. It allows creating MRs with any page offset. Previously,
+only page-aligned addresses worked.
+
+For dma regions that must have a zero dma offset (e.g., for queues),
+mana_ib_create_zero_offset_dma_region() is added.
+To get the zero offset, ib_umem_find_best_pgoff() is used with zero
+pgoff_bitmask.
+
+Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter")
+Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com>
+Link: https://lore.kernel.org/r/1709560361-26393-3-git-send-email-kotaranov@linux.microsoft.com
+Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mana/cq.c      |  4 +--
+ drivers/infiniband/hw/mana/main.c    | 40 +++++++++++++++++++++-------
+ drivers/infiniband/hw/mana/mana_ib.h |  7 +++--
+ drivers/infiniband/hw/mana/mr.c      |  4 +--
+ drivers/infiniband/hw/mana/qp.c      |  6 ++---
+ drivers/infiniband/hw/mana/wq.c      |  4 +--
+ 6 files changed, 45 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c
+index 83d20c3f048df..4a71e678d09c1 100644
+--- a/drivers/infiniband/hw/mana/cq.c
++++ b/drivers/infiniband/hw/mana/cq.c
+@@ -48,7 +48,7 @@ int mana_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
+ 		return err;
+ 	}
+ 
+-	err = mana_ib_gd_create_dma_region(mdev, cq->umem, &cq->gdma_region);
++	err = mana_ib_create_zero_offset_dma_region(mdev, cq->umem, &cq->gdma_region);
+ 	if (err) {
+ 		ibdev_dbg(ibdev,
+ 			  "Failed to create dma region for create cq, %d\n",
+@@ -57,7 +57,7 @@ int mana_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
+ 	}
+ 
+ 	ibdev_dbg(ibdev,
+-		  "mana_ib_gd_create_dma_region ret %d gdma_region 0x%llx\n",
++		  "create_dma_region ret %d gdma_region 0x%llx\n",
+ 		  err, cq->gdma_region);
+ 
+ 	/*
+diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
+index dd570832d61ea..71e33feee61bb 100644
+--- a/drivers/infiniband/hw/mana/main.c
++++ b/drivers/infiniband/hw/mana/main.c
+@@ -301,8 +301,8 @@ mana_ib_gd_add_dma_region(struct mana_ib_dev *dev, struct gdma_context *gc,
+ 	return 0;
+ }
+ 
+-int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+-				 mana_handle_t *gdma_region)
++static int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
++					mana_handle_t *gdma_region, unsigned long page_sz)
+ {
+ 	struct gdma_dma_region_add_pages_req *add_req = NULL;
+ 	size_t num_pages_processed = 0, num_pages_to_handle;
+@@ -314,7 +314,6 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 	size_t max_pgs_create_cmd;
+ 	struct gdma_context *gc;
+ 	size_t num_pages_total;
+-	unsigned long page_sz;
+ 	unsigned int tail = 0;
+ 	u64 *page_addr_list;
+ 	void *request_buf;
+@@ -323,12 +322,6 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 	gc = mdev_to_gc(dev);
+ 	hwc = gc->hwc.driver_data;
+ 
+-	/* Hardware requires dma region to align to chosen page size */
+-	page_sz = ib_umem_find_best_pgsz(umem, PAGE_SZ_BM, 0);
+-	if (!page_sz) {
+-		ibdev_dbg(&dev->ib_dev, "failed to find page size.\n");
+-		return -ENOMEM;
+-	}
+ 	num_pages_total = ib_umem_num_dma_blocks(umem, page_sz);
+ 
+ 	max_pgs_create_cmd =
+@@ -414,6 +407,35 @@ int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+ 	return err;
+ }
+ 
++int mana_ib_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
++			      mana_handle_t *gdma_region, u64 virt)
++{
++	unsigned long page_sz;
++
++	page_sz = ib_umem_find_best_pgsz(umem, PAGE_SZ_BM, virt);
++	if (!page_sz) {
++		ibdev_dbg(&dev->ib_dev, "Failed to find page size.\n");
++		return -EINVAL;
++	}
++
++	return mana_ib_gd_create_dma_region(dev, umem, gdma_region, page_sz);
++}
++
++int mana_ib_create_zero_offset_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
++					  mana_handle_t *gdma_region)
++{
++	unsigned long page_sz;
++
++	/* Hardware requires dma region to align to chosen page size */
++	page_sz = ib_umem_find_best_pgoff(umem, PAGE_SZ_BM, 0);
++	if (!page_sz) {
++		ibdev_dbg(&dev->ib_dev, "Failed to find page size.\n");
++		return -EINVAL;
++	}
++
++	return mana_ib_gd_create_dma_region(dev, umem, gdma_region, page_sz);
++}
++
+ int mana_ib_gd_destroy_dma_region(struct mana_ib_dev *dev, u64 gdma_region)
+ {
+ 	struct gdma_context *gc = mdev_to_gc(dev);
+diff --git a/drivers/infiniband/hw/mana/mana_ib.h b/drivers/infiniband/hw/mana/mana_ib.h
+index 6a03ae645c012..f83390eebb7d7 100644
+--- a/drivers/infiniband/hw/mana/mana_ib.h
++++ b/drivers/infiniband/hw/mana/mana_ib.h
+@@ -160,8 +160,11 @@ static inline struct net_device *mana_ib_get_netdev(struct ib_device *ibdev, u32
+ 
+ int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq);
+ 
+-int mana_ib_gd_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
+-				 mana_handle_t *gdma_region);
++int mana_ib_create_zero_offset_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
++					  mana_handle_t *gdma_region);
++
++int mana_ib_create_dma_region(struct mana_ib_dev *dev, struct ib_umem *umem,
++			      mana_handle_t *gdma_region, u64 virt);
+ 
+ int mana_ib_gd_destroy_dma_region(struct mana_ib_dev *dev,
+ 				  mana_handle_t gdma_region);
+diff --git a/drivers/infiniband/hw/mana/mr.c b/drivers/infiniband/hw/mana/mr.c
+index ee4d4f83467c8..b70b13484f097 100644
+--- a/drivers/infiniband/hw/mana/mr.c
++++ b/drivers/infiniband/hw/mana/mr.c
+@@ -127,7 +127,7 @@ struct ib_mr *mana_ib_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 length,
+ 		goto err_free;
+ 	}
+ 
+-	err = mana_ib_gd_create_dma_region(dev, mr->umem, &dma_region_handle);
++	err = mana_ib_create_dma_region(dev, mr->umem, &dma_region_handle, iova);
+ 	if (err) {
+ 		ibdev_dbg(ibdev, "Failed create dma region for user-mr, %d\n",
+ 			  err);
+@@ -135,7 +135,7 @@ struct ib_mr *mana_ib_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 length,
+ 	}
+ 
+ 	ibdev_dbg(ibdev,
+-		  "mana_ib_gd_create_dma_region ret %d gdma_region %llx\n", err,
++		  "create_dma_region ret %d gdma_region %llx\n", err,
+ 		  dma_region_handle);
+ 
+ 	mr_params.pd_handle = pd->pd_handle;
+diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
+index 5d4c05dcd0032..6e7627745c957 100644
+--- a/drivers/infiniband/hw/mana/qp.c
++++ b/drivers/infiniband/hw/mana/qp.c
+@@ -357,8 +357,8 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	}
+ 	qp->sq_umem = umem;
+ 
+-	err = mana_ib_gd_create_dma_region(mdev, qp->sq_umem,
+-					   &qp->sq_gdma_region);
++	err = mana_ib_create_zero_offset_dma_region(mdev, qp->sq_umem,
++						    &qp->sq_gdma_region);
+ 	if (err) {
+ 		ibdev_dbg(&mdev->ib_dev,
+ 			  "Failed to create dma region for create qp-raw, %d\n",
+@@ -367,7 +367,7 @@ static int mana_ib_create_qp_raw(struct ib_qp *ibqp, struct ib_pd *ibpd,
+ 	}
+ 
+ 	ibdev_dbg(&mdev->ib_dev,
+-		  "mana_ib_gd_create_dma_region ret %d gdma_region 0x%llx\n",
++		  "create_dma_region ret %d gdma_region 0x%llx\n",
+ 		  err, qp->sq_gdma_region);
+ 
+ 	/* Create a WQ on the same port handle used by the Ethernet */
+diff --git a/drivers/infiniband/hw/mana/wq.c b/drivers/infiniband/hw/mana/wq.c
+index 372d361510e0c..7c9c699625734 100644
+--- a/drivers/infiniband/hw/mana/wq.c
++++ b/drivers/infiniband/hw/mana/wq.c
+@@ -46,7 +46,7 @@ struct ib_wq *mana_ib_create_wq(struct ib_pd *pd,
+ 	wq->wq_buf_size = ucmd.wq_buf_size;
+ 	wq->rx_object = INVALID_MANA_HANDLE;
+ 
+-	err = mana_ib_gd_create_dma_region(mdev, wq->umem, &wq->gdma_region);
++	err = mana_ib_create_zero_offset_dma_region(mdev, wq->umem, &wq->gdma_region);
+ 	if (err) {
+ 		ibdev_dbg(&mdev->ib_dev,
+ 			  "Failed to create dma region for create wq, %d\n",
+@@ -55,7 +55,7 @@ struct ib_wq *mana_ib_create_wq(struct ib_pd *pd,
+ 	}
+ 
+ 	ibdev_dbg(&mdev->ib_dev,
+-		  "mana_ib_gd_create_dma_region ret %d gdma_region 0x%llx\n",
++		  "create_dma_region ret %d gdma_region 0x%llx\n",
+ 		  err, wq->gdma_region);
+ 
+ 	/* WQ ID is returned at wq_create time, doesn't know the value yet */
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch b/queue-6.8/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
new file mode 100644
index 00000000000..7be50648e7c
--- /dev/null
+++ b/queue-6.8/rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
@@ -0,0 +1,41 @@
+From 039e2c86f168c945ea1819ef6011d3193c70fb75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 11:32:04 +0000
+Subject: RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
+
+From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+
+[ Upstream commit 7a7b7f575a25aa68ee934ee8107294487efcb3fe ]
+
+strnlen() may return 0 (e.g. for "\0\n" string), it's better to
+check the result of strnlen() before using 'len - 1' expression
+for the 'buf' array index.
+
+Detected using the static analysis tool - Svace.
+
+Fixes: dc3b66a0ce70 ("RDMA/rtrs-clt: Add a minimum latency multipath policy")
+Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
+Link: https://lore.kernel.org/r/20240221113204.147478-1-aleksei.kodanev@bell-sw.com
+Acked-by: Jack Wang <jinpu.wang@ionos.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+index d3c436ead6946..4aa80c9388f05 100644
+--- a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+@@ -133,7 +133,7 @@ static ssize_t mpath_policy_store(struct device *dev,
+ 
+ 	/* distinguish "mi" and "min-latency" with length */
+ 	len = strnlen(buf, NAME_MAX);
+-	if (buf[len - 1] == '\n')
++	if (len && buf[len - 1] == '\n')
+ 		len--;
+ 
+ 	if (!strncasecmp(buf, "round-robin", 11) ||
+-- 
+2.43.0
+
diff --git a/queue-6.8/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch b/queue-6.8/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
new file mode 100644
index 00000000000..6868eb2cc37
--- /dev/null
+++ b/queue-6.8/rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
@@ -0,0 +1,61 @@
+From d44e9b82464b830240075ca0cbb0f055f563aaaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 02:15:49 -0700
+Subject: RDMA/srpt: Do not register event handler until srpt device is fully
+ setup
+
+From: William Kucharski <william.kucharski@oracle.com>
+
+[ Upstream commit c21a8870c98611e8f892511825c9607f1e2cd456 ]
+
+Upon rare occasions, KASAN reports a use-after-free Write
+in srpt_refresh_port().
+
+This seems to be because an event handler is registered before the
+srpt device is fully setup and a race condition upon error may leave a
+partially setup event handler in place.
+
+Instead, only register the event handler after srpt device initialization
+is complete.
+
+Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
+Signed-off-by: William Kucharski <william.kucharski@oracle.com>
+Link: https://lore.kernel.org/r/20240202091549.991784-2-william.kucharski@oracle.com
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 040234c01be4d..9632afbd727b6 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -3209,7 +3209,6 @@ static int srpt_add_one(struct ib_device *device)
+ 
+ 	INIT_IB_EVENT_HANDLER(&sdev->event_handler, sdev->device,
+ 			      srpt_event_handler);
+-	ib_register_event_handler(&sdev->event_handler);
+ 
+ 	for (i = 1; i <= sdev->device->phys_port_cnt; i++) {
+ 		sport = &sdev->port[i - 1];
+@@ -3232,6 +3231,7 @@ static int srpt_add_one(struct ib_device *device)
+ 		}
+ 	}
+ 
++	ib_register_event_handler(&sdev->event_handler);
+ 	spin_lock(&srpt_dev_lock);
+ 	list_add_tail(&sdev->list, &srpt_dev_list);
+ 	spin_unlock(&srpt_dev_lock);
+@@ -3242,7 +3242,6 @@ static int srpt_add_one(struct ib_device *device)
+ 
+ err_port:
+ 	srpt_unregister_mad_agent(sdev, i);
+-	ib_unregister_event_handler(&sdev->event_handler);
+ err_cm:
+ 	if (sdev->cm_id)
+ 		ib_destroy_cm_id(sdev->cm_id);
+-- 
+2.43.0
+
diff --git a/queue-6.8/regulator-userspace-consumer-add-module-device-table.patch b/queue-6.8/regulator-userspace-consumer-add-module-device-table.patch
new file mode 100644
index 00000000000..4dfb771fe26
--- /dev/null
+++ b/queue-6.8/regulator-userspace-consumer-add-module-device-table.patch
@@ -0,0 +1,39 @@
+From 7b775b2531353cbf6b6f6041ecf93745a326c57d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Feb 2024 16:05:53 +0000
+Subject: regulator: userspace-consumer: add module device table
+
+From: John Keeping <jkeeping@inmusicbrands.com>
+
+[ Upstream commit 531a0c0cdbff9cecf41073220a826f8b1132f9ab ]
+
+The userspace consumer can be built as a module but it cannot be
+automatically probed as there is no device table to match it up with
+device tree nodes.
+
+Add the missing macro so that the module can load automatically.
+
+Fixes: 5c51d4afcf3fd ("regulator: userspace-consumer: Handle regulator-output DT nodes")
+Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
+Link: https://msgid.link/r/20240226160554.1453283-1-jkeeping@inmusicbrands.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/userspace-consumer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/userspace-consumer.c b/drivers/regulator/userspace-consumer.c
+index 53d1b9d6f69c5..86a626a4f610a 100644
+--- a/drivers/regulator/userspace-consumer.c
++++ b/drivers/regulator/userspace-consumer.c
+@@ -208,6 +208,7 @@ static const struct of_device_id regulator_userspace_consumer_of_match[] = {
+ 	{ .compatible = "regulator-output", },
+ 	{},
+ };
++MODULE_DEVICE_TABLE(of, regulator_userspace_consumer_of_match);
+ 
+ static struct platform_driver regulator_userspace_consumer_driver = {
+ 	.probe		= regulator_userspace_consumer_probe,
+-- 
+2.43.0
+
diff --git a/queue-6.8/risc-v-kvm-forward-seed-csr-access-to-user-space.patch b/queue-6.8/risc-v-kvm-forward-seed-csr-access-to-user-space.patch
new file mode 100644
index 00000000000..38895096dc0
--- /dev/null
+++ b/queue-6.8/risc-v-kvm-forward-seed-csr-access-to-user-space.patch
@@ -0,0 +1,61 @@
+From 34fac0a9aa8c348513b05fc2552751eab68ce7be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 19:04:00 +0530
+Subject: RISC-V: KVM: Forward SEED CSR access to user space
+
+From: Anup Patel <apatel@ventanamicro.com>
+
+[ Upstream commit d808f0b1be4888a87524164bc7dad2242734de38 ]
+
+The SEED CSR access from VS/VU mode (guest) will always trap to
+HS-mode (KVM) when Zkr extension is available to the Guest/VM.
+
+Forward this CSR access to KVM user space so that it can be
+emulated based on the method chosen by VMM.
+
+Fixes: f370b4e668f0 ("RISC-V: KVM: Allow scalar crypto extensions for Guest/VM")
+Signed-off-by: Anup Patel <apatel@ventanamicro.com>
+Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
+Signed-off-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kvm/vcpu_insn.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/arch/riscv/kvm/vcpu_insn.c b/arch/riscv/kvm/vcpu_insn.c
+index 7a6abed41bc17..ee7215f4071f5 100644
+--- a/arch/riscv/kvm/vcpu_insn.c
++++ b/arch/riscv/kvm/vcpu_insn.c
+@@ -7,6 +7,8 @@
+ #include <linux/bitops.h>
+ #include <linux/kvm_host.h>
+ 
++#include <asm/cpufeature.h>
++
+ #define INSN_OPCODE_MASK	0x007c
+ #define INSN_OPCODE_SHIFT	2
+ #define INSN_OPCODE_SYSTEM	28
+@@ -213,9 +215,20 @@ struct csr_func {
+ 		    unsigned long wr_mask);
+ };
+ 
++static int seed_csr_rmw(struct kvm_vcpu *vcpu, unsigned int csr_num,
++			unsigned long *val, unsigned long new_val,
++			unsigned long wr_mask)
++{
++	if (!riscv_isa_extension_available(vcpu->arch.isa, ZKR))
++		return KVM_INSN_ILLEGAL_TRAP;
++
++	return KVM_INSN_EXIT_TO_USER_SPACE;
++}
++
+ static const struct csr_func csr_funcs[] = {
+ 	KVM_RISCV_VCPU_AIA_CSR_FUNCS
+ 	KVM_RISCV_VCPU_HPMCOUNTER_CSR_FUNCS
++	{ .base = CSR_SEED, .count = 1, .func = seed_csr_rmw },
+ };
+ 
+ /**
+-- 
+2.43.0
+
diff --git a/queue-6.8/riscv-dts-starfive-jh7100-fix-root-clock-names.patch b/queue-6.8/riscv-dts-starfive-jh7100-fix-root-clock-names.patch
new file mode 100644
index 00000000000..cd8e734efc7
--- /dev/null
+++ b/queue-6.8/riscv-dts-starfive-jh7100-fix-root-clock-names.patch
@@ -0,0 +1,61 @@
+From 7947df620450ac023c4c0eb25467dbde29a3c89a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 17:00:46 +0100
+Subject: riscv: dts: starfive: jh7100: fix root clock names
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 7921e231f85a349d5927b26c812c86e03f4cd37b ]
+
+JH7100 clock controller driver depends on certain root clock names.
+
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Closes: https://lore.kernel.org/all/CAMuHMdWw0dteXO2jw4cwGvzKcL6vmnb96C=qgPgUqNDMtF6X0Q@mail.gmail.com/
+Fixes: f03606470886 ("riscv: dts: starfive: replace underscores in node names")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/starfive/jh7100.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/riscv/boot/dts/starfive/jh7100.dtsi b/arch/riscv/boot/dts/starfive/jh7100.dtsi
+index 8bcf36d07f3f7..5d499d8aa8044 100644
+--- a/arch/riscv/boot/dts/starfive/jh7100.dtsi
++++ b/arch/riscv/boot/dts/starfive/jh7100.dtsi
+@@ -116,6 +116,7 @@ cpu-crit {
+ 	osc_sys: osc-sys {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
++		clock-output-names = "osc_sys";
+ 		/* This value must be overridden by the board */
+ 		clock-frequency = <0>;
+ 	};
+@@ -123,6 +124,7 @@ osc_sys: osc-sys {
+ 	osc_aud: osc-aud {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
++		clock-output-names = "osc_aud";
+ 		/* This value must be overridden by the board */
+ 		clock-frequency = <0>;
+ 	};
+@@ -130,6 +132,7 @@ osc_aud: osc-aud {
+ 	gmac_rmii_ref: gmac-rmii-ref {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
++		clock-output-names = "gmac_rmii_ref";
+ 		/* Should be overridden by the board when needed */
+ 		clock-frequency = <0>;
+ 	};
+@@ -137,6 +140,7 @@ gmac_rmii_ref: gmac-rmii-ref {
+ 	gmac_gr_mii_rxclk: gmac-gr-mii-rxclk {
+ 		compatible = "fixed-clock";
+ 		#clock-cells = <0>;
++		clock-output-names = "gmac_gr_mii_rxclk";
+ 		/* Should be overridden by the board when needed */
+ 		clock-frequency = <0>;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.8/rtc-test-fix-invalid-format-specifier.patch b/queue-6.8/rtc-test-fix-invalid-format-specifier.patch
new file mode 100644
index 00000000000..8b5f14fb6b4
--- /dev/null
+++ b/queue-6.8/rtc-test-fix-invalid-format-specifier.patch
@@ -0,0 +1,41 @@
+From 3546f7a59b1a92585b35516264993488a0de3a8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:18 +0800
+Subject: rtc: test: Fix invalid format specifier.
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 8a904a3caa88118744062e872ae90f37748a8fd8 ]
+
+'days' is a s64 (from div_s64), and so should use a %lld specifier.
+
+This was found by extending KUnit's assertion macros to use gcc's
+__printf attribute.
+
+Fixes: 1d1bb12a8b18 ("rtc: Improve performance of rtc_time64_to_tm(). Add tests.")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/lib_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/lib_test.c b/drivers/rtc/lib_test.c
+index d5caf36c56cdc..225c859d6da55 100644
+--- a/drivers/rtc/lib_test.c
++++ b/drivers/rtc/lib_test.c
+@@ -54,7 +54,7 @@ static void rtc_time64_to_tm_test_date_range(struct kunit *test)
+ 
+ 		days = div_s64(secs, 86400);
+ 
+-		#define FAIL_MSG "%d/%02d/%02d (%2d) : %ld", \
++		#define FAIL_MSG "%d/%02d/%02d (%2d) : %lld", \
+ 			year, month, mday, yday, days
+ 
+ 		KUNIT_ASSERT_EQ_MSG(test, year - 1900, result.tm_year, FAIL_MSG);
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-cache-prevent-rebuild-of-shared_cpu_list.patch b/queue-6.8/s390-cache-prevent-rebuild-of-shared_cpu_list.patch
new file mode 100644
index 00000000000..cb01ff08349
--- /dev/null
+++ b/queue-6.8/s390-cache-prevent-rebuild-of-shared_cpu_list.patch
@@ -0,0 +1,49 @@
+From 8ff0a8f78106e00f34da01088694b4d8e149fe82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Mar 2024 20:22:09 +0100
+Subject: s390/cache: prevent rebuild of shared_cpu_list
+
+From: Heiko Carstens <hca@linux.ibm.com>
+
+[ Upstream commit cb0cd4ee11142339f2d47eef6db274290b7a482d ]
+
+With commit 36bbc5b4ffab ("cacheinfo: Allow early detection and population
+of cache attributes") the shared cpu list for each cache level higher than
+L1 is rebuilt even if the list already has been set up.
+
+This is caused by the removal of the cpumask_empty() check within
+cache_shared_cpu_map_setup().
+
+However architectures can enforce that the shared cpu list is not rebuilt
+by simply setting cpu_map_populated of the per cpu cache info structure to
+true, which is also the fix for this problem.
+
+Before:
+$ cat /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_list
+0-7
+
+After:
+$ cat /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_list
+1
+
+Fixes: 36bbc5b4ffab ("cacheinfo: Allow early detection and population of cache attributes")
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/cache.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
+index 56254fa06f990..4f26690302209 100644
+--- a/arch/s390/kernel/cache.c
++++ b/arch/s390/kernel/cache.c
+@@ -166,5 +166,6 @@ int populate_cache_leaves(unsigned int cpu)
+ 			ci_leaf_init(this_leaf++, pvt, ctype, level, cpu);
+ 		}
+ 	}
++	this_cpu_ci->cpu_map_populated = true;
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-dasd-fix-double-module-refcount-decrement.patch b/queue-6.8/s390-dasd-fix-double-module-refcount-decrement.patch
new file mode 100644
index 00000000000..63a0fc53c2b
--- /dev/null
+++ b/queue-6.8/s390-dasd-fix-double-module-refcount-decrement.patch
@@ -0,0 +1,58 @@
+From 8f3407a59f8309236f8c9438724ca78038dd8f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Feb 2024 13:45:22 +0100
+Subject: s390/dasd: fix double module refcount decrement
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miroslav Franc <mfranc@suse.cz>
+
+[ Upstream commit c3116e62ddeff79cae342147753ce596f01fcf06 ]
+
+Once the discipline is associated with the device, deleting the device
+takes care of decrementing the module's refcount.  Doing it manually on
+this error path causes refcount to artificially decrease on each error
+while it should just stay the same.
+
+Fixes: c020d722b110 ("s390/dasd: fix panic during offline processing")
+Signed-off-by: Miroslav Franc <mfranc@suse.cz>
+Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240209124522.3697827-3-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 4a7d70426a6e6..30851faade97b 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -3524,12 +3524,11 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 		dasd_delete_device(device);
+ 		return -EINVAL;
+ 	}
++	device->base_discipline = base_discipline;
+ 	if (!try_module_get(discipline->owner)) {
+-		module_put(base_discipline->owner);
+ 		dasd_delete_device(device);
+ 		return -EINVAL;
+ 	}
+-	device->base_discipline = base_discipline;
+ 	device->discipline = discipline;
+ 
+ 	/* check_device will allocate block device if necessary */
+@@ -3537,8 +3536,6 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 	if (rc) {
+ 		dev_warn(dev, "Setting the DASD online with discipline %s failed with rc=%i\n",
+ 			 discipline->name, rc);
+-		module_put(discipline->owner);
+-		module_put(base_discipline->owner);
+ 		dasd_delete_device(device);
+ 		return rc;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-dasd-use-dev_-for-device-log-messages.patch b/queue-6.8/s390-dasd-use-dev_-for-device-log-messages.patch
new file mode 100644
index 00000000000..97e54d5d622
--- /dev/null
+++ b/queue-6.8/s390-dasd-use-dev_-for-device-log-messages.patch
@@ -0,0 +1,172 @@
+From bfced69e9d79c1b3dd7e58af7b09172cd3f9cc27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 17:42:48 +0100
+Subject: s390/dasd: Use dev_*() for device log messages
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Höppner <hoeppner@linux.ibm.com>
+
+[ Upstream commit 79ae56fc475869d636071f66d9e4ef2a3819eee6 ]
+
+All log messages in dasd.c use the printk variants of pr_*(). They all
+add the name of the affected device manually to the log message.
+This can be simplified by using the dev_*() variants of printk, which
+include the device information and make a separate call to dev_name()
+unnecessary.
+
+The KMSG_COMPONENT and the pr_fmt() definition can be dropped. Note that
+this removes the "dasd: " prefix from the one pr_info() call in
+dasd_init(). However, the log message already provides all relevant
+information.
+
+Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
+Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Link: https://lore.kernel.org/r/20240208164248.540985-10-sth@linux.ibm.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: c3116e62ddef ("s390/dasd: fix double module refcount decrement")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/block/dasd.c | 50 +++++++++++++++++++--------------------
+ 1 file changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 7327e81352e9c..4a7d70426a6e6 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -8,9 +8,6 @@
+  * Copyright IBM Corp. 1999, 2009
+  */
+ 
+-#define KMSG_COMPONENT "dasd"
+-#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
+-
+ #include <linux/kmod.h>
+ #include <linux/init.h>
+ #include <linux/interrupt.h>
+@@ -3402,8 +3399,7 @@ static void dasd_generic_auto_online(void *data, async_cookie_t cookie)
+ 
+ 	ret = ccw_device_set_online(cdev);
+ 	if (ret)
+-		pr_warn("%s: Setting the DASD online failed with rc=%d\n",
+-			dev_name(&cdev->dev), ret);
++		dev_warn(&cdev->dev, "Setting the DASD online failed with rc=%d\n", ret);
+ }
+ 
+ /*
+@@ -3490,8 +3486,11 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ {
+ 	struct dasd_discipline *discipline;
+ 	struct dasd_device *device;
++	struct device *dev;
+ 	int rc;
+ 
++	dev = &cdev->dev;
++
+ 	/* first online clears initial online feature flag */
+ 	dasd_set_feature(cdev, DASD_FEATURE_INITIAL_ONLINE, 0);
+ 	device = dasd_create_device(cdev);
+@@ -3504,11 +3503,10 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 			/* Try to load the required module. */
+ 			rc = request_module(DASD_DIAG_MOD);
+ 			if (rc) {
+-				pr_warn("%s Setting the DASD online failed "
+-					"because the required module %s "
+-					"could not be loaded (rc=%d)\n",
+-					dev_name(&cdev->dev), DASD_DIAG_MOD,
+-					rc);
++				dev_warn(dev, "Setting the DASD online failed "
++					 "because the required module %s "
++					 "could not be loaded (rc=%d)\n",
++					 DASD_DIAG_MOD, rc);
+ 				dasd_delete_device(device);
+ 				return -ENODEV;
+ 			}
+@@ -3516,8 +3514,7 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 		/* Module init could have failed, so check again here after
+ 		 * request_module(). */
+ 		if (!dasd_diag_discipline_pointer) {
+-			pr_warn("%s Setting the DASD online failed because of missing DIAG discipline\n",
+-				dev_name(&cdev->dev));
++			dev_warn(dev, "Setting the DASD online failed because of missing DIAG discipline\n");
+ 			dasd_delete_device(device);
+ 			return -ENODEV;
+ 		}
+@@ -3538,8 +3535,8 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 	/* check_device will allocate block device if necessary */
+ 	rc = discipline->check_device(device);
+ 	if (rc) {
+-		pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n",
+-			dev_name(&cdev->dev), discipline->name, rc);
++		dev_warn(dev, "Setting the DASD online with discipline %s failed with rc=%i\n",
++			 discipline->name, rc);
+ 		module_put(discipline->owner);
+ 		module_put(base_discipline->owner);
+ 		dasd_delete_device(device);
+@@ -3548,16 +3545,15 @@ int dasd_generic_set_online(struct ccw_device *cdev,
+ 
+ 	dasd_set_target_state(device, DASD_STATE_ONLINE);
+ 	if (device->state <= DASD_STATE_KNOWN) {
+-		pr_warn("%s Setting the DASD online failed because of a missing discipline\n",
+-			dev_name(&cdev->dev));
++		dev_warn(dev, "Setting the DASD online failed because of a missing discipline\n");
+ 		rc = -ENODEV;
+ 		dasd_set_target_state(device, DASD_STATE_NEW);
+ 		if (device->block)
+ 			dasd_free_block(device->block);
+ 		dasd_delete_device(device);
+-	} else
+-		pr_debug("dasd_generic device %s found\n",
+-				dev_name(&cdev->dev));
++	} else {
++		dev_dbg(dev, "dasd_generic device found\n");
++	}
+ 
+ 	wait_event(dasd_init_waitq, _wait_for_device(device));
+ 
+@@ -3568,10 +3564,13 @@ EXPORT_SYMBOL_GPL(dasd_generic_set_online);
+ 
+ int dasd_generic_set_offline(struct ccw_device *cdev)
+ {
++	int max_count, open_count, rc;
+ 	struct dasd_device *device;
+ 	struct dasd_block *block;
+-	int max_count, open_count, rc;
+ 	unsigned long flags;
++	struct device *dev;
++
++	dev = &cdev->dev;
+ 
+ 	rc = 0;
+ 	spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+@@ -3592,11 +3591,10 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
+ 		open_count = atomic_read(&device->block->open_count);
+ 		if (open_count > max_count) {
+ 			if (open_count > 0)
+-				pr_warn("%s: The DASD cannot be set offline with open count %i\n",
+-					dev_name(&cdev->dev), open_count);
++				dev_warn(dev, "The DASD cannot be set offline with open count %i\n",
++					 open_count);
+ 			else
+-				pr_warn("%s: The DASD cannot be set offline while it is in use\n",
+-					dev_name(&cdev->dev));
++				dev_warn(dev, "The DASD cannot be set offline while it is in use\n");
+ 			rc = -EBUSY;
+ 			goto out_err;
+ 		}
+@@ -3956,8 +3954,8 @@ static int dasd_handle_autoquiesce(struct dasd_device *device,
+ 	if (dasd_eer_enabled(device))
+ 		dasd_eer_write(device, NULL, DASD_EER_AUTOQUIESCE);
+ 
+-	pr_info("%s: The DASD has been put in the quiesce state\n",
+-		dev_name(&device->cdev->dev));
++	dev_info(&device->cdev->dev,
++		 "The DASD has been put in the quiesce state\n");
+ 	dasd_device_set_stop_bits(device, DASD_STOPPED_QUIESCE);
+ 
+ 	if (device->features & DASD_FEATURE_REQUEUEQUIESCE)
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-pai-fix-attr_event_free-upper-limit-for-pai-dev.patch b/queue-6.8/s390-pai-fix-attr_event_free-upper-limit-for-pai-dev.patch
new file mode 100644
index 00000000000..bc2f3780731
--- /dev/null
+++ b/queue-6.8/s390-pai-fix-attr_event_free-upper-limit-for-pai-dev.patch
@@ -0,0 +1,58 @@
+From e7e8424883be14373dd70d6fb64f9fe584702d93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Jan 2024 13:03:39 +0100
+Subject: s390/pai: fix attr_event_free upper limit for pai device drivers
+
+From: Thomas Richter <tmricht@linux.ibm.com>
+
+[ Upstream commit 225d09d6e5f3870560665a1829d2db79330b4c58 ]
+
+When the device drivers are initialized, a sysfs directory
+is created. This contains many attributes which are allocated with
+kzalloc(). Should it fail, the memory for the attributes already
+created is freed in attr_event_free(). Its second parameter is number
+of attribute elements to delete. This parameter is off by one.
+When i. e. the 10th attribute fails to get created, attributes
+numbered 0 to 9 should be deleted. Currently only attributes
+numbered 0 to 8 are deleted.
+
+Fixes: 39d62336f5c1 ("s390/pai: add support for cryptography counters")
+Reported-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/perf_pai_crypto.c | 2 +-
+ arch/s390/kernel/perf_pai_ext.c    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/perf_pai_crypto.c b/arch/s390/kernel/perf_pai_crypto.c
+index bf8a672b15a41..522a5ea0a9f49 100644
+--- a/arch/s390/kernel/perf_pai_crypto.c
++++ b/arch/s390/kernel/perf_pai_crypto.c
+@@ -721,7 +721,7 @@ static int __init attr_event_init(void)
+ 	for (i = 0; i < ARRAY_SIZE(paicrypt_ctrnames); i++) {
+ 		ret = attr_event_init_one(attrs, i);
+ 		if (ret) {
+-			attr_event_free(attrs, i - 1);
++			attr_event_free(attrs, i);
+ 			return ret;
+ 		}
+ 	}
+diff --git a/arch/s390/kernel/perf_pai_ext.c b/arch/s390/kernel/perf_pai_ext.c
+index af7f2b538c8fd..95d1a890640a3 100644
+--- a/arch/s390/kernel/perf_pai_ext.c
++++ b/arch/s390/kernel/perf_pai_ext.c
+@@ -611,7 +611,7 @@ static int __init attr_event_init(void)
+ 	for (i = 0; i < ARRAY_SIZE(paiext_ctrnames); i++) {
+ 		ret = attr_event_init_one(attrs, i);
+ 		if (ret) {
+-			attr_event_free(attrs, i - 1);
++			attr_event_free(attrs, i);
+ 			return ret;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/s390-vdso-drop-fpic-from-ldflags.patch b/queue-6.8/s390-vdso-drop-fpic-from-ldflags.patch
new file mode 100644
index 00000000000..1afcf3aca8d
--- /dev/null
+++ b/queue-6.8/s390-vdso-drop-fpic-from-ldflags.patch
@@ -0,0 +1,66 @@
+From c10b1465629f046f6259481da5b14ea205df4ad7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 20:14:28 -0700
+Subject: s390/vdso: drop '-fPIC' from LDFLAGS
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 0628c03934187be33942580e10bb9afcc61adeed ]
+
+'-fPIC' as an option to the linker does not do what it seems like it
+should. With ld.bfd, it is treated as '-f PIC', which does not make
+sense based on the meaning of '-f':
+
+  -f SHLIB, --auxiliary SHLIB Auxiliary filter for shared object symbol table
+
+When building with ld.lld (currently under review in a GitHub pull
+request), it just errors out because '-f' means nothing and neither does
+'-fPIC':
+
+  ld.lld: error: unknown argument '-fPIC'
+
+'-fPIC' was blindly copied from CFLAGS when the vDSO stopped being
+linked with '$(CC)', it should not be needed. Remove it to clear up the
+build failure with ld.lld.
+
+Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO")
+Link: https://github.com/llvm/llvm-project/pull/75643
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Fangrui Song <maskray@google.com>
+Link: https://lore.kernel.org/r/20240130-s390-vdso-drop-fpic-from-ldflags-v1-1-094ad104fc55@kernel.org
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vdso32/Makefile | 2 +-
+ arch/s390/kernel/vdso64/Makefile | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile
+index caec7db6f9668..b12a274cbb473 100644
+--- a/arch/s390/kernel/vdso32/Makefile
++++ b/arch/s390/kernel/vdso32/Makefile
+@@ -22,7 +22,7 @@ KBUILD_CFLAGS_32 := $(filter-out -m64,$(KBUILD_CFLAGS))
+ KBUILD_CFLAGS_32 := $(filter-out -mno-pic-data-is-text-relative,$(KBUILD_CFLAGS_32))
+ KBUILD_CFLAGS_32 += -m31 -fPIC -shared -fno-common -fno-builtin
+ 
+-LDFLAGS_vdso32.so.dbg += -fPIC -shared -soname=linux-vdso32.so.1 \
++LDFLAGS_vdso32.so.dbg += -shared -soname=linux-vdso32.so.1 \
+ 	--hash-style=both --build-id=sha1 -melf_s390 -T
+ 
+ $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
+diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile
+index e3c9085f8fa72..caa4ebff8a193 100644
+--- a/arch/s390/kernel/vdso64/Makefile
++++ b/arch/s390/kernel/vdso64/Makefile
+@@ -26,7 +26,7 @@ KBUILD_AFLAGS_64 += -m64
+ KBUILD_CFLAGS_64 := $(filter-out -m64,$(KBUILD_CFLAGS))
+ KBUILD_CFLAGS_64 := $(filter-out -mno-pic-data-is-text-relative,$(KBUILD_CFLAGS_64))
+ KBUILD_CFLAGS_64 += -m64 -fPIC -fno-common -fno-builtin
+-ldflags-y := -fPIC -shared -soname=linux-vdso64.so.1 \
++ldflags-y := -shared -soname=linux-vdso64.so.1 \
+ 	     --hash-style=both --build-id=sha1 -T
+ 
+ $(targets:%=$(obj)/%.dbg): KBUILD_CFLAGS = $(KBUILD_CFLAGS_64)
+-- 
+2.43.0
+
diff --git a/queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch b/queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch
new file mode 100644
index 00000000000..d0187c66cc5
--- /dev/null
+++ b/queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch
@@ -0,0 +1,87 @@
+From b11f2a145455af03d48e7674a14c995d67d655d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 14:17:06 +0100
+Subject: sched/fair: Take the scheduling domain into account in
+ select_idle_smt()
+
+From: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+
+[ Upstream commit 8aeaffef8c6eceab0e1498486fdd4f3dc3b7066c ]
+
+When picking a CPU on task wakeup, select_idle_smt() has to take
+into account the scheduling domain of @target. This is because the
+"isolcpus" kernel command line option can remove CPUs from the domain to
+isolate them from other SMT siblings.
+
+This fix checks if the candidate CPU is in the target scheduling domain.
+
+Commit:
+
+  df3cb4ea1fb6 ("sched/fair: Fix wrong cpu selecting from isolated domain")
+
+... originally introduced this fix by adding the check of the scheduling
+domain in the loop.
+
+However, commit:
+
+  3e6efe87cd5cc ("sched/fair: Remove redundant check in select_idle_smt()")
+
+... accidentally removed the check. Bring it back.
+
+Fixes: 3e6efe87cd5c ("sched/fair: Remove redundant check in select_idle_smt()")
+Signed-off-by: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
+Link: https://lore.kernel.org/r/20240110131707.437301-1-keisuke.nishimura@inria.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 533547e3c90a7..66457d4b8965c 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7311,13 +7311,19 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu
+ /*
+  * Scan the local SMT mask for idle CPUs.
+  */
+-static int select_idle_smt(struct task_struct *p, int target)
++static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target)
+ {
+ 	int cpu;
+ 
+ 	for_each_cpu_and(cpu, cpu_smt_mask(target), p->cpus_ptr) {
+ 		if (cpu == target)
+ 			continue;
++		/*
++		 * Check if the CPU is in the LLC scheduling domain of @target.
++		 * Due to isolcpus, there is no guarantee that all the siblings are in the domain.
++		 */
++		if (!cpumask_test_cpu(cpu, sched_domain_span(sd)))
++			continue;
+ 		if (available_idle_cpu(cpu) || sched_idle_cpu(cpu))
+ 			return cpu;
+ 	}
+@@ -7341,7 +7347,7 @@ static inline int select_idle_core(struct task_struct *p, int core, struct cpuma
+ 	return __select_idle_cpu(core, p);
+ }
+ 
+-static inline int select_idle_smt(struct task_struct *p, int target)
++static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target)
+ {
+ 	return -1;
+ }
+@@ -7591,7 +7597,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target)
+ 		has_idle_core = test_idle_cores(target);
+ 
+ 		if (!has_idle_core && cpus_share_cache(prev, target)) {
+-			i = select_idle_smt(p, prev);
++			i = select_idle_smt(p, sd, prev);
+ 			if ((unsigned int)i < nr_cpumask_bits)
+ 				return i;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch-30615 b/queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch-30615
new file mode 100644
index 00000000000..55cce861403
--- /dev/null
+++ b/queue-6.8/sched-fair-take-the-scheduling-domain-into-account-i.patch-30615
@@ -0,0 +1,55 @@
+From 5f73f09733cd06244fcebc93073324423f5e8844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 14:17:07 +0100
+Subject: sched/fair: Take the scheduling domain into account in
+ select_idle_core()
+
+From: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+
+[ Upstream commit 23d04d8c6b8ec339057264659b7834027f3e6a63 ]
+
+When picking a CPU on task wakeup, select_idle_core() has to take
+into account the scheduling domain where the function looks for the CPU.
+
+This is because the "isolcpus" kernel command line option can remove CPUs
+from the domain to isolate them from other SMT siblings.
+
+This change replaces the set of CPUs allowed to run the task from
+p->cpus_ptr by the intersection of p->cpus_ptr and sched_domain_span(sd)
+which is stored in the 'cpus' argument provided by select_idle_cpu().
+
+Fixes: 9fe1f127b913 ("sched/fair: Merge select_idle_core/cpu()")
+Signed-off-by: Keisuke Nishimura <keisuke.nishimura@inria.fr>
+Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20240110131707.437301-2-keisuke.nishimura@inria.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 66457d4b8965c..e2b4e0396af84 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7289,7 +7289,7 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu
+ 		if (!available_idle_cpu(cpu)) {
+ 			idle = false;
+ 			if (*idle_cpu == -1) {
+-				if (sched_idle_cpu(cpu) && cpumask_test_cpu(cpu, p->cpus_ptr)) {
++				if (sched_idle_cpu(cpu) && cpumask_test_cpu(cpu, cpus)) {
+ 					*idle_cpu = cpu;
+ 					break;
+ 				}
+@@ -7297,7 +7297,7 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu
+ 			}
+ 			break;
+ 		}
+-		if (*idle_cpu == -1 && cpumask_test_cpu(cpu, p->cpus_ptr))
++		if (*idle_cpu == -1 && cpumask_test_cpu(cpu, cpus))
+ 			*idle_cpu = cpu;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch b/queue-6.8/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
new file mode 100644
index 00000000000..b67e9b4faa9
--- /dev/null
+++ b/queue-6.8/scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
@@ -0,0 +1,152 @@
+From f09c9dfc5b9e040d64dd84c300ca58f28be46232 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Feb 2024 13:44:06 +0100
+Subject: scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b69600231f751304db914c63b937f7098ed2895c ]
+
+Some callback functions used here take a boolean argument, others take a
+status argument. This breaks KCFI type checking, so clang now warns about
+the function pointer cast:
+
+drivers/scsi/bfa/bfad_bsg.c:2138:29: error: cast from 'void (*)(void *, enum bfa_status)' to 'bfa_cb_cbfn_t' (aka 'void (*)(void *, enum bfa_boolean)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+
+Assuming the code is actually correct here and the callers always match the
+argument types of the callee, rework this to replace the explicit cast with
+a union of the two pointer types. This does not change the behavior of the
+code, so if something is actually broken here, a larger rework may be
+necessary.
+
+Fixes: 37ea0558b87a ("[SCSI] bfa: Added support to collect and reset fcport stats")
+Fixes: 3ec4f2c8bff2 ("[SCSI] bfa: Added support to configure QOS and collect stats.")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240222124433.2046570-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bfa/bfa.h      |  9 ++++++++-
+ drivers/scsi/bfa/bfa_core.c |  4 +---
+ drivers/scsi/bfa/bfa_ioc.h  |  8 ++++++--
+ drivers/scsi/bfa/bfad_bsg.c | 11 ++++-------
+ 4 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/bfa/bfa.h b/drivers/scsi/bfa/bfa.h
+index 7bd2ba1ad4d11..f30fe324e6ecc 100644
+--- a/drivers/scsi/bfa/bfa.h
++++ b/drivers/scsi/bfa/bfa.h
+@@ -20,7 +20,6 @@
+ struct bfa_s;
+ 
+ typedef void (*bfa_isr_func_t) (struct bfa_s *bfa, struct bfi_msg_s *m);
+-typedef void (*bfa_cb_cbfn_status_t) (void *cbarg, bfa_status_t status);
+ 
+ /*
+  * Interrupt message handlers
+@@ -437,4 +436,12 @@ struct bfa_cb_pending_q_s {
+ 	(__qe)->data = (__data);				\
+ } while (0)
+ 
++#define bfa_pending_q_init_status(__qe, __cbfn, __cbarg, __data) do {	\
++	bfa_q_qe_init(&((__qe)->hcb_qe.qe));			\
++	(__qe)->hcb_qe.cbfn_status = (__cbfn);			\
++	(__qe)->hcb_qe.cbarg = (__cbarg);			\
++	(__qe)->hcb_qe.pre_rmv = BFA_TRUE;			\
++	(__qe)->data = (__data);				\
++} while (0)
++
+ #endif /* __BFA_H__ */
+diff --git a/drivers/scsi/bfa/bfa_core.c b/drivers/scsi/bfa/bfa_core.c
+index 6846ca8f7313c..3438d0b8ba062 100644
+--- a/drivers/scsi/bfa/bfa_core.c
++++ b/drivers/scsi/bfa/bfa_core.c
+@@ -1907,15 +1907,13 @@ bfa_comp_process(struct bfa_s *bfa, struct list_head *comp_q)
+ 	struct list_head		*qe;
+ 	struct list_head		*qen;
+ 	struct bfa_cb_qe_s	*hcb_qe;
+-	bfa_cb_cbfn_status_t	cbfn;
+ 
+ 	list_for_each_safe(qe, qen, comp_q) {
+ 		hcb_qe = (struct bfa_cb_qe_s *) qe;
+ 		if (hcb_qe->pre_rmv) {
+ 			/* qe is invalid after return, dequeue before cbfn() */
+ 			list_del(qe);
+-			cbfn = (bfa_cb_cbfn_status_t)(hcb_qe->cbfn);
+-			cbfn(hcb_qe->cbarg, hcb_qe->fw_status);
++			hcb_qe->cbfn_status(hcb_qe->cbarg, hcb_qe->fw_status);
+ 		} else
+ 			hcb_qe->cbfn(hcb_qe->cbarg, BFA_TRUE);
+ 	}
+diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
+index 933a1c3890ff5..5e568d6d7b261 100644
+--- a/drivers/scsi/bfa/bfa_ioc.h
++++ b/drivers/scsi/bfa/bfa_ioc.h
+@@ -361,14 +361,18 @@ struct bfa_reqq_wait_s {
+ 	void	*cbarg;
+ };
+ 
+-typedef void	(*bfa_cb_cbfn_t) (void *cbarg, bfa_boolean_t complete);
++typedef void (*bfa_cb_cbfn_t) (void *cbarg, bfa_boolean_t complete);
++typedef void (*bfa_cb_cbfn_status_t) (void *cbarg, bfa_status_t status);
+ 
+ /*
+  * Generic BFA callback element.
+  */
+ struct bfa_cb_qe_s {
+ 	struct list_head	qe;
+-	bfa_cb_cbfn_t	cbfn;
++	union {
++		bfa_cb_cbfn_status_t	cbfn_status;
++		bfa_cb_cbfn_t		cbfn;
++	};
+ 	bfa_boolean_t	once;
+ 	bfa_boolean_t	pre_rmv;	/* set for stack based qe(s) */
+ 	bfa_status_t	fw_status;	/* to access fw status in comp proc */
+diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
+index d4ceca2d435ee..54bd11e6d5933 100644
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -2135,8 +2135,7 @@ bfad_iocmd_fcport_get_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_cb_pending_q_s cb_qe;
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
+-			   &fcomp, &iocmd->stats);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, &iocmd->stats);
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	iocmd->status = bfa_fcport_get_stats(&bfad->bfa, &cb_qe);
+ 	spin_unlock_irqrestore(&bfad->bfad_lock, flags);
+@@ -2159,7 +2158,7 @@ bfad_iocmd_fcport_reset_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_cb_pending_q_s cb_qe;
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp, &fcomp, NULL);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, NULL);
+ 
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	iocmd->status = bfa_fcport_clear_stats(&bfad->bfa, &cb_qe);
+@@ -2443,8 +2442,7 @@ bfad_iocmd_qos_get_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_fcport_s *fcport = BFA_FCPORT_MOD(&bfad->bfa);
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
+-			   &fcomp, &iocmd->stats);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, &iocmd->stats);
+ 
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	WARN_ON(!bfa_ioc_get_fcmode(&bfad->bfa.ioc));
+@@ -2474,8 +2472,7 @@ bfad_iocmd_qos_reset_stats(struct bfad_s *bfad, void *cmd)
+ 	struct bfa_fcport_s *fcport = BFA_FCPORT_MOD(&bfad->bfa);
+ 
+ 	init_completion(&fcomp.comp);
+-	bfa_pending_q_init(&cb_qe, (bfa_cb_cbfn_t)bfad_hcb_comp,
+-			   &fcomp, NULL);
++	bfa_pending_q_init_status(&cb_qe, bfad_hcb_comp, &fcomp, NULL);
+ 
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+ 	WARN_ON(!bfa_ioc_get_fcmode(&bfad->bfa.ioc));
+-- 
+2.43.0
+
diff --git a/queue-6.8/scsi-csiostor-avoid-function-pointer-casts.patch b/queue-6.8/scsi-csiostor-avoid-function-pointer-casts.patch
new file mode 100644
index 00000000000..2395999056a
--- /dev/null
+++ b/queue-6.8/scsi-csiostor-avoid-function-pointer-casts.patch
@@ -0,0 +1,135 @@
+From 35163db63acc4ecca554c34158f146f696ce5f8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:05:00 +0100
+Subject: scsi: csiostor: Avoid function pointer casts
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9f3dbcb5632d6876226031d552ef6163bb3ad215 ]
+
+csiostor uses function pointer casts to keep the csio_ln_ev state machine
+hidden, but this causes warnings about control flow integrity (KCFI)
+violations in clang-16 and higher:
+
+drivers/scsi/csiostor/csio_lnode.c:1098:33: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1098 |         return (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready));
+      |                                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/csiostor/csio_lnode.c:1369:29: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1369 |         if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_uninit)) {
+      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/csiostor/csio_lnode.c:1373:29: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1373 |         if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready)) {
+      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/csiostor/csio_lnode.c:1377:29: error: cast from 'void (*)(struct csio_lnode *, enum csio_ln_ev)' to 'csio_sm_state_t' (aka 'void (*)(void *, unsigned int)') converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+ 1377 |         if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_offline)) {
+      |                                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Move the enum into a shared header so the correct types can be used without
+the need for casts.
+
+Fixes: a3667aaed569 ("[SCSI] csiostor: Chelsio FCoE offload driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20240213100518.457623-1-arnd@kernel.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_defs.h  | 18 ++++++++++++++++--
+ drivers/scsi/csiostor/csio_lnode.c |  8 ++++----
+ drivers/scsi/csiostor/csio_lnode.h | 13 -------------
+ 3 files changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/scsi/csiostor/csio_defs.h b/drivers/scsi/csiostor/csio_defs.h
+index c38017b4af982..e50e93e7fe5a1 100644
+--- a/drivers/scsi/csiostor/csio_defs.h
++++ b/drivers/scsi/csiostor/csio_defs.h
+@@ -73,7 +73,21 @@ csio_list_deleted(struct list_head *list)
+ #define csio_list_prev(elem)	(((struct list_head *)(elem))->prev)
+ 
+ /* State machine */
+-typedef void (*csio_sm_state_t)(void *, uint32_t);
++struct csio_lnode;
++
++/* State machine evets */
++enum csio_ln_ev {
++	CSIO_LNE_NONE = (uint32_t)0,
++	CSIO_LNE_LINKUP,
++	CSIO_LNE_FAB_INIT_DONE,
++	CSIO_LNE_LINK_DOWN,
++	CSIO_LNE_DOWN_LINK,
++	CSIO_LNE_LOGO,
++	CSIO_LNE_CLOSE,
++	CSIO_LNE_MAX_EVENT,
++};
++
++typedef void (*csio_sm_state_t)(struct csio_lnode *ln, enum csio_ln_ev evt);
+ 
+ struct csio_sm {
+ 	struct list_head	sm_list;
+@@ -83,7 +97,7 @@ struct csio_sm {
+ static inline void
+ csio_set_state(void *smp, void *state)
+ {
+-	((struct csio_sm *)smp)->sm_state = (csio_sm_state_t)state;
++	((struct csio_sm *)smp)->sm_state = state;
+ }
+ 
+ static inline void
+diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
+index d5ac938970232..5b3ffefae476d 100644
+--- a/drivers/scsi/csiostor/csio_lnode.c
++++ b/drivers/scsi/csiostor/csio_lnode.c
+@@ -1095,7 +1095,7 @@ csio_handle_link_down(struct csio_hw *hw, uint8_t portid, uint32_t fcfi,
+ int
+ csio_is_lnode_ready(struct csio_lnode *ln)
+ {
+-	return (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready));
++	return (csio_get_state(ln) == csio_lns_ready);
+ }
+ 
+ /*****************************************************************************/
+@@ -1366,15 +1366,15 @@ csio_free_fcfinfo(struct kref *kref)
+ void
+ csio_lnode_state_to_str(struct csio_lnode *ln, int8_t *str)
+ {
+-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_uninit)) {
++	if (csio_get_state(ln) == csio_lns_uninit) {
+ 		strcpy(str, "UNINIT");
+ 		return;
+ 	}
+-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_ready)) {
++	if (csio_get_state(ln) == csio_lns_ready) {
+ 		strcpy(str, "READY");
+ 		return;
+ 	}
+-	if (csio_get_state(ln) == ((csio_sm_state_t)csio_lns_offline)) {
++	if (csio_get_state(ln) == csio_lns_offline) {
+ 		strcpy(str, "OFFLINE");
+ 		return;
+ 	}
+diff --git a/drivers/scsi/csiostor/csio_lnode.h b/drivers/scsi/csiostor/csio_lnode.h
+index 372a67d122d38..607698a0f0631 100644
+--- a/drivers/scsi/csiostor/csio_lnode.h
++++ b/drivers/scsi/csiostor/csio_lnode.h
+@@ -53,19 +53,6 @@
+ extern int csio_fcoe_rnodes;
+ extern int csio_fdmi_enable;
+ 
+-/* State machine evets */
+-enum csio_ln_ev {
+-	CSIO_LNE_NONE = (uint32_t)0,
+-	CSIO_LNE_LINKUP,
+-	CSIO_LNE_FAB_INIT_DONE,
+-	CSIO_LNE_LINK_DOWN,
+-	CSIO_LNE_DOWN_LINK,
+-	CSIO_LNE_LOGO,
+-	CSIO_LNE_CLOSE,
+-	CSIO_LNE_MAX_EVENT,
+-};
+-
+-
+ struct csio_fcf_info {
+ 	struct list_head	list;
+ 	uint8_t			priority;
+-- 
+2.43.0
+
diff --git a/queue-6.8/scsi-hisi_sas-fix-a-deadlock-issue-related-to-automa.patch b/queue-6.8/scsi-hisi_sas-fix-a-deadlock-issue-related-to-automa.patch
new file mode 100644
index 00000000000..462997b9a68
--- /dev/null
+++ b/queue-6.8/scsi-hisi_sas-fix-a-deadlock-issue-related-to-automa.patch
@@ -0,0 +1,125 @@
+From 96ffe43260efee00ac8f7fcccff49f981e692d80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 14:25:44 +0800
+Subject: scsi: hisi_sas: Fix a deadlock issue related to automatic dump
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 3c4f53b2c341ec6428b98cb51a89a09b025d0953 ]
+
+If we issue a disabling PHY command, the device attached with it will go
+offline, if a 2 bit ECC error occurs at the same time, a hung task may be
+found:
+
+[ 4613.652388] INFO: task kworker/u256:0:165233 blocked for more than 120 seconds.
+[ 4613.666297] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 4613.674809] task:kworker/u256:0  state:D stack:    0 pid:165233 ppid:     2 flags:0x00000208
+[ 4613.683959] Workqueue: 0000:74:02.0_disco_q sas_revalidate_domain [libsas]
+[ 4613.691518] Call trace:
+[ 4613.694678]  __switch_to+0xf8/0x17c
+[ 4613.698872]  __schedule+0x660/0xee0
+[ 4613.703063]  schedule+0xac/0x240
+[ 4613.706994]  schedule_timeout+0x500/0x610
+[ 4613.711705]  __down+0x128/0x36c
+[ 4613.715548]  down+0x240/0x2d0
+[ 4613.719221]  hisi_sas_internal_abort_timeout+0x1bc/0x260 [hisi_sas_main]
+[ 4613.726618]  sas_execute_internal_abort+0x144/0x310 [libsas]
+[ 4613.732976]  sas_execute_internal_abort_dev+0x44/0x60 [libsas]
+[ 4613.739504]  hisi_sas_internal_task_abort_dev.isra.0+0xbc/0x1b0 [hisi_sas_main]
+[ 4613.747499]  hisi_sas_dev_gone+0x174/0x250 [hisi_sas_main]
+[ 4613.753682]  sas_notify_lldd_dev_gone+0xec/0x2e0 [libsas]
+[ 4613.759781]  sas_unregister_common_dev+0x4c/0x7a0 [libsas]
+[ 4613.765962]  sas_destruct_devices+0xb8/0x120 [libsas]
+[ 4613.771709]  sas_do_revalidate_domain.constprop.0+0x1b8/0x31c [libsas]
+[ 4613.778930]  sas_revalidate_domain+0x60/0xa4 [libsas]
+[ 4613.784716]  process_one_work+0x248/0x950
+[ 4613.789424]  worker_thread+0x318/0x934
+[ 4613.793878]  kthread+0x190/0x200
+[ 4613.797810]  ret_from_fork+0x10/0x18
+[ 4613.802121] INFO: task kworker/u256:4:316722 blocked for more than 120 seconds.
+[ 4613.816026] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 4613.824538] task:kworker/u256:4  state:D stack:    0 pid:316722 ppid:     2 flags:0x00000208
+[ 4613.833670] Workqueue: 0000:74:02.0 hisi_sas_rst_work_handler [hisi_sas_main]
+[ 4613.841491] Call trace:
+[ 4613.844647]  __switch_to+0xf8/0x17c
+[ 4613.848852]  __schedule+0x660/0xee0
+[ 4613.853052]  schedule+0xac/0x240
+[ 4613.856984]  schedule_timeout+0x500/0x610
+[ 4613.861695]  __down+0x128/0x36c
+[ 4613.865542]  down+0x240/0x2d0
+[ 4613.869216]  hisi_sas_controller_prereset+0x58/0x1fc [hisi_sas_main]
+[ 4613.876324]  hisi_sas_rst_work_handler+0x40/0x8c [hisi_sas_main]
+[ 4613.883019]  process_one_work+0x248/0x950
+[ 4613.887732]  worker_thread+0x318/0x934
+[ 4613.892204]  kthread+0x190/0x200
+[ 4613.896118]  ret_from_fork+0x10/0x18
+[ 4613.900423] INFO: task kworker/u256:1:348985 blocked for more than 121 seconds.
+[ 4613.914341] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+[ 4613.922852] task:kworker/u256:1  state:D stack:    0 pid:348985 ppid:     2 flags:0x00000208
+[ 4613.931984] Workqueue: 0000:74:02.0_event_q sas_port_event_worker [libsas]
+[ 4613.939549] Call trace:
+[ 4613.942702]  __switch_to+0xf8/0x17c
+[ 4613.946892]  __schedule+0x660/0xee0
+[ 4613.951083]  schedule+0xac/0x240
+[ 4613.955015]  schedule_timeout+0x500/0x610
+[ 4613.959725]  wait_for_common+0x200/0x610
+[ 4613.964349]  wait_for_completion+0x3c/0x5c
+[ 4613.969146]  flush_workqueue+0x198/0x790
+[ 4613.973776]  sas_porte_broadcast_rcvd+0x1e8/0x320 [libsas]
+[ 4613.979960]  sas_port_event_worker+0x54/0xa0 [libsas]
+[ 4613.985708]  process_one_work+0x248/0x950
+[ 4613.990420]  worker_thread+0x318/0x934
+[ 4613.994868]  kthread+0x190/0x200
+[ 4613.998800]  ret_from_fork+0x10/0x18
+
+This is because when the device goes offline, we obtain the hisi_hba
+semaphore and send the ABORT_DEV command to the device. However, the
+internal abort timed out due to the 2 bit ECC error and triggers automatic
+dump. In addition, since the hisi_hba semaphore has been obtained, the dump
+cannot be executed and the controller cannot be reset.
+
+Therefore, the deadlocks occur on the following circular dependencies:
+hisi_sas_dev_gone() -> down() -> hisi_sas_internal_task_abort_dev() -> ...
+-> hisi_sas_internal_abort_timeout() -> down().
+
+The deadlock is triggered only when the timeout occurs during device goes
+offline. To fix this issue, use .rst_ha_timeout to distinguish the scenario
+where a device goes offline from other scenarios.
+
+Fixes: 2ff07b5c6fe9 ("scsi: hisi_sas: Directly call register snapshot instead of using workqueue")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1705904747-62186-2-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_main.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index bbb7b2d9ffcfb..1abc62b07d24c 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -1962,9 +1962,17 @@ static bool hisi_sas_internal_abort_timeout(struct sas_task *task,
+ 	struct hisi_sas_internal_abort_data *timeout = data;
+ 
+ 	if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct) {
+-		down(&hisi_hba->sem);
++		/*
++		 * If timeout occurs in device gone scenario, to avoid
++		 * circular dependency like:
++		 * hisi_sas_dev_gone() -> down() -> ... ->
++		 * hisi_sas_internal_abort_timeout() -> down().
++		 */
++		if (!timeout->rst_ha_timeout)
++			down(&hisi_hba->sem);
+ 		hisi_hba->hw->debugfs_snapshot_regs(hisi_hba);
+-		up(&hisi_hba->sem);
++		if (!timeout->rst_ha_timeout)
++			up(&hisi_hba->sem);
+ 	}
+ 
+ 	if (task->task_state_flags & SAS_TASK_STATE_DONE) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch b/queue-6.8/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
new file mode 100644
index 00000000000..d3a2bfe4291
--- /dev/null
+++ b/queue-6.8/selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
@@ -0,0 +1,98 @@
+From 7417d4a600e4f57edc4be3ee8ab1a80818db29a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 16:06:19 +0300
+Subject: selftest/bpf: Add map_in_maps with BPF_MAP_TYPE_PERF_EVENT_ARRAY
+ values
+
+From: Andrey Grafin <conquistador@yandex-team.ru>
+
+[ Upstream commit 40628f9fff73adecac77a9aa390f8016724cad99 ]
+
+Check that bpf_object__load() successfully creates map_in_maps
+with BPF_MAP_TYPE_PERF_EVENT_ARRAY values.
+These changes cover fix in the previous patch
+"libbpf: Apply map_set_def_max_entries() for inner_maps on creation".
+
+A command line output is:
+- w/o fix
+$ sudo ./test_maps
+libbpf: map 'mim_array_pe': failed to create inner map: -22
+libbpf: map 'mim_array_pe': failed to create: Invalid argument(-22)
+libbpf: failed to load object './test_map_in_map.bpf.o'
+Failed to load test prog
+
+- with fix
+$ sudo ./test_maps
+...
+test_maps: OK, 0 SKIPPED
+
+Fixes: 646f02ffdd49 ("libbpf: Add BTF-defined map-in-map support")
+Signed-off-by: Andrey Grafin <conquistador@yandex-team.ru>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/bpf/20240117130619.9403-2-conquistador@yandex-team.ru
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/progs/test_map_in_map.c     | 26 +++++++++++++++++++
+ tools/testing/selftests/bpf/test_maps.c       |  6 ++++-
+ 2 files changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/test_map_in_map.c b/tools/testing/selftests/bpf/progs/test_map_in_map.c
+index f416032ba858b..b295f9b721bf8 100644
+--- a/tools/testing/selftests/bpf/progs/test_map_in_map.c
++++ b/tools/testing/selftests/bpf/progs/test_map_in_map.c
+@@ -21,6 +21,32 @@ struct {
+ 	__type(value, __u32);
+ } mim_hash SEC(".maps");
+ 
++/* The following three maps are used to test
++ * perf_event_array map can be an inner
++ * map of hash/array_of_maps.
++ */
++struct perf_event_array {
++	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
++	__type(key, __u32);
++	__type(value, __u32);
++} inner_map0 SEC(".maps");
++
++struct {
++	__uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
++	__uint(max_entries, 1);
++	__type(key, __u32);
++	__array(values, struct perf_event_array);
++} mim_array_pe SEC(".maps") = {
++	.values = {&inner_map0}};
++
++struct {
++	__uint(type, BPF_MAP_TYPE_HASH_OF_MAPS);
++	__uint(max_entries, 1);
++	__type(key, __u32);
++	__array(values, struct perf_event_array);
++} mim_hash_pe SEC(".maps") = {
++	.values = {&inner_map0}};
++
+ SEC("xdp")
+ int xdp_mimtest0(struct xdp_md *ctx)
+ {
+diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
+index 767e0693df106..dfbab214f4d1c 100644
+--- a/tools/testing/selftests/bpf/test_maps.c
++++ b/tools/testing/selftests/bpf/test_maps.c
+@@ -1190,7 +1190,11 @@ static void test_map_in_map(void)
+ 		goto out_map_in_map;
+ 	}
+ 
+-	bpf_object__load(obj);
++	err = bpf_object__load(obj);
++	if (err) {
++		printf("Failed to load test prog\n");
++		goto out_map_in_map;
++	}
+ 
+ 	map = bpf_object__find_map_by_name(obj, "mim_array");
+ 	if (!map) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-bpf-disable-ipv6-for-lwt_redirect-test.patch b/queue-6.8/selftests-bpf-disable-ipv6-for-lwt_redirect-test.patch
new file mode 100644
index 00000000000..0337ce18abc
--- /dev/null
+++ b/queue-6.8/selftests-bpf-disable-ipv6-for-lwt_redirect-test.patch
@@ -0,0 +1,131 @@
+From 0d43080e034e8fa7085c389e61deef9b42ddf6ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 21:32:12 -0800
+Subject: selftests/bpf: Disable IPv6 for lwt_redirect test
+
+From: Manu Bretelle <chantr4@gmail.com>
+
+[ Upstream commit 2ef61296d2844c6a4211e07ab70ef2fb412b2c30 ]
+
+After a recent change in the vmtest runner, this test started failing
+sporadically.
+
+Investigation showed that this test was subject to race condition which
+got exacerbated after the vm runner change. The symptoms being that the
+logic that waited for an ICMPv4 packet is naive and will break if 5 or
+more non-ICMPv4 packets make it to tap0.
+When ICMPv6 is enabled, the kernel will generate traffic such as ICMPv6
+router solicitation...
+On a system with good performance, the expected ICMPv4 packet would very
+likely make it to the network interface promptly, but on a system with
+poor performance, those "guarantees" do not hold true anymore.
+
+Given that the test is IPv4 only, this change disable IPv6 in the test
+netns by setting `net.ipv6.conf.all.disable_ipv6` to 1.
+This essentially leaves "ping" as the sole generator of traffic in the
+network namespace.
+If this test was to be made IPv6 compatible, the logic in
+`wait_for_packet` would need to be modified.
+
+In more details...
+
+At a high level, the test does:
+- create a new namespace
+- in `setup_redirect_target` set up lo, tap0, and link_err interfaces as
+  well as add 2 routes that attaches ingress/egress sections of
+  `test_lwt_redirect.bpf.o` to the xmit path.
+- in `send_and_capture_test_packets` send an ICMP packet and read off
+  the tap interface (using `wait_for_packet`) to check that a ICMP packet
+  with the right size is read.
+
+`wait_for_packet` will try to read `max_retry` (5) times from the tap0
+fd looking for an ICMPv4 packet matching some criteria.
+
+The problem is that when we set up the `tap0` interface, because IPv6 is
+enabled by default, traffic such as Router solicitation is sent through
+tap0, as in:
+
+  # tcpdump -r /tmp/lwt_redirect.pc
+  reading from file /tmp/lwt_redirect.pcap, link-type EN10MB (Ethernet)
+  04:46:23.578352 IP6 :: > ff02::1:ffc0:4427: ICMP6, neighbor solicitation, who has fe80::fcba:dff:fec0:4427, length 32
+  04:46:23.659522 IP6 :: > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
+  04:46:24.389169 IP 10.0.0.1 > 20.0.0.9: ICMP echo request, id 122, seq 1, length 108
+  04:46:24.618599 IP6 fe80::fcba:dff:fec0:4427 > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
+  04:46:24.619985 IP6 fe80::fcba:dff:fec0:4427 > ff02::2: ICMP6, router solicitation, length 16
+  04:46:24.767326 IP6 fe80::fcba:dff:fec0:4427 > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28
+  04:46:28.936402 IP6 fe80::fcba:dff:fec0:4427 > ff02::2: ICMP6, router solicitation, length 16
+
+If `wait_for_packet` sees 5 non-ICMPv4 packets, it will return 0, which is what we see in:
+
+  2024-01-31T03:51:25.0336992Z test_lwt_redirect_run:PASS:netns_create 0 nsec
+  2024-01-31T03:51:25.0341309Z open_netns:PASS:malloc token 0 nsec
+  2024-01-31T03:51:25.0344844Z open_netns:PASS:open /proc/self/ns/net 0 nsec
+  2024-01-31T03:51:25.0350071Z open_netns:PASS:open netns fd 0 nsec
+  2024-01-31T03:51:25.0353516Z open_netns:PASS:setns 0 nsec
+  2024-01-31T03:51:25.0356560Z test_lwt_redirect_run:PASS:setns 0 nsec
+  2024-01-31T03:51:25.0360140Z open_tuntap:PASS:open(/dev/net/tun) 0 nsec
+  2024-01-31T03:51:25.0363822Z open_tuntap:PASS:ioctl(TUNSETIFF) 0 nsec
+  2024-01-31T03:51:25.0367402Z open_tuntap:PASS:fcntl(O_NONBLOCK) 0 nsec
+  2024-01-31T03:51:25.0371167Z setup_redirect_target:PASS:open_tuntap 0 nsec
+  2024-01-31T03:51:25.0375180Z setup_redirect_target:PASS:if_nametoindex 0 nsec
+  2024-01-31T03:51:25.0379929Z setup_redirect_target:PASS:ip link add link_err type dummy 0 nsec
+  2024-01-31T03:51:25.0384874Z setup_redirect_target:PASS:ip link set lo up 0 nsec
+  2024-01-31T03:51:25.0389678Z setup_redirect_target:PASS:ip addr add dev lo 10.0.0.1/32 0 nsec
+  2024-01-31T03:51:25.0394814Z setup_redirect_target:PASS:ip link set link_err up 0 nsec
+  2024-01-31T03:51:25.0399874Z setup_redirect_target:PASS:ip link set tap0 up 0 nsec
+  2024-01-31T03:51:25.0407731Z setup_redirect_target:PASS:ip route add 10.0.0.0/24 dev link_err encap bpf xmit obj test_lwt_redirect.bpf.o sec redir_ingress 0 nsec
+  2024-01-31T03:51:25.0419105Z setup_redirect_target:PASS:ip route add 20.0.0.0/24 dev link_err encap bpf xmit obj test_lwt_redirect.bpf.o sec redir_egress 0 nsec
+  2024-01-31T03:51:25.0427209Z test_lwt_redirect_normal:PASS:setup_redirect_target 0 nsec
+  2024-01-31T03:51:25.0431424Z ping_dev:PASS:if_nametoindex 0 nsec
+  2024-01-31T03:51:25.0437222Z send_and_capture_test_packets:FAIL:wait_for_epacket unexpected wait_for_epacket: actual 0 != expected 1
+  2024-01-31T03:51:25.0448298Z (/tmp/work/bpf/bpf/tools/testing/selftests/bpf/prog_tests/lwt_redirect.c:175: errno: Success) test_lwt_redirect_normal egress test fails
+  2024-01-31T03:51:25.0457124Z close_netns:PASS:setns 0 nsec
+
+When running in a VM which potential resource contrains, the odds that calling
+`ping` is not scheduled very soon after bringing `tap0` up increases,
+and with this the chances to get our ICMP packet pushed to position 6+
+in the network trace.
+
+To confirm this indeed solves the issue, I ran the test 100 times in a
+row with:
+
+  errors=0
+  successes=0
+  for i in `seq 1 100`
+  do
+    ./test_progs -t lwt_redirect/lwt_redirect_normal
+    if [ $? -eq 0 ]; then
+      successes=$((successes+1))
+    else
+      errors=$((errors+1))
+    fi
+  done
+  echo "successes: $successes/errors: $errors"
+
+While this test would at least fail a couple of time every 10 runs, here
+it ran 100 times with no error.
+
+Fixes: 43a7c3ef8a15 ("selftests/bpf: Add lwt_xmit tests for BPF_REDIRECT")
+Signed-off-by: Manu Bretelle <chantr4@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240131053212.2247527-1-chantr4@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/lwt_redirect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/lwt_redirect.c b/tools/testing/selftests/bpf/prog_tests/lwt_redirect.c
+index 59b38569f310b..2bc932a18c17e 100644
+--- a/tools/testing/selftests/bpf/prog_tests/lwt_redirect.c
++++ b/tools/testing/selftests/bpf/prog_tests/lwt_redirect.c
+@@ -203,6 +203,7 @@ static int setup_redirect_target(const char *target_dev, bool need_mac)
+ 	if (!ASSERT_GE(target_index, 0, "if_nametoindex"))
+ 		goto fail;
+ 
++	SYS(fail, "sysctl -w net.ipv6.conf.all.disable_ipv6=1");
+ 	SYS(fail, "ip link add link_err type dummy");
+ 	SYS(fail, "ip link set lo up");
+ 	SYS(fail, "ip addr add dev lo " LOCAL_SRC "/32");
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-bpf-fix-potential-premature-unload-in-bpf_.patch b/queue-6.8/selftests-bpf-fix-potential-premature-unload-in-bpf_.patch
new file mode 100644
index 00000000000..b2cb22b2796
--- /dev/null
+++ b/queue-6.8/selftests-bpf-fix-potential-premature-unload-in-bpf_.patch
@@ -0,0 +1,62 @@
+From e2d8b83f63ae1e454f4b06d6b41443d3ca24b1b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 09:57:37 +0100
+Subject: selftests/bpf: Fix potential premature unload in bpf_testmod
+
+From: Artem Savkov <asavkov@redhat.com>
+
+[ Upstream commit d177c1be06ce28aa8c8710ac55be1b5ad3f314c6 ]
+
+It is possible for bpf_kfunc_call_test_release() to be called from
+bpf_map_free_deferred() when bpf_testmod is already unloaded and
+perf_test_stuct.cnt which it tries to decrease is no longer in memory.
+This patch tries to fix the issue by waiting for all references to be
+dropped in bpf_testmod_exit().
+
+The issue can be triggered by running 'test_progs -t map_kptr' in 6.5,
+but is obscured in 6.6 by d119357d07435 ("rcu-tasks: Treat only
+synchronous grace periods urgently").
+
+Fixes: 65eb006d85a2 ("bpf: Move kernel test kfuncs to bpf_testmod")
+Signed-off-by: Artem Savkov <asavkov@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/bpf/82f55c0e-0ec8-4fe1-8d8c-b1de07558ad9@linux.dev
+Link: https://lore.kernel.org/bpf/20240110085737.8895-1-asavkov@redhat.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c b/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
+index 91907b321f913..e7c9e1c7fde04 100644
+--- a/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
++++ b/tools/testing/selftests/bpf/bpf_testmod/bpf_testmod.c
+@@ -2,6 +2,7 @@
+ /* Copyright (c) 2020 Facebook */
+ #include <linux/btf.h>
+ #include <linux/btf_ids.h>
++#include <linux/delay.h>
+ #include <linux/error-injection.h>
+ #include <linux/init.h>
+ #include <linux/module.h>
+@@ -544,6 +545,14 @@ static int bpf_testmod_init(void)
+ 
+ static void bpf_testmod_exit(void)
+ {
++        /* Need to wait for all references to be dropped because
++         * bpf_kfunc_call_test_release() which currently resides in kernel can
++         * be called after bpf_testmod is unloaded. Once release function is
++         * moved into the module this wait can be removed.
++         */
++	while (refcount_read(&prog_test_struct.cnt) > 1)
++		msleep(20);
++
+ 	return sysfs_remove_bin_file(kernel_kobj, &bin_attr_bpf_testmod_file);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-bpf-fix-the-flaky-tc_redirect_dtime-test.patch b/queue-6.8/selftests-bpf-fix-the-flaky-tc_redirect_dtime-test.patch
new file mode 100644
index 00000000000..163bc24d13d
--- /dev/null
+++ b/queue-6.8/selftests-bpf-fix-the-flaky-tc_redirect_dtime-test.patch
@@ -0,0 +1,96 @@
+From 5d3a25bab3d84a1b02935d375347aa6d9486fd61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 22:05:17 -0800
+Subject: selftests/bpf: Fix the flaky tc_redirect_dtime test
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit 177f1d083a19af58f4b1206d299ed73689249fd8 ]
+
+BPF CI has been reporting the tc_redirect_dtime test failing
+from time to time:
+
+test_inet_dtime:PASS:setns src 0 nsec
+(network_helpers.c:253: errno: No route to host) Failed to connect to server
+close_netns:PASS:setns 0 nsec
+test_inet_dtime:FAIL:connect_to_fd unexpected connect_to_fd: actual -1 < expected 0
+test_tcp_clear_dtime:PASS:tcp ip6 clear dtime ingress_fwdns_p100 0 nsec
+
+The connect_to_fd failure (EHOSTUNREACH) is from the
+test_tcp_clear_dtime() test and it is the very first IPv6 traffic
+after setting up all the links, addresses, and routes.
+
+The symptom is this first connect() is always slow. In my setup, it
+could take ~3s.
+
+After some tracing and tcpdump, the slowness is mostly spent in
+the neighbor solicitation in the "ns_fwd" namespace while
+the "ns_src" and "ns_dst" are fine.
+
+I forced the kernel to drop the neighbor solicitation messages.
+I can then reproduce EHOSTUNREACH. What actually happen could be:
+- the neighbor advertisement came back a little slow.
+- the "ns_fwd" namespace concluded a neighbor discovery failure
+  and triggered the ndisc_error_report() => ip6_link_failure() =>
+  icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0)
+- the client's connect() reports EHOSTUNREACH after receiving
+  the ICMPV6_DEST_UNREACH message.
+
+The neigh table of both "ns_src" and "ns_dst" namespace has already
+been manually populated but not the "ns_fwd" namespace. This patch
+fixes it by manually populating the neigh table also in the "ns_fwd"
+namespace.
+
+Although the namespace configuration part had been existed before
+the tc_redirect_dtime test, still Fixes-tagging the patch when
+the tc_redirect_dtime test was added since it is the only test
+hitting it so far.
+
+Fixes: c803475fd8dd ("bpf: selftests: test skb->tstamp in redirect_neigh")
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240120060518.3604920-1-martin.lau@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/tc_redirect.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
+index 518f143c5b0fe..610887157fd85 100644
+--- a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
++++ b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
+@@ -188,6 +188,7 @@ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ {
+ 	struct nstoken *nstoken = NULL;
+ 	char src_fwd_addr[IFADDR_STR_LEN+1] = {};
++	char src_addr[IFADDR_STR_LEN + 1] = {};
+ 	int err;
+ 
+ 	if (result->dev_mode == MODE_VETH) {
+@@ -208,6 +209,9 @@ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ 	if (get_ifaddr("src_fwd", src_fwd_addr))
+ 		goto fail;
+ 
++	if (get_ifaddr("src", src_addr))
++		goto fail;
++
+ 	result->ifindex_src = if_nametoindex("src");
+ 	if (!ASSERT_GT(result->ifindex_src, 0, "ifindex_src"))
+ 		goto fail;
+@@ -270,6 +274,13 @@ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ 	SYS(fail, "ip route add " IP4_DST "/32 dev dst_fwd scope global");
+ 	SYS(fail, "ip route add " IP6_DST "/128 dev dst_fwd scope global");
+ 
++	if (result->dev_mode == MODE_VETH) {
++		SYS(fail, "ip neigh add " IP4_SRC " dev src_fwd lladdr %s", src_addr);
++		SYS(fail, "ip neigh add " IP6_SRC " dev src_fwd lladdr %s", src_addr);
++		SYS(fail, "ip neigh add " IP4_DST " dev dst_fwd lladdr %s", MAC_DST);
++		SYS(fail, "ip neigh add " IP6_DST " dev dst_fwd lladdr %s", MAC_DST);
++	}
++
+ 	close_netns(nstoken);
+ 
+ 	/** setup in 'dst' namespace */
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-bpf-trace_helpers.c-do-not-use-poisoned-ty.patch b/queue-6.8/selftests-bpf-trace_helpers.c-do-not-use-poisoned-ty.patch
new file mode 100644
index 00000000000..ca0efffd431
--- /dev/null
+++ b/queue-6.8/selftests-bpf-trace_helpers.c-do-not-use-poisoned-ty.patch
@@ -0,0 +1,43 @@
+From 5677714e18dee0fa872523ad9e52a2a0a8ba0671 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 17:55:58 +0800
+Subject: selftests/bpf: trace_helpers.c: do not use poisoned type
+
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+
+[ Upstream commit a68b50f47bec8bd6a33b07b7e1562db2553981a7 ]
+
+After commit c698eaebdf47 ("selftests/bpf: trace_helpers.c: Optimize
+kallsyms cache") trace_helpers.c now includes libbpf_internal.h, and
+thus can no longer use the u32 type (among others) since they are poison
+in libbpf_internal.h. Replace u32 with __u32 to fix the following error
+when building trace_helpers.c on powerpc:
+
+  error: attempt to use poisoned "u32"
+
+Fixes: c698eaebdf47 ("selftests/bpf: trace_helpers.c: Optimize kallsyms cache")
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: https://lore.kernel.org/r/20240202095559.12900-1-shung-hsi.yu@suse.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/trace_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/trace_helpers.c b/tools/testing/selftests/bpf/trace_helpers.c
+index 4faa898ff7fc4..27fd7ed3e4b0c 100644
+--- a/tools/testing/selftests/bpf/trace_helpers.c
++++ b/tools/testing/selftests/bpf/trace_helpers.c
+@@ -271,7 +271,7 @@ ssize_t get_uprobe_offset(const void *addr)
+ 	 * addi  r2,r2,XXXX
+ 	 */
+ 	{
+-		const u32 *insn = (const u32 *)(uintptr_t)addr;
++		const __u32 *insn = (const __u32 *)(uintptr_t)addr;
+ 
+ 		if ((((*insn & OP_RT_RA_MASK) == ADDIS_R2_R12) ||
+ 		     ((*insn & OP_RT_RA_MASK) == LIS_R2)) &&
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-bpf-wait-for-the-netstamp_needed_key-stati.patch b/queue-6.8/selftests-bpf-wait-for-the-netstamp_needed_key-stati.patch
new file mode 100644
index 00000000000..dc8f59dbe1e
--- /dev/null
+++ b/queue-6.8/selftests-bpf-wait-for-the-netstamp_needed_key-stati.patch
@@ -0,0 +1,186 @@
+From 585c052566ba4b4ba9dfcf5efc8885388ddf5ac5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 22:05:18 -0800
+Subject: selftests/bpf: Wait for the netstamp_needed_key static key to be
+ turned on
+
+From: Martin KaFai Lau <martin.lau@kernel.org>
+
+[ Upstream commit ce6f6cffaeaa0a3bcdafcae7fe03c68c3afae631 ]
+
+After the previous patch that speeded up the test (by avoiding neigh
+discovery in IPv6), the BPF CI occasionally hits this error:
+
+rcv tstamp unexpected pkt rcv tstamp: actual 0 == expected 0
+
+The test complains about the cmsg returned from the recvmsg() does not
+have the rcv timestamp. Setting skb->tstamp or not is
+controlled by a kernel static key "netstamp_needed_key". The static
+key is enabled whenever this is at least one sk with the SOCK_TIMESTAMP
+set.
+
+The test_redirect_dtime does use setsockopt() to turn on
+the SOCK_TIMESTAMP for the reading sk. In the kernel
+net_enable_timestamp() has a delay to enable the "netstamp_needed_key"
+when CONFIG_JUMP_LABEL is set. This potential delay is the likely reason
+for packet missing rcv timestamp occasionally.
+
+This patch is to create udp sockets with SOCK_TIMESTAMP set.
+It sends and receives some packets until the received packet
+has a rcv timestamp. It currently retries at most 5 times with 1s
+in between. This should be enough to wait for the "netstamp_needed_key".
+It then holds on to the socket and only closes it at the end of the test.
+This guarantees that the test has the "netstamp_needed_key" key turned
+on from the beginning.
+
+To simplify the udp sockets setup, they are sending/receiving packets
+in the same netns (ns_dst is used) and communicate over the "lo" dev.
+Hence, the patch enables the "lo" dev in the ns_dst.
+
+Fixes: c803475fd8dd ("bpf: selftests: test skb->tstamp in redirect_neigh")
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20240120060518.3604920-2-martin.lau@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/prog_tests/tc_redirect.c    | 79 ++++++++++++++++++-
+ 1 file changed, 75 insertions(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
+index 610887157fd85..dbe06aeaa2b27 100644
+--- a/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
++++ b/tools/testing/selftests/bpf/prog_tests/tc_redirect.c
+@@ -291,6 +291,7 @@ static int netns_setup_links_and_routes(struct netns_setup_result *result)
+ 	SYS(fail, "ip addr add " IP4_DST "/32 dev dst");
+ 	SYS(fail, "ip addr add " IP6_DST "/128 dev dst nodad");
+ 	SYS(fail, "ip link set dev dst up");
++	SYS(fail, "ip link set dev lo up");
+ 
+ 	SYS(fail, "ip route add " IP4_SRC "/32 dev dst scope global");
+ 	SYS(fail, "ip route add " IP4_NET "/16 dev dst scope global");
+@@ -468,7 +469,7 @@ static int set_forwarding(bool enable)
+ 	return 0;
+ }
+ 
+-static void rcv_tstamp(int fd, const char *expected, size_t s)
++static int __rcv_tstamp(int fd, const char *expected, size_t s, __u64 *tstamp)
+ {
+ 	struct __kernel_timespec pkt_ts = {};
+ 	char ctl[CMSG_SPACE(sizeof(pkt_ts))];
+@@ -489,7 +490,7 @@ static void rcv_tstamp(int fd, const char *expected, size_t s)
+ 
+ 	ret = recvmsg(fd, &msg, 0);
+ 	if (!ASSERT_EQ(ret, s, "recvmsg"))
+-		return;
++		return -1;
+ 	ASSERT_STRNEQ(data, expected, s, "expected rcv data");
+ 
+ 	cmsg = CMSG_FIRSTHDR(&msg);
+@@ -498,6 +499,12 @@ static void rcv_tstamp(int fd, const char *expected, size_t s)
+ 		memcpy(&pkt_ts, CMSG_DATA(cmsg), sizeof(pkt_ts));
+ 
+ 	pkt_ns = pkt_ts.tv_sec * NSEC_PER_SEC + pkt_ts.tv_nsec;
++	if (tstamp) {
++		/* caller will check the tstamp itself */
++		*tstamp = pkt_ns;
++		return 0;
++	}
++
+ 	ASSERT_NEQ(pkt_ns, 0, "pkt rcv tstamp");
+ 
+ 	ret = clock_gettime(CLOCK_REALTIME, &now_ts);
+@@ -507,6 +514,60 @@ static void rcv_tstamp(int fd, const char *expected, size_t s)
+ 	if (ASSERT_GE(now_ns, pkt_ns, "check rcv tstamp"))
+ 		ASSERT_LT(now_ns - pkt_ns, 5 * NSEC_PER_SEC,
+ 			  "check rcv tstamp");
++	return 0;
++}
++
++static void rcv_tstamp(int fd, const char *expected, size_t s)
++{
++	__rcv_tstamp(fd, expected, s, NULL);
++}
++
++static int wait_netstamp_needed_key(void)
++{
++	int opt = 1, srv_fd = -1, cli_fd = -1, nretries = 0, err, n;
++	char buf[] = "testing testing";
++	struct nstoken *nstoken;
++	__u64 tstamp = 0;
++
++	nstoken = open_netns(NS_DST);
++	if (!nstoken)
++		return -1;
++
++	srv_fd = start_server(AF_INET6, SOCK_DGRAM, "::1", 0, 0);
++	if (!ASSERT_GE(srv_fd, 0, "start_server"))
++		goto done;
++
++	err = setsockopt(srv_fd, SOL_SOCKET, SO_TIMESTAMPNS_NEW,
++			 &opt, sizeof(opt));
++	if (!ASSERT_OK(err, "setsockopt(SO_TIMESTAMPNS_NEW)"))
++		goto done;
++
++	cli_fd = connect_to_fd(srv_fd, TIMEOUT_MILLIS);
++	if (!ASSERT_GE(cli_fd, 0, "connect_to_fd"))
++		goto done;
++
++again:
++	n = write(cli_fd, buf, sizeof(buf));
++	if (!ASSERT_EQ(n, sizeof(buf), "send to server"))
++		goto done;
++	err = __rcv_tstamp(srv_fd, buf, sizeof(buf), &tstamp);
++	if (!ASSERT_OK(err, "__rcv_tstamp"))
++		goto done;
++	if (!tstamp && nretries++ < 5) {
++		sleep(1);
++		printf("netstamp_needed_key retry#%d\n", nretries);
++		goto again;
++	}
++
++done:
++	if (!tstamp && srv_fd != -1) {
++		close(srv_fd);
++		srv_fd = -1;
++	}
++	if (cli_fd != -1)
++		close(cli_fd);
++	close_netns(nstoken);
++	return srv_fd;
+ }
+ 
+ static void snd_tstamp(int fd, char *b, size_t s)
+@@ -843,11 +904,20 @@ static void test_tc_redirect_dtime(struct netns_setup_result *setup_result)
+ {
+ 	struct test_tc_dtime *skel;
+ 	struct nstoken *nstoken;
+-	int err;
++	int hold_tstamp_fd, err;
++
++	/* Hold a sk with the SOCK_TIMESTAMP set to ensure there
++	 * is no delay in the kernel net_enable_timestamp().
++	 * This ensures the following tests must have
++	 * non zero rcv tstamp in the recvmsg().
++	 */
++	hold_tstamp_fd = wait_netstamp_needed_key();
++	if (!ASSERT_GE(hold_tstamp_fd, 0, "wait_netstamp_needed_key"))
++		return;
+ 
+ 	skel = test_tc_dtime__open();
+ 	if (!ASSERT_OK_PTR(skel, "test_tc_dtime__open"))
+-		return;
++		goto done;
+ 
+ 	skel->rodata->IFINDEX_SRC = setup_result->ifindex_src_fwd;
+ 	skel->rodata->IFINDEX_DST = setup_result->ifindex_dst_fwd;
+@@ -892,6 +962,7 @@ static void test_tc_redirect_dtime(struct netns_setup_result *setup_result)
+ 
+ done:
+ 	test_tc_dtime__destroy(skel);
++	close(hold_tstamp_fd);
+ }
+ 
+ static void test_tc_redirect_neigh_fib(struct netns_setup_result *setup_result)
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-forwarding-add-missing-config-entries.patch b/queue-6.8/selftests-forwarding-add-missing-config-entries.patch
new file mode 100644
index 00000000000..7cb9f5f2bdf
--- /dev/null
+++ b/queue-6.8/selftests-forwarding-add-missing-config-entries.patch
@@ -0,0 +1,83 @@
+From f63e0ef801611520cd468c722d99ad99d5520ae1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:36:16 +0100
+Subject: selftests: forwarding: Add missing config entries
+
+From: Petr Machata <petrm@nvidia.com>
+
+[ Upstream commit 4acf4e62cd572b0c806035046b3698f5585ab821 ]
+
+The config file contains a partial kernel configuration to be used by
+`virtme-configkernel --custom'. The presumption is that the config file
+contains all Kconfig options needed by the selftests from the directory.
+
+In net/forwarding/config, many are missing, which manifests as spurious
+failures when running the selftests, with messages about unknown device
+types, qdisc kinds or classifier actions. Add the missing configurations.
+
+Tested the resulting configuration using virtme-ng as follows:
+
+ # vng -b -f tools/testing/selftests/net/forwarding/config
+ # vng --user root
+ (within the VM:)
+ # make -C tools/testing/selftests TARGETS=net/forwarding run_tests
+
+Signed-off-by: Petr Machata <petrm@nvidia.com>
+Link: https://lore.kernel.org/r/025abded7ff9cea5874a7fe35dcd3fd41bf5e6ac.1706286755.git.petrm@nvidia.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Stable-dep-of: f0ddf15f0a74 ("selftests: forwarding: Add missing multicast routing config entries")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/config | 28 +++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/tools/testing/selftests/net/forwarding/config b/tools/testing/selftests/net/forwarding/config
+index 697994a9278bb..ba23435145827 100644
+--- a/tools/testing/selftests/net/forwarding/config
++++ b/tools/testing/selftests/net/forwarding/config
+@@ -6,14 +6,42 @@ CONFIG_IPV6_MULTIPLE_TABLES=y
+ CONFIG_NET_VRF=m
+ CONFIG_BPF_SYSCALL=y
+ CONFIG_CGROUP_BPF=y
++CONFIG_DUMMY=m
++CONFIG_IPV6=y
++CONFIG_IPV6_GRE=m
++CONFIG_MACVLAN=m
+ CONFIG_NET_ACT_CT=m
+ CONFIG_NET_ACT_MIRRED=m
+ CONFIG_NET_ACT_MPLS=m
++CONFIG_NET_ACT_PEDIT=m
++CONFIG_NET_ACT_POLICE=m
++CONFIG_NET_ACT_SAMPLE=m
++CONFIG_NET_ACT_SKBEDIT=m
++CONFIG_NET_ACT_TUNNEL_KEY=m
+ CONFIG_NET_ACT_VLAN=m
+ CONFIG_NET_CLS_FLOWER=m
+ CONFIG_NET_CLS_MATCHALL=m
++CONFIG_NET_CLS_BASIC=m
++CONFIG_NET_EMATCH=y
++CONFIG_NET_EMATCH_META=m
++CONFIG_NET_IPGRE=m
++CONFIG_NET_IPGRE_DEMUX=m
++CONFIG_NET_IPIP=m
++CONFIG_NET_SCH_ETS=m
+ CONFIG_NET_SCH_INGRESS=m
+ CONFIG_NET_ACT_GACT=m
++CONFIG_NET_SCH_PRIO=m
++CONFIG_NET_SCH_RED=m
++CONFIG_NET_SCH_TBF=m
++CONFIG_NET_TC_SKB_EXT=y
++CONFIG_NET_TEAM=y
++CONFIG_NET_TEAM_MODE_LOADBALANCE=y
++CONFIG_NETFILTER=y
++CONFIG_NF_CONNTRACK=m
++CONFIG_NF_FLOW_TABLE=m
++CONFIG_NF_TABLES=m
+ CONFIG_VETH=m
+ CONFIG_NAMESPACES=y
+ CONFIG_NET_NS=y
++CONFIG_VXLAN=m
++CONFIG_XFRM_USER=m
+-- 
+2.43.0
+
diff --git a/queue-6.8/selftests-forwarding-add-missing-multicast-routing-c.patch b/queue-6.8/selftests-forwarding-add-missing-multicast-routing-c.patch
new file mode 100644
index 00000000000..3969e604761
--- /dev/null
+++ b/queue-6.8/selftests-forwarding-add-missing-multicast-routing-c.patch
@@ -0,0 +1,46 @@
+From efed436ea0d23443e62a4a47c5619ec57b437046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 18:55:38 +0200
+Subject: selftests: forwarding: Add missing multicast routing config entries
+
+From: Ido Schimmel <idosch@nvidia.com>
+
+[ Upstream commit f0ddf15f0a74c27eb4b2271a90e69948acc3fa2c ]
+
+The two tests that make use of multicast routig (router.sh and
+router_multicast.sh) are currently failing in the netdev CI because the
+kernel is missing multicast routing support.
+
+Fix by adding the required config entries.
+
+Fixes: 6d4efada3b82 ("selftests: forwarding: Add multicast routing test")
+Signed-off-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://lore.kernel.org/r/20240208165538.1303021-1-idosch@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/config | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/testing/selftests/net/forwarding/config b/tools/testing/selftests/net/forwarding/config
+index ba23435145827..8d7a1a004b7c3 100644
+--- a/tools/testing/selftests/net/forwarding/config
++++ b/tools/testing/selftests/net/forwarding/config
+@@ -9,6 +9,13 @@ CONFIG_CGROUP_BPF=y
+ CONFIG_DUMMY=m
+ CONFIG_IPV6=y
+ CONFIG_IPV6_GRE=m
++CONFIG_IPV6_MROUTE=y
++CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
++CONFIG_IPV6_PIMSM_V2=y
++CONFIG_IP_MROUTE=y
++CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
++CONFIG_IP_PIMSM_V1=y
++CONFIG_IP_PIMSM_V2=y
+ CONFIG_MACVLAN=m
+ CONFIG_NET_ACT_CT=m
+ CONFIG_NET_ACT_MIRRED=m
+-- 
+2.43.0
+
diff --git a/queue-6.8/series b/queue-6.8/series
new file mode 100644
index 00000000000..6cae78ea23f
--- /dev/null
+++ b/queue-6.8/series
@@ -0,0 +1,619 @@
+do_sys_name_to_handle-use-kzalloc-to-fix-kernel-info.patch
+workqueue.c-increase-workqueue-name-length.patch
+workqueue-move-pwq-max_active-to-wq-max_active.patch
+workqueue-factor-out-pwq_is_empty.patch
+workqueue-replace-pwq_activate_inactive_work-with-__.patch
+workqueue-move-nr_active-handling-into-helpers.patch
+workqueue-make-wq_adjust_max_active-round-robin-pwqs.patch
+workqueue-rcu-protect-wq-dfl_pwq-and-implement-acces.patch
+workqueue-introduce-struct-wq_node_nr_active.patch
+workqueue-implement-system-wide-nr_active-enforcemen.patch
+workqueue-don-t-call-cpumask_test_cpu-with-1-cpu-in-.patch
+iomap-clear-the-per-folio-dirty-bits-on-all-writebac.patch
+fs-fix-rw_hint-validation.patch
+io_uring-remove-looping-around-handling-traditional-.patch
+io_uring-remove-unconditional-looping-in-local-task_.patch
+s390-dasd-use-dev_-for-device-log-messages.patch
+s390-dasd-fix-double-module-refcount-decrement.patch
+fs-hfsplus-use-better-opf-description.patch
+md-fix-kmemleak-of-rdev-serial.patch
+rcu-exp-fix-rcu-expedited-parallel-grace-period-kwor.patch
+rcu-exp-handle-rcu-expedited-grace-period-kworker-al.patch
+nbd-null-check-for-nla_nest_start.patch
+fs-select-rework-stack-allocation-hack-for-clang.patch
+block-fix-deadlock-between-bd_link_disk_holder-and-p.patch
+md-don-t-clear-md_closing-when-the-raid-is-about-to-.patch
+kunit-setup-dma-masks-on-the-kunit-device.patch
+ovl-always-reject-mounting-over-case-insensitive-dir.patch
+kunit-test-log-the-correct-filter-string-in-executor.patch
+lib-cmdline-fix-an-invalid-format-specifier-in-an-as.patch
+lib-memcpy_kunit-fix-an-invalid-format-specifier-in-.patch
+time-test-fix-incorrect-format-specifier.patch
+rtc-test-fix-invalid-format-specifier.patch
+net-test-fix-printf-format-specifier-in-skb_segment-.patch
+drm-xe-tests-fix-printf-format-specifiers-in-xe_migr.patch
+drm-tests-fix-invalid-printf-format-specifiers-in-ku.patch
+md-raid1-factor-out-helpers-to-add-rdev-to-conf.patch
+md-raid1-record-nonrot-rdevs-while-adding-removing-r.patch
+md-raid1-fix-choose-next-idle-in-read_balance.patch
+io_uring-net-unify-how-recvmsg-and-sendmsg-copy-in-t.patch
+io_uring-net-move-receive-multishot-out-of-the-gener.patch
+io_uring-net-fix-overflow-check-in-io_recvmsg_mshot_.patch
+nvme-host-fix-double-free-of-struct-nvme_id_ns-in-ns.patch
+aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
+x86-mm-ensure-input-to-pfn_to_kaddr-is-treated-as-a-.patch
+x86-resctrl-remove-hard-coded-memory-bandwidth-limit.patch
+x86-resctrl-read-supported-bandwidth-sources-from-cp.patch
+x86-resctrl-implement-new-mba_mbps-throttling-heuris.patch
+x86-sme-fix-memory-encryption-setting-if-enabled-by-.patch
+timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
+timekeeping-fix-cross-timestamp-interpolation-corner.patch
+timekeeping-fix-cross-timestamp-interpolation-for-no.patch
+x86-asm-remove-the-__iomem-annotation-of-movdir64b-s.patch
+sched-fair-take-the-scheduling-domain-into-account-i.patch
+sched-fair-take-the-scheduling-domain-into-account-i.patch-30615
+wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
+wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
+wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
+wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
+wifi-b43-disable-qos-for-bcm4331.patch
+wifi-wilc1000-fix-declarations-ordering.patch
+wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
+wifi-ath11k-add-support-to-select-6-ghz-regulatory-t.patch
+wifi-ath11k-store-cur_regulatory_info-for-each-radio.patch
+wifi-ath11k-fix-a-possible-dead-lock-caused-by-ab-ba.patch
+wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
+wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch
+wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
+wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
+arm-dts-renesas-r8a73a4-fix-external-clocks-and-cloc.patch
+arm64-dts-qcom-x1e80100-drop-qcom-drv-count.patch
+arm64-dts-qcom-sc8180x-hook-up-vdd_cx-as-gcc-parent-.patch
+arm64-dts-qcom-sc8180x-fix-up-big-cpu-idle-state-ent.patch
+arm64-dts-qcom-sc8180x-add-missing-cpu-off-state.patch
+arm64-dts-qcom-sc8180x-fix-edp-phy-power-domains.patch
+arm64-dts-qcom-sc8180x-don-t-hold-mdp-core-clock-at-.patch
+arm64-dts-qcom-sc8180x-require-low_svs-vote-for-mmcx.patch
+arm64-dts-qcom-sc8180x-add-missing-cpu-mdp_cfg-path.patch
+arm64-dts-qcom-sc8180x-shrink-aoss_qmp-register-spac.patch
+cpufreq-brcmstb-avs-cpufreq-add-check-for-cpufreq_cp.patch
+cpufreq-mediatek-hw-wait-for-cpu-supplies-before-pro.patch
+sock_diag-annotate-data-races-around-sock_diag_handl.patch
+inet_diag-annotate-data-races-around-inet_diag_table.patch
+bpftool-silence-build-warning-about-calloc.patch
+selftests-bpf-fix-potential-premature-unload-in-bpf_.patch
+libbpf-apply-map_set_def_max_entries-for-inner_maps-.patch
+selftest-bpf-add-map_in_maps-with-bpf_map_type_perf_.patch
+bpftool-fix-wrong-free-call-in-do_show_link.patch
+wifi-ath12k-fix-issues-in-channel-list-update.patch
+selftests-bpf-fix-the-flaky-tc_redirect_dtime-test.patch
+selftests-bpf-wait-for-the-netstamp_needed_key-stati.patch
+wifi-cfg80211-add-rnr-with-reporting-ap-information.patch
+wifi-mac80211-use-deflink-and-fix-typo-in-link-id-ch.patch
+wifi-iwlwifi-change-link-id-in-time-event-to-s8.patch
+af_unix-annotate-data-race-of-gc_in_progress-in-wait.patch
+arm64-dts-qcom-sm8450-add-missing-interconnects-to-s.patch
+soc-qcom-socinfo-rename-pm2250-to-pm4125.patch
+arm64-dts-qcom-sc7280-add-static-properties-to-crypt.patch
+arm64-dts-qcom-qcm6490-fairphone-fp5-add-missing-res.patch
+arm64-dts-qcom-sdm845-oneplus-common-improve-dai-nod.patch
+arm64-dts-qcom-rename-pm2250-to-pm4125.patch
+cpufreq-mediatek-hw-don-t-error-out-if-supply-is-not.patch
+libbpf-fix-faccessat-usage-on-android.patch
+libbpf-fix-__arg_ctx-type-enforcement-for-perf_event.patch
+pmdomain-qcom-rpmhpd-drop-sa8540p-gfx.lvl.patch
+arm64-dts-qcom-sa8540p-drop-gfx.lvl-as-power-domain-.patch
+arm64-dts-renesas-r8a779g0-restore-sort-order.patch
+arm64-dts-renesas-r8a779g0-add-missing-scif_clk2.patch
+selftests-bpf-disable-ipv6-for-lwt_redirect-test.patch
+arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch
+arm64-dts-imx8mm-kontron-disable-pullups-for-i2c-sig.patch-24016
+arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch
+arm64-dts-imx8mm-kontron-disable-pullups-for-onboard.patch-1464
+arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch
+arm64-dts-imx8mm-kontron-disable-pull-resistors-for-.patch-27736
+arm64-dts-imx8mm-kontron-fix-interrupt-for-rtc-on-os.patch
+arm64-dts-imx8qm-align-edma3-power-domains-resources.patch
+arm64-dts-imx8qm-correct-edma3-power-domains-and-int.patch
+libbpf-add-missing-libbpf_api-annotation-to-libbpf_s.patch
+libbpf-add-bpf_token_create-api.patch
+libbpf-add-btf__new_split-api-that-was-declared-but-.patch
+libbpf-add-missed-btf_ext__raw_data-api.patch
+wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
+wifi-ath11k-change-to-move-wmi_vdev_param_set_hemu_m.patch
+wifi-ath12k-fix-fetching-mcbc-flag-for-qcn9274.patch
+wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
+wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
+wifi-iwlwifi-acpi-fix-wpfc-reading.patch
+wifi-iwlwifi-mvm-initialize-rates-in-fw-earlier.patch
+wifi-iwlwifi-fix-ewrd-table-validity-check.patch
+wifi-iwlwifi-mvm-d3-fix-ipn-byte-order.patch
+wifi-iwlwifi-always-have-uats_enabled.patch
+wifi-iwlwifi-mvm-fix-the-tlc-command-after-add_sta.patch
+wifi-iwlwifi-read-bios-pnvm-only-for-non-intel-sku.patch
+gpio-vf610-allow-disabling-the-vf610-driver.patch
+selftests-bpf-trace_helpers.c-do-not-use-poisoned-ty.patch
+bpf-make-sure-scalar-args-don-t-accept-__arg_nonnull.patch
+bpf-don-t-emit-warnings-intended-for-global-subprogs.patch
+arm64-dts-imx8mm-venice-gw71xx-fix-usb-otg-vbus.patch
+pwm-atmel-hlcdc-fix-clock-imbalance-related-to-suspe.patch
+net-blackhole_dev-fix-build-warning-for-ethh-set-but.patch
+spi-consolidate-setting-message-spi.patch
+spi-move-split-xfers-for-cs_word-emulation.patch
+arm64-dts-ti-k3-am62p5-sk-enable-cpsw-mdio-node.patch
+arm64-dts-ti-k3-j721s2-fix-power-domain-for-vtm-node.patch
+arm64-dts-ti-k3-j784s4-fix-power-domain-for-vtm-node.patch
+wifi-ath11k-initialize-rx_mcs_80-and-rx_mcs_160-befo.patch
+wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
+arm64-dts-ti-k3-am69-sk-remove-assigned-clock-parent.patch
+libbpf-fix-return-value-for-perf_event-__arg_ctx-typ.patch
+arm64-dts-ti-k3-am62p-mcu-wakeup-disable-mcu-and-wak.patch
+arm64-dts-qcom-x1e80100-qcp-fix-supplies-for-ldos-3e.patch
+libbpf-use-opts_set-macro-in-bpf_xdp_query.patch
+wifi-wfx-fix-memory-leak-when-starting-ap.patch
+arm64-dts-qcom-msm8998-declare-vls-clamp-register-fo.patch
+arm64-dts-qcom-qcm2290-declare-vls-clamp-register-fo.patch
+arm64-dts-qcom-sm6115-declare-vls-clamp-register-for.patch
+arm64-dts-qcom-msm8996-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-msm8998-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sdm845-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm6115-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm6125-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm6350-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm8150-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm8250-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sc8280xp-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm8350-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm8550-fix-ufs-phy-clocks.patch
+arm64-dts-qcom-sm8650-fix-ufs-phy-clocks.patch
+wifi-ath12k-fix-incorrect-logic-of-calculating-vdev_.patch
+printk-nbcon-relocate-32bit-seq-macros.patch
+printk-ringbuffer-do-not-skip-non-finalized-records-.patch
+printk-wait-for-all-reserved-records-with-pr_flush.patch
+printk-add-this_cpu_in_panic.patch
+printk-ringbuffer-cleanup-reader-terminology.patch
+printk-ringbuffer-skip-non-finalized-records-in-pani.patch
+printk-disable-passing-console-lock-owner-completely.patch
+pwm-sti-fix-capture-for-st-pwm-num-chan-st-capture-n.patch
+tools-resolve_btfids-refactor-set-sorting-with-types.patch
+tools-resolve_btfids-fix-cross-compilation-to-non-ho.patch
+wifi-iwlwifi-support-eht-for-wh.patch
+wifi-iwlwifi-properly-check-if-link-is-active.patch
+wifi-iwlwifi-mvm-fix-erroneous-queue-index-mask.patch
+wifi-iwlwifi-mvm-don-t-set-the-mfp-flag-for-the-gtk.patch
+wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
+s390-pai-fix-attr_event_free-upper-limit-for-pai-dev.patch
+s390-vdso-drop-fpic-from-ldflags.patch
+arm64-dts-qcom-qcm6490-idp-correct-the-voltage-setti.patch
+arm64-dts-qcom-qcs6490-rb3gen2-correct-the-voltage-s.patch
+selftests-forwarding-add-missing-config-entries.patch
+selftests-forwarding-add-missing-multicast-routing-c.patch
+arm64-dts-qcom-sm6115-drop-pipe-clock-selection.patch
+ipv6-mcast-remove-one-synchronize_net-barrier-in-ipv.patch
+arm64-dts-mt8183-move-crosec-base-detection-node-to-.patch
+arm64-dts-mediatek-mt7986-fix-reference-to-pwm-in-fa.patch
+arm64-dts-mediatek-mt7986-drop-crypto-s-unneeded-inv.patch
+arm64-dts-mediatek-mt7986-fix-spi-bus-width-properti.patch
+arm64-dts-mediatek-mt7986-fix-spi-nodename.patch
+arm64-dts-mediatek-mt7986-drop-clock-cells-from-pwm.patch
+arm64-dts-mediatek-mt7986-add-reset-cells-to-infracf.patch
+arm64-dts-mediatek-mt8192-asurada-remove-crosec-base.patch
+arm64-dts-mediatek-mt8192-fix-vencoder-clock-name.patch
+arm64-dts-mediatek-mt8186-fix-venc-power-domain-cloc.patch
+arm64-dts-mediatek-mt7622-add-missing-device_type-to.patch
+can-m_can-start-cancel-polling-timer-together-with-i.patch
+wifi-iwlwifi-mvm-fix-the-listener-mac-filter-flags.patch
+bpf-mark-bpf_spin_-lock-unlock-helpers-with-notrace-.patch
+bpf-don-t-infer-ptr_to_ctx-for-programs-with-unnamed.patch
+arm64-dts-qcom-msm8996-define-ufs-unipro-clock-limit.patch
+arm64-dts-qcom-sdm845-use-the-low-power-island-cx-mx.patch
+soc-qcom-llcc-check-return-value-on-broadcast_or-reg.patch
+arm-dts-qcom-msm8974-correct-qfprom-node-size.patch
+arm64-dts-mediatek-mt8186-add-missing-clocks-to-ssus.patch
+arm64-dts-mediatek-mt8186-add-missing-xhci-clock-to-.patch
+arm64-dts-ti-am65x-fix-dtbs_install-for-rocktech-old.patch
+cpufreq-qcom-hw-add-config_common_clk-dependency.patch
+wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
+pwm-dwc-use-pm_sleep_ptr-macro.patch
+arm64-dts-ti-k3-am69-sk-fix-pmic-interrupt-number.patch
+arm64-dts-ti-k3-j721e-sk-fix-pmic-interrupt-number.patch
+arm64-dts-ti-k3-am62-main-disable-usb-lpm.patch
+acpi-processor_idle-fix-memory-leak-in-acpi_processo.patch
+bus-tegra-aconnect-update-dependency-to-arch_tegra.patch
+iommu-amd-mark-interrupt-as-managed.patch
+wifi-brcmsmac-avoid-function-pointer-casts.patch
+arm64-dts-qcom-sdm845-db845c-correct-pcie-wake-gpios.patch
+arm64-dts-qcom-sm8150-correct-pcie-wake-gpios.patch
+powercap-dtpm_cpu-fix-error-check-against-freq_qos_a.patch
+net-ena-remove-ena_select_queue.patch
+arm64-dts-ti-k3-j7200-common-proc-board-modify-pinmu.patch
+arm64-dts-ti-k3-j7200-common-proc-board-remove-clock.patch
+arm64-dts-ti-k3-j721s2-common-proc-board-remove-pinm.patch
+arm64-dts-ti-k3-j784s4-evm-remove-pinmux-for-cts-and.patch
+arm64-dts-ti-k3-am64-main-fix-itap-otap-values-for-m.patch
+arm64-dts-mt8195-cherry-tomato-change-watchdog-reset.patch
+arm64-dts-ti-add-common1-register-space-for-am65x-so.patch
+arm64-dts-ti-add-common1-register-space-for-am62x-so.patch
+firmware-arm_scmi-fix-double-free-in-smc-transport-c.patch
+wifi-cfg80211-set-correct-param-change-count-in-ml-e.patch
+arm64-dts-ti-k3-j721e-fix-mux-reg-masks-in-hbmc_mux.patch
+arm64-dts-ti-k3-j784s4-main-fix-mux-reg-masks-in-ser.patch
+arm64-dts-ti-k3-am62p-fix-memory-ranges-for-dmss.patch
+wifi-wilc1000-revert-reset-line-logic-flip.patch
+arm-dts-arm-realview-fix-development-chip-rom-compat.patch
+memory-tegra-correct-dla-client-names.patch
+wifi-mt76-mt7996-fix-fw-loading-timeout.patch
+wifi-mt76-mt7925-fix-connect-to-80211b-mode-fail-in-.patch
+wifi-mt76-mt7925-fix-sap-no-beacon-issue-in-5ghz-and.patch
+wifi-mt76-mt7925-fix-mcu-query-command-fail.patch
+wifi-mt76-mt7925-fix-wmm-queue-mapping.patch
+wifi-mt76-mt7925-fix-fw-download-fail.patch
+wifi-mt76-mt7925-fix-wow-failed-in-encrypted-mode.patch
+wifi-mt76-mt7925-fix-the-wrong-header-translation-co.patch
+wifi-mt76-mt7925-add-flow-to-avoid-chip-bt-function-.patch
+wifi-mt76-mt7925-add-support-to-set-ifs-time-by-mcu-.patch
+wifi-mt76-mt7925-update-pcie-dma-settings.patch
+wifi-mt76-mt7996-check-txs-format-before-getting-skb.patch
+wifi-mt76-mt7996-fix-twt-issues.patch
+wifi-mt76-mt7996-fix-incorrect-interpretation-of-eht.patch
+wifi-mt76-mt7996-fix-he-beamformer-phy-cap-for-stati.patch
+wifi-mt76-mt7996-fix-efuse-reading-issue.patch
+wifi-mt76-mt7996-fix-hif_txd_v2_1-value.patch
+wifi-mt76-mt792x-fix-ethtool-warning.patch
+wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch
+wifi-mt76-mt7925e-fix-use-after-free-in-free_irq.patch
+wifi-mt76-mt7921-fix-incorrect-type-conversion-for-c.patch
+wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch
+wifi-mt76-fix-the-issue-of-missing-txpwr-settings-fr.patch
+arm64-dts-renesas-rzg2l-add-missing-interrupts-to-ir.patch
+arm64-dts-renesas-r9a08g045-add-missing-interrupts-t.patch
+arm64-dts-renesas-rzg3s-smarc-som-guard-ethernet-irq.patch
+arm64-dts-renesas-r8a779a0-correct-avb-01-reg-sizes.patch
+arm64-dts-renesas-r8a779g0-correct-avb-01-reg-sizes.patch
+net-mctp-copy-skb-ext-data-when-fragmenting.patch
+pstore-inode-only-d_invalidate-is-needed.patch
+arm64-dts-allwinner-h6-add-rx-dma-channel-for-spdif.patch
+arm-dts-imx6dl-yapp4-fix-typo-in-the-qca-switch-regi.patch
+arm-dts-imx6dl-yapp4-move-the-internal-switch-phys-u.patch
+arm64-dts-imx8mp-set-spi-nor-to-max-40-mhz-on-data-m.patch
+arm64-dts-imx8mp-evk-fix-hdmi-3d-node.patch
+regulator-userspace-consumer-add-module-device-table.patch
+gpiolib-pass-consumer-device-through-to-core-in-devm.patch
+arm64-dts-marvell-reorder-crypto-interrupts-on-armad.patch
+acpi-resource-do-irq-override-on-lunnen-ground-lapto.patch
+acpi-resource-add-maibenben-x577-to-irq1_edge_low_fo.patch
+acpi-scan-fix-device-check-notification-handling.patch
+arm64-dts-rockchip-add-missing-interrupt-names-for-r.patch
+arm64-dts-rockchip-fix-reset-names-for-rk356x-i2s2-c.patch
+arm64-dts-rockchip-drop-rockchip-trcm-sync-tx-only-f.patch
+iommu-arm-smmu-v3-check-that-the-rid-domain-is-s1-in.patch
+objtool-fix-unwind_hint_-save-restore-across-basic-b.patch
+x86-relocs-ignore-relocations-in-.notes-section.patch
+sunrpc-fix-a-memleak-in-gss_import_v2_context.patch
+sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
+arm64-dts-qcom-sm8550-fix-spmi-channels-size.patch
+arm64-dts-qcom-sm8650-fix-spmi-channels-size.patch
+mmc-wmt-sdmmc-remove-an-incorrect-release_mem_region.patch
+acpi-cppc-enable-amd-cppc-v2-support-for-family-17h-.patch
+btrfs-fix-race-when-detecting-delalloc-ranges-during.patch
+wifi-rtw88-8821cu-fix-firmware-upload-fail.patch
+wifi-rtw88-8821c-fix-beacon-loss-and-disconnect.patch
+wifi-rtw88-8821c-fix-false-alarm-count.patch
+wifi-brcm80211-handle-pmk_op-allocation-failure.patch
+riscv-dts-starfive-jh7100-fix-root-clock-names.patch
+pci-make-pci_dev_is_disconnected-helper-public-for-o.patch
+iommu-vt-d-don-t-issue-ats-invalidation-request-when.patch
+iommu-vt-d-use-rbtree-to-track-iommu-probed-devices.patch
+iommu-vt-d-improve-ite-fault-handling-if-target-devi.patch
+iommu-vt-d-use-device-rbtree-in-iopf-reporting-path.patch
+iommu-add-static-iommu_ops-release_domain.patch
+iommu-vt-d-fix-null-domain-on-device-release.patch
+igc-fix-missing-time-sync-events.patch
+igb-fix-missing-time-sync-events.patch
+ice-fix-stats-being-updated-by-way-too-large-values.patch
+bluetooth-remove-hci_power_off_timeout.patch
+bluetooth-mgmt-remove-leftover-queuing-of-power_off-.patch
+bluetooth-remove-superfluous-call-to-hci_conn_check_.patch
+bluetooth-remove-bt_hs.patch
+bluetooth-hci_event-fix-not-indicating-new-connectio.patch
+bluetooth-hci_qca-don-t-use-is_err_or_null-with-gpio.patch
+bluetooth-hci_core-cancel-request-on-command-timeout.patch
+bluetooth-hci_sync-fix-overwriting-request-callback.patch
+bluetooth-hci_h5-add-ability-to-allocate-memory-for-.patch
+bluetooth-btrtl-fix-out-of-bounds-memory-access.patch
+bluetooth-hci_core-fix-possible-buffer-overflow.patch
+bluetooth-msft-fix-memory-leak.patch
+bluetooth-btusb-fix-memory-leak.patch
+bluetooth-af_bluetooth-fix-deadlock.patch
+bluetooth-fix-use-after-free-in-accessing-skb-after-.patch
+sr9800-add-check-for-usbnet_get_endpoints.patch
+s390-cache-prevent-rebuild-of-shared_cpu_list.patch
+bpf-fix-devmap_hash-overflow-check-on-32-bit-arches.patch
+bpf-fix-hashtab-overflow-check-on-32-bit-arches.patch
+bpf-fix-stackmap-overflow-check-on-32-bit-arches.patch
+net-dsa-microchip-make-sure-drive-strength-configura.patch
+dpll-spec-use-proper-enum-for-pin-capabilities-attri.patch
+iommu-fix-compilation-without-config_iommu_intel.patch
+ipv6-fib6_rules-flush-route-cache-when-rule-is-chang.patch
+net-ip_tunnel-make-sure-to-pull-inner-header-in-ip_t.patch
+octeontx2-af-fix-devlink-params.patch
+net-phy-fix-phy_get_internal_delay-accessing-an-empt.patch
+dpll-fix-dpll_xa_ref_-_del-for-multiple-registration.patch
+net-hns3-fix-wrong-judgment-condition-issue.patch
+net-hns3-fix-kernel-crash-when-1588-is-received-on-h.patch
+net-hns3-fix-port-duplex-configure-error-in-imp-rese.patch
+bluetooth-fix-eir-name-length.patch
+net-phy-dp83822-fix-rgmii-tx-delay-configuration.patch
+erofs-fix-lockdep-false-positives-on-initializing-er.patch
+opp-debugfs-fix-warning-around-icc_get_name.patch
+tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
+ipmr-fix-incorrect-parameter-validation-in-the-ip_mr.patch
+l2tp-fix-incorrect-parameter-validation-in-the-pppol.patch
+udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
+net-kcm-fix-incorrect-parameter-validation-in-the-kc.patch
+net-x25-fix-incorrect-parameter-validation-in-the-x2.patch
+devlink-fix-length-of-eswitch-inline-mode.patch
+r8152-fix-unknown-device-for-choose_configuration.patch
+nfp-flower-handle-acti_netdevs-allocation-failure.patch
+bpf-hardcode-bpf_prog_pack_size-to-2mb-num_possible_.patch
+dm-raid-fix-false-positive-for-requeue-needed-during.patch
+dm-call-the-resume-method-on-internal-suspend.patch
+fbdev-simplefb-change-loglevel-when-the-power-domain.patch
+drm-tegra-dsi-add-missing-check-for-of_find_device_b.patch
+drm-tegra-dpaux-fix-pm-disable-depth-imbalance-in-te.patch
+drm-tegra-dsi-fix-some-error-handling-paths-in-tegra.patch
+drm-tegra-dsi-fix-missing-pm_runtime_disable-in-the-.patch
+drm-tegra-hdmi-fix-some-error-handling-paths-in-tegr.patch
+drm-tegra-rgb-fix-some-error-handling-paths-in-tegra.patch
+drm-tegra-rgb-fix-missing-clk_put-in-the-error-handl.patch
+drm-tegra-output-fix-missing-i2c_put_adapter-in-the-.patch
+drm-rockchip-inno_hdmi-fix-video-timing.patch
+drm-don-t-treat-0-as-1-in-drm_fixp2int_ceil.patch
+drm-vkms-avoid-reading-beyond-lut-array.patch
+drm-vmwgfx-fix-a-memleak-in-vmw_gmrid_man_get_node.patch
+drm-rockchip-lvds-do-not-overwrite-error-code.patch
+drm-rockchip-lvds-do-not-print-scary-message-when-pr.patch
+drm-panel-edp-use-put_sync-in-unprepare.patch
+drm-lima-fix-a-memleak-in-lima_heap_alloc.patch
+asoc-amd-acp-add-missing-error-handling-in-sof-mach.patch
+asoc-sof-amd-fix-memory-leak-in-amd_sof_acp_probe.patch
+asoc-sof-core-skip-firmware-test-for-custom-loaders.patch
+asoc-sof-amd-compute-file-paths-on-firmware-load.patch
+soundwire-stream-add-missing-const-to-documentation.patch
+dmaengine-tegra210-adma-update-dependency-to-arch_te.patch
+media-tc358743-register-v4l2-async-device-only-after.patch
+media-cadence-csi2rx-use-match-fwnode-for-media-link.patch
+pci-dpc-print-all-tlp-prefixes-not-just-the-first.patch
+perf-record-fix-possible-incorrect-free-in-record__s.patch
+perf-record-check-conflict-between-timestamp-filenam.patch
+hid-lenovo-add-middleclick_workaround-sysfs-knob-for.patch
+drm-amd-display-fix-a-potential-buffer-overflow-in-d.patch
+perf-pmu-treat-the-msr-pmu-as-software.patch
+crypto-qat-avoid-memcpy-overflow-warning.patch
+alsa-hda-cs35l41-set-channel-index-correctly-when-sy.patch
+drm-amd-display-fix-potential-null-pointer-dereferen.patch
+asoc-sh-rz-ssi-fix-error-message-print.patch
+drm-vmwgfx-fix-vmw_du_get_cursor_mob-fencing-of-newl.patch
+clk-renesas-r8a779g0-fix-pcie-clock-name.patch
+pinctrl-renesas-rzg2l-fix-locking-in-rzg2l_dt_subnod.patch
+pinctrl-renesas-r8a779g0-add-missing-scif_clk2-pin-g.patch
+clk-samsung-exynos850-propagate-spi-ipclk-rate-chang.patch
+media-v4l2-cci-print-leading-0-on-error.patch
+perf-evsel-fix-duplicate-initialization-of-data-id-i.patch
+pci-aer-fix-rootport-attribute-paths-in-abi-docs.patch
+perf-bpf-clean-up-the-generated-copied-vmlinux.h.patch
+clk-meson-add-missing-clocks-to-axg_clk_regmaps.patch
+media-em28xx-annotate-unchecked-call-to-media_device.patch
+media-v4l2-tpg-fix-some-memleaks-in-tpg_alloc.patch
+media-v4l2-mem2mem-fix-a-memleak-in-v4l2_m2m_registe.patch
+media-dt-bindings-techwell-tw9900-fix-port-schema-re.patch
+mtd-spinand-esmt-extend-ids-to-5-bytes.patch
+media-edia-dvbdev-fix-a-use-after-free.patch
+pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch
+pinctrl-mediatek-drop-bogus-slew-rate-register-range.patch-14189
+drm-amdgpu-fix-potential-out-of-bounds-access-in-amd.patch
+clk-qcom-reset-commonize-the-de-assert-functions.patch
+clk-qcom-reset-ensure-write-completion-on-reset-de-a.patch
+quota-fix-potential-null-pointer-dereference.patch
+quota-fix-rcu-annotations-of-inode-dquot-pointers.patch
+quota-properly-annotate-i_dquot-arrays-with-__rcu.patch
+asoc-intel-ssp-common-add-stub-for-sof_ssp_get_codec.patch
+pci-p2pdma-fix-a-sleeping-issue-in-a-rcu-read-sectio.patch
+pci-switchtec-fix-an-error-handling-path-in-switchte.patch
+crypto-xilinx-call-finalize-with-bh-disabled.patch
+drivers-ps3-select-video-to-provide-cmdline-function.patch
+perf-thread_map-free-strlist-on-normal-path-in-threa.patch
+perf-srcline-add-missed-addr2line-closes.patch
+dt-bindings-msm-qcom-mdss-include-ommited-fam-b-comp.patch
+drm-msm-dpu-fix-the-programming-of-intf_cfg2_data_hc.patch
+drm-msm-dpu-only-enable-dsc_mode_multiplex-if-dsc_me.patch
+drm-radeon-ni-fix-wrong-firmware-size-logging-in-ni_.patch
+drm-amd-display-fix-null-checks-for-adev-dm.dc-in-am.patch
+clk-renesas-r8a779g0-correct-pfc-gpio-parent-clocks.patch
+clk-renesas-r8a779f0-correct-pfc-gpio-parent-clock.patch
+clk-renesas-r9a07g04-34-use-sel_sdhi1_sts-status-con.patch
+alsa-seq-fix-function-cast-warnings.patch
+perf-expr-fix-has_event-function-for-metric-style-ev.patch
+perf-stat-avoid-metric-only-segv.patch
+perf-metric-don-t-remove-scale-from-counts.patch
+asoc-meson-aiu-fix-function-pointer-type-mismatch.patch
+asoc-meson-t9015-fix-function-pointer-type-mismatch.patch
+powerpc-force-inlining-of-arch_vmap_p-u-m-d_supporte.patch
+asoc-sof-add-some-bounds-checking-to-firmware-data.patch
+drm-ci-use-clk_ignore_unused-for-apq8016.patch
+ntb-fix-possible-name-leak-in-ntb_register_device.patch
+media-cedrus-h265-fix-configuring-bitstream-size.patch
+media-sun8i-di-fix-coefficient-writes.patch
+media-sun8i-di-fix-power-on-off-sequences.patch
+media-sun8i-di-fix-chroma-difference-threshold.patch
+staging-media-starfive-set-16-bpp-for-capture_raw-de.patch
+media-imx-csc-scaler-fix-v4l2_ctrl_handler-memory-le.patch
+media-go7007-add-check-of-return-value-of-go7007_rea.patch
+media-pvrusb2-remove-redundant-null-check.patch
+media-videobuf2-add-missing-doc-comment-for-waiting_.patch
+media-pvrusb2-fix-pvr2_stream_callback-casts.patch
+clk-qcom-dispcc-sdm845-adjust-internal-gdsc-wait-tim.patch
+drm-amd-display-add-replay-null-check-in-edp_set_rep.patch
+drm-panel-boe-tv101wum-nl6-make-use-of-prepare_prev_.patch
+drm-msm-dpu-finalise-global-state-object.patch
+drm-mediatek-dsi-fix-dsi-rgb666-formats-and-definiti.patch
+pci-mark-3ware-9650se-root-port-extended-tags-as-bro.patch
+powerpc-ps3-fix-lv1-hcall-assembly-for-elfv2-calling.patch
+drm-bridge-adv7511-fix-crash-on-irq-during-probe.patch
+pinctrl-renesas-allow-the-compiler-to-optimize-away-.patch
+clk-hisilicon-hi3519-release-the-correct-number-of-g.patch
+clk-hisilicon-hi3559a-fix-an-erroneous-devm_kfree.patch
+clk-mediatek-mt8135-fix-an-error-handling-path-in-cl.patch
+clk-mediatek-mt7622-apmixedsys-fix-an-error-handling.patch
+clk-mediatek-mt8183-correct-parent-of-clk_infra_sspm.patch
+clk-mediatek-mt7981-topckgen-flag-sgm_reg_sel-as-cri.patch
+drm-tegra-put-drm_gem_object-ref-on-error-in-tegra_f.patch
+tty-mips_ejtag_fdc-fix-passing-incompatible-pointer-.patch
+media-ivsc-csi-swap-sink-and-source-pads.patch
+media-i2c-imx290-fix-imx920-typo.patch
+mfd-syscon-call-of_node_put-only-when-of_parse_phand.patch
+mfd-altera-sysmgr-call-of_node_put-only-when-of_pars.patch
+perf-print-events-make-is_event_supported-more-robus.patch
+crypto-arm-sha-fix-function-cast-warnings.patch
+crypto-ccp-avoid-discarding-errors-in-psp_send_platf.patch
+crypto-qat-remove-unused-macros-in-qat_comp_alg.c.patch
+crypto-qat-removed-unused-macro-in-adf_cnv_dbgfs.c.patch
+crypto-qat-avoid-division-by-zero.patch
+crypto-qat-remove-double-initialization-of-value.patch
+crypto-qat-fix-ring-to-service-map-for-dcc-in-4xxx.patch
+crypto-qat-fix-ring-to-service-map-for-dcc-in-420xx.patch
+crypto-jitter-fix-crypto_jitterentropy-help-text.patch
+drm-tidss-fix-initial-plane-zpos-values.patch
+drm-tidss-fix-sync-lost-issue-with-two-displays.patch
+clk-imx-imx8mp-fix-sai_mclk_sel-definition.patch
+mtd-maps-physmap-core-fix-flash-size-larger-than-32-.patch
+mtd-rawnand-lpc32xx_mlc-fix-irq-handler-prototype.patch
+mtd-rawnand-brcmnand-exec_op-helper-functions-return.patch
+asoc-meson-axg-tdm-interface-fix-mclk-setup-without-.patch
+asoc-meson-axg-tdm-interface-add-frame-rate-constrai.patch
+drm-msm-a6xx-specify-ubwc-config-for-sc7180.patch
+drm-msm-a7xx-fix-llc-typo.patch
+dt-bindings-arm-smmu-fix-sm8-45-50-gpu-smmu-if-condi.patch
+perf-pmu-fix-a-potential-memory-leak-in-perf_pmu__lo.patch
+hid-amd_sfh-update-hpd-sensor-structure-elements.patch
+hid-amd_sfh-avoid-disabling-the-interrupt.patch
+drm-amdgpu-fix-missing-break-in-atom_arg_imm-case-of.patch
+media-pvrusb2-fix-uaf-in-pvr2_context_set_notify.patch
+media-dvb-frontends-avoid-stack-overflow-warnings-wi.patch
+media-go7007-fix-a-memleak-in-go7007_load_encoder.patch
+media-ttpci-fix-two-memleaks-in-budget_av_attach.patch
+media-mediatek-vcodec-avoid-wcast-function-type-stri.patch
+arm64-ftrace-don-t-forbid-call_ops-cc_optimize_for_s.patch
+drm-tests-helpers-include-missing-drm_drv-header.patch
+drm-amd-pm-fix-esm-reg-mask-use-to-get-pcie-speed.patch
+gpio-nomadik-fix-offset-bug-in-nmk_pmx_set.patch
+drm-mediatek-fix-a-null-pointer-crash-in-mtk_drm_crt.patch
+mfd-cs42l43-fix-wrong-register-defaults.patch
+powerpc-32-fix-adb_cuda-kconfig-warning.patch
+powerpc-pseries-fix-potential-memleak-in-papr_get_at.patch
+powerpc-hv-gpci-fix-the-h_get_perf_counter_info-hcal.patch
+clk-qcom-gcc-ipq5018-fix-enable_reg-offset-of-gcc_gm.patch
+clk-qcom-gcc-ipq5018-fix-halt_reg-offset-of-gcc_pcie.patch
+clk-qcom-gcc-ipq5018-fix-register-offset-for-gcc_ubi.patch
+perf-vendor-events-amd-fix-zen-4-cache-latency-event.patch
+drm-msm-dpu-allow-certain-formats-for-cdm-for-dp.patch
+drm-msm-dpu-add-division-of-drm_display_mode-s-hskew.patch
+media-usbtv-remove-useless-locks-in-usbtv_video_free.patch
+drm-xe-fix-ref-counting-leak-on-page-fault.patch
+drm-xe-replace-grouped-target-in-makefile-with-patte.patch
+lib-stackdepot-fix-first-entry-having-a-0-handle.patch
+lib-stackdepot-off-by-one-in-depot_fetch_stack.patch
+modules-wait-do_free_init-correctly.patch
+mfd-cs42l43-fix-wrong-gpio_fn_sel-and-spi_clk_config.patch
+power-supply-mm8013-fix-not-charging-detection.patch
+powerpc-embedded6xx-fix-no-previous-prototype-for-av.patch
+powerpc-4xx-fix-warp_gpio_leds-build-failure.patch
+risc-v-kvm-forward-seed-csr-access-to-user-space.patch
+leds-aw2013-unlock-mutex-before-destroying-it.patch
+leds-sgm3140-add-missing-timer-cleanup-and-flash-gpi.patch
+backlight-hx8357-fix-potential-null-pointer-derefere.patch
+backlight-ktz8866-correct-the-check-for-of_property_.patch
+backlight-lm3630a-initialize-backlight_properties-on.patch
+backlight-lm3630a-don-t-set-bl-props.brightness-in-g.patch
+backlight-da9052-fully-initialize-backlight_properti.patch
+backlight-lm3639-fully-initialize-backlight_properti.patch
+backlight-lp8788-fully-initialize-backlight_properti.patch
+arch-powerpc-remove-linux-fb.h-from-backlight-code.patch
+sparc32-use-generic-cmpdi2-ucmpdi2-variants.patch
+mtd-maps-sun_uflash-declare-uflash_devinit-static.patch
+sparc32-do-not-select-generic_isa_dma.patch
+sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
+clk-fix-clk_core_get-null-dereference.patch
+clk-zynq-prevent-null-pointer-dereference-caused-by-.patch
+pci-brcmstb-fix-broken-brcm_pcie_mdio_write-polling.patch
+cifs-fix-writeback-data-corruption.patch
+alsa-hda-realtek-fix-alc285-issues-on-hp-envy-x360-l.patch
+alsa-hda-tas2781-use-dev_dbg-in-system_resume.patch
+alsa-hda-tas2781-add-lock-to-system_suspend.patch
+alsa-hda-tas2781-do-not-reset-cur_-values-in-runtime.patch
+alsa-hda-tas2781-do-not-call-pm_runtime_force_-in-sy.patch
+alsa-hda-tas2781-restore-power-state-after-system_re.patch
+alsa-scarlett2-fix-scarlett-4th-gen-4i4-low-voltage-.patch
+alsa-scarlett2-fix-scarlett-4th-gen-autogain-status-.patch
+alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch
+alsa-scarlett2-fix-scarlett-4th-gen-input-gain-range.patch-21200
+mips-cm-convert-__mips_cm_l2sync_phys_base-to-weak-f.patch
+platform-x86-intel-pmc-lnl-remove-ssram-support.patch
+platform-x86-intel-pmc-arl-put-gna-device-in-d3.patch
+platform-x86-amd-pmf-do-not-use-readl-for-policy-buf.patch
+alsa-usb-audio-stop-parsing-channels-bits-when-all-c.patch
+phy-qcom-qmp-usb-split-usb-c-phy-driver.patch
+phy-qcom-qmp-usbc-add-support-for-the-type-c-handlin.patch
+phy-qcom-qmp-usbc-handle-clamp-register-in-a-correct.patch
+scsi-hisi_sas-fix-a-deadlock-issue-related-to-automa.patch
+rdma-irdma-remove-duplicate-assignment.patch
+rdma-srpt-do-not-register-event-handler-until-srpt-d.patch
+f2fs-compress-fix-to-guarantee-persisting-compressed.patch
+f2fs-compress-fix-to-cover-normal-cluster-write-with.patch
+f2fs-compress-fix-to-check-unreleased-compressed-clu.patch
+f2fs-compress-fix-to-avoid-inconsistence-bewteen-i_b.patch
+f2fs-fix-to-remove-unnecessary-f2fs_bug_on-to-avoid-.patch
+f2fs-zone-fix-to-wait-completion-of-last-bio-in-zone.patch
+f2fs-fix-null-pointer-dereference-in-f2fs_submit_pag.patch
+f2fs-compress-fix-to-cover-f2fs_disable_compressed_f.patch
+f2fs-fix-to-avoid-potential-panic-during-recovery.patch
+scsi-csiostor-avoid-function-pointer-casts.patch
+i3c-dw-disable-ibi-irq-depends-on-hot-join-and-sir-e.patch
+rdma-hns-fix-mis-modifying-default-congestion-contro.patch
+rdma-device-fix-a-race-between-mad_client-and-cm_cli.patch
+rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
+scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
+f2fs-fix-to-create-selinux-label-during-whiteout-ini.patch
+f2fs-compress-fix-to-check-zstd-compress-level-corre.patch
+net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
+nfsv4.2-fix-nfs4_listxattr-kernel-bug-at-mm-usercopy.patch
+nfsv4.2-fix-listxattr-maximum-xdr-buffer-size.patch
+f2fs-compress-fix-to-check-compress-flag-w-.i_sem-lo.patch
+f2fs-check-number-of-blocks-in-a-current-section.patch
+watchdog-starfive-check-pm_runtime_enabled-before-de.patch
+watchdog-stm32_iwdg-initialize-default-timeout.patch
+f2fs-fix-to-use-correct-segment-type-in-f2fs_allocat.patch
+f2fs-ro-compress-fix-to-avoid-caching-unaligned-exte.patch
+rdma-mana_ib-fix-bug-in-creation-of-dma-regions.patch
+rdma-mana_ib-introduce-mdev_to_gc-helper-function.patch
+rdma-mana_ib-introduce-mana_ib_get_netdev-helper-fun.patch
+rdma-mana_ib-introduce-mana_ib_install_cq_cb-helper-.patch
+rdma-mana_ib-use-virtual-address-in-dma-regions-for-.patch
+input-iqs7222-add-support-for-iqs7222d-v1.1-and-v1.2.patch
+nfs-fix-nfs_netfs_issue_read-xarray-locking-for-writ.patch
+nfs-fix-an-off-by-one-in-root_nfs_cat.patch
+nfsv4.1-pnfs-fix-nfs-with-tls-in-pnfs.patch
+acpi-hmat-remove-register-of-memory-node-for-generic.patch
+f2fs-compress-relocate-some-judgments-in-f2fs_reserv.patch
+f2fs-compress-fix-reserve_cblocks-counting-error-whe.patch
+f2fs-fix-to-truncate-meta-inode-pages-forcely.patch
+f2fs-zone-fix-to-remove-pow2-check-condition-for-zon.patch
+cxl-fix-the-incorrect-assignment-of-sslbis-entry-poi.patch
+perf-x86-amd-core-avoid-register-reset-when-cpu-is-d.patch
+afs-revert-afs-hide-silly-rename-files-from-userspac.patch
+afs-don-t-cache-preferred-address.patch
+afs-fix-occasional-rmdir-then-vnovnode-with-generic-.patch
+f2fs-fix-to-avoid-use-after-free-issue-in-f2fs_filem.patch
+nfs-fix-panic-when-nfs4_ff_layout_prepare_ds-fails.patch
+ovl-relax-warn_on-in-ovl_verify_area.patch
+io_uring-net-correct-the-type-of-variable.patch
diff --git a/queue-6.8/soc-qcom-llcc-check-return-value-on-broadcast_or-reg.patch b/queue-6.8/soc-qcom-llcc-check-return-value-on-broadcast_or-reg.patch
new file mode 100644
index 00000000000..f361d480ca6
--- /dev/null
+++ b/queue-6.8/soc-qcom-llcc-check-return-value-on-broadcast_or-reg.patch
@@ -0,0 +1,41 @@
+From d7730036666b9da0e86a35db9b9b63f34a8dd5bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 10:35:15 -0800
+Subject: soc: qcom: llcc: Check return value on Broadcast_OR reg read
+
+From: Unnathi Chalicheemala <quic_uchalich@quicinc.com>
+
+[ Upstream commit ceeaddc19a90039861564d8e1078b778a8f95101 ]
+
+Commit c72ca343f911 ("soc: qcom: llcc: Add v4.1 HW version support")
+introduced a new 4.1 if statement in llcc_update_act_ctrl() without
+considering that ret might be overwritten. So, add return value check
+after Broadcast_OR register read in llcc_update_act_ctrl().
+
+Fixes: c72ca343f911 ("soc: qcom: llcc: Add v4.1 HW version support")
+Signed-off-by: Unnathi Chalicheemala <quic_uchalich@quicinc.com>
+Reviewed-by: Elliot Berman <quic_eberman@quicinc.com>
+Reviewed-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Link: https://lore.kernel.org/r/20240212183515.433873-1-quic_uchalich@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/llcc-qcom.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
+index 4ca88eaebf06a..cbef0dea1d5d7 100644
+--- a/drivers/soc/qcom/llcc-qcom.c
++++ b/drivers/soc/qcom/llcc-qcom.c
+@@ -859,6 +859,8 @@ static int llcc_update_act_ctrl(u32 sid,
+ 	ret = regmap_read_poll_timeout(drv_data->bcast_regmap, status_reg,
+ 				      slice_status, !(slice_status & status),
+ 				      0, LLCC_STATUS_READ_DELAY);
++	if (ret)
++		return ret;
+ 
+ 	if (drv_data->version >= LLCC_VERSION_4_1_0_0)
+ 		ret = regmap_write(drv_data->bcast_regmap, act_clear_reg,
+-- 
+2.43.0
+
diff --git a/queue-6.8/soc-qcom-socinfo-rename-pm2250-to-pm4125.patch b/queue-6.8/soc-qcom-socinfo-rename-pm2250-to-pm4125.patch
new file mode 100644
index 00000000000..0ef2500e7b6
--- /dev/null
+++ b/queue-6.8/soc-qcom-socinfo-rename-pm2250-to-pm4125.patch
@@ -0,0 +1,54 @@
+From 1493441942f90c91306bd969428790e99063fc3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 03:32:44 +0200
+Subject: soc: qcom: socinfo: rename PM2250 to PM4125
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 5155e48128826d0c5999dc9f47aa746df54da448 ]
+
+It seems, the only actual mentions of PM2250 can be found are related to
+the Qualcomm RB1 platform. However even RB1 schematics use PM4125 as a
+PMIC name. Rename PM2250 to PM4125 to follow the documentation.
+
+Fixes: 082f9bc60f33 ("soc: qcom: spmi-pmic: add more PMIC SUBTYPE IDs")
+Fixes: 112d96fd2927 ("soc: qcom: socinfo: Add some PMICs")
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20240128-pm2250-pm4125-rename-v2-1-d51987e9f83a@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/socinfo.c        | 2 +-
+ include/soc/qcom/qcom-spmi-pmic.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
+index 6349a0debeb57..a980020ab854f 100644
+--- a/drivers/soc/qcom/socinfo.c
++++ b/drivers/soc/qcom/socinfo.c
+@@ -124,7 +124,7 @@ static const char *const pmic_models[] = {
+ 	[50] = "PM8350B",
+ 	[51] = "PMR735A",
+ 	[52] = "PMR735B",
+-	[55] = "PM2250",
++	[55] = "PM4125",
+ 	[58] = "PM8450",
+ 	[65] = "PM8010",
+ 	[69] = "PM8550VS",
+diff --git a/include/soc/qcom/qcom-spmi-pmic.h b/include/soc/qcom/qcom-spmi-pmic.h
+index 17a0a8c3d6560..a62d500a6fdaf 100644
+--- a/include/soc/qcom/qcom-spmi-pmic.h
++++ b/include/soc/qcom/qcom-spmi-pmic.h
+@@ -49,7 +49,7 @@
+ #define PMK8350_SUBTYPE		0x2f
+ #define PMR735B_SUBTYPE		0x34
+ #define PM6350_SUBTYPE		0x36
+-#define PM2250_SUBTYPE		0x37
++#define PM4125_SUBTYPE		0x37
+ 
+ #define PMI8998_FAB_ID_SMIC	0x11
+ #define PMI8998_FAB_ID_GF	0x30
+-- 
+2.43.0
+
diff --git a/queue-6.8/sock_diag-annotate-data-races-around-sock_diag_handl.patch b/queue-6.8/sock_diag-annotate-data-races-around-sock_diag_handl.patch
new file mode 100644
index 00000000000..11f3e833c20
--- /dev/null
+++ b/queue-6.8/sock_diag-annotate-data-races-around-sock_diag_handl.patch
@@ -0,0 +1,74 @@
+From d2f7594f50f7cf991c8806d70d7f79b930fe360d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 11:25:55 +0000
+Subject: sock_diag: annotate data-races around sock_diag_handlers[family]
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit efd402537673f9951992aea4ef0f5ff51d858f4b ]
+
+__sock_diag_cmd() and sock_diag_bind() read sock_diag_handlers[family]
+without a lock held.
+
+Use READ_ONCE()/WRITE_ONCE() annotations to avoid potential issues.
+
+Fixes: 8ef874bfc729 ("sock_diag: Move the sock_ code to net/core/")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Guillaume Nault <gnault@redhat.com>
+Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_diag.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index b1e29e18d1d60..c53b731f2d672 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -193,7 +193,7 @@ int sock_diag_register(const struct sock_diag_handler *hndl)
+ 	if (sock_diag_handlers[hndl->family])
+ 		err = -EBUSY;
+ 	else
+-		sock_diag_handlers[hndl->family] = hndl;
++		WRITE_ONCE(sock_diag_handlers[hndl->family], hndl);
+ 	mutex_unlock(&sock_diag_table_mutex);
+ 
+ 	return err;
+@@ -209,7 +209,7 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld)
+ 
+ 	mutex_lock(&sock_diag_table_mutex);
+ 	BUG_ON(sock_diag_handlers[family] != hnld);
+-	sock_diag_handlers[family] = NULL;
++	WRITE_ONCE(sock_diag_handlers[family], NULL);
+ 	mutex_unlock(&sock_diag_table_mutex);
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_unregister);
+@@ -227,7 +227,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 		return -EINVAL;
+ 	req->sdiag_family = array_index_nospec(req->sdiag_family, AF_MAX);
+ 
+-	if (sock_diag_handlers[req->sdiag_family] == NULL)
++	if (READ_ONCE(sock_diag_handlers[req->sdiag_family]) == NULL)
+ 		sock_load_diag_module(req->sdiag_family, 0);
+ 
+ 	mutex_lock(&sock_diag_table_mutex);
+@@ -286,12 +286,12 @@ static int sock_diag_bind(struct net *net, int group)
+ 	switch (group) {
+ 	case SKNLGRP_INET_TCP_DESTROY:
+ 	case SKNLGRP_INET_UDP_DESTROY:
+-		if (!sock_diag_handlers[AF_INET])
++		if (!READ_ONCE(sock_diag_handlers[AF_INET]))
+ 			sock_load_diag_module(AF_INET, 0);
+ 		break;
+ 	case SKNLGRP_INET6_TCP_DESTROY:
+ 	case SKNLGRP_INET6_UDP_DESTROY:
+-		if (!sock_diag_handlers[AF_INET6])
++		if (!READ_ONCE(sock_diag_handlers[AF_INET6]))
+ 			sock_load_diag_module(AF_INET6, 0);
+ 		break;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/soundwire-stream-add-missing-const-to-documentation.patch b/queue-6.8/soundwire-stream-add-missing-const-to-documentation.patch
new file mode 100644
index 00000000000..d94434ba109
--- /dev/null
+++ b/queue-6.8/soundwire-stream-add-missing-const-to-documentation.patch
@@ -0,0 +1,44 @@
+From 2f1761c1165c2dd61b7699c20c0f9a63ae5f5694 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 17:06:39 +0100
+Subject: soundwire: stream: add missing const to Documentation
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 0707496ff4e416ea08c90053fd5fde5811b11b22 ]
+
+Commit 21f4c443731f ("soundwire: stream: constify sdw_port_config when
+adding devices") added const to sdw_port_config argument, but forgot
+documentation.
+
+Fixes: 21f4c443731f ("soundwire: stream: constify sdw_port_config when adding devices")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20240117160639.1327266-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/driver-api/soundwire/stream.rst | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/driver-api/soundwire/stream.rst b/Documentation/driver-api/soundwire/stream.rst
+index b432a2de45d37..2a794484f62c9 100644
+--- a/Documentation/driver-api/soundwire/stream.rst
++++ b/Documentation/driver-api/soundwire/stream.rst
+@@ -324,12 +324,12 @@ framework, this stream state is linked to .hw_params() operation.
+ 
+   int sdw_stream_add_master(struct sdw_bus * bus,
+ 		struct sdw_stream_config * stream_config,
+-		struct sdw_ports_config * ports_config,
++		const struct sdw_ports_config * ports_config,
+ 		struct sdw_stream_runtime * stream);
+ 
+   int sdw_stream_add_slave(struct sdw_slave * slave,
+ 		struct sdw_stream_config * stream_config,
+-		struct sdw_ports_config * ports_config,
++		const struct sdw_ports_config * ports_config,
+ 		struct sdw_stream_runtime * stream);
+ 
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/sparc32-do-not-select-generic_isa_dma.patch b/queue-6.8/sparc32-do-not-select-generic_isa_dma.patch
new file mode 100644
index 00000000000..0352785272c
--- /dev/null
+++ b/queue-6.8/sparc32-do-not-select-generic_isa_dma.patch
@@ -0,0 +1,49 @@
+From 2b09165ceded15faf7bb1dc3c13c293ab78316ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 18:42:26 +0100
+Subject: sparc32: Do not select GENERIC_ISA_DMA
+
+From: Sam Ravnborg <sam@ravnborg.org>
+
+[ Upstream commit 99bd9a4f87926e12ce60796d7db1d6b226aca5e3 ]
+
+sparc32 do not support generic isa dma, so do not select the symbol.
+
+This fixes the following warnings:
+dma.c:70:5: error: no previous prototype for 'request_dma' [-Werror=missing-prototypes]
+dma.c:88:6: error: no previous prototype for 'free_dma' [-Werror=missing-prototypes]
+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Fixes: 0fcb70851fbf ("Makefile.extrawarn: turn on missing-prototypes globally")
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Cc: Andreas Larsson <andreas@gaisler.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: Maciej W. Rozycki <macro@orcam.me.uk>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20240224-sam-fix-sparc32-all-builds-v2-5-1f186603c5c4@ravnborg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/Kconfig | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 0c5a98ef11440..37a1cfecd9c73 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -142,10 +142,6 @@ config HIGHMEM
+ 	default y if SPARC32
+ 	select KMAP_LOCAL
+ 
+-config GENERIC_ISA_DMA
+-	bool
+-	default y if SPARC32
+-
+ config PGTABLE_LEVELS
+ 	default 4 if 64BIT
+ 	default 3
+-- 
+2.43.0
+
diff --git a/queue-6.8/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch b/queue-6.8/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
new file mode 100644
index 00000000000..e73de6c8db8
--- /dev/null
+++ b/queue-6.8/sparc32-fix-section-mismatch-in-leon_pci_grpci.patch
@@ -0,0 +1,62 @@
+From 936d4c6abfa522e0296a8418112ed4fbd5f94b47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 18:42:28 +0100
+Subject: sparc32: Fix section mismatch in leon_pci_grpci
+
+From: Sam Ravnborg <sam@ravnborg.org>
+
+[ Upstream commit 24338a6ae13cb743ced77da1b3a12c83f08a0c96 ]
+
+Passing a datastructre marked _initconst to platform_driver_register()
+is wrong. Drop the __initconst notation.
+
+This fixes the following warnings:
+
+WARNING: modpost: vmlinux: section mismatch in reference: grpci1_of_driver+0x30 (section: .data) -> grpci1_of_match (section: .init.rodata)
+WARNING: modpost: vmlinux: section mismatch in reference: grpci2_of_driver+0x30 (section: .data) -> grpci2_of_match (section: .init.rodata)
+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Andreas Larsson <andreas@gaisler.com>
+Fixes: 4154bb821f0b ("sparc: leon: grpci1: constify of_device_id")
+Fixes: 03949b1cb9f1 ("sparc: leon: grpci2: constify of_device_id")
+Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Tested-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20240224-sam-fix-sparc32-all-builds-v2-7-1f186603c5c4@ravnborg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/leon_pci_grpci1.c | 2 +-
+ arch/sparc/kernel/leon_pci_grpci2.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/sparc/kernel/leon_pci_grpci1.c b/arch/sparc/kernel/leon_pci_grpci1.c
+index 8700a0e3b0df7..b2b639bee0684 100644
+--- a/arch/sparc/kernel/leon_pci_grpci1.c
++++ b/arch/sparc/kernel/leon_pci_grpci1.c
+@@ -697,7 +697,7 @@ static int grpci1_of_probe(struct platform_device *ofdev)
+ 	return err;
+ }
+ 
+-static const struct of_device_id grpci1_of_match[] __initconst = {
++static const struct of_device_id grpci1_of_match[] = {
+ 	{
+ 	 .name = "GAISLER_PCIFBRG",
+ 	 },
+diff --git a/arch/sparc/kernel/leon_pci_grpci2.c b/arch/sparc/kernel/leon_pci_grpci2.c
+index 60b6bdf7761fb..ac2acd62a24ec 100644
+--- a/arch/sparc/kernel/leon_pci_grpci2.c
++++ b/arch/sparc/kernel/leon_pci_grpci2.c
+@@ -889,7 +889,7 @@ static int grpci2_of_probe(struct platform_device *ofdev)
+ 	return err;
+ }
+ 
+-static const struct of_device_id grpci2_of_match[] __initconst = {
++static const struct of_device_id grpci2_of_match[] = {
+ 	{
+ 	 .name = "GAISLER_GRPCI2",
+ 	 },
+-- 
+2.43.0
+
diff --git a/queue-6.8/sparc32-use-generic-cmpdi2-ucmpdi2-variants.patch b/queue-6.8/sparc32-use-generic-cmpdi2-ucmpdi2-variants.patch
new file mode 100644
index 00000000000..b7563e745a0
--- /dev/null
+++ b/queue-6.8/sparc32-use-generic-cmpdi2-ucmpdi2-variants.patch
@@ -0,0 +1,133 @@
+From feef09432e684ea9df665dd209385a71b878951b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Feb 2024 18:42:22 +0100
+Subject: sparc32: Use generic cmpdi2/ucmpdi2 variants
+
+From: Sam Ravnborg <sam@ravnborg.org>
+
+[ Upstream commit 802a8874a3889a4a0d218d4f73e5855c96d5b8a8 ]
+
+Use the generic variants - the implementation is the same.
+As a nice side-effect fix the following warnings:
+
+cmpdi2.c: warning: no previous prototype for '__cmpdi2' [-Wmissing-prototypes]
+ucmpdi2.c: warning: no previous prototype for '__ucmpdi2' [-Wmissing-prototypes]
+
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Fixes: 0fcb70851fbf ("Makefile.extrawarn: turn on missing-prototypes globally")
+Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Reviewed-by: Maciej W. Rozycki <macro@orcam.me.uk>
+Tested-by: Maciej W. Rozycki <macro@orcam.me.uk> # build-tested
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Andreas Larsson <andreas@gaisler.com>
+Reviewed-by: Andreas Larsson <andreas@gaisler.com>
+Tested-by: Andreas Larsson <andreas@gaisler.com>
+Signed-off-by: Andreas Larsson <andreas@gaisler.com>
+Link: https://lore.kernel.org/r/20240224-sam-fix-sparc32-all-builds-v2-1-1f186603c5c4@ravnborg.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/Kconfig       |  2 ++
+ arch/sparc/lib/Makefile  |  4 ++--
+ arch/sparc/lib/cmpdi2.c  | 28 ----------------------------
+ arch/sparc/lib/ucmpdi2.c | 20 --------------------
+ 4 files changed, 4 insertions(+), 50 deletions(-)
+ delete mode 100644 arch/sparc/lib/cmpdi2.c
+ delete mode 100644 arch/sparc/lib/ucmpdi2.c
+
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index 204c43cb3d435..0c5a98ef11440 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -57,6 +57,8 @@ config SPARC32
+ 	select CLZ_TAB
+ 	select DMA_DIRECT_REMAP
+ 	select GENERIC_ATOMIC64
++	select GENERIC_LIB_CMPDI2
++	select GENERIC_LIB_UCMPDI2
+ 	select HAVE_UID16
+ 	select LOCK_MM_AND_FIND_VMA
+ 	select OLD_SIGACTION
+diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
+index 59669ebddd4e1..ee5091dd67ed7 100644
+--- a/arch/sparc/lib/Makefile
++++ b/arch/sparc/lib/Makefile
+@@ -14,7 +14,7 @@ lib-$(CONFIG_SPARC32) += divdi3.o udivdi3.o
+ lib-$(CONFIG_SPARC32) += copy_user.o locks.o
+ lib-$(CONFIG_SPARC64) += atomic_64.o
+ lib-$(CONFIG_SPARC32) += lshrdi3.o ashldi3.o
+-lib-$(CONFIG_SPARC32) += muldi3.o bitext.o cmpdi2.o
++lib-$(CONFIG_SPARC32) += muldi3.o bitext.o
+ lib-$(CONFIG_SPARC64) += multi3.o
+ lib-$(CONFIG_SPARC64) += fls.o
+ lib-$(CONFIG_SPARC64) += fls64.o
+@@ -51,5 +51,5 @@ lib-$(CONFIG_SPARC64) += copy_in_user.o memmove.o
+ lib-$(CONFIG_SPARC64) += mcount.o ipcsum.o xor.o hweight.o ffs.o
+ 
+ obj-$(CONFIG_SPARC64) += iomap.o
+-obj-$(CONFIG_SPARC32) += atomic32.o ucmpdi2.o
++obj-$(CONFIG_SPARC32) += atomic32.o
+ obj-$(CONFIG_SPARC64) += PeeCeeI.o
+diff --git a/arch/sparc/lib/cmpdi2.c b/arch/sparc/lib/cmpdi2.c
+deleted file mode 100644
+index 333367fe73533..0000000000000
+--- a/arch/sparc/lib/cmpdi2.c
++++ /dev/null
+@@ -1,28 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-#include <linux/module.h>
+-
+-#include "libgcc.h"
+-
+-word_type __cmpdi2(long long a, long long b)
+-{
+-	const DWunion au = {
+-		.ll = a
+-	};
+-	const DWunion bu = {
+-		.ll = b
+-	};
+-
+-	if (au.s.high < bu.s.high)
+-		return 0;
+-	else if (au.s.high > bu.s.high)
+-		return 2;
+-
+-	if ((unsigned int) au.s.low < (unsigned int) bu.s.low)
+-		return 0;
+-	else if ((unsigned int) au.s.low > (unsigned int) bu.s.low)
+-		return 2;
+-
+-	return 1;
+-}
+-
+-EXPORT_SYMBOL(__cmpdi2);
+diff --git a/arch/sparc/lib/ucmpdi2.c b/arch/sparc/lib/ucmpdi2.c
+deleted file mode 100644
+index 82c1cccb12644..0000000000000
+--- a/arch/sparc/lib/ucmpdi2.c
++++ /dev/null
+@@ -1,20 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-#include <linux/module.h>
+-#include "libgcc.h"
+-
+-word_type __ucmpdi2(unsigned long long a, unsigned long long b)
+-{
+-	const DWunion au = {.ll = a};
+-	const DWunion bu = {.ll = b};
+-
+-	if ((unsigned int) au.s.high < (unsigned int) bu.s.high)
+-		return 0;
+-	else if ((unsigned int) au.s.high > (unsigned int) bu.s.high)
+-		return 2;
+-	if ((unsigned int) au.s.low < (unsigned int) bu.s.low)
+-		return 0;
+-	else if ((unsigned int) au.s.low > (unsigned int) bu.s.low)
+-		return 2;
+-	return 1;
+-}
+-EXPORT_SYMBOL(__ucmpdi2);
+-- 
+2.43.0
+
diff --git a/queue-6.8/spi-consolidate-setting-message-spi.patch b/queue-6.8/spi-consolidate-setting-message-spi.patch
new file mode 100644
index 00000000000..19b09805efa
--- /dev/null
+++ b/queue-6.8/spi-consolidate-setting-message-spi.patch
@@ -0,0 +1,72 @@
+From 856ce6c20bb73b31ce8d77392e462b6aeae56ffa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 15:49:46 -0600
+Subject: spi: consolidate setting message->spi
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit b204aa0f99cfe3c9d796ecfc0bc6f3f89585789e ]
+
+Previously, __spi_sync() and __spi_async() set message->spi to the spi
+device independently after calling __spi_validate(). __spi_validate()
+also would conditionally set this if it needed to split the message
+since it wasn't set yet.
+
+Since both __spi_sync() and __spi_async() call __spi_validate(), we can
+consolidate this into only setting message->spi once (unconditionally)
+in __spi_validate(). This will also save any future callers of
+__spi_validate() from also needing to set message->spi.
+
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://msgid.link/r/20240123214946.2616786-1-dlechner@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: c8bec3355f08 ("spi: move split xfers for CS_WORD emulation")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index f2170f4b50775..8dfe635fffd63 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -4063,6 +4063,8 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message)
+ 	if (list_empty(&message->transfers))
+ 		return -EINVAL;
+ 
++	message->spi = spi;
++
+ 	/*
+ 	 * If an SPI controller does not support toggling the CS line on each
+ 	 * transfer (indicated by the SPI_CS_WORD flag) or we are using a GPIO
+@@ -4075,9 +4077,6 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message)
+ 		size_t maxsize = BITS_TO_BYTES(spi->bits_per_word);
+ 		int ret;
+ 
+-		/* spi_split_transfers_maxsize() requires message->spi */
+-		message->spi = spi;
+-
+ 		ret = spi_split_transfers_maxsize(ctlr, message, maxsize,
+ 						  GFP_KERNEL);
+ 		if (ret)
+@@ -4214,8 +4213,6 @@ static int __spi_async(struct spi_device *spi, struct spi_message *message)
+ 	if (!ctlr->transfer)
+ 		return -ENOTSUPP;
+ 
+-	message->spi = spi;
+-
+ 	SPI_STATISTICS_INCREMENT_FIELD(ctlr->pcpu_statistics, spi_async);
+ 	SPI_STATISTICS_INCREMENT_FIELD(spi->pcpu_statistics, spi_async);
+ 
+@@ -4395,8 +4392,6 @@ static int __spi_sync(struct spi_device *spi, struct spi_message *message)
+ 	if (status != 0)
+ 		return status;
+ 
+-	message->spi = spi;
+-
+ 	SPI_STATISTICS_INCREMENT_FIELD(ctlr->pcpu_statistics, spi_sync);
+ 	SPI_STATISTICS_INCREMENT_FIELD(spi->pcpu_statistics, spi_sync);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/spi-move-split-xfers-for-cs_word-emulation.patch b/queue-6.8/spi-move-split-xfers-for-cs_word-emulation.patch
new file mode 100644
index 00000000000..05b37e026a9
--- /dev/null
+++ b/queue-6.8/spi-move-split-xfers-for-cs_word-emulation.patch
@@ -0,0 +1,119 @@
+From c694c8479a653ab6edb760b69a9495f8e82575b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 15:23:57 -0600
+Subject: spi: move split xfers for CS_WORD emulation
+
+From: David Lechner <dlechner@baylibre.com>
+
+[ Upstream commit c8bec3355f08ddb887d5c13b7095dfa79e6db108 ]
+
+This moves splitting transfers for CS_WORD software emulation to the
+same place where we split transfers for controller-specific reasons.
+
+This fixes a few subtle bugs.
+
+The calculation for maxsize was wrong for bit sizes between 17 and 24.
+This is fixed by making use of spi_split_transfers_maxwords() which
+already has the correct calculation.
+
+Also, since this indirectly calls spi_res_alloc(), to avoid leaking
+resources, spi_finalize_current_message() would need to be called
+on all error paths in __spi_validate() and callers of __spi_validate()
+would need to do the same. This is fixed by moving the call to
+__spi_pump_transfer_message() where it is already splitting transfers
+for other reasons and correctly releases resources in the subsequent
+error paths.
+
+Fixes: cbaa62e0094a ("spi: add software implementation for SPI_CS_WORD")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://lore.kernel.org/r/20240126212358.3916280-2-dlechner@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 63 +++++++++++++++++++++++------------------------
+ 1 file changed, 31 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 8dfe635fffd63..d1b297f438f14 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1747,13 +1747,37 @@ static int __spi_pump_transfer_message(struct spi_controller *ctlr,
+ 
+ 	trace_spi_message_start(msg);
+ 
+-	ret = spi_split_transfers_maxsize(ctlr, msg,
+-					  spi_max_transfer_size(msg->spi),
+-					  GFP_KERNEL | GFP_DMA);
+-	if (ret) {
+-		msg->status = ret;
+-		spi_finalize_current_message(ctlr);
+-		return ret;
++	/*
++	 * If an SPI controller does not support toggling the CS line on each
++	 * transfer (indicated by the SPI_CS_WORD flag) or we are using a GPIO
++	 * for the CS line, we can emulate the CS-per-word hardware function by
++	 * splitting transfers into one-word transfers and ensuring that
++	 * cs_change is set for each transfer.
++	 */
++	if ((msg->spi->mode & SPI_CS_WORD) && (!(ctlr->mode_bits & SPI_CS_WORD) ||
++					       spi_is_csgpiod(msg->spi))) {
++		ret = spi_split_transfers_maxwords(ctlr, msg, 1, GFP_KERNEL);
++		if (ret) {
++			msg->status = ret;
++			spi_finalize_current_message(ctlr);
++			return ret;
++		}
++
++		list_for_each_entry(xfer, &msg->transfers, transfer_list) {
++			/* Don't change cs_change on the last entry in the list */
++			if (list_is_last(&xfer->transfer_list, &msg->transfers))
++				break;
++			xfer->cs_change = 1;
++		}
++	} else {
++		ret = spi_split_transfers_maxsize(ctlr, msg,
++						  spi_max_transfer_size(msg->spi),
++						  GFP_KERNEL | GFP_DMA);
++		if (ret) {
++			msg->status = ret;
++			spi_finalize_current_message(ctlr);
++			return ret;
++		}
+ 	}
+ 
+ 	if (ctlr->prepare_message) {
+@@ -4065,31 +4089,6 @@ static int __spi_validate(struct spi_device *spi, struct spi_message *message)
+ 
+ 	message->spi = spi;
+ 
+-	/*
+-	 * If an SPI controller does not support toggling the CS line on each
+-	 * transfer (indicated by the SPI_CS_WORD flag) or we are using a GPIO
+-	 * for the CS line, we can emulate the CS-per-word hardware function by
+-	 * splitting transfers into one-word transfers and ensuring that
+-	 * cs_change is set for each transfer.
+-	 */
+-	if ((spi->mode & SPI_CS_WORD) && (!(ctlr->mode_bits & SPI_CS_WORD) ||
+-					  spi_is_csgpiod(spi))) {
+-		size_t maxsize = BITS_TO_BYTES(spi->bits_per_word);
+-		int ret;
+-
+-		ret = spi_split_transfers_maxsize(ctlr, message, maxsize,
+-						  GFP_KERNEL);
+-		if (ret)
+-			return ret;
+-
+-		list_for_each_entry(xfer, &message->transfers, transfer_list) {
+-			/* Don't change cs_change on the last entry in the list */
+-			if (list_is_last(&xfer->transfer_list, &message->transfers))
+-				break;
+-			xfer->cs_change = 1;
+-		}
+-	}
+-
+ 	/*
+ 	 * Half-duplex links include original MicroWire, and ones with
+ 	 * only one data pin like SPI_3WIRE (switches direction) or where
+-- 
+2.43.0
+
diff --git a/queue-6.8/sr9800-add-check-for-usbnet_get_endpoints.patch b/queue-6.8/sr9800-add-check-for-usbnet_get_endpoints.patch
new file mode 100644
index 00000000000..1f57bf76c7f
--- /dev/null
+++ b/queue-6.8/sr9800-add-check-for-usbnet_get_endpoints.patch
@@ -0,0 +1,40 @@
+From 2bba94510dcd362ba30f551c6cdb43d5e42e82c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Mar 2024 07:59:27 +0000
+Subject: sr9800: Add check for usbnet_get_endpoints
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit 07161b2416f740a2cb87faa5566873f401440a61 ]
+
+Add check for usbnet_get_endpoints() and return the error if it fails
+in order to transfer the error.
+
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support")
+Link: https://lore.kernel.org/r/20240305075927.261284-1-nichen@iscas.ac.cn
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/sr9800.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c
+index 143bd4ab160df..57947a5590cca 100644
+--- a/drivers/net/usb/sr9800.c
++++ b/drivers/net/usb/sr9800.c
+@@ -737,7 +737,9 @@ static int sr9800_bind(struct usbnet *dev, struct usb_interface *intf)
+ 
+ 	data->eeprom_len = SR9800_EEPROM_LEN;
+ 
+-	usbnet_get_endpoints(dev, intf);
++	ret = usbnet_get_endpoints(dev, intf);
++	if (ret)
++		goto out;
+ 
+ 	/* LED Setting Rule :
+ 	 * AABB:CCDD
+-- 
+2.43.0
+
diff --git a/queue-6.8/staging-media-starfive-set-16-bpp-for-capture_raw-de.patch b/queue-6.8/staging-media-starfive-set-16-bpp-for-capture_raw-de.patch
new file mode 100644
index 00000000000..da72efa53ca
--- /dev/null
+++ b/queue-6.8/staging-media-starfive-set-16-bpp-for-capture_raw-de.patch
@@ -0,0 +1,60 @@
+From c95e2b89d10d559a535c910ceb6bfd3a00f28819 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 01:24:32 -0800
+Subject: staging: media: starfive: Set 16 bpp for capture_raw device
+
+From: Changhuang Liang <changhuang.liang@starfivetech.com>
+
+[ Upstream commit a38cd27c9ee8c25308b71ea16393d0c231e9bde4 ]
+
+For StarFive JH7110 Camera Subsystem, capture_raw video device output
+raw10 pixelformat requires 16bit of alignment.
+
+Fixes: e080f339c80a ("media: staging: media: starfive: camss: Add capture driver")
+Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/starfive/camss/stf-capture.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/starfive/camss/stf-capture.c b/drivers/staging/media/starfive/camss/stf-capture.c
+index 70c24b050a1b5..ec5169e7b3918 100644
+--- a/drivers/staging/media/starfive/camss/stf-capture.c
++++ b/drivers/staging/media/starfive/camss/stf-capture.c
+@@ -20,28 +20,28 @@ static const struct stfcamss_format_info stf_wr_fmts[] = {
+ 		.pixelformat = V4L2_PIX_FMT_SRGGB10,
+ 		.planes = 1,
+ 		.vsub = { 1 },
+-		.bpp = 10,
++		.bpp = 16,
+ 	},
+ 	{
+ 		.code = MEDIA_BUS_FMT_SGRBG10_1X10,
+ 		.pixelformat = V4L2_PIX_FMT_SGRBG10,
+ 		.planes = 1,
+ 		.vsub = { 1 },
+-		.bpp = 10,
++		.bpp = 16,
+ 	},
+ 	{
+ 		.code = MEDIA_BUS_FMT_SGBRG10_1X10,
+ 		.pixelformat = V4L2_PIX_FMT_SGBRG10,
+ 		.planes = 1,
+ 		.vsub = { 1 },
+-		.bpp = 10,
++		.bpp = 16,
+ 	},
+ 	{
+ 		.code = MEDIA_BUS_FMT_SBGGR10_1X10,
+ 		.pixelformat = V4L2_PIX_FMT_SBGGR10,
+ 		.planes = 1,
+ 		.vsub = { 1 },
+-		.bpp = 10,
++		.bpp = 16,
+ 	},
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/sunrpc-fix-a-memleak-in-gss_import_v2_context.patch b/queue-6.8/sunrpc-fix-a-memleak-in-gss_import_v2_context.patch
new file mode 100644
index 00000000000..4cb8b5e4c3c
--- /dev/null
+++ b/queue-6.8/sunrpc-fix-a-memleak-in-gss_import_v2_context.patch
@@ -0,0 +1,59 @@
+From 1a568bb97a00635cb2748e77662f19c3fae14eb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 16:20:33 +0800
+Subject: SUNRPC: fix a memleak in gss_import_v2_context
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit e67b652d8e8591d3b1e569dbcdfcee15993e91fa ]
+
+The ctx->mech_used.data allocated by kmemdup is not freed in neither
+gss_import_v2_context nor it only caller gss_krb5_import_sec_context,
+which frees ctx on error.
+
+Thus, this patch reform the last call of gss_import_v2_context to the
+gss_krb5_import_ctx_v2, preventing the memleak while keepping the return
+formation.
+
+Fixes: 47d848077629 ("gss_krb5: handle new context format from gssd")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/gss_krb5_mech.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
+index 64cff717c3d9b..3366505bc669a 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
++++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
+@@ -398,6 +398,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
+ 	u64 seq_send64;
+ 	int keylen;
+ 	u32 time32;
++	int ret;
+ 
+ 	p = simple_get_bytes(p, end, &ctx->flags, sizeof(ctx->flags));
+ 	if (IS_ERR(p))
+@@ -450,8 +451,16 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
+ 	}
+ 	ctx->mech_used.len = gss_kerberos_mech.gm_oid.len;
+ 
+-	return gss_krb5_import_ctx_v2(ctx, gfp_mask);
++	ret = gss_krb5_import_ctx_v2(ctx, gfp_mask);
++	if (ret) {
++		p = ERR_PTR(ret);
++		goto out_free;
++	}
+ 
++	return 0;
++
++out_free:
++	kfree(ctx->mech_used.data);
+ out_err:
+ 	return PTR_ERR(p);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch b/queue-6.8/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
new file mode 100644
index 00000000000..adee756dd77
--- /dev/null
+++ b/queue-6.8/sunrpc-fix-some-memleaks-in-gssx_dec_option_array.patch
@@ -0,0 +1,86 @@
+From 060eaf078b989bc0b64218e16561c61ae2d9829f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 13:38:13 +0800
+Subject: SUNRPC: fix some memleaks in gssx_dec_option_array
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 3cfcfc102a5e57b021b786a755a38935e357797d ]
+
+The creds and oa->data need to be freed in the error-handling paths after
+their allocation. So this patch add these deallocations in the
+corresponding paths.
+
+Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/auth_gss/gss_rpc_xdr.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+index d79f12c2550ac..cb32ab9a83952 100644
+--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c
++++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c
+@@ -250,8 +250,8 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
+ 
+ 	creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL);
+ 	if (!creds) {
+-		kfree(oa->data);
+-		return -ENOMEM;
++		err = -ENOMEM;
++		goto free_oa;
+ 	}
+ 
+ 	oa->data[0].option.data = CREDS_VALUE;
+@@ -265,29 +265,40 @@ static int gssx_dec_option_array(struct xdr_stream *xdr,
+ 
+ 		/* option buffer */
+ 		p = xdr_inline_decode(xdr, 4);
+-		if (unlikely(p == NULL))
+-			return -ENOSPC;
++		if (unlikely(p == NULL)) {
++			err = -ENOSPC;
++			goto free_creds;
++		}
+ 
+ 		length = be32_to_cpup(p);
+ 		p = xdr_inline_decode(xdr, length);
+-		if (unlikely(p == NULL))
+-			return -ENOSPC;
++		if (unlikely(p == NULL)) {
++			err = -ENOSPC;
++			goto free_creds;
++		}
+ 
+ 		if (length == sizeof(CREDS_VALUE) &&
+ 		    memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {
+ 			/* We have creds here. parse them */
+ 			err = gssx_dec_linux_creds(xdr, creds);
+ 			if (err)
+-				return err;
++				goto free_creds;
+ 			oa->data[0].value.len = 1; /* presence */
+ 		} else {
+ 			/* consume uninteresting buffer */
+ 			err = gssx_dec_buffer(xdr, &dummy);
+ 			if (err)
+-				return err;
++				goto free_creds;
+ 		}
+ 	}
+ 	return 0;
++
++free_creds:
++	kfree(creds);
++free_oa:
++	kfree(oa->data);
++	oa->data = NULL;
++	return err;
+ }
+ 
+ static int gssx_dec_status(struct xdr_stream *xdr,
+-- 
+2.43.0
+
diff --git a/queue-6.8/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch b/queue-6.8/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
new file mode 100644
index 00000000000..55c01c7dbf6
--- /dev/null
+++ b/queue-6.8/tcp-fix-incorrect-parameter-validation-in-the-do_tcp.patch
@@ -0,0 +1,47 @@
+From a80ff49cf10c4b1396549f1e902cbe07b34fa952 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:49 +0000
+Subject: tcp: fix incorrect parameter validation in the do_tcp_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 716edc9706deb3bb2ff56e2eeb83559cea8f22db ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index c82dc42f57c65..a4f4185923144 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -4010,11 +4010,11 @@ int do_tcp_getsockopt(struct sock *sk, int level,
+ 	if (copy_from_sockptr(&len, optlen, sizeof(int)))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	switch (optname) {
+ 	case TCP_MAXSEG:
+ 		val = tp->mss_cache;
+-- 
+2.43.0
+
diff --git a/queue-6.8/time-test-fix-incorrect-format-specifier.patch b/queue-6.8/time-test-fix-incorrect-format-specifier.patch
new file mode 100644
index 00000000000..a1cd2ae9161
--- /dev/null
+++ b/queue-6.8/time-test-fix-incorrect-format-specifier.patch
@@ -0,0 +1,40 @@
+From 1d32815514329bb5d39a5044067a74b5bc6c1283 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Feb 2024 17:27:17 +0800
+Subject: time: test: Fix incorrect format specifier
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit 133e267ef4a26d19c93996a874714e9f3f8c70aa ]
+
+'days' is a s64 (from div_s64), and so should use a %lld specifier.
+
+This was found by extending KUnit's assertion macros to use gcc's
+__printf attribute.
+
+Fixes: 276010551664 ("time: Improve performance of time64_to_tm()")
+Signed-off-by: David Gow <davidgow@google.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Justin Stitt <justinstitt@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/time_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/time_test.c b/kernel/time/time_test.c
+index ca058c8af6baf..3e5d422dd15cb 100644
+--- a/kernel/time/time_test.c
++++ b/kernel/time/time_test.c
+@@ -73,7 +73,7 @@ static void time64_to_tm_test_date_range(struct kunit *test)
+ 
+ 		days = div_s64(secs, 86400);
+ 
+-		#define FAIL_MSG "%05ld/%02d/%02d (%2d) : %ld", \
++		#define FAIL_MSG "%05ld/%02d/%02d (%2d) : %lld", \
+ 			year, month, mdday, yday, days
+ 
+ 		KUNIT_ASSERT_EQ_MSG(test, year - 1900, result.tm_year, FAIL_MSG);
+-- 
+2.43.0
+
diff --git a/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-corner.patch b/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-corner.patch
new file mode 100644
index 00000000000..64a4b8c60d4
--- /dev/null
+++ b/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-corner.patch
@@ -0,0 +1,114 @@
+From eb275d7480f15dee9464f54064ad594cee9ac9bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 08:38:40 +0100
+Subject: timekeeping: Fix cross-timestamp interpolation corner case decision
+
+From: Peter Hilber <peter.hilber@opensynergy.com>
+
+[ Upstream commit 87a41130881995f82f7adbafbfeddaebfb35f0ef ]
+
+The cycle_between() helper checks if parameter test is in the open interval
+(before, after). Colloquially speaking, this also applies to the counter
+wrap-around special case before > after. get_device_system_crosststamp()
+currently uses cycle_between() at the first call site to decide whether to
+interpolate for older counter readings.
+
+get_device_system_crosststamp() has the following problem with
+cycle_between() testing against an open interval: Assume that, by chance,
+cycles == tk->tkr_mono.cycle_last (in the following, "cycle_last" for
+brevity). Then, cycle_between() at the first call site, with effective
+argument values cycle_between(cycle_last, cycles, now), returns false,
+enabling interpolation. During interpolation,
+get_device_system_crosststamp() will then call cycle_between() at the
+second call site (if a history_begin was supplied). The effective argument
+values are cycle_between(history_begin->cycles, cycles, cycles), since
+system_counterval.cycles == interval_start == cycles, per the assumption.
+Due to the test against the open interval, cycle_between() returns false
+again. This causes get_device_system_crosststamp() to return -EINVAL.
+
+This failure should be avoided, since get_device_system_crosststamp() works
+both when cycles follows cycle_last (no interpolation), and when cycles
+precedes cycle_last (interpolation). For the case cycles == cycle_last,
+interpolation is actually unneeded.
+
+Fix this by changing cycle_between() into timestamp_in_interval(), which
+now checks against the closed interval, rather than the open interval.
+
+This changes the get_device_system_crosststamp() behavior for three corner
+cases:
+
+1. Bypass interpolation in the case cycles == tk->tkr_mono.cycle_last,
+   fixing the problem described above.
+
+2. At the first timestamp_in_interval() call site, cycles == now no longer
+   causes failure.
+
+3. At the second timestamp_in_interval() call site, history_begin->cycles
+   == system_counterval.cycles no longer causes failure.
+   adjust_historical_crosststamp() also works for this corner case,
+   where partial_history_cycles == total_history_cycles.
+
+These behavioral changes should not cause any problems.
+
+Fixes: 2c756feb18d9 ("time: Add history to cross timestamp interface supporting slower devices")
+Signed-off-by: Peter Hilber <peter.hilber@opensynergy.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20231218073849.35294-3-peter.hilber@opensynergy.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 8f35455b62509..4e9f2f88c9d6e 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1180,13 +1180,15 @@ static int adjust_historical_crosststamp(struct system_time_snapshot *history,
+ }
+ 
+ /*
+- * cycle_between - true if test occurs chronologically between before and after
++ * timestamp_in_interval - true if ts is chronologically in [start, end]
++ *
++ * True if ts occurs chronologically at or after start, and before or at end.
+  */
+-static bool cycle_between(u64 before, u64 test, u64 after)
++static bool timestamp_in_interval(u64 start, u64 end, u64 ts)
+ {
+-	if (test > before && test < after)
++	if (ts >= start && ts <= end)
+ 		return true;
+-	if (before > after && (test > before || test < after))
++	if (start > end && (ts >= start || ts <= end))
+ 		return true;
+ 	return false;
+ }
+@@ -1246,7 +1248,7 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ 		 */
+ 		now = tk_clock_read(&tk->tkr_mono);
+ 		interval_start = tk->tkr_mono.cycle_last;
+-		if (!cycle_between(interval_start, cycles, now)) {
++		if (!timestamp_in_interval(interval_start, now, cycles)) {
+ 			clock_was_set_seq = tk->clock_was_set_seq;
+ 			cs_was_changed_seq = tk->cs_was_changed_seq;
+ 			cycles = interval_start;
+@@ -1277,13 +1279,13 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ 		bool discontinuity;
+ 
+ 		/*
+-		 * Check that the counter value occurs after the provided
++		 * Check that the counter value is not before the provided
+ 		 * history reference and that the history doesn't cross a
+ 		 * clocksource change
+ 		 */
+ 		if (!history_begin ||
+-		    !cycle_between(history_begin->cycles,
+-				   system_counterval.cycles, cycles) ||
++		    !timestamp_in_interval(history_begin->cycles,
++					   cycles, system_counterval.cycles) ||
+ 		    history_begin->cs_was_changed_seq != cs_was_changed_seq)
+ 			return -EINVAL;
+ 		partial_history_cycles = cycles - system_counterval.cycles;
+-- 
+2.43.0
+
diff --git a/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-for-no.patch b/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-for-no.patch
new file mode 100644
index 00000000000..31dd00e0e0f
--- /dev/null
+++ b/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-for-no.patch
@@ -0,0 +1,58 @@
+From 0bcee8b1c38ec6cef1dbe83ee547a97193850137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 08:38:41 +0100
+Subject: timekeeping: Fix cross-timestamp interpolation for non-x86
+
+From: Peter Hilber <peter.hilber@opensynergy.com>
+
+[ Upstream commit 14274d0bd31b4debf28284604589f596ad2e99f2 ]
+
+So far, get_device_system_crosststamp() unconditionally passes
+system_counterval.cycles to timekeeping_cycles_to_ns(). But when
+interpolating system time (do_interp == true), system_counterval.cycles is
+before tkr_mono.cycle_last, contrary to the timekeeping_cycles_to_ns()
+expectations.
+
+On x86, CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE will mitigate on
+interpolating, setting delta to 0. With delta == 0, xtstamp->sys_monoraw
+and xtstamp->sys_realtime are then set to the last update time, as
+implicitly expected by adjust_historical_crosststamp(). On other
+architectures, the resulting nonsense xtstamp->sys_monoraw and
+xtstamp->sys_realtime corrupt the xtstamp (ts) adjustment in
+adjust_historical_crosststamp().
+
+Fix this by deriving xtstamp->sys_monoraw and xtstamp->sys_realtime from
+the last update time when interpolating, by using the local variable
+"cycles". The local variable already has the right value when
+interpolating, unlike system_counterval.cycles.
+
+Fixes: 2c756feb18d9 ("time: Add history to cross timestamp interface supporting slower devices")
+Signed-off-by: Peter Hilber <peter.hilber@opensynergy.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: John Stultz <jstultz@google.com>
+Link: https://lore.kernel.org/r/20231218073849.35294-4-peter.hilber@opensynergy.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 4e9f2f88c9d6e..8aab7ed414907 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1261,10 +1261,8 @@ int get_device_system_crosststamp(int (*get_time_fn)
+ 				      tk_core.timekeeper.offs_real);
+ 		base_raw = tk->tkr_raw.base;
+ 
+-		nsec_real = timekeeping_cycles_to_ns(&tk->tkr_mono,
+-						     system_counterval.cycles);
+-		nsec_raw = timekeeping_cycles_to_ns(&tk->tkr_raw,
+-						    system_counterval.cycles);
++		nsec_real = timekeeping_cycles_to_ns(&tk->tkr_mono, cycles);
++		nsec_raw = timekeeping_cycles_to_ns(&tk->tkr_raw, cycles);
+ 	} while (read_seqcount_retry(&tk_core.seq, seq));
+ 
+ 	xtstamp->sys_realtime = ktime_add_ns(base_real, nsec_real);
+-- 
+2.43.0
+
diff --git a/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch b/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
new file mode 100644
index 00000000000..4786bd993a4
--- /dev/null
+++ b/queue-6.8/timekeeping-fix-cross-timestamp-interpolation-on-cou.patch
@@ -0,0 +1,43 @@
+From a073a175ad09808e5ba95af157b0ff96a4adda80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 08:38:39 +0100
+Subject: timekeeping: Fix cross-timestamp interpolation on counter wrap
+
+From: Peter Hilber <peter.hilber@opensynergy.com>
+
+[ Upstream commit 84dccadd3e2a3f1a373826ad71e5ced5e76b0c00 ]
+
+cycle_between() decides whether get_device_system_crosststamp() will
+interpolate for older counter readings.
+
+cycle_between() yields wrong results for a counter wrap-around where after
+< before < test, and for the case after < test < before.
+
+Fix the comparison logic.
+
+Fixes: 2c756feb18d9 ("time: Add history to cross timestamp interface supporting slower devices")
+Signed-off-by: Peter Hilber <peter.hilber@opensynergy.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: John Stultz <jstultz@google.com>
+Link: https://lore.kernel.org/r/20231218073849.35294-2-peter.hilber@opensynergy.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/timekeeping.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 266d02809dbb1..8f35455b62509 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1186,7 +1186,7 @@ static bool cycle_between(u64 before, u64 test, u64 after)
+ {
+ 	if (test > before && test < after)
+ 		return true;
+-	if (test < before && before > after)
++	if (before > after && (test > before || test < after))
+ 		return true;
+ 	return false;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/tools-resolve_btfids-fix-cross-compilation-to-non-ho.patch b/queue-6.8/tools-resolve_btfids-fix-cross-compilation-to-non-ho.patch
new file mode 100644
index 00000000000..d0f28b4d372
--- /dev/null
+++ b/queue-6.8/tools-resolve_btfids-fix-cross-compilation-to-non-ho.patch
@@ -0,0 +1,121 @@
+From 06115b84b09b53a9377d7e719ba7819c08d7dd86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 13:46:10 +0100
+Subject: tools/resolve_btfids: Fix cross-compilation to non-host endianness
+
+From: Viktor Malik <vmalik@redhat.com>
+
+[ Upstream commit 903fad4394666bc23975c93fb58f137ce64b5192 ]
+
+The .BTF_ids section is pre-filled with zeroed BTF ID entries during the
+build and afterwards patched by resolve_btfids with correct values.
+Since resolve_btfids always writes in host-native endianness, it relies
+on libelf to do the translation when the target ELF is cross-compiled to
+a different endianness (this was introduced in commit 61e8aeda9398
+("bpf: Fix libelf endian handling in resolv_btfids")).
+
+Unfortunately, the translation will corrupt the flags fields of SET8
+entries because these were written during vmlinux compilation and are in
+the correct endianness already. This will lead to numerous selftests
+failures such as:
+
+    $ sudo ./test_verifier 502 502
+    #502/p sleepable fentry accept FAIL
+    Failed to load prog 'Invalid argument'!
+    bpf_fentry_test1 is not sleepable
+    verification time 34 usec
+    stack depth 0
+    processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
+    Summary: 0 PASSED, 0 SKIPPED, 1 FAILED
+
+Since it's not possible to instruct libelf to translate just certain
+values, let's manually bswap the flags (both global and entry flags) in
+resolve_btfids when needed, so that libelf then translates everything
+correctly.
+
+Fixes: ef2c6f370a63 ("tools/resolve_btfids: Add support for 8-byte BTF sets")
+Signed-off-by: Viktor Malik <vmalik@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/7b6bff690919555574ce0f13d2a5996cacf7bf69.1707223196.git.vmalik@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/resolve_btfids/main.c | 35 +++++++++++++++++++++++++++++++++
+ 1 file changed, 35 insertions(+)
+
+diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
+index 32634f00abba4..d9520cb826b31 100644
+--- a/tools/bpf/resolve_btfids/main.c
++++ b/tools/bpf/resolve_btfids/main.c
+@@ -90,6 +90,14 @@
+ 
+ #define ADDR_CNT	100
+ 
++#if __BYTE_ORDER == __LITTLE_ENDIAN
++# define ELFDATANATIVE	ELFDATA2LSB
++#elif __BYTE_ORDER == __BIG_ENDIAN
++# define ELFDATANATIVE	ELFDATA2MSB
++#else
++# error "Unknown machine endianness!"
++#endif
++
+ struct btf_id {
+ 	struct rb_node	 rb_node;
+ 	char		*name;
+@@ -117,6 +125,7 @@ struct object {
+ 		int		 idlist_shndx;
+ 		size_t		 strtabidx;
+ 		unsigned long	 idlist_addr;
++		int		 encoding;
+ 	} efile;
+ 
+ 	struct rb_root	sets;
+@@ -320,6 +329,7 @@ static int elf_collect(struct object *obj)
+ {
+ 	Elf_Scn *scn = NULL;
+ 	size_t shdrstrndx;
++	GElf_Ehdr ehdr;
+ 	int idx = 0;
+ 	Elf *elf;
+ 	int fd;
+@@ -351,6 +361,13 @@ static int elf_collect(struct object *obj)
+ 		return -1;
+ 	}
+ 
++	if (gelf_getehdr(obj->efile.elf, &ehdr) == NULL) {
++		pr_err("FAILED cannot get ELF header: %s\n",
++			elf_errmsg(-1));
++		return -1;
++	}
++	obj->efile.encoding = ehdr.e_ident[EI_DATA];
++
+ 	/*
+ 	 * Scan all the elf sections and look for save data
+ 	 * from .BTF_ids section and symbols.
+@@ -681,6 +698,24 @@ static int sets_patch(struct object *obj)
+ 			 */
+ 			BUILD_BUG_ON(set8->pairs != &set8->pairs[0].id);
+ 			qsort(set8->pairs, set8->cnt, sizeof(set8->pairs[0]), cmp_id);
++
++			/*
++			 * When ELF endianness does not match endianness of the
++			 * host, libelf will do the translation when updating
++			 * the ELF. This, however, corrupts SET8 flags which are
++			 * already in the target endianness. So, let's bswap
++			 * them to the host endianness and libelf will then
++			 * correctly translate everything.
++			 */
++			if (obj->efile.encoding != ELFDATANATIVE) {
++				int i;
++
++				set8->flags = bswap_32(set8->flags);
++				for (i = 0; i < set8->cnt; i++) {
++					set8->pairs[i].flags =
++						bswap_32(set8->pairs[i].flags);
++				}
++			}
+ 		}
+ 
+ 		pr_debug("sorting  addr %5lu: cnt %6d [%s]\n",
+-- 
+2.43.0
+
diff --git a/queue-6.8/tools-resolve_btfids-refactor-set-sorting-with-types.patch b/queue-6.8/tools-resolve_btfids-refactor-set-sorting-with-types.patch
new file mode 100644
index 00000000000..fb1d0f0474d
--- /dev/null
+++ b/queue-6.8/tools-resolve_btfids-refactor-set-sorting-with-types.patch
@@ -0,0 +1,145 @@
+From 9503e73b3a31358120ccb407ecc3d26fad9e16f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 13:46:09 +0100
+Subject: tools/resolve_btfids: Refactor set sorting with types from btf_ids.h
+
+From: Viktor Malik <vmalik@redhat.com>
+
+[ Upstream commit 9707ac4fe2f5bac6406d2403f8b8a64d7b3d8e43 ]
+
+Instead of using magic offsets to access BTF ID set data, leverage types
+from btf_ids.h (btf_id_set and btf_id_set8) which define the actual
+layout of the data. Thanks to this change, set sorting should also
+continue working if the layout changes.
+
+This requires to sync the definition of 'struct btf_id_set8' from
+include/linux/btf_ids.h to tools/include/linux/btf_ids.h. We don't sync
+the rest of the file at the moment, b/c that would require to also sync
+multiple dependent headers and we don't need any other defs from
+btf_ids.h.
+
+Signed-off-by: Viktor Malik <vmalik@redhat.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Daniel Xu <dxu@dxuuu.xyz>
+Link: https://lore.kernel.org/bpf/ff7f062ddf6a00815fda3087957c4ce667f50532.1707223196.git.vmalik@redhat.com
+Stable-dep-of: 903fad439466 ("tools/resolve_btfids: Fix cross-compilation to non-host endianness")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/resolve_btfids/main.c | 35 ++++++++++++++++++++-------------
+ tools/include/linux/btf_ids.h   |  9 +++++++++
+ 2 files changed, 30 insertions(+), 14 deletions(-)
+
+diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c
+index 27a23196d58e1..32634f00abba4 100644
+--- a/tools/bpf/resolve_btfids/main.c
++++ b/tools/bpf/resolve_btfids/main.c
+@@ -70,6 +70,7 @@
+ #include <sys/stat.h>
+ #include <fcntl.h>
+ #include <errno.h>
++#include <linux/btf_ids.h>
+ #include <linux/rbtree.h>
+ #include <linux/zalloc.h>
+ #include <linux/err.h>
+@@ -78,7 +79,7 @@
+ #include <subcmd/parse-options.h>
+ 
+ #define BTF_IDS_SECTION	".BTF_ids"
+-#define BTF_ID		"__BTF_ID__"
++#define BTF_ID_PREFIX	"__BTF_ID__"
+ 
+ #define BTF_STRUCT	"struct"
+ #define BTF_UNION	"union"
+@@ -161,7 +162,7 @@ static int eprintf(int level, int var, const char *fmt, ...)
+ 
+ static bool is_btf_id(const char *name)
+ {
+-	return name && !strncmp(name, BTF_ID, sizeof(BTF_ID) - 1);
++	return name && !strncmp(name, BTF_ID_PREFIX, sizeof(BTF_ID_PREFIX) - 1);
+ }
+ 
+ static struct btf_id *btf_id__find(struct rb_root *root, const char *name)
+@@ -441,7 +442,7 @@ static int symbols_collect(struct object *obj)
+ 		 * __BTF_ID__TYPE__vfs_truncate__0
+ 		 * prefix =  ^
+ 		 */
+-		prefix = name + sizeof(BTF_ID) - 1;
++		prefix = name + sizeof(BTF_ID_PREFIX) - 1;
+ 
+ 		/* struct */
+ 		if (!strncmp(prefix, BTF_STRUCT, sizeof(BTF_STRUCT) - 1)) {
+@@ -649,19 +650,18 @@ static int cmp_id(const void *pa, const void *pb)
+ static int sets_patch(struct object *obj)
+ {
+ 	Elf_Data *data = obj->efile.idlist;
+-	int *ptr = data->d_buf;
+ 	struct rb_node *next;
+ 
+ 	next = rb_first(&obj->sets);
+ 	while (next) {
+-		unsigned long addr, idx;
++		struct btf_id_set8 *set8;
++		struct btf_id_set *set;
++		unsigned long addr, off;
+ 		struct btf_id *id;
+-		int *base;
+-		int cnt;
+ 
+ 		id   = rb_entry(next, struct btf_id, rb_node);
+ 		addr = id->addr[0];
+-		idx  = addr - obj->efile.idlist_addr;
++		off = addr - obj->efile.idlist_addr;
+ 
+ 		/* sets are unique */
+ 		if (id->addr_cnt != 1) {
+@@ -670,14 +670,21 @@ static int sets_patch(struct object *obj)
+ 			return -1;
+ 		}
+ 
+-		idx = idx / sizeof(int);
+-		base = &ptr[idx] + (id->is_set8 ? 2 : 1);
+-		cnt = ptr[idx];
++		if (id->is_set) {
++			set = data->d_buf + off;
++			qsort(set->ids, set->cnt, sizeof(set->ids[0]), cmp_id);
++		} else {
++			set8 = data->d_buf + off;
++			/*
++			 * Make sure id is at the beginning of the pairs
++			 * struct, otherwise the below qsort would not work.
++			 */
++			BUILD_BUG_ON(set8->pairs != &set8->pairs[0].id);
++			qsort(set8->pairs, set8->cnt, sizeof(set8->pairs[0]), cmp_id);
++		}
+ 
+ 		pr_debug("sorting  addr %5lu: cnt %6d [%s]\n",
+-			 (idx + 1) * sizeof(int), cnt, id->name);
+-
+-		qsort(base, cnt, id->is_set8 ? sizeof(uint64_t) : sizeof(int), cmp_id);
++			 off, id->is_set ? set->cnt : set8->cnt, id->name);
+ 
+ 		next = rb_next(next);
+ 	}
+diff --git a/tools/include/linux/btf_ids.h b/tools/include/linux/btf_ids.h
+index 2f882d5cb30f5..72535f00572f6 100644
+--- a/tools/include/linux/btf_ids.h
++++ b/tools/include/linux/btf_ids.h
+@@ -8,6 +8,15 @@ struct btf_id_set {
+ 	u32 ids[];
+ };
+ 
++struct btf_id_set8 {
++	u32 cnt;
++	u32 flags;
++	struct {
++		u32 id;
++		u32 flags;
++	} pairs[];
++};
++
+ #ifdef CONFIG_DEBUG_INFO_BTF
+ 
+ #include <linux/compiler.h> /* for __PASTE */
+-- 
+2.43.0
+
diff --git a/queue-6.8/tty-mips_ejtag_fdc-fix-passing-incompatible-pointer-.patch b/queue-6.8/tty-mips_ejtag_fdc-fix-passing-incompatible-pointer-.patch
new file mode 100644
index 00000000000..ab7028b348d
--- /dev/null
+++ b/queue-6.8/tty-mips_ejtag_fdc-fix-passing-incompatible-pointer-.patch
@@ -0,0 +1,51 @@
+From 3804bdb51f0d0d6ad30275ff05143e27686f7e7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Feb 2024 20:17:29 +0300
+Subject: tty: mips_ejtag_fdc: Fix passing incompatible pointer type warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Serge Semin <fancer.lancer@gmail.com>
+
+[ Upstream commit 188942f05ce45f80c06f7242ad7478bd204c3387 ]
+
+mips_ejtag_fdc_encode() method expects having a first argument passed of
+the "u8 **" type, meanwhile the driver passes the "const char **" type.
+That causes the next build-warning:
+
+drivers/tty/mips_ejtag_fdc.c: In function ‘mips_ejtag_fdc_console_write’:
+drivers/tty/mips_ejtag_fdc.c:343:32: error: passing argument 1 of ‘mips_ejtag_fdc_encode’ from incompatible pointer type [-Werror=incompatible-pointer-types]
+   word = mips_ejtag_fdc_encode(&buf_ptr, &buf_len, 1);
+                                ^
+drivers/tty/mips_ejtag_fdc.c:216:24: note: expected ‘const u8 ** {aka const unsigned char **}’ but argument is of type ‘const char **’
+ static struct fdc_word mips_ejtag_fdc_encode(const u8 **ptrs,
+                        ^~~~~~~~~~~~~~~~~~~~~
+
+Fix it by altering the type of the pointer which is passed to the
+mips_ejtag_fdc_encode() method.
+
+Fixes: ce7cbd9a6c81 ("tty: mips_ejtag_fdc: use u8 for character pointers")
+Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/mips_ejtag_fdc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/mips_ejtag_fdc.c b/drivers/tty/mips_ejtag_fdc.c
+index aac80b69a069c..afbf7738c7c47 100644
+--- a/drivers/tty/mips_ejtag_fdc.c
++++ b/drivers/tty/mips_ejtag_fdc.c
+@@ -309,7 +309,7 @@ static void mips_ejtag_fdc_console_write(struct console *c, const char *s,
+ 	unsigned int i, buf_len, cpu;
+ 	bool done_cr = false;
+ 	char buf[4];
+-	const char *buf_ptr = buf;
++	const u8 *buf_ptr = buf;
+ 	/* Number of bytes of input data encoded up to each byte in buf */
+ 	u8 inc[4];
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch b/queue-6.8/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
new file mode 100644
index 00000000000..ff1858e1af2
--- /dev/null
+++ b/queue-6.8/udp-fix-incorrect-parameter-validation-in-the-udp_li.patch
@@ -0,0 +1,47 @@
+From a6076e51abf37c3fe69c7270cac7174d10742c2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2024 14:23:50 +0000
+Subject: udp: fix incorrect parameter validation in the udp_lib_getsockopt()
+ function
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit 4bb3ba7b74fceec6f558745b25a43c6521cf5506 ]
+
+The 'len' variable can't be negative when assigned the result of
+'min_t' because all 'min_t' parameters are cast to unsigned int,
+and then the minimum one is chosen.
+
+To fix the logic, check 'len' as read from 'optlen',
+where the types of relevant variables are (signed) int.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/udp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index e474b201900f9..17231c0f88302 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2792,11 +2792,11 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+-	len = min_t(unsigned int, len, sizeof(int));
+-
+ 	if (len < 0)
+ 		return -EINVAL;
+ 
++	len = min_t(unsigned int, len, sizeof(int));
++
+ 	switch (optname) {
+ 	case UDP_CORK:
+ 		val = udp_test_bit(CORK, sk);
+-- 
+2.43.0
+
diff --git a/queue-6.8/watchdog-starfive-check-pm_runtime_enabled-before-de.patch b/queue-6.8/watchdog-starfive-check-pm_runtime_enabled-before-de.patch
new file mode 100644
index 00000000000..01d7652124f
--- /dev/null
+++ b/queue-6.8/watchdog-starfive-check-pm_runtime_enabled-before-de.patch
@@ -0,0 +1,51 @@
+From 97cf6467f61bc86a71e82114b5f4af836ee1a764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Jan 2024 16:27:21 +0800
+Subject: watchdog: starfive: Check pm_runtime_enabled() before decrementing
+ usage counter
+
+From: Ji Sheng Teoh <jisheng.teoh@starfivetech.com>
+
+[ Upstream commit 8bc22a2f1bf0f402029087fcb53130233a544fed ]
+
+In the probe function, pm_runtime_put_sync() will fail on platform with
+runtime PM disabled.
+Check if runtime PM is enabled before calling pm_runtime_put_sync() to
+fix it.
+
+Fixes: db728ea9c7be ("drivers: watchdog: Add StarFive Watchdog driver")
+Signed-off-by: Xingyu Wu <xingyu.wu@starfivetech.com>
+Signed-off-by: Ley Foon Tan <leyfoon.tan@starfivetech.com>
+Signed-off-by: Ji Sheng Teoh <jisheng.teoh@starfivetech.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20240119082722.1133024-1-jisheng.teoh@starfivetech.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/starfive-wdt.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/starfive-wdt.c b/drivers/watchdog/starfive-wdt.c
+index e28ead24c520e..df68ae4acbd7e 100644
+--- a/drivers/watchdog/starfive-wdt.c
++++ b/drivers/watchdog/starfive-wdt.c
+@@ -494,8 +494,13 @@ static int starfive_wdt_probe(struct platform_device *pdev)
+ 	if (ret)
+ 		goto err_exit;
+ 
+-	if (!early_enable)
+-		pm_runtime_put_sync(&pdev->dev);
++	if (!early_enable) {
++		if (pm_runtime_enabled(&pdev->dev)) {
++			ret = pm_runtime_put_sync(&pdev->dev);
++			if (ret)
++				goto err_exit;
++		}
++	}
+ 
+ 	return 0;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/watchdog-stm32_iwdg-initialize-default-timeout.patch b/queue-6.8/watchdog-stm32_iwdg-initialize-default-timeout.patch
new file mode 100644
index 00000000000..a23e8e64186
--- /dev/null
+++ b/queue-6.8/watchdog-stm32_iwdg-initialize-default-timeout.patch
@@ -0,0 +1,59 @@
+From 2d0c73f10b63bc69050467f37bf0bd349f09b9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Feb 2024 13:27:23 -0500
+Subject: watchdog: stm32_iwdg: initialize default timeout
+
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+
+[ Upstream commit dbd7c0088b7f44aa0b9276ed3449df075a7b5b54 ]
+
+The driver never sets a default timeout value, therefore it is
+initialized to zero. When CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED is
+enabled, the watchdog is started during probe. The kernel is supposed to
+automatically ping the watchdog from this point until userspace takes
+over, but this does not happen if the configured timeout is zero. A zero
+timeout causes watchdog_need_worker() to return false, so the heartbeat
+worker does not run and the system therefore resets soon after the
+driver is probed.
+
+This patch fixes this by setting an arbitrary non-zero default timeout.
+The default could be read from the hardware instead, but I didn't see
+any reason to add this complexity.
+
+This has been tested on an STM32F746.
+
+Fixes: 85fdc63fe256 ("drivers: watchdog: stm32_iwdg: set WDOG_HW_RUNNING at probe")
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20240228182723.12855-1-ben.wolsieffer@hefring.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/stm32_iwdg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/watchdog/stm32_iwdg.c b/drivers/watchdog/stm32_iwdg.c
+index d9fd50df9802c..5404e03876202 100644
+--- a/drivers/watchdog/stm32_iwdg.c
++++ b/drivers/watchdog/stm32_iwdg.c
+@@ -20,6 +20,8 @@
+ #include <linux/platform_device.h>
+ #include <linux/watchdog.h>
+ 
++#define DEFAULT_TIMEOUT 10
++
+ /* IWDG registers */
+ #define IWDG_KR		0x00 /* Key register */
+ #define IWDG_PR		0x04 /* Prescaler Register */
+@@ -248,6 +250,7 @@ static int stm32_iwdg_probe(struct platform_device *pdev)
+ 	wdd->parent = dev;
+ 	wdd->info = &stm32_iwdg_info;
+ 	wdd->ops = &stm32_iwdg_ops;
++	wdd->timeout = DEFAULT_TIMEOUT;
+ 	wdd->min_timeout = DIV_ROUND_UP((RLR_MIN + 1) * PR_MIN, wdt->rate);
+ 	wdd->max_hw_heartbeat_ms = ((RLR_MAX + 1) * wdt->data->max_prescaler *
+ 				    1000) / wdt->rate;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch b/queue-6.8/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
new file mode 100644
index 00000000000..941d9cb7a6f
--- /dev/null
+++ b/queue-6.8/wifi-ath10k-fix-null-pointer-dereference-in-ath10k_w.patch
@@ -0,0 +1,42 @@
+From 4e257a6fcd83953d2f3d4a96e12264c34185281e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 17 Dec 2023 13:29:01 +0200
+Subject: wifi: ath10k: fix NULL pointer dereference in
+ ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
+
+From: Xingyuan Mo <hdthky0@gmail.com>
+
+[ Upstream commit ad25ee36f00172f7d53242dc77c69fff7ced0755 ]
+
+We should check whether the WMI_TLV_TAG_STRUCT_MGMT_TX_COMPL_EVENT tlv is
+present before accessing it, otherwise a null pointer deference error will
+occur.
+
+Fixes: dc405152bb64 ("ath10k: handle mgmt tx completion event")
+Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20231208043433.271449-1-hdthky0@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 6b6aa3c367448..0ce08e9a0a3d2 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -851,6 +851,10 @@ ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev(struct ath10k *ar, struct sk_buff *skb,
+ 	}
+ 
+ 	ev = tb[WMI_TLV_TAG_STRUCT_MGMT_TX_COMPL_EVENT];
++	if (!ev) {
++		kfree(tb);
++		return -EPROTO;
++	}
+ 
+ 	arg->desc_id = ev->desc_id;
+ 	arg->status = ev->status;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath11k-add-support-to-select-6-ghz-regulatory-t.patch b/queue-6.8/wifi-ath11k-add-support-to-select-6-ghz-regulatory-t.patch
new file mode 100644
index 00000000000..cddda0f1294
--- /dev/null
+++ b/queue-6.8/wifi-ath11k-add-support-to-select-6-ghz-regulatory-t.patch
@@ -0,0 +1,160 @@
+From 9a98af7d5ed97c57e4b106bcf13fdb743bc6c894 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 15:56:57 +0200
+Subject: wifi: ath11k: add support to select 6 GHz regulatory type
+
+From: Wen Gong <quic_wgong@quicinc.com>
+
+[ Upstream commit e3d373ec4f02bf41379d91707e3e3f2a46464cd7 ]
+
+There are 3 types of regulatory rules for AP mode and 6 type for
+station mode. Add wmi_vdev_type and ieee80211_ap_reg_power to
+select the exact reg rules.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20231218085844.2658-2-quic_bqiang@quicinc.com
+Stable-dep-of: cf2df0080bd5 ("wifi: ath11k: fix a possible dead lock caused by ab->base_lock")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 70 +++++++++++++++++++++------
+ drivers/net/wireless/ath/ath11k/reg.h |  6 ++-
+ drivers/net/wireless/ath/ath11k/wmi.c |  3 +-
+ 3 files changed, 62 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index b4fd4d2107c71..78b99ab10c634 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -618,25 +618,68 @@ ath11k_reg_update_weather_radar_band(struct ath11k_base *ab,
+ 	*rule_idx = i;
+ }
+ 
++enum wmi_reg_6ghz_ap_type
++ath11k_reg_ap_pwr_convert(enum ieee80211_ap_reg_power power_type)
++{
++	switch (power_type) {
++	case IEEE80211_REG_LPI_AP:
++		return WMI_REG_INDOOR_AP;
++	case IEEE80211_REG_SP_AP:
++		return WMI_REG_STANDARD_POWER_AP;
++	case IEEE80211_REG_VLP_AP:
++		return WMI_REG_VERY_LOW_POWER_AP;
++	default:
++		return WMI_REG_MAX_AP_TYPE;
++	}
++}
++
+ struct ieee80211_regdomain *
+ ath11k_reg_build_regd(struct ath11k_base *ab,
+-		      struct cur_regulatory_info *reg_info, bool intersect)
++		      struct cur_regulatory_info *reg_info, bool intersect,
++		      enum wmi_vdev_type vdev_type,
++		      enum ieee80211_ap_reg_power power_type)
+ {
+ 	struct ieee80211_regdomain *tmp_regd, *default_regd, *new_regd = NULL;
+-	struct cur_reg_rule *reg_rule;
++	struct cur_reg_rule *reg_rule, *reg_rule_6ghz;
+ 	u8 i = 0, j = 0, k = 0;
+ 	u8 num_rules;
+ 	u16 max_bw;
+-	u32 flags;
++	u32 flags, reg_6ghz_number, max_bw_6ghz;
+ 	char alpha2[3];
+ 
+ 	num_rules = reg_info->num_5ghz_reg_rules + reg_info->num_2ghz_reg_rules;
+ 
+-	/* FIXME: Currently taking reg rules for 6 GHz only from Indoor AP mode list.
+-	 * This can be updated after complete 6 GHz regulatory support is added.
+-	 */
+-	if (reg_info->is_ext_reg_event)
+-		num_rules += reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
++	if (reg_info->is_ext_reg_event) {
++		if (vdev_type == WMI_VDEV_TYPE_STA) {
++			enum wmi_reg_6ghz_ap_type ap_type;
++
++			ap_type = ath11k_reg_ap_pwr_convert(power_type);
++
++			if (ap_type == WMI_REG_MAX_AP_TYPE)
++				ap_type = WMI_REG_INDOOR_AP;
++
++			reg_6ghz_number = reg_info->num_6ghz_rules_client
++					[ap_type][WMI_REG_DEFAULT_CLIENT];
++
++			if (reg_6ghz_number == 0) {
++				ap_type = WMI_REG_INDOOR_AP;
++				reg_6ghz_number = reg_info->num_6ghz_rules_client
++						[ap_type][WMI_REG_DEFAULT_CLIENT];
++			}
++
++			reg_rule_6ghz = reg_info->reg_rules_6ghz_client_ptr
++					[ap_type][WMI_REG_DEFAULT_CLIENT];
++			max_bw_6ghz = reg_info->max_bw_6ghz_client
++					[ap_type][WMI_REG_DEFAULT_CLIENT];
++		} else {
++			reg_6ghz_number = reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP];
++			reg_rule_6ghz =
++				reg_info->reg_rules_6ghz_ap_ptr[WMI_REG_INDOOR_AP];
++			max_bw_6ghz = reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP];
++		}
++
++		num_rules += reg_6ghz_number;
++	}
+ 
+ 	if (!num_rules)
+ 		goto ret;
+@@ -683,13 +726,10 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
+ 			 * per other BW rule flags we pass from here
+ 			 */
+ 			flags = NL80211_RRF_AUTO_BW;
+-		} else if (reg_info->is_ext_reg_event &&
+-			   reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP] &&
+-			   (k < reg_info->num_6ghz_rules_ap[WMI_REG_INDOOR_AP])) {
+-			reg_rule = reg_info->reg_rules_6ghz_ap_ptr[WMI_REG_INDOOR_AP] +
+-				   k++;
+-			max_bw = min_t(u16, reg_rule->max_bw,
+-				       reg_info->max_bw_6ghz_ap[WMI_REG_INDOOR_AP]);
++		} else if (reg_info->is_ext_reg_event && reg_6ghz_number &&
++			   k < reg_6ghz_number) {
++			reg_rule = reg_rule_6ghz + k++;
++			max_bw = min_t(u16, reg_rule->max_bw, max_bw_6ghz);
+ 			flags = NL80211_RRF_AUTO_BW;
+ 		} else {
+ 			break;
+diff --git a/drivers/net/wireless/ath/ath11k/reg.h b/drivers/net/wireless/ath/ath11k/reg.h
+index f28902f85e419..989b27b16bea0 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.h
++++ b/drivers/net/wireless/ath/ath11k/reg.h
+@@ -34,7 +34,11 @@ void ath11k_reg_free(struct ath11k_base *ab);
+ void ath11k_regd_update_work(struct work_struct *work);
+ struct ieee80211_regdomain *
+ ath11k_reg_build_regd(struct ath11k_base *ab,
+-		      struct cur_regulatory_info *reg_info, bool intersect);
++		      struct cur_regulatory_info *reg_info, bool intersect,
++		      enum wmi_vdev_type vdev_type,
++		      enum ieee80211_ap_reg_power power_type);
+ int ath11k_regd_update(struct ath11k *ar);
+ int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait);
++enum wmi_reg_6ghz_ap_type
++ath11k_reg_ap_pwr_convert(enum ieee80211_ap_reg_power power_type);
+ #endif
+diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
+index 8a65fa04b48d9..75c79c99faa9f 100644
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -7151,7 +7151,8 @@ static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
+ 	    !ath11k_reg_is_world_alpha((char *)reg_info->alpha2))
+ 		intersect = true;
+ 
+-	regd = ath11k_reg_build_regd(ab, reg_info, intersect);
++	regd = ath11k_reg_build_regd(ab, reg_info, intersect,
++				     WMI_VDEV_TYPE_AP, IEEE80211_REG_LPI_AP);
+ 	if (!regd) {
+ 		ath11k_warn(ab, "failed to build regd from reg_info\n");
+ 		goto fallback;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath11k-change-to-move-wmi_vdev_param_set_hemu_m.patch b/queue-6.8/wifi-ath11k-change-to-move-wmi_vdev_param_set_hemu_m.patch
new file mode 100644
index 00000000000..bf99231fec8
--- /dev/null
+++ b/queue-6.8/wifi-ath11k-change-to-move-wmi_vdev_param_set_hemu_m.patch
@@ -0,0 +1,98 @@
+From b587e187119bd7627010d6a8e1b7f4587d8ca29d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 10:18:32 +0800
+Subject: wifi: ath11k: change to move WMI_VDEV_PARAM_SET_HEMU_MODE before
+ WMI_PEER_ASSOC_CMDID
+
+From: Wen Gong <quic_wgong@quicinc.com>
+
+[ Upstream commit 413e20e82ee78f142cb5194fd317db514f012602 ]
+
+Currently when connecting to an AP with 11AX-HE phy mode, host sends
+WMI_VDEV_PARAM_SET_HEMU_MODE parameter to firmware after
+WMI_PEER_ASSOC_CMDID command. This results in TXBF not working, because
+firmware calculates TXBF values while handling WMI_PEER_ASSOC_CMDID,
+however at that time WMI_VDEV_PARAM_SET_HEMU_MODE has not been sent yet.
+See below log:
+
+AP sends "VHT/HE/EHT NDP Announcement" to station, and station sends
+"Action no Ack" of category code HE to AP, the "Nc Index" and
+"Codebook Information" are wrong:
+
+Issued action:
+IEEE 802.11 Action No Ack, Flags: ........
+IEEE 802.11 wireless LAN
+    Fixed parameters
+        Category code: HE (30)
+        HE Action: HE Compressed Beamforming And CQI (0)
+            Total length: 152
+            HE MIMO Control: 0x0004008018
+                .... .... .... .... .... .... .... .... .... .000 = Nc Index: 1 Column (0)
+                .... .... .... .... .... .... .... ..0. .... .... = Codebook Information: 0
+
+Change to send WMI_VDEV_PARAM_SET_HEMU_MODE before WMI_PEER_ASSOC_CMDID,
+then firmware will calculate the TXBF values with valid parameters
+instead of empty values. TXBF works well and throughput performance is
+improved from 80 Mbps to 130 Mbps with this patch.
+
+Good action after this patch:
+IEEE 802.11 Action No Ack, Flags: ........
+IEEE 802.11 wireless LAN
+    Fixed parameters
+        Category code: HE (30)
+        HE Action: HE Compressed Beamforming And CQI (0)
+            Total length: 409
+            HE MIMO Control: 0x0004008219
+                .... .... .... .... .... .... .... .... .... .001 = Nc Index: 2 Columns (1)
+                .... .... .... .... .... .... .... ..1. .... .... = Codebook Information: 1
+
+This change applies to all chipsets.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Fixes: 38dfe775d0ab ("wifi: ath11k: push MU-MIMO params from hostapd to hardware")
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20240131021832.17298-1-quic_bqiang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index b13525bbbb808..b6b474a7f1c9c 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -3026,7 +3026,14 @@ static void ath11k_bss_assoc(struct ieee80211_hw *hw,
+ 
+ 	rcu_read_unlock();
+ 
++	if (!ath11k_mac_vif_recalc_sta_he_txbf(ar, vif, &he_cap)) {
++		ath11k_warn(ar->ab, "failed to recalc he txbf for vdev %i on bss %pM\n",
++			    arvif->vdev_id, bss_conf->bssid);
++		return;
++	}
++
+ 	peer_arg.is_assoc = true;
++
+ 	ret = ath11k_wmi_send_peer_assoc_cmd(ar, &peer_arg);
+ 	if (ret) {
+ 		ath11k_warn(ar->ab, "failed to run peer assoc for %pM vdev %i: %d\n",
+@@ -3049,12 +3056,6 @@ static void ath11k_bss_assoc(struct ieee80211_hw *hw,
+ 		return;
+ 	}
+ 
+-	if (!ath11k_mac_vif_recalc_sta_he_txbf(ar, vif, &he_cap)) {
+-		ath11k_warn(ar->ab, "failed to recalc he txbf for vdev %i on bss %pM\n",
+-			    arvif->vdev_id, bss_conf->bssid);
+-		return;
+-	}
+-
+ 	WARN_ON(arvif->is_up);
+ 
+ 	arvif->aid = vif->cfg.aid;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath11k-fix-a-possible-dead-lock-caused-by-ab-ba.patch b/queue-6.8/wifi-ath11k-fix-a-possible-dead-lock-caused-by-ab-ba.patch
new file mode 100644
index 00000000000..55a8ba4f23a
--- /dev/null
+++ b/queue-6.8/wifi-ath11k-fix-a-possible-dead-lock-caused-by-ab-ba.patch
@@ -0,0 +1,75 @@
+From b3632f753a9ab6498769a38a58ce0d6756529a84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 15:56:57 +0200
+Subject: wifi: ath11k: fix a possible dead lock caused by ab->base_lock
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit cf2df0080bd59cb97a1519ddefaf59788febdaa5 ]
+
+spin_lock()/spin_unlock() are used in ath11k_reg_chan_list_event() to
+acquire/release ab->base_lock. For now this is safe because that
+function is only called in soft IRQ context.
+
+But ath11k_reg_chan_list_event() will be called from process
+context in an upcoming patch, and this can result in a deadlock if
+ab->base_lock is acquired in process context and then soft IRQ occurs
+on the same CPU and tries to acquire that lock.
+
+Fix it by using spin_lock_bh() and spin_unlock_bh() instead.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Fixes: 69a0fcf8a9f2 ("ath11k: Avoid reg rules update during firmware recovery")
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20231218085844.2658-4-quic_bqiang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/reg.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index adcd9063a59c3..d4fd3509e608c 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -852,13 +852,13 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+ 	/* Avoid default reg rule updates sent during FW recovery if
+ 	 * it is already available
+ 	 */
+-	spin_lock(&ab->base_lock);
++	spin_lock_bh(&ab->base_lock);
+ 	if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags) &&
+ 	    ab->default_regd[pdev_idx]) {
+-		spin_unlock(&ab->base_lock);
++		spin_unlock_bh(&ab->base_lock);
+ 		goto retfail;
+ 	}
+-	spin_unlock(&ab->base_lock);
++	spin_unlock_bh(&ab->base_lock);
+ 
+ 	if (pdev_idx >= ab->num_radios) {
+ 		/* Process the event for phy0 only if single_pdev_only
+@@ -911,7 +911,7 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+ 		ab->reg_info_store[pdev_idx] = *reg_info;
+ 	}
+ 
+-	spin_lock(&ab->base_lock);
++	spin_lock_bh(&ab->base_lock);
+ 	if (ab->default_regd[pdev_idx]) {
+ 		/* The initial rules from FW after WMI Init is to build
+ 		 * the default regd. From then on, any rules updated for
+@@ -931,7 +931,7 @@ int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
+ 		ab->default_regd[pdev_idx] = regd;
+ 	}
+ 	ab->dfs_region = reg_info->dfs_region;
+-	spin_unlock(&ab->base_lock);
++	spin_unlock_bh(&ab->base_lock);
+ 
+ 	return 0;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath11k-initialize-rx_mcs_80-and-rx_mcs_160-befo.patch b/queue-6.8/wifi-ath11k-initialize-rx_mcs_80-and-rx_mcs_160-befo.patch
new file mode 100644
index 00000000000..0bd8e88d76a
--- /dev/null
+++ b/queue-6.8/wifi-ath11k-initialize-rx_mcs_80-and-rx_mcs_160-befo.patch
@@ -0,0 +1,71 @@
+From 398c3f2526d99e56f82426cb3df37261aaa9b205 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 10:35:47 +0800
+Subject: wifi: ath11k: initialize rx_mcs_80 and rx_mcs_160 before use
+
+From: Baochen Qiang <quic_bqiang@quicinc.com>
+
+[ Upstream commit b802e7b7e771dee3377d071418281f8b64d2d832 ]
+
+Currently in ath11k_peer_assoc_h_he() rx_mcs_80 and rx_mcs_160
+are used to calculate max_nss, see
+	if (support_160)
+		max_nss = min(rx_mcs_80, rx_mcs_160);
+	else
+		max_nss = rx_mcs_80;
+
+Kernel test robot complains on uninitialized symbols:
+drivers/net/wireless/ath/ath11k/mac.c:2321 ath11k_peer_assoc_h_he() error: uninitialized symbol 'rx_mcs_80'.
+drivers/net/wireless/ath/ath11k/mac.c:2321 ath11k_peer_assoc_h_he() error: uninitialized symbol 'rx_mcs_160'.
+drivers/net/wireless/ath/ath11k/mac.c:2323 ath11k_peer_assoc_h_he() error: uninitialized symbol 'rx_mcs_80'.
+
+This is because there are some code paths that never set them, so
+the assignment of max_nss can come from uninitialized variables.
+This could result in some unknown issues since a wrong peer_nss
+might be passed to firmware.
+
+Change to initialize them to an invalid value at the beginning. This
+makes sense because even max_nss gets an invalid value, due to either
+or both of them being invalid, we can get an valid peer_nss with
+following guard:
+	arg->peer_nss = min(sta->deflink.rx_nss, max_nss)
+
+Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Fixes: 3db26ecf7114 ("ath11k: calculate the correct NSS of peer for HE capabilities")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202401311243.NyXwWZxP-lkp@intel.com/
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20240202023547.11141-1-quic_bqiang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
+index b6b474a7f1c9c..cc80310088ce1 100644
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -2297,6 +2297,8 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar,
+ 	mcs_160_map = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_160);
+ 	mcs_80_map = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80);
+ 
++	/* Initialize rx_mcs_160 to 9 which is an invalid value */
++	rx_mcs_160 = 9;
+ 	if (support_160) {
+ 		for (i = 7; i >= 0; i--) {
+ 			u8 mcs_160 = (mcs_160_map >> (2 * i)) & 3;
+@@ -2308,6 +2310,8 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar,
+ 		}
+ 	}
+ 
++	/* Initialize rx_mcs_80 to 9 which is an invalid value */
++	rx_mcs_80 = 9;
+ 	for (i = 7; i >= 0; i--) {
+ 		u8 mcs_80 = (mcs_80_map >> (2 * i)) & 3;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath11k-store-cur_regulatory_info-for-each-radio.patch b/queue-6.8/wifi-ath11k-store-cur_regulatory_info-for-each-radio.patch
new file mode 100644
index 00000000000..ee870fffcb8
--- /dev/null
+++ b/queue-6.8/wifi-ath11k-store-cur_regulatory_info-for-each-radio.patch
@@ -0,0 +1,467 @@
+From b3b6bc61e826c3e1cd2716a5b9a68186c1cb3e4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 15:56:57 +0200
+Subject: wifi: ath11k: store cur_regulatory_info for each radio
+
+From: Wen Gong <quic_wgong@quicinc.com>
+
+[ Upstream commit 7004bdceef605e5c1c5ab4aaf282002ad7523ddd ]
+
+The regulatory info of WMI_REG_CHAN_LIST_CC_EXT_EVENTID is not saved
+in ath11k now, the info should be saved in ath11k. Save the info for
+each radio and support switch regulatory rules dynamically.
+
+As mac.c will also call ath11k_reg_handle_chan_list() in next patches move the
+function to reg.c.
+
+Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.23
+
+Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20231218085844.2658-3-quic_bqiang@quicinc.com
+Stable-dep-of: cf2df0080bd5 ("wifi: ath11k: fix a possible dead lock caused by ab->base_lock")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/core.h |   1 +
+ drivers/net/wireless/ath/ath11k/reg.c  | 179 +++++++++++++++++++++++++
+ drivers/net/wireless/ath/ath11k/reg.h  |   5 +
+ drivers/net/wireless/ath/ath11k/wmi.c  | 148 +++-----------------
+ drivers/net/wireless/ath/ath11k/wmi.h  |   1 +
+ 5 files changed, 207 insertions(+), 127 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/core.h b/drivers/net/wireless/ath/ath11k/core.h
+index 02e160d831bed..cd829ec70d76b 100644
+--- a/drivers/net/wireless/ath/ath11k/core.h
++++ b/drivers/net/wireless/ath/ath11k/core.h
+@@ -918,6 +918,7 @@ struct ath11k_base {
+ 	 * This may or may not be used during the runtime
+ 	 */
+ 	struct ieee80211_regdomain *new_regd[MAX_RADIOS];
++	struct cur_regulatory_info *reg_info_store;
+ 
+ 	/* Current DFS Regulatory */
+ 	enum ath11k_dfs_region dfs_region;
+diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
+index 78b99ab10c634..adcd9063a59c3 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.c
++++ b/drivers/net/wireless/ath/ath11k/reg.c
+@@ -798,6 +798,159 @@ ath11k_reg_build_regd(struct ath11k_base *ab,
+ 	return new_regd;
+ }
+ 
++static bool ath11k_reg_is_world_alpha(char *alpha)
++{
++	if (alpha[0] == '0' && alpha[1] == '0')
++		return true;
++
++	if (alpha[0] == 'n' && alpha[1] == 'a')
++		return true;
++
++	return false;
++}
++
++static enum wmi_vdev_type ath11k_reg_get_ar_vdev_type(struct ath11k *ar)
++{
++	struct ath11k_vif *arvif;
++
++	/* Currently each struct ath11k maps to one struct ieee80211_hw/wiphy
++	 * and one struct ieee80211_regdomain, so it could only store one group
++	 * reg rules. It means multi-interface concurrency in the same ath11k is
++	 * not support for the regdomain. So get the vdev type of the first entry
++	 * now. After concurrency support for the regdomain, this should change.
++	 */
++	arvif = list_first_entry_or_null(&ar->arvifs, struct ath11k_vif, list);
++	if (arvif)
++		return arvif->vdev_type;
++
++	return WMI_VDEV_TYPE_UNSPEC;
++}
++
++int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
++				struct cur_regulatory_info *reg_info,
++				enum ieee80211_ap_reg_power power_type)
++{
++	struct ieee80211_regdomain *regd;
++	bool intersect = false;
++	int pdev_idx;
++	struct ath11k *ar;
++	enum wmi_vdev_type vdev_type;
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI, "event reg handle chan list");
++
++	if (reg_info->status_code != REG_SET_CC_STATUS_PASS) {
++		/* In case of failure to set the requested ctry,
++		 * fw retains the current regd. We print a failure info
++		 * and return from here.
++		 */
++		ath11k_warn(ab, "Failed to set the requested Country regulatory setting\n");
++		return -EINVAL;
++	}
++
++	pdev_idx = reg_info->phy_id;
++
++	/* Avoid default reg rule updates sent during FW recovery if
++	 * it is already available
++	 */
++	spin_lock(&ab->base_lock);
++	if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags) &&
++	    ab->default_regd[pdev_idx]) {
++		spin_unlock(&ab->base_lock);
++		goto retfail;
++	}
++	spin_unlock(&ab->base_lock);
++
++	if (pdev_idx >= ab->num_radios) {
++		/* Process the event for phy0 only if single_pdev_only
++		 * is true. If pdev_idx is valid but not 0, discard the
++		 * event. Otherwise, it goes to fallback. In either case
++		 * ath11k_reg_reset_info() needs to be called to avoid
++		 * memory leak issue.
++		 */
++		ath11k_reg_reset_info(reg_info);
++
++		if (ab->hw_params.single_pdev_only &&
++		    pdev_idx < ab->hw_params.num_rxmda_per_pdev)
++			return 0;
++		goto fallback;
++	}
++
++	/* Avoid multiple overwrites to default regd, during core
++	 * stop-start after mac registration.
++	 */
++	if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
++	    !memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
++		    (char *)reg_info->alpha2, 2))
++		goto retfail;
++
++	/* Intersect new rules with default regd if a new country setting was
++	 * requested, i.e a default regd was already set during initialization
++	 * and the regd coming from this event has a valid country info.
++	 */
++	if (ab->default_regd[pdev_idx] &&
++	    !ath11k_reg_is_world_alpha((char *)
++		ab->default_regd[pdev_idx]->alpha2) &&
++	    !ath11k_reg_is_world_alpha((char *)reg_info->alpha2))
++		intersect = true;
++
++	ar = ab->pdevs[pdev_idx].ar;
++	vdev_type = ath11k_reg_get_ar_vdev_type(ar);
++
++	ath11k_dbg(ab, ATH11K_DBG_WMI,
++		   "wmi handle chan list power type %d vdev type %d intersect %d\n",
++		   power_type, vdev_type, intersect);
++
++	regd = ath11k_reg_build_regd(ab, reg_info, intersect, vdev_type, power_type);
++	if (!regd) {
++		ath11k_warn(ab, "failed to build regd from reg_info\n");
++		goto fallback;
++	}
++
++	if (power_type == IEEE80211_REG_UNSET_AP) {
++		ath11k_reg_reset_info(&ab->reg_info_store[pdev_idx]);
++		ab->reg_info_store[pdev_idx] = *reg_info;
++	}
++
++	spin_lock(&ab->base_lock);
++	if (ab->default_regd[pdev_idx]) {
++		/* The initial rules from FW after WMI Init is to build
++		 * the default regd. From then on, any rules updated for
++		 * the pdev could be due to user reg changes.
++		 * Free previously built regd before assigning the newly
++		 * generated regd to ar. NULL pointer handling will be
++		 * taken care by kfree itself.
++		 */
++		ar = ab->pdevs[pdev_idx].ar;
++		kfree(ab->new_regd[pdev_idx]);
++		ab->new_regd[pdev_idx] = regd;
++		queue_work(ab->workqueue, &ar->regd_update_work);
++	} else {
++		/* This regd would be applied during mac registration and is
++		 * held constant throughout for regd intersection purpose
++		 */
++		ab->default_regd[pdev_idx] = regd;
++	}
++	ab->dfs_region = reg_info->dfs_region;
++	spin_unlock(&ab->base_lock);
++
++	return 0;
++
++fallback:
++	/* Fallback to older reg (by sending previous country setting
++	 * again if fw has succeeded and we failed to process here.
++	 * The Regdomain should be uniform across driver and fw. Since the
++	 * FW has processed the command and sent a success status, we expect
++	 * this function to succeed as well. If it doesn't, CTRY needs to be
++	 * reverted at the fw and the old SCAN_CHAN_LIST cmd needs to be sent.
++	 */
++	/* TODO: This is rare, but still should also be handled */
++	WARN_ON(1);
++
++retfail:
++
++	return -EINVAL;
++}
++
+ void ath11k_regd_update_work(struct work_struct *work)
+ {
+ 	struct ath11k *ar = container_of(work, struct ath11k,
+@@ -821,10 +974,36 @@ void ath11k_reg_init(struct ath11k *ar)
+ 	ar->hw->wiphy->reg_notifier = ath11k_reg_notifier;
+ }
+ 
++void ath11k_reg_reset_info(struct cur_regulatory_info *reg_info)
++{
++	int i, j;
++
++	if (!reg_info)
++		return;
++
++	kfree(reg_info->reg_rules_2ghz_ptr);
++	kfree(reg_info->reg_rules_5ghz_ptr);
++
++	for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++) {
++		kfree(reg_info->reg_rules_6ghz_ap_ptr[i]);
++
++		for (j = 0; j < WMI_REG_MAX_CLIENT_TYPE; j++)
++			kfree(reg_info->reg_rules_6ghz_client_ptr[i][j]);
++	}
++
++	memset(reg_info, 0, sizeof(*reg_info));
++}
++
+ void ath11k_reg_free(struct ath11k_base *ab)
+ {
+ 	int i;
+ 
++	for (i = 0; i < ab->num_radios; i++)
++		ath11k_reg_reset_info(&ab->reg_info_store[i]);
++
++	kfree(ab->reg_info_store);
++	ab->reg_info_store = NULL;
++
+ 	for (i = 0; i < ab->hw_params.max_radios; i++) {
+ 		kfree(ab->default_regd[i]);
+ 		kfree(ab->new_regd[i]);
+diff --git a/drivers/net/wireless/ath/ath11k/reg.h b/drivers/net/wireless/ath/ath11k/reg.h
+index 989b27b16bea0..64edb794260ab 100644
+--- a/drivers/net/wireless/ath/ath11k/reg.h
++++ b/drivers/net/wireless/ath/ath11k/reg.h
+@@ -30,6 +30,7 @@ enum ath11k_dfs_region {
+ 
+ /* ATH11K Regulatory API's */
+ void ath11k_reg_init(struct ath11k *ar);
++void ath11k_reg_reset_info(struct cur_regulatory_info *reg_info);
+ void ath11k_reg_free(struct ath11k_base *ab);
+ void ath11k_regd_update_work(struct work_struct *work);
+ struct ieee80211_regdomain *
+@@ -41,4 +42,8 @@ int ath11k_regd_update(struct ath11k *ar);
+ int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait);
+ enum wmi_reg_6ghz_ap_type
+ ath11k_reg_ap_pwr_convert(enum ieee80211_ap_reg_power power_type);
++int ath11k_reg_handle_chan_list(struct ath11k_base *ab,
++				struct cur_regulatory_info *reg_info,
++				enum ieee80211_ap_reg_power power_type);
++
+ #endif
+diff --git a/drivers/net/wireless/ath/ath11k/wmi.c b/drivers/net/wireless/ath/ath11k/wmi.c
+index 75c79c99faa9f..442afda7ec885 100644
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -4749,6 +4749,14 @@ static int ath11k_wmi_tlv_ext_soc_hal_reg_caps_parse(struct ath11k_base *soc,
+ 		soc->pdevs[0].pdev_id = 0;
+ 	}
+ 
++	if (!soc->reg_info_store) {
++		soc->reg_info_store = kcalloc(soc->num_radios,
++					      sizeof(*soc->reg_info_store),
++					      GFP_ATOMIC);
++		if (!soc->reg_info_store)
++			return -ENOMEM;
++	}
++
+ 	return 0;
+ }
+ 
+@@ -7060,32 +7068,15 @@ static void ath11k_wmi_htc_tx_complete(struct ath11k_base *ab,
+ 		wake_up(&wmi->tx_ce_desc_wq);
+ }
+ 
+-static bool ath11k_reg_is_world_alpha(char *alpha)
+-{
+-	if (alpha[0] == '0' && alpha[1] == '0')
+-		return true;
+-
+-	if (alpha[0] == 'n' && alpha[1] == 'a')
+-		return true;
+-
+-	return false;
+-}
+-
+-static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
+-				      struct sk_buff *skb,
++static int ath11k_reg_chan_list_event(struct ath11k_base *ab, struct sk_buff *skb,
+ 				      enum wmi_reg_chan_list_cmd_type id)
+ {
+-	struct cur_regulatory_info *reg_info = NULL;
+-	struct ieee80211_regdomain *regd = NULL;
+-	bool intersect = false;
+-	int ret = 0, pdev_idx, i, j;
+-	struct ath11k *ar;
++	struct cur_regulatory_info *reg_info;
++	int ret;
+ 
+ 	reg_info = kzalloc(sizeof(*reg_info), GFP_ATOMIC);
+-	if (!reg_info) {
+-		ret = -ENOMEM;
+-		goto fallback;
+-	}
++	if (!reg_info)
++		return -ENOMEM;
+ 
+ 	if (id == WMI_REG_CHAN_LIST_CC_ID)
+ 		ret = ath11k_pull_reg_chan_list_update_ev(ab, skb, reg_info);
+@@ -7093,119 +7084,22 @@ static int ath11k_reg_chan_list_event(struct ath11k_base *ab,
+ 		ret = ath11k_pull_reg_chan_list_ext_update_ev(ab, skb, reg_info);
+ 
+ 	if (ret) {
+-		ath11k_warn(ab, "failed to extract regulatory info from received event\n");
+-		goto fallback;
+-	}
+-
+-	ath11k_dbg(ab, ATH11K_DBG_WMI, "event reg chan list id %d", id);
+-
+-	if (reg_info->status_code != REG_SET_CC_STATUS_PASS) {
+-		/* In case of failure to set the requested ctry,
+-		 * fw retains the current regd. We print a failure info
+-		 * and return from here.
+-		 */
+-		ath11k_warn(ab, "Failed to set the requested Country regulatory setting\n");
+-		goto mem_free;
+-	}
+-
+-	pdev_idx = reg_info->phy_id;
+-
+-	/* Avoid default reg rule updates sent during FW recovery if
+-	 * it is already available
+-	 */
+-	spin_lock(&ab->base_lock);
+-	if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags) &&
+-	    ab->default_regd[pdev_idx]) {
+-		spin_unlock(&ab->base_lock);
++		ath11k_warn(ab, "failed to extract regulatory info\n");
+ 		goto mem_free;
+ 	}
+-	spin_unlock(&ab->base_lock);
+ 
+-	if (pdev_idx >= ab->num_radios) {
+-		/* Process the event for phy0 only if single_pdev_only
+-		 * is true. If pdev_idx is valid but not 0, discard the
+-		 * event. Otherwise, it goes to fallback.
+-		 */
+-		if (ab->hw_params.single_pdev_only &&
+-		    pdev_idx < ab->hw_params.num_rxmda_per_pdev)
+-			goto mem_free;
+-		else
+-			goto fallback;
+-	}
+-
+-	/* Avoid multiple overwrites to default regd, during core
+-	 * stop-start after mac registration.
+-	 */
+-	if (ab->default_regd[pdev_idx] && !ab->new_regd[pdev_idx] &&
+-	    !memcmp((char *)ab->default_regd[pdev_idx]->alpha2,
+-		    (char *)reg_info->alpha2, 2))
++	ret = ath11k_reg_handle_chan_list(ab, reg_info, IEEE80211_REG_UNSET_AP);
++	if (ret) {
++		ath11k_warn(ab, "failed to process regulatory info %d\n", ret);
+ 		goto mem_free;
+-
+-	/* Intersect new rules with default regd if a new country setting was
+-	 * requested, i.e a default regd was already set during initialization
+-	 * and the regd coming from this event has a valid country info.
+-	 */
+-	if (ab->default_regd[pdev_idx] &&
+-	    !ath11k_reg_is_world_alpha((char *)
+-		ab->default_regd[pdev_idx]->alpha2) &&
+-	    !ath11k_reg_is_world_alpha((char *)reg_info->alpha2))
+-		intersect = true;
+-
+-	regd = ath11k_reg_build_regd(ab, reg_info, intersect,
+-				     WMI_VDEV_TYPE_AP, IEEE80211_REG_LPI_AP);
+-	if (!regd) {
+-		ath11k_warn(ab, "failed to build regd from reg_info\n");
+-		goto fallback;
+-	}
+-
+-	spin_lock(&ab->base_lock);
+-	if (ab->default_regd[pdev_idx]) {
+-		/* The initial rules from FW after WMI Init is to build
+-		 * the default regd. From then on, any rules updated for
+-		 * the pdev could be due to user reg changes.
+-		 * Free previously built regd before assigning the newly
+-		 * generated regd to ar. NULL pointer handling will be
+-		 * taken care by kfree itself.
+-		 */
+-		ar = ab->pdevs[pdev_idx].ar;
+-		kfree(ab->new_regd[pdev_idx]);
+-		ab->new_regd[pdev_idx] = regd;
+-		queue_work(ab->workqueue, &ar->regd_update_work);
+-	} else {
+-		/* This regd would be applied during mac registration and is
+-		 * held constant throughout for regd intersection purpose
+-		 */
+-		ab->default_regd[pdev_idx] = regd;
+ 	}
+-	ab->dfs_region = reg_info->dfs_region;
+-	spin_unlock(&ab->base_lock);
+ 
+-	goto mem_free;
++	kfree(reg_info);
++	return 0;
+ 
+-fallback:
+-	/* Fallback to older reg (by sending previous country setting
+-	 * again if fw has succeeded and we failed to process here.
+-	 * The Regdomain should be uniform across driver and fw. Since the
+-	 * FW has processed the command and sent a success status, we expect
+-	 * this function to succeed as well. If it doesn't, CTRY needs to be
+-	 * reverted at the fw and the old SCAN_CHAN_LIST cmd needs to be sent.
+-	 */
+-	/* TODO: This is rare, but still should also be handled */
+-	WARN_ON(1);
+ mem_free:
+-	if (reg_info) {
+-		kfree(reg_info->reg_rules_2ghz_ptr);
+-		kfree(reg_info->reg_rules_5ghz_ptr);
+-		if (reg_info->is_ext_reg_event) {
+-			for (i = 0; i < WMI_REG_CURRENT_MAX_AP_TYPE; i++)
+-				kfree(reg_info->reg_rules_6ghz_ap_ptr[i]);
+-
+-			for (j = 0; j < WMI_REG_CURRENT_MAX_AP_TYPE; j++)
+-				for (i = 0; i < WMI_REG_MAX_CLIENT_TYPE; i++)
+-					kfree(reg_info->reg_rules_6ghz_client_ptr[j][i]);
+-		}
+-		kfree(reg_info);
+-	}
++	ath11k_reg_reset_info(reg_info);
++	kfree(reg_info);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h
+index ff0a9a92beeb0..cd2098d78e861 100644
+--- a/drivers/net/wireless/ath/ath11k/wmi.h
++++ b/drivers/net/wireless/ath/ath11k/wmi.h
+@@ -4951,6 +4951,7 @@ struct ath11k_targ_cap {
+ };
+ 
+ enum wmi_vdev_type {
++	WMI_VDEV_TYPE_UNSPEC =  0,
+ 	WMI_VDEV_TYPE_AP      = 1,
+ 	WMI_VDEV_TYPE_STA     = 2,
+ 	WMI_VDEV_TYPE_IBSS    = 3,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath12k-fix-fetching-mcbc-flag-for-qcn9274.patch b/queue-6.8/wifi-ath12k-fix-fetching-mcbc-flag-for-qcn9274.patch
new file mode 100644
index 00000000000..16ec9399c58
--- /dev/null
+++ b/queue-6.8/wifi-ath12k-fix-fetching-mcbc-flag-for-qcn9274.patch
@@ -0,0 +1,62 @@
+From f0194f01febfc8965e4699e10f12a915cec2f1e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 12:27:15 +0530
+Subject: wifi: ath12k: fix fetching MCBC flag for QCN9274
+
+From: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+
+[ Upstream commit 902700d55d4a4522bb3eb4ef94f752a19c42230a ]
+
+In QCN9274, RX packet's multicast and broadcast(MCBC) flag is fetched
+from RX descriptor's msdu_end info5 member but it is not correct
+for QCN9274. Due to this with encryption, ARP request packet is wrongly
+marked as MCBC packet and it is sent to mac80211 without setting
+RX_FLAG_PN_VALIDATED & RX_FLAG_DECRYPTED flag. This results in packet
+getting dropped in mac80211. Hence ping initiated from station to AP
+fails.
+
+Fix this by fetching correct MCBC flag in case of QCN9274.
+For QC9274 MCBC flag should be fetched from RX descriptor's mpdu_start
+info6 member.
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00188-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Fixes: 8f04852e90cb ("wifi: ath12k: Use msdu_end to check MCBC")
+Signed-off-by: Raj Kumar Bhagat <quic_rajkbhag@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20240129065724.2310207-5-quic_rajkbhag@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/hal.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c
+index a489369d80687..1bdab8604db94 100644
+--- a/drivers/net/wireless/ath/ath12k/hal.c
++++ b/drivers/net/wireless/ath/ath12k/hal.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ #include <linux/dma-mapping.h>
+ #include "hal_tx.h"
+@@ -449,8 +449,8 @@ static u8 *ath12k_hw_qcn9274_rx_desc_mpdu_start_addr2(struct hal_rx_desc *desc)
+ 
+ static bool ath12k_hw_qcn9274_rx_desc_is_da_mcbc(struct hal_rx_desc *desc)
+ {
+-	return __le16_to_cpu(desc->u.qcn9274.msdu_end.info5) &
+-	       RX_MSDU_END_INFO5_DA_IS_MCBC;
++	return __le32_to_cpu(desc->u.qcn9274.mpdu_start.info6) &
++	       RX_MPDU_START_INFO6_MCAST_BCAST;
+ }
+ 
+ static void ath12k_hw_qcn9274_rx_desc_get_dot11_hdr(struct hal_rx_desc *desc,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath12k-fix-incorrect-logic-of-calculating-vdev_.patch b/queue-6.8/wifi-ath12k-fix-incorrect-logic-of-calculating-vdev_.patch
new file mode 100644
index 00000000000..281d2bbd0af
--- /dev/null
+++ b/queue-6.8/wifi-ath12k-fix-incorrect-logic-of-calculating-vdev_.patch
@@ -0,0 +1,49 @@
+From 9be426668fe6595806bb5edfb3c29d1e52e82374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Feb 2024 19:03:27 +0200
+Subject: wifi: ath12k: fix incorrect logic of calculating vdev_stats_id
+
+From: Kang Yang <quic_kangyang@quicinc.com>
+
+[ Upstream commit 019b58dcb6ed267e17b7efd03ec8575c1b67d942 ]
+
+During calculate vdev_stats_id, will compare vdev_stats_id with
+ATH12K_INVAL_VDEV_STATS_ID by '<='. If vdev_stats_id is relatively
+small, then assign ATH12K_INVAL_VDEV_STATS_ID to vdev_stats_id.
+
+This logic is incorrect. Firstly, should use '>=' instead of '<=' to
+check if this u8 variable exceeds the max valid range.
+
+Secondly, should use the maximum value as comparison value.
+
+Correct comparison symbols and use the maximum value
+ATH12K_MAX_VDEV_STATS_ID for comparison.
+
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+Signed-off-by: Kang Yang <quic_kangyang@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20240130040303.370590-3-quic_kangyang@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index f4e5dc363472b..b965fc46ad89a 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -5269,7 +5269,7 @@ ath12k_mac_get_vdev_stats_id(struct ath12k_vif *arvif)
+ 	do {
+ 		if (ab->free_vdev_stats_id_map & (1LL << vdev_stats_id)) {
+ 			vdev_stats_id++;
+-			if (vdev_stats_id <= ATH12K_INVAL_VDEV_STATS_ID) {
++			if (vdev_stats_id >= ATH12K_MAX_VDEV_STATS_ID) {
+ 				vdev_stats_id = ATH12K_INVAL_VDEV_STATS_ID;
+ 				break;
+ 			}
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath12k-fix-issues-in-channel-list-update.patch b/queue-6.8/wifi-ath12k-fix-issues-in-channel-list-update.patch
new file mode 100644
index 00000000000..03d3e81bd97
--- /dev/null
+++ b/queue-6.8/wifi-ath12k-fix-issues-in-channel-list-update.patch
@@ -0,0 +1,101 @@
+From 67d2a6560309c9357123079bda24a0420ff6e781 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Jan 2024 11:56:28 +0530
+Subject: wifi: ath12k: Fix issues in channel list update
+
+From: Sriram R <quic_srirrama@quicinc.com>
+
+[ Upstream commit 67a48d937fac917947540c9f89630d472cd61fcb ]
+
+Currently, the logic used to select the 6 GHz band is incorrect,
+which may cause 6 GHz supported channels to not be updated properly.
+This is because the 6 GHz Max frequency supported by the driver is
+being compared to the Max frequency supported on the board. If in
+some cases, the 6 GHz Max frequency supported on the board is less
+than the defined 6 GHz Max frequency, all 6 GHz channels are disabled.
+To address this, compare the max frequency supported by the board to
+the defined 6 GHz Minimum frequency by the driver.
+
+Similarly, when a dual mac card supports both 6 GHz and 5 GHz radios,
+if the 5 GHz radio gets enumerated first before 6 GHz, the checks in
+ath12k_mac_setup_channels_rates() can cause the 5 GHz channels which
+were enabled earlier to get disabled when the 6 GHz channel list is
+updated. This is because the Min 6 GHz frequency defined in the driver
+is 5945 MHz, which should be 5925 MHz since channel 2 is not considered
+currently, but the firmware can pass 5925 MHz as the minimum.
+Hence, update the Min frequency supported by the driver to 5925 MHz.
+
+In addition, ensure that the channel list update to firmware updates
+only the channels that the current radio (ar) supports rather than
+considering the wiphy support. This would be required when multiple pdevs
+are supported in a wiphy and they support different ranges of frequencies
+or bands as in single wiphy support.
+
+Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
+
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
+Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00188-QCAHKSWPL_SILICONZ-1
+Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
+
+Signed-off-by: Sriram R <quic_srirrama@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20240117062628.8260-1-quic_srirrama@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/core.h | 2 +-
+ drivers/net/wireless/ath/ath12k/mac.c  | 2 +-
+ drivers/net/wireless/ath/ath12k/reg.c  | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/core.h b/drivers/net/wireless/ath/ath12k/core.h
+index 8458dc292821a..01fb9b2ae4314 100644
+--- a/drivers/net/wireless/ath/ath12k/core.h
++++ b/drivers/net/wireless/ath/ath12k/core.h
+@@ -420,7 +420,7 @@ struct ath12k_sta {
+ };
+ 
+ #define ATH12K_MIN_5G_FREQ 4150
+-#define ATH12K_MIN_6G_FREQ 5945
++#define ATH12K_MIN_6G_FREQ 5925
+ #define ATH12K_MAX_6G_FREQ 7115
+ #define ATH12K_NUM_CHANS 100
+ #define ATH12K_MAX_5G_CHAN 173
+diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
+index 88cec54c6c2e6..f4e5dc363472b 100644
+--- a/drivers/net/wireless/ath/ath12k/mac.c
++++ b/drivers/net/wireless/ath/ath12k/mac.c
+@@ -7198,7 +7198,7 @@ static int ath12k_mac_setup_channels_rates(struct ath12k *ar,
+ 	}
+ 
+ 	if (supported_bands & WMI_HOST_WLAN_5G_CAP) {
+-		if (reg_cap->high_5ghz_chan >= ATH12K_MAX_6G_FREQ) {
++		if (reg_cap->high_5ghz_chan >= ATH12K_MIN_6G_FREQ) {
+ 			channels = kmemdup(ath12k_6ghz_channels,
+ 					   sizeof(ath12k_6ghz_channels), GFP_KERNEL);
+ 			if (!channels) {
+diff --git a/drivers/net/wireless/ath/ath12k/reg.c b/drivers/net/wireless/ath/ath12k/reg.c
+index f924bc13ccff5..29542c46b0941 100644
+--- a/drivers/net/wireless/ath/ath12k/reg.c
++++ b/drivers/net/wireless/ath/ath12k/reg.c
+@@ -103,7 +103,7 @@ int ath12k_reg_update_chan_list(struct ath12k *ar)
+ 
+ 	bands = hw->wiphy->bands;
+ 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
+-		if (!bands[band])
++		if (!(ar->mac.sbands[band].channels && bands[band]))
+ 			continue;
+ 
+ 		for (i = 0; i < bands[band]->n_channels; i++) {
+@@ -129,7 +129,7 @@ int ath12k_reg_update_chan_list(struct ath12k *ar)
+ 	ch = arg->channel;
+ 
+ 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
+-		if (!bands[band])
++		if (!(ar->mac.sbands[band].channels && bands[band]))
+ 			continue;
+ 
+ 		for (i = 0; i < bands[band]->n_channels; i++) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch b/queue-6.8/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
new file mode 100644
index 00000000000..cb486030556
--- /dev/null
+++ b/queue-6.8/wifi-ath9k-delay-all-of-ath9k_wmi_event_tasklet-unti.patch
@@ -0,0 +1,124 @@
+From 22a29af29d8ee8cb62dfb5183da3c4bff4e27a0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 15:02:17 +0100
+Subject: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is
+ complete
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 24355fcb0d4cbcb6ddda262596558e8cfba70f11 ]
+
+The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data
+structures have been fully initialised by the time it runs. However, because of
+the order in which things are initialised, this is not guaranteed to be the
+case, because the device is exposed to the USB subsystem before the ath9k driver
+initialisation is completed.
+
+We already committed a partial fix for this in commit:
+8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()")
+
+However, that commit only aborted the WMI_TXSTATUS_EVENTID command in the event
+tasklet, pairing it with an "initialisation complete" bit in the TX struct. It
+seems syzbot managed to trigger the race for one of the other commands as well,
+so let's just move the existing synchronisation bit to cover the whole
+tasklet (setting it at the end of ath9k_htc_probe_device() instead of inside
+ath9k_tx_init()).
+
+Link: https://lore.kernel.org/r/ed1d2c66-1193-4c81-9542-d514c29ba8b8.bugreport@ubisectech.com
+Fixes: 8b3046abc99e ("ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet()")
+Reported-by: Ubisectech Sirius <bugreport@ubisectech.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://msgid.link/20240126140218.1033443-1-toke@toke.dk
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/htc.h          |  2 +-
+ drivers/net/wireless/ath/ath9k/htc_drv_init.c |  4 ++++
+ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c |  4 ----
+ drivers/net/wireless/ath/ath9k/wmi.c          | 10 ++++++----
+ 4 files changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
+index 237f4ec2cffd7..6c33e898b3000 100644
+--- a/drivers/net/wireless/ath/ath9k/htc.h
++++ b/drivers/net/wireless/ath/ath9k/htc.h
+@@ -306,7 +306,6 @@ struct ath9k_htc_tx {
+ 	DECLARE_BITMAP(tx_slot, MAX_TX_BUF_NUM);
+ 	struct timer_list cleanup_timer;
+ 	spinlock_t tx_lock;
+-	bool initialized;
+ };
+ 
+ struct ath9k_htc_tx_ctl {
+@@ -515,6 +514,7 @@ struct ath9k_htc_priv {
+ 	unsigned long ps_usecount;
+ 	bool ps_enabled;
+ 	bool ps_idle;
++	bool initialized;
+ 
+ #ifdef CONFIG_MAC80211_LEDS
+ 	enum led_brightness brightness;
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 0aa5bdeb44a1b..3633f9eb2c559 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -966,6 +966,10 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
+ 
+ 	htc_handle->drv_priv = priv;
+ 
++	/* Allow ath9k_wmi_event_tasklet() to operate. */
++	smp_wmb();
++	priv->initialized = true;
++
+ 	return 0;
+ 
+ err_init:
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index efcaeccb055aa..ce9c04e418b8d 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -815,10 +815,6 @@ int ath9k_tx_init(struct ath9k_htc_priv *priv)
+ 	skb_queue_head_init(&priv->tx.data_vo_queue);
+ 	skb_queue_head_init(&priv->tx.tx_failed);
+ 
+-	/* Allow ath9k_wmi_event_tasklet(WMI_TXSTATUS_EVENTID) to operate. */
+-	smp_wmb();
+-	priv->tx.initialized = true;
+-
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
+index 1476b42b52a91..805ad31edba2b 100644
+--- a/drivers/net/wireless/ath/ath9k/wmi.c
++++ b/drivers/net/wireless/ath/ath9k/wmi.c
+@@ -155,6 +155,12 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
+ 		}
+ 		spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+ 
++		/* Check if ath9k_htc_probe_device() completed. */
++		if (!data_race(priv->initialized)) {
++			kfree_skb(skb);
++			continue;
++		}
++
+ 		hdr = (struct wmi_cmd_hdr *) skb->data;
+ 		cmd_id = be16_to_cpu(hdr->command_id);
+ 		wmi_event = skb_pull(skb, sizeof(struct wmi_cmd_hdr));
+@@ -169,10 +175,6 @@ void ath9k_wmi_event_tasklet(struct tasklet_struct *t)
+ 					     &wmi->drv_priv->fatal_work);
+ 			break;
+ 		case WMI_TXSTATUS_EVENTID:
+-			/* Check if ath9k_tx_init() completed. */
+-			if (!data_race(priv->tx.initialized))
+-				break;
+-
+ 			spin_lock_bh(&priv->tx.tx_lock);
+ 			if (priv->tx.flags & ATH9K_HTC_OP_TX_DRAIN) {
+ 				spin_unlock_bh(&priv->tx.tx_lock);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-b43-disable-qos-for-bcm4331.patch b/queue-6.8/wifi-b43-disable-qos-for-bcm4331.patch
new file mode 100644
index 00000000000..61b0629a2d8
--- /dev/null
+++ b/queue-6.8/wifi-b43-disable-qos-for-bcm4331.patch
@@ -0,0 +1,68 @@
+From 76827c82cc71af1b6263bc36f08ec1666e535b9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:58 +0000
+Subject: wifi: b43: Disable QoS for bcm4331
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 09795bded2e725443fe4a4803cae2079cdaf7b26 ]
+
+bcm4331 seems to not function correctly with QoS support. This may be due
+to issues with currently available firmware or potentially a device
+specific issue.
+
+When queues that are not of the default "best effort" priority are
+selected, traffic appears to not transmit out of the hardware while no
+errors are returned. This behavior is present among all the other priority
+queues: video, voice, and background. While this can be worked around by
+setting a kernel parameter, the default behavior is problematic for most
+users and may be difficult to debug. This patch offers a working out-of-box
+experience for bcm4331 users.
+
+Log of the issue (using ssh low-priority traffic as an example):
+    ssh -T -vvvv git@github.com
+    OpenSSH_9.6p1, OpenSSL 3.0.12 24 Oct 2023
+    debug1: Reading configuration data /etc/ssh/ssh_config
+    debug2: checking match for 'host * exec "/nix/store/q1c2flcykgr4wwg5a6h450hxbk4ch589-bash-5.2-p15/bin/bash -c '/nix/store/c015armnkhr6v18za0rypm7sh1i8js8w-gnupg-2.4.1/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1'"' host github.com originally github.com
+    debug3: /etc/ssh/ssh_config line 5: matched 'host "github.com"'
+    debug1: Executing command: '/nix/store/q1c2flcykgr4wwg5a6h450hxbk4ch589-bash-5.2-p15/bin/bash -c '/nix/store/c015armnkhr6v18za0rypm7sh1i8js8w-gnupg-2.4.1/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1''
+    debug3: command returned status 0
+    debug3: /etc/ssh/ssh_config line 5: matched 'exec "/nix/store/q1c2flcykgr4wwg5a6h450hxbk4ch589-bash-5.2-p15/bin/bash -c '/nix/store/c015armnkhr6v18za0r"'
+    debug2: match found
+    debug1: /etc/ssh/ssh_config line 9: Applying options for *
+    debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/binary-eater/.ssh/known_hosts'
+    debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/binary-eater/.ssh/known_hosts2'
+    debug2: resolving "github.com" port 22
+    debug3: resolve_host: lookup github.com:22
+    debug3: channel_clear_timeouts: clearing
+    debug3: ssh_connect_direct: entering
+    debug1: Connecting to github.com [192.30.255.113] port 22.
+    debug3: set_sock_tos: set socket 3 IP_TOS 0x48
+
+Fixes: e6f5b934fba8 ("b43: Add QOS support")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-5-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
+index 97d8bdeaa06cb..effb6c23f8257 100644
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -2587,7 +2587,8 @@ static void b43_request_firmware(struct work_struct *work)
+ 
+ start_ieee80211:
+ 	wl->hw->queues = B43_QOS_QUEUE_NUM;
+-	if (!modparam_qos || dev->fw.opensource)
++	if (!modparam_qos || dev->fw.opensource ||
++	    dev->dev->chip_id == BCMA_CHIP_ID_BCM4331)
+ 		wl->hw->queues = 1;
+ 
+ 	err = ieee80211_register_hw(wl->hw);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch b/queue-6.8/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
new file mode 100644
index 00000000000..a848c813119
--- /dev/null
+++ b/queue-6.8/wifi-b43-stop-correct-queue-in-dma-worker-when-qos-i.patch
@@ -0,0 +1,66 @@
+From 1771aadcbe4f43eb77d7b59f7f83dd291e500341 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:51 +0000
+Subject: wifi: b43: Stop correct queue in DMA worker when QoS is disabled
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 581c8967d66c4961076dbbee356834e9c6777184 ]
+
+When QoS is disabled, the queue priority value will not map to the correct
+ieee80211 queue since there is only one queue. Stop queue 0 when QoS is
+disabled to prevent trying to stop a non-existent queue and failing to stop
+the actual queue instantiated.
+
+Fixes: bad691946966 ("b43: avoid packet losses in the dma worker code.")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-4-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/main.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c
+index 92ca0b2ca286d..97d8bdeaa06cb 100644
+--- a/drivers/net/wireless/broadcom/b43/main.c
++++ b/drivers/net/wireless/broadcom/b43/main.c
+@@ -3603,7 +3603,7 @@ static void b43_tx_work(struct work_struct *work)
+ 				err = b43_dma_tx(dev, skb);
+ 			if (err == -ENOSPC) {
+ 				wl->tx_queue_stopped[queue_num] = true;
+-				ieee80211_stop_queue(wl->hw, queue_num);
++				b43_stop_queue(dev, queue_num);
+ 				skb_queue_head(&wl->tx_queue[queue_num], skb);
+ 				break;
+ 			}
+@@ -3627,6 +3627,7 @@ static void b43_op_tx(struct ieee80211_hw *hw,
+ 		      struct sk_buff *skb)
+ {
+ 	struct b43_wl *wl = hw_to_b43_wl(hw);
++	u16 skb_queue_mapping;
+ 
+ 	if (unlikely(skb->len < 2 + 2 + 6)) {
+ 		/* Too short, this can't be a valid frame. */
+@@ -3635,12 +3636,12 @@ static void b43_op_tx(struct ieee80211_hw *hw,
+ 	}
+ 	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
+ 
+-	skb_queue_tail(&wl->tx_queue[skb->queue_mapping], skb);
+-	if (!wl->tx_queue_stopped[skb->queue_mapping]) {
++	skb_queue_mapping = skb_get_queue_mapping(skb);
++	skb_queue_tail(&wl->tx_queue[skb_queue_mapping], skb);
++	if (!wl->tx_queue_stopped[skb_queue_mapping])
+ 		ieee80211_queue_work(wl->hw, &wl->tx_work);
+-	} else {
+-		ieee80211_stop_queue(wl->hw, skb->queue_mapping);
+-	}
++	else
++		b43_stop_queue(wl->current_dev, skb_queue_mapping);
+ }
+ 
+ static void b43_qos_params_upload(struct b43_wldev *dev,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch b/queue-6.8/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
new file mode 100644
index 00000000000..19d2cbd3825
--- /dev/null
+++ b/queue-6.8/wifi-b43-stop-wake-correct-queue-in-dma-tx-path-when.patch
@@ -0,0 +1,167 @@
+From ebbd31988a17b06bb316940a9363a6d3a61dcd3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:33 +0000
+Subject: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is
+ disabled
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 9636951e4468f02c72cc75a82dc65d003077edbc ]
+
+When QoS is disabled, the queue priority value will not map to the correct
+ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS
+is disabled to prevent trying to stop/wake a non-existent queue and failing
+to stop/wake the actual queue instantiated.
+
+Log of issue before change (with kernel parameter qos=0):
+    [  +5.112651] ------------[ cut here ]------------
+    [  +0.000005] WARNING: CPU: 7 PID: 25513 at net/mac80211/util.c:449 __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000067] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3
+    [  +0.000044]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common
+    [  +0.000055]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43(O)]
+    [  +0.000009] CPU: 7 PID: 25513 Comm: irq/17-b43 Tainted: G        W  O       6.6.7 #1-NixOS
+    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019
+    [  +0.000001] RIP: 0010:__ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000046] Code: 00 45 85 e4 0f 85 9b 00 00 00 48 8d bd 40 09 00 00 f0 48 0f ba ad 48 09 00 00 00 72 0f 5b 5d 41 5c 41 5d 41 5e e9 cb 6d 3c d0 <0f> 0b 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8d b4 16 94 00 00
+    [  +0.000002] RSP: 0018:ffffc90003c77d60 EFLAGS: 00010097
+    [  +0.000001] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000
+    [  +0.000001] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88820b924900
+    [  +0.000002] RBP: ffff88820b924900 R08: ffffc90003c77d90 R09: 000000000003bfd0
+    [  +0.000001] R10: ffff88820b924900 R11: ffffc90003c77c68 R12: 0000000000000000
+    [  +0.000001] R13: 0000000000000000 R14: ffffc90003c77d90 R15: ffffffffc0fa6f40
+    [  +0.000001] FS:  0000000000000000(0000) GS:ffff88846fb80000(0000) knlGS:0000000000000000
+    [  +0.000001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    [  +0.000001] CR2: 00007fafda7ae008 CR3: 000000046d220005 CR4: 00000000000606e0
+    [  +0.000002] Call Trace:
+    [  +0.000003]  <TASK>
+    [  +0.000001]  ? __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000044]  ? __warn+0x81/0x130
+    [  +0.000005]  ? __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000045]  ? report_bug+0x171/0x1a0
+    [  +0.000004]  ? handle_bug+0x41/0x70
+    [  +0.000004]  ? exc_invalid_op+0x17/0x70
+    [  +0.000003]  ? asm_exc_invalid_op+0x1a/0x20
+    [  +0.000005]  ? __ieee80211_wake_queue+0xd5/0x180 [mac80211]
+    [  +0.000043]  ieee80211_wake_queue+0x4a/0x80 [mac80211]
+    [  +0.000044]  b43_dma_handle_txstatus+0x29c/0x3a0 [b43]
+    [  +0.000016]  ? __pfx_irq_thread_fn+0x10/0x10
+    [  +0.000002]  b43_handle_txstatus+0x61/0x80 [b43]
+    [  +0.000012]  b43_interrupt_thread_handler+0x3f9/0x6b0 [b43]
+    [  +0.000011]  irq_thread_fn+0x23/0x60
+    [  +0.000002]  irq_thread+0xfe/0x1c0
+    [  +0.000002]  ? __pfx_irq_thread_dtor+0x10/0x10
+    [  +0.000001]  ? __pfx_irq_thread+0x10/0x10
+    [  +0.000001]  kthread+0xe8/0x120
+    [  +0.000003]  ? __pfx_kthread+0x10/0x10
+    [  +0.000003]  ret_from_fork+0x34/0x50
+    [  +0.000002]  ? __pfx_kthread+0x10/0x10
+    [  +0.000002]  ret_from_fork_asm+0x1b/0x30
+    [  +0.000004]  </TASK>
+    [  +0.000001] ---[ end trace 0000000000000000 ]---
+
+    [  +0.000065] ------------[ cut here ]------------
+    [  +0.000001] WARNING: CPU: 0 PID: 56077 at net/mac80211/util.c:514 __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000077] Modules linked in: b43(O) snd_seq_dummy snd_hrtimer snd_seq snd_seq_device nft_chain_nat xt_MASQUERADE nf_nat xfrm_user xfrm_algo xt_addrtype overlay ccm af_packet amdgpu snd_hda_codec_cirrus snd_hda_codec_generic ledtrig_audio drm_exec amdxcp gpu_sched xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_rpfilter ipt_rpfilter xt_pkttype xt_LOG nf_log_syslog xt_tcpudp nft_compat nf_tables nfnetlink sch_fq_codel btusb uinput iTCO_wdt ctr btrtl intel_pmc_bxt i915 intel_rapl_msr mei_hdcp mei_pxp joydev at24 watchdog btintel atkbd libps2 serio radeon btbcm vivaldi_fmap btmtk intel_rapl_common snd_hda_codec_hdmi bluetooth uvcvideo nls_iso8859_1 applesmc nls_cp437 x86_pkg_temp_thermal snd_hda_intel intel_powerclamp vfat videobuf2_vmalloc coretemp fat snd_intel_dspcfg crc32_pclmul uvc polyval_clmulni snd_intel_sdw_acpi loop videobuf2_memops snd_hda_codec tun drm_suballoc_helper polyval_generic drm_ttm_helper drm_buddy tap ecdh_generic videobuf2_v4l2 gf128mul macvlan ttm ghash_clmulni_intel ecc tg3
+    [  +0.000073]  videodev bridge snd_hda_core rapl crc16 drm_display_helper cec mousedev snd_hwdep evdev intel_cstate bcm5974 hid_appleir videobuf2_common stp mac_hid libphy snd_pcm drm_kms_helper acpi_als mei_me intel_uncore llc mc snd_timer intel_gtt industrialio_triggered_buffer apple_mfi_fastcharge i2c_i801 mei snd lpc_ich agpgart ptp i2c_smbus thunderbolt apple_gmux i2c_algo_bit kfifo_buf video industrialio soundcore pps_core wmi tiny_power_button sbs sbshc button ac cordic bcma mac80211 cfg80211 ssb rfkill libarc4 kvm_intel kvm drm irqbypass fuse backlight firmware_class efi_pstore configfs efivarfs dmi_sysfs ip_tables x_tables autofs4 dm_crypt cbc encrypted_keys trusted asn1_encoder tee tpm rng_core input_leds hid_apple led_class hid_generic usbhid hid sd_mod t10_pi crc64_rocksoft crc64 crc_t10dif crct10dif_generic ahci libahci libata uhci_hcd ehci_pci ehci_hcd crct10dif_pclmul crct10dif_common sha512_ssse3 sha512_generic sha256_ssse3 sha1_ssse3 aesni_intel usbcore scsi_mod libaes crypto_simd cryptd scsi_common
+    [  +0.000084]  usb_common rtc_cmos btrfs blake2b_generic libcrc32c crc32c_generic crc32c_intel xor raid6_pq dm_snapshot dm_bufio dm_mod dax [last unloaded: b43]
+    [  +0.000012] CPU: 0 PID: 56077 Comm: kworker/u16:17 Tainted: G        W  O       6.6.7 #1-NixOS
+    [  +0.000003] Hardware name: Apple Inc. MacBookPro8,3/Mac-942459F5819B171B, BIOS 87.0.0.0.0 06/13/2019
+    [  +0.000001] Workqueue: phy7 b43_tx_work [b43]
+    [  +0.000019] RIP: 0010:__ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000076] Code: 74 11 48 8b 78 08 0f b7 d6 89 e9 4c 89 e6 e8 ab f4 00 00 65 ff 0d 9c b7 34 3f 0f 85 55 ff ff ff 0f 1f 44 00 00 e9 4b ff ff ff <0f> 0b 5b 5d 41 5c 41 5d c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90
+    [  +0.000002] RSP: 0000:ffffc90004157d50 EFLAGS: 00010097
+    [  +0.000002] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 0000000000000000
+    [  +0.000002] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff8882d65d0900
+    [  +0.000002] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
+    [  +0.000001] R10: 00000000000000ff R11: ffff88814d0155a0 R12: ffff8882d65d0900
+    [  +0.000002] R13: 0000000000000000 R14: ffff8881002d2800 R15: 00000000000000d0
+    [  +0.000002] FS:  0000000000000000(0000) GS:ffff88846f800000(0000) knlGS:0000000000000000
+    [  +0.000003] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+    [  +0.000002] CR2: 00007f2e8c10c880 CR3: 0000000385b66005 CR4: 00000000000606f0
+    [  +0.000002] Call Trace:
+    [  +0.000001]  <TASK>
+    [  +0.000001]  ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000075]  ? __warn+0x81/0x130
+    [  +0.000004]  ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000075]  ? report_bug+0x171/0x1a0
+    [  +0.000005]  ? handle_bug+0x41/0x70
+    [  +0.000003]  ? exc_invalid_op+0x17/0x70
+    [  +0.000004]  ? asm_exc_invalid_op+0x1a/0x20
+    [  +0.000004]  ? __ieee80211_stop_queue+0xcc/0xe0 [mac80211]
+    [  +0.000076]  ieee80211_stop_queue+0x36/0x50 [mac80211]
+    [  +0.000077]  b43_dma_tx+0x550/0x780 [b43]
+    [  +0.000023]  b43_tx_work+0x90/0x130 [b43]
+    [  +0.000018]  process_one_work+0x174/0x340
+    [  +0.000003]  worker_thread+0x27b/0x3a0
+    [  +0.000004]  ? __pfx_worker_thread+0x10/0x10
+    [  +0.000002]  kthread+0xe8/0x120
+    [  +0.000003]  ? __pfx_kthread+0x10/0x10
+    [  +0.000004]  ret_from_fork+0x34/0x50
+    [  +0.000002]  ? __pfx_kthread+0x10/0x10
+    [  +0.000003]  ret_from_fork_asm+0x1b/0x30
+    [  +0.000006]  </TASK>
+    [  +0.000001] ---[ end trace 0000000000000000 ]---
+
+Fixes: e6f5b934fba8 ("b43: Add QOS support")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-2-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/b43.h | 16 ++++++++++++++++
+ drivers/net/wireless/broadcom/b43/dma.c |  4 ++--
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/b43.h b/drivers/net/wireless/broadcom/b43/b43.h
+index 67b4bac048e58..c0d8fc0b22fb2 100644
+--- a/drivers/net/wireless/broadcom/b43/b43.h
++++ b/drivers/net/wireless/broadcom/b43/b43.h
+@@ -1082,6 +1082,22 @@ static inline bool b43_using_pio_transfers(struct b43_wldev *dev)
+ 	return dev->__using_pio_transfers;
+ }
+ 
++static inline void b43_wake_queue(struct b43_wldev *dev, int queue_prio)
++{
++	if (dev->qos_enabled)
++		ieee80211_wake_queue(dev->wl->hw, queue_prio);
++	else
++		ieee80211_wake_queue(dev->wl->hw, 0);
++}
++
++static inline void b43_stop_queue(struct b43_wldev *dev, int queue_prio)
++{
++	if (dev->qos_enabled)
++		ieee80211_stop_queue(dev->wl->hw, queue_prio);
++	else
++		ieee80211_stop_queue(dev->wl->hw, 0);
++}
++
+ /* Message printing */
+ __printf(2, 3) void b43info(struct b43_wl *wl, const char *fmt, ...);
+ __printf(2, 3) void b43err(struct b43_wl *wl, const char *fmt, ...);
+diff --git a/drivers/net/wireless/broadcom/b43/dma.c b/drivers/net/wireless/broadcom/b43/dma.c
+index 760d1a28edc6c..6ac7dcebfff9d 100644
+--- a/drivers/net/wireless/broadcom/b43/dma.c
++++ b/drivers/net/wireless/broadcom/b43/dma.c
+@@ -1399,7 +1399,7 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
+ 	    should_inject_overflow(ring)) {
+ 		/* This TX ring is full. */
+ 		unsigned int skb_mapping = skb_get_queue_mapping(skb);
+-		ieee80211_stop_queue(dev->wl->hw, skb_mapping);
++		b43_stop_queue(dev, skb_mapping);
+ 		dev->wl->tx_queue_stopped[skb_mapping] = true;
+ 		ring->stopped = true;
+ 		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
+@@ -1570,7 +1570,7 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ 	} else {
+ 		/* If the driver queue is running wake the corresponding
+ 		 * mac80211 queue. */
+-		ieee80211_wake_queue(dev->wl->hw, ring->queue_prio);
++		b43_wake_queue(dev, ring->queue_prio);
+ 		if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
+ 			b43dbg(dev->wl, "Woke up TX ring %d\n", ring->index);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch b/queue-6.8/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
new file mode 100644
index 00000000000..48066fd4194
--- /dev/null
+++ b/queue-6.8/wifi-b43-stop-wake-correct-queue-in-pio-tx-path-when.patch
@@ -0,0 +1,59 @@
+From b27f779ed2f0634bdf0f90495010ffcfe7af280b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 31 Dec 2023 05:03:45 +0000
+Subject: wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is
+ disabled
+
+From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+
+[ Upstream commit 77135a38f6c2f950d2306ac3d37cbb407e6243f2 ]
+
+When QoS is disabled, the queue priority value will not map to the correct
+ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS
+is disabled to prevent trying to stop/wake a non-existent queue and failing
+to stop/wake the actual queue instantiated.
+
+Fixes: 5100d5ac81b9 ("b43: Add PIO support for PCMCIA devices")
+Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
+Reviewed-by: Julian Calaby <julian.calaby@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231231050300.122806-3-sergeantsagara@protonmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43/pio.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/pio.c b/drivers/net/wireless/broadcom/b43/pio.c
+index 0cf70fdb60a6a..e41f2f5b4c266 100644
+--- a/drivers/net/wireless/broadcom/b43/pio.c
++++ b/drivers/net/wireless/broadcom/b43/pio.c
+@@ -525,7 +525,7 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
+ 	if (total_len > (q->buffer_size - q->buffer_used)) {
+ 		/* Not enough memory on the queue. */
+ 		err = -EBUSY;
+-		ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
++		b43_stop_queue(dev, skb_get_queue_mapping(skb));
+ 		q->stopped = true;
+ 		goto out;
+ 	}
+@@ -552,7 +552,7 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
+ 	if (((q->buffer_size - q->buffer_used) < roundup(2 + 2 + 6, 4)) ||
+ 	    (q->free_packet_slots == 0)) {
+ 		/* The queue is full. */
+-		ieee80211_stop_queue(dev->wl->hw, skb_get_queue_mapping(skb));
++		b43_stop_queue(dev, skb_get_queue_mapping(skb));
+ 		q->stopped = true;
+ 	}
+ 
+@@ -587,7 +587,7 @@ void b43_pio_handle_txstatus(struct b43_wldev *dev,
+ 	list_add(&pack->list, &q->packets_list);
+ 
+ 	if (q->stopped) {
+-		ieee80211_wake_queue(dev->wl->hw, q->queue_prio);
++		b43_wake_queue(dev, q->queue_prio);
+ 		q->stopped = false;
+ 	}
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-brcm80211-handle-pmk_op-allocation-failure.patch b/queue-6.8/wifi-brcm80211-handle-pmk_op-allocation-failure.patch
new file mode 100644
index 00000000000..c57deeeec5d
--- /dev/null
+++ b/queue-6.8/wifi-brcm80211-handle-pmk_op-allocation-failure.patch
@@ -0,0 +1,44 @@
+From bdb49afb440e0806361abd87bf02b3f05cda849e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Feb 2024 18:31:53 +0800
+Subject: wifi: brcm80211: handle pmk_op allocation failure
+
+From: Duoming Zhou <duoming@zju.edu.cn>
+
+[ Upstream commit b4152222e04cb8afeeca239c90e3fcaf4c553b42 ]
+
+The kzalloc() in brcmf_pmksa_v3_op() will return null if the
+physical memory has run out. As a result, if we dereference
+the null value, the null pointer dereference bug will happen.
+
+Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails
+for pmk_op.
+
+Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations")
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240229103153.18533-1-duoming@zju.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 28d6a30cc0106..1a5d7494f5e80 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -4322,6 +4322,9 @@ brcmf_pmksa_v3_op(struct brcmf_if *ifp, struct cfg80211_pmksa *pmksa,
+ 	int ret;
+ 
+ 	pmk_op = kzalloc(sizeof(*pmk_op), GFP_KERNEL);
++	if (!pmk_op)
++		return -ENOMEM;
++
+ 	pmk_op->version = cpu_to_le16(BRCMF_PMKSA_VER_3);
+ 
+ 	if (!pmksa) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-brcmsmac-avoid-function-pointer-casts.patch b/queue-6.8/wifi-brcmsmac-avoid-function-pointer-casts.patch
new file mode 100644
index 00000000000..7de1c772468
--- /dev/null
+++ b/queue-6.8/wifi-brcmsmac-avoid-function-pointer-casts.patch
@@ -0,0 +1,81 @@
+From 9c0ef7845d2f60e781dc691a865a473dadf26b2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Feb 2024 11:05:37 +0100
+Subject: wifi: brcmsmac: avoid function pointer casts
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e1ea6db35fc3ba5ff063f097385e9f7a88c25356 ]
+
+An old cleanup went a little too far and causes a warning with clang-16
+and higher as it breaks control flow integrity (KCFI) rules:
+
+drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c:64:34: error: cast from 'void (*)(struct brcms_phy *)' to 'void (*)(void *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
+   64 |                         brcms_init_timer(physhim->wl, (void (*)(void *))fn,
+      |                                                       ^~~~~~~~~~~~~~~~~~~~
+
+Change this one instance back to passing a void pointer so it can be
+used with the timer callback interface.
+
+Fixes: d89a4c80601d ("staging: brcm80211: removed void * from softmac phy")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240213100548.457854-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c   | 3 ++-
+ drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c  | 5 ++---
+ drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h  | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
+index ccc621b8ed9f2..4a1fe982a948e 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_cmn.c
+@@ -383,8 +383,9 @@ struct shared_phy *wlc_phy_shared_attach(struct shared_phy_params *shp)
+ 	return sh;
+ }
+ 
+-static void wlc_phy_timercb_phycal(struct brcms_phy *pi)
++static void wlc_phy_timercb_phycal(void *ptr)
+ {
++	struct brcms_phy *pi = ptr;
+ 	uint delay = 5;
+ 
+ 	if (PHY_PERICAL_MPHASE_PENDING(pi)) {
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
+index a0de5db0cd646..b723817915365 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.c
+@@ -57,12 +57,11 @@ void wlc_phy_shim_detach(struct phy_shim_info *physhim)
+ }
+ 
+ struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
+-				     void (*fn)(struct brcms_phy *pi),
++				     void (*fn)(void *pi),
+ 				     void *arg, const char *name)
+ {
+ 	return (struct wlapi_timer *)
+-			brcms_init_timer(physhim->wl, (void (*)(void *))fn,
+-					 arg, name);
++			brcms_init_timer(physhim->wl, fn, arg, name);
+ }
+ 
+ void wlapi_free_timer(struct wlapi_timer *t)
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
+index dd8774717adee..27d0934e600ed 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy_shim.h
+@@ -131,7 +131,7 @@ void wlc_phy_shim_detach(struct phy_shim_info *physhim);
+ 
+ /* PHY to WL utility functions */
+ struct wlapi_timer *wlapi_init_timer(struct phy_shim_info *physhim,
+-				     void (*fn)(struct brcms_phy *pi),
++				     void (*fn)(void *pi),
+ 				     void *arg, const char *name);
+ void wlapi_free_timer(struct wlapi_timer *t);
+ void wlapi_add_timer(struct wlapi_timer *t, uint ms, int periodic);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-cfg80211-add-rnr-with-reporting-ap-information.patch b/queue-6.8/wifi-cfg80211-add-rnr-with-reporting-ap-information.patch
new file mode 100644
index 00000000000..1295429f84a
--- /dev/null
+++ b/queue-6.8/wifi-cfg80211-add-rnr-with-reporting-ap-information.patch
@@ -0,0 +1,300 @@
+From 6d0ce365a8e03bea2ad79fb1e6228a334a637db7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 21:35:32 +0200
+Subject: wifi: cfg80211: add RNR with reporting AP information
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 4d1d6b3f45999b1ddde53831d639a67e2655285f ]
+
+If the reporting AP is part of the same MLD, then an entry in the RNR is
+required in order to discover it again from the BSS generated from the
+per-STA profile in the Multi-Link Probe Response.
+
+We need this because we do not have a direct concept of an MLD AP and
+just do the lookup from one to the other on the fly if needed. As such,
+we need to ensure that this lookup will work both ways.
+
+Fixes: 2481b5da9c6b ("wifi: cfg80211: handle BSS data contained in ML probe responses")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240102213313.4cb3dbb1d84f.I7c74edec83c5d7598cdd578929fd0876d67aef7f@changeid
+[roll in off-by-one fix and test updates from Benjamin]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c       | 135 ++++++++++++++++++++++++++++++++++++--
+ net/wireless/tests/scan.c |  36 +++++++++-
+ 2 files changed, 163 insertions(+), 8 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 389a52c29bfc7..7c9dc52ed783e 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2674,6 +2674,103 @@ cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
+ 	return 0;
+ }
+ 
++static struct element *
++cfg80211_gen_reporter_rnr(struct cfg80211_bss *source_bss, bool is_mbssid,
++			  bool same_mld, u8 link_id, u8 bss_change_count,
++			  gfp_t gfp)
++{
++	const struct cfg80211_bss_ies *ies;
++	struct ieee80211_neighbor_ap_info ap_info;
++	struct ieee80211_tbtt_info_ge_11 tbtt_info;
++	u32 short_ssid;
++	const struct element *elem;
++	struct element *res;
++
++	/*
++	 * We only generate the RNR to permit ML lookups. For that we do not
++	 * need an entry for the corresponding transmitting BSS, lets just skip
++	 * it even though it would be easy to add.
++	 */
++	if (!same_mld)
++		return NULL;
++
++	/* We could use tx_data->ies if we change cfg80211_calc_short_ssid */
++	rcu_read_lock();
++	ies = rcu_dereference(source_bss->ies);
++
++	ap_info.tbtt_info_len = offsetofend(typeof(tbtt_info), mld_params);
++	ap_info.tbtt_info_hdr =
++			u8_encode_bits(IEEE80211_TBTT_INFO_TYPE_TBTT,
++				       IEEE80211_AP_INFO_TBTT_HDR_TYPE) |
++			u8_encode_bits(0, IEEE80211_AP_INFO_TBTT_HDR_COUNT);
++
++	ap_info.channel = ieee80211_frequency_to_channel(source_bss->channel->center_freq);
++
++	/* operating class */
++	elem = cfg80211_find_elem(WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
++				  ies->data, ies->len);
++	if (elem && elem->datalen >= 1) {
++		ap_info.op_class = elem->data[0];
++	} else {
++		struct cfg80211_chan_def chandef;
++
++		/* The AP is not providing us with anything to work with. So
++		 * make up a somewhat reasonable operating class, but don't
++		 * bother with it too much as no one will ever use the
++		 * information.
++		 */
++		cfg80211_chandef_create(&chandef, source_bss->channel,
++					NL80211_CHAN_NO_HT);
++
++		if (!ieee80211_chandef_to_operating_class(&chandef,
++							  &ap_info.op_class))
++			goto out_unlock;
++	}
++
++	/* Just set TBTT offset and PSD 20 to invalid/unknown */
++	tbtt_info.tbtt_offset = 255;
++	tbtt_info.psd_20 = IEEE80211_RNR_TBTT_PARAMS_PSD_RESERVED;
++
++	memcpy(tbtt_info.bssid, source_bss->bssid, ETH_ALEN);
++	if (cfg80211_calc_short_ssid(ies, &elem, &short_ssid))
++		goto out_unlock;
++
++	rcu_read_unlock();
++
++	tbtt_info.short_ssid = cpu_to_le32(short_ssid);
++
++	tbtt_info.bss_params = IEEE80211_RNR_TBTT_PARAMS_SAME_SSID;
++
++	if (is_mbssid) {
++		tbtt_info.bss_params |= IEEE80211_RNR_TBTT_PARAMS_MULTI_BSSID;
++		tbtt_info.bss_params |= IEEE80211_RNR_TBTT_PARAMS_TRANSMITTED_BSSID;
++	}
++
++	tbtt_info.mld_params.mld_id = 0;
++	tbtt_info.mld_params.params =
++		le16_encode_bits(link_id, IEEE80211_RNR_MLD_PARAMS_LINK_ID) |
++		le16_encode_bits(bss_change_count,
++				 IEEE80211_RNR_MLD_PARAMS_BSS_CHANGE_COUNT);
++
++	res = kzalloc(struct_size(res, data,
++				  sizeof(ap_info) + ap_info.tbtt_info_len),
++		      gfp);
++	if (!res)
++		return NULL;
++
++	/* Copy the data */
++	res->id = WLAN_EID_REDUCED_NEIGHBOR_REPORT;
++	res->datalen = sizeof(ap_info) + ap_info.tbtt_info_len;
++	memcpy(res->data, &ap_info, sizeof(ap_info));
++	memcpy(res->data + sizeof(ap_info), &tbtt_info, ap_info.tbtt_info_len);
++
++	return res;
++
++out_unlock:
++	rcu_read_unlock();
++	return NULL;
++}
++
+ static void
+ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 				struct cfg80211_inform_single_bss_data *tx_data,
+@@ -2687,13 +2784,14 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 		.source_bss = source_bss,
+ 		.bss_source = BSS_SOURCE_STA_PROFILE,
+ 	};
++	struct element *reporter_rnr = NULL;
+ 	struct ieee80211_multi_link_elem *ml_elem;
+ 	struct cfg80211_mle *mle;
+ 	u16 control;
+ 	u8 ml_common_len;
+-	u8 *new_ie;
++	u8 *new_ie = NULL;
+ 	struct cfg80211_bss *bss;
+-	int mld_id;
++	u8 mld_id, reporter_link_id, bss_change_count;
+ 	u16 seen_links = 0;
+ 	const u8 *pos;
+ 	u8 i;
+@@ -2715,8 +2813,14 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 
+ 	ml_common_len = ml_elem->variable[0];
+ 
+-	/* length + MLD MAC address + link ID info + BSS Params Change Count */
+-	pos = ml_elem->variable + 1 + 6 + 1 + 1;
++	/* length + MLD MAC address */
++	pos = ml_elem->variable + 1 + 6;
++
++	reporter_link_id = pos[0];
++	pos += 1;
++
++	bss_change_count = pos[0];
++	pos += 1;
+ 
+ 	if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MED_SYNC_DELAY))
+ 		pos += 2;
+@@ -2747,10 +2851,21 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 	if (!mle)
+ 		return;
+ 
++	/* No point in doing anything if there is no per-STA profile */
++	if (!mle->sta_prof[0])
++		goto out;
++
+ 	new_ie = kmalloc(IEEE80211_MAX_DATA_LEN, gfp);
+ 	if (!new_ie)
+ 		goto out;
+ 
++	reporter_rnr = cfg80211_gen_reporter_rnr(source_bss,
++						 u16_get_bits(control,
++							      IEEE80211_MLC_BASIC_PRES_MLD_ID),
++						 mld_id == 0, reporter_link_id,
++						 bss_change_count,
++						 gfp);
++
+ 	for (i = 0; i < ARRAY_SIZE(mle->sta_prof) && mle->sta_prof[i]; i++) {
+ 		const struct ieee80211_neighbor_ap_info *ap_info;
+ 		enum nl80211_band band;
+@@ -2860,7 +2975,16 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 
+ 		data.ielen += sizeof(*ml_elem) + ml_common_len;
+ 
+-		/* TODO: Add an RNR containing only the reporting AP */
++		if (reporter_rnr && (use_for & NL80211_BSS_USE_FOR_NORMAL)) {
++			if (data.ielen + sizeof(struct element) +
++			    reporter_rnr->datalen > IEEE80211_MAX_DATA_LEN)
++				continue;
++
++			memcpy(new_ie + data.ielen, reporter_rnr,
++			       sizeof(struct element) + reporter_rnr->datalen);
++			data.ielen += sizeof(struct element) +
++				      reporter_rnr->datalen;
++		}
+ 
+ 		bss = cfg80211_inform_single_bss_data(wiphy, &data, gfp);
+ 		if (!bss)
+@@ -2869,6 +2993,7 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 	}
+ 
+ out:
++	kfree(reporter_rnr);
+ 	kfree(new_ie);
+ 	kfree(mle);
+ }
+diff --git a/net/wireless/tests/scan.c b/net/wireless/tests/scan.c
+index 77854161cd22b..f9ea44aee9952 100644
+--- a/net/wireless/tests/scan.c
++++ b/net/wireless/tests/scan.c
+@@ -2,7 +2,7 @@
+ /*
+  * KUnit tests for inform_bss functions
+  *
+- * Copyright (C) 2023 Intel Corporation
++ * Copyright (C) 2023-2024 Intel Corporation
+  */
+ #include <linux/ieee80211.h>
+ #include <net/cfg80211.h>
+@@ -406,9 +406,27 @@ static struct inform_bss_ml_sta_case {
+ 	const char *desc;
+ 	int mld_id;
+ 	bool sta_prof_vendor_elems;
++	bool include_oper_class;
+ } inform_bss_ml_sta_cases[] = {
+-	{ .desc = "no_mld_id", .mld_id = 0, .sta_prof_vendor_elems = false },
+-	{ .desc = "mld_id_eq_1", .mld_id = 1, .sta_prof_vendor_elems = true },
++	{
++		.desc = "zero_mld_id",
++		.mld_id = 0,
++		.sta_prof_vendor_elems = false,
++	}, {
++		.desc = "zero_mld_id_with_oper_class",
++		.mld_id = 0,
++		.sta_prof_vendor_elems = false,
++		.include_oper_class = true,
++	}, {
++		.desc = "mld_id_eq_1",
++		.mld_id = 1,
++		.sta_prof_vendor_elems = true,
++	}, {
++		.desc = "mld_id_eq_1_with_oper_class",
++		.mld_id = 1,
++		.sta_prof_vendor_elems = true,
++		.include_oper_class = true,
++	},
+ };
+ KUNIT_ARRAY_PARAM_DESC(inform_bss_ml_sta, inform_bss_ml_sta_cases, desc)
+ 
+@@ -515,6 +533,12 @@ static void test_inform_bss_ml_sta(struct kunit *test)
+ 	skb_put_u8(input, 4);
+ 	skb_put_data(input, "TEST", 4);
+ 
++	if (params->include_oper_class) {
++		skb_put_u8(input, WLAN_EID_SUPPORTED_REGULATORY_CLASSES);
++		skb_put_u8(input, 1);
++		skb_put_u8(input, 81);
++	}
++
+ 	skb_put_u8(input, WLAN_EID_REDUCED_NEIGHBOR_REPORT);
+ 	skb_put_u8(input, sizeof(rnr));
+ 	skb_put_data(input, &rnr, sizeof(rnr));
+@@ -582,15 +606,21 @@ static void test_inform_bss_ml_sta(struct kunit *test)
+ 	KUNIT_EXPECT_EQ(test, ies->tsf, tsf + le64_to_cpu(sta_prof.tsf_offset));
+ 	/* Resulting length should be:
+ 	 * SSID (inherited) + RNR (inherited) + vendor element(s) +
++	 * operating class (if requested) +
++	 * generated RNR (if MLD ID == 0) +
+ 	 * MLE common info + MLE header and control
+ 	 */
+ 	if (params->sta_prof_vendor_elems)
+ 		KUNIT_EXPECT_EQ(test, ies->len,
+ 				6 + 2 + sizeof(rnr) + 2 + 160 + 2 + 165 +
++				(params->include_oper_class ? 3 : 0) +
++				(!params->mld_id ? 22 : 0) +
+ 				mle_basic_common_info.var_len + 5);
+ 	else
+ 		KUNIT_EXPECT_EQ(test, ies->len,
+ 				6 + 2 + sizeof(rnr) + 2 + 155 +
++				(params->include_oper_class ? 3 : 0) +
++				(!params->mld_id ? 22 : 0) +
+ 				mle_basic_common_info.var_len + 5);
+ 	rcu_read_unlock();
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-cfg80211-set-correct-param-change-count-in-ml-e.patch b/queue-6.8/wifi-cfg80211-set-correct-param-change-count-in-ml-e.patch
new file mode 100644
index 00000000000..aabefc1ac26
--- /dev/null
+++ b/queue-6.8/wifi-cfg80211-set-correct-param-change-count-in-ml-e.patch
@@ -0,0 +1,105 @@
+From 49b9a19ca047547e5c02e2ba4ca2f0329e7ec15c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Feb 2024 13:54:27 +0200
+Subject: wifi: cfg80211: set correct param change count in ML element
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit f8599d634094b1257054a8d0815785d658cbdb74 ]
+
+The ML element generation code to create a BSS entry from a per-STA
+profile was not overwriting the BSS parameter change count. This meant
+that the incorrect parameter change count would be reported within the
+multi-link element.
+
+Fix this by returning the BSS parameter change count from the function
+and placing it into the ML element. The returned tbtt info was never
+used, so just drop that to simplify the code.
+
+Fixes: 5f478adf1f99 ("wifi: cfg80211: generate an ML element for per-STA profiles")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240216135047.f2a507634692.I06b122c7a319a38b4e970f5e0bd3d3ef9cac4cbe@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 7c9dc52ed783e..f138f88be9048 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2602,9 +2602,9 @@ cfg80211_defrag_mle(const struct element *mle, const u8 *ie, size_t ielen,
+ }
+ 
+ static u8
+-cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
+-			      const struct ieee80211_neighbor_ap_info **ap_info,
+-			      const u8 **tbtt_info)
++cfg80211_rnr_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
++			     const struct ieee80211_neighbor_ap_info **ap_info,
++			     u8 *param_ch_count)
+ {
+ 	const struct ieee80211_neighbor_ap_info *info;
+ 	const struct element *rnr;
+@@ -2661,7 +2661,9 @@ cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
+ 				if (mld_id == mld_params->mld_id &&
+ 				    link_id == lid) {
+ 					*ap_info = info;
+-					*tbtt_info = pos;
++					*param_ch_count =
++						le16_get_bits(mld_params->params,
++							      IEEE80211_RNR_MLD_PARAMS_BSS_CHANGE_COUNT);
+ 
+ 					return use_for;
+ 				}
+@@ -2871,8 +2873,8 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 		enum nl80211_band band;
+ 		u32 freq;
+ 		const u8 *profile;
+-		const u8 *tbtt_info;
+ 		ssize_t profile_len;
++		u8 param_ch_count;
+ 		u8 link_id, use_for;
+ 
+ 		if (!ieee80211_mle_basic_sta_prof_size_ok((u8 *)mle->sta_prof[i],
+@@ -2915,10 +2917,11 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 		profile_len -= 2;
+ 
+ 		/* Find in RNR to look up channel information */
+-		use_for = cfg80211_tbtt_info_for_mld_ap(tx_data->ie,
+-							tx_data->ielen,
+-							mld_id, link_id,
+-							&ap_info, &tbtt_info);
++		use_for = cfg80211_rnr_info_for_mld_ap(tx_data->ie,
++						       tx_data->ielen,
++						       mld_id, link_id,
++						       &ap_info,
++						       &param_ch_count);
+ 		if (!use_for)
+ 			continue;
+ 
+@@ -2961,7 +2964,8 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 			continue;
+ 
+ 		/* Copy the Basic Multi-Link element including the common
+-		 * information, and then fix up the link ID.
++		 * information, and then fix up the link ID and BSS param
++		 * change count.
+ 		 * Note that the ML element length has been verified and we
+ 		 * also checked that it contains the link ID.
+ 		 */
+@@ -2972,6 +2976,8 @@ cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
+ 		       sizeof(*ml_elem) + ml_common_len);
+ 
+ 		new_ie[data.ielen + sizeof(*ml_elem) + 1 + ETH_ALEN] = link_id;
++		new_ie[data.ielen + sizeof(*ml_elem) + 1 + ETH_ALEN + 1] =
++			param_ch_count;
+ 
+ 		data.ielen += sizeof(*ml_elem) + ml_common_len;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-acpi-fix-wpfc-reading.patch b/queue-6.8/wifi-iwlwifi-acpi-fix-wpfc-reading.patch
new file mode 100644
index 00000000000..c7889d68df7
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-acpi-fix-wpfc-reading.patch
@@ -0,0 +1,73 @@
+From e6cbd637b8b20668a166028a26edc276adba6730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 08:53:55 +0200
+Subject: wifi: iwlwifi: acpi: fix WPFC reading
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 296f3e926716ded8dc29e349d2b042b362f96515 ]
+
+The code reading the WPFC table needs to take into account
+the domain type (first element in the package), shouldn't
+leak the memory if it fails, and has a bad comment. Fix all
+these issues.
+
+Fixes: c4c954547755 ("wifi: iwlwifi: implement WPFC ACPI table loading")
+Reported-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman Gregory <gregory.greenman@intel.com>
+Link: https://msgid.link/20240128084842.2afeb476b62d.I200568dc42a277e21c12be99d5aaa39b009d45da@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 10 +++++-----
+ drivers/net/wireless/intel/iwlwifi/fw/acpi.h |  2 +-
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+index dcc4810cb3247..f6ee5afb3320e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+@@ -1296,7 +1296,6 @@ void iwl_acpi_get_phy_filters(struct iwl_fw_runtime *fwrt,
+ 	if (IS_ERR(data))
+ 		return;
+ 
+-	/* try to read wtas table revision 1 or revision 0*/
+ 	wifi_pkg = iwl_acpi_get_wifi_pkg(fwrt->dev, data,
+ 					 ACPI_WPFC_WIFI_DATA_SIZE,
+ 					 &tbl_rev);
+@@ -1306,13 +1305,14 @@ void iwl_acpi_get_phy_filters(struct iwl_fw_runtime *fwrt,
+ 	if (tbl_rev != 0)
+ 		goto out_free;
+ 
+-	BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) != ACPI_WPFC_WIFI_DATA_SIZE);
++	BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) !=
++		     ACPI_WPFC_WIFI_DATA_SIZE - 1);
+ 
+ 	for (i = 0; i < ARRAY_SIZE(filters->filter_cfg_chains); i++) {
+-		if (wifi_pkg->package.elements[i].type != ACPI_TYPE_INTEGER)
+-			return;
++		if (wifi_pkg->package.elements[i + 1].type != ACPI_TYPE_INTEGER)
++			goto out_free;
+ 		tmp.filter_cfg_chains[i] =
+-			cpu_to_le32(wifi_pkg->package.elements[i].integer.value);
++			cpu_to_le32(wifi_pkg->package.elements[i + 1].integer.value);
+ 	}
+ 
+ 	IWL_DEBUG_RADIO(fwrt, "Loaded WPFC filter config from ACPI\n");
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+index e9277f6f35821..39106ccb4b9b6 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+@@ -56,7 +56,7 @@
+ #define ACPI_EWRD_WIFI_DATA_SIZE_REV2	((ACPI_SAR_PROFILE_NUM - 1) * \
+ 					 ACPI_SAR_NUM_CHAINS_REV2 * \
+ 					 ACPI_SAR_NUM_SUB_BANDS_REV2 + 3)
+-#define ACPI_WPFC_WIFI_DATA_SIZE	4 /* 4 filter config words */
++#define ACPI_WPFC_WIFI_DATA_SIZE	5 /* domain and 4 filter config words */
+ 
+ /* revision 0 and 1 are identical, except for the semantics in the FW */
+ #define ACPI_GEO_NUM_BANDS_REV0		2
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-always-have-uats_enabled.patch b/queue-6.8/wifi-iwlwifi-always-have-uats_enabled.patch
new file mode 100644
index 00000000000..77dd95e397e
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-always-have-uats_enabled.patch
@@ -0,0 +1,42 @@
+From e59c982510e00f2240fe5c2a7db2f67ca73e9d63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 21:21:54 +0200
+Subject: wifi: iwlwifi: always have 'uats_enabled'
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit f639602a58e7564dd091c7c0793f61042bad9bb6 ]
+
+We check this in code that'd be complicated to put under
+ifdef (CONFIG_ACPI), so just always have 'uats_enabled'.
+
+Fixes: 4a9bb5b4d949 ("wifi: iwlwifi: fw: Add support for UATS table in UHB")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Mukesh Sisodiya <mukesh.sisodiya@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240129211905.bdc5fb20f00a.I902d801d79873c5c9cd51cef8e8226e2acefe88d@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+index 357727774db90..baabb8e321f8d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h
+@@ -173,9 +173,9 @@ struct iwl_fw_runtime {
+ 	struct iwl_sar_offset_mapping_cmd sgom_table;
+ 	bool sgom_enabled;
+ 	u8 reduced_power_flags;
+-	bool uats_enabled;
+ 	struct iwl_uats_table_cmd uats_table;
+ #endif
++	bool uats_enabled;
+ };
+ 
+ void iwl_fw_runtime_init(struct iwl_fw_runtime *fwrt, struct iwl_trans *trans,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-change-link-id-in-time-event-to-s8.patch b/queue-6.8/wifi-iwlwifi-change-link-id-in-time-event-to-s8.patch
new file mode 100644
index 00000000000..06ba63b649f
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-change-link-id-in-time-event-to-s8.patch
@@ -0,0 +1,80 @@
+From b25207ea8afe3339b994f4fb8bd4f25d3d5fe3aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 20:08:16 +0200
+Subject: wifi: iwlwifi: change link id in time event to s8
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 6c8ce23854b66db94d88e0957e531cb074806c16 ]
+
+Link ID in time event data is -1 when the time event is cleared.
+Change the type of the link ID in the time event data structure
+and in the affected function from unsigned to signed.
+
+Fixes: 135065837310 ("wifi: iwlwifi: support link_id in SESSION_PROTECTION cmd")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://msgid.link/20240123200528.50d4941f946c.Iea990b118c69bc3e1eb61c1d134c9d470b3a17ac@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mvm.h        | 2 +-
+ drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+index 81dbef6947f55..fe0fa9ff533d7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+@@ -121,7 +121,7 @@ struct iwl_mvm_time_event_data {
+ 	 * if the te is in the time event list or not (when id == TE_MAX)
+ 	 */
+ 	u32 id;
+-	u8 link_id;
++	s8 link_id;
+ };
+ 
+  /* Power management */
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+index 2e653a417d626..98c64ae315e68 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+@@ -692,7 +692,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm,
+ /* Determine whether mac or link id should be used, and validate the link id */
+ static int iwl_mvm_get_session_prot_id(struct iwl_mvm *mvm,
+ 				       struct ieee80211_vif *vif,
+-				       u32 link_id)
++				       s8 link_id)
+ {
+ 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ 	int ver = iwl_fw_lookup_cmd_ver(mvm->fw,
+@@ -716,7 +716,7 @@ static int iwl_mvm_get_session_prot_id(struct iwl_mvm *mvm,
+ 
+ static void iwl_mvm_cancel_session_protection(struct iwl_mvm *mvm,
+ 					      struct ieee80211_vif *vif,
+-					      u32 id, u32 link_id)
++					      u32 id, s8 link_id)
+ {
+ 	int mac_link_id = iwl_mvm_get_session_prot_id(mvm, vif, link_id);
+ 	struct iwl_mvm_session_prot_cmd cmd = {
+@@ -745,7 +745,7 @@ static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm,
+ 	struct ieee80211_vif *vif = te_data->vif;
+ 	struct iwl_mvm_vif *mvmvif;
+ 	enum nl80211_iftype iftype;
+-	unsigned int link_id;
++	s8 link_id;
+ 
+ 	if (!vif)
+ 		return false;
+@@ -1297,7 +1297,7 @@ void iwl_mvm_schedule_session_protection(struct iwl_mvm *mvm,
+ 	struct iwl_mvm_time_event_data *te_data = &mvmvif->time_event_data;
+ 	const u16 notif[] = { WIDE_ID(MAC_CONF_GROUP, SESSION_PROTECTION_NOTIF) };
+ 	struct iwl_notification_wait wait_notif;
+-	int mac_link_id = iwl_mvm_get_session_prot_id(mvm, vif, link_id);
++	int mac_link_id = iwl_mvm_get_session_prot_id(mvm, vif, (s8)link_id);
+ 	struct iwl_mvm_session_prot_cmd cmd = {
+ 		.id_and_color = cpu_to_le32(mac_link_id),
+ 		.action = cpu_to_le32(FW_CTXT_ACTION_ADD),
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch b/queue-6.8/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
new file mode 100644
index 00000000000..d2d12462137
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-dbg-tlv-ensure-nul-termination.patch
@@ -0,0 +1,43 @@
+From 7e2206c61b383955564f802259facc281bd8752d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 08:53:53 +0200
+Subject: wifi: iwlwifi: dbg-tlv: ensure NUL termination
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ]
+
+The iwl_fw_ini_debug_info_tlv is used as a string, so we must
+ensure the string is terminated correctly before using it.
+
+Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4c055dc84984a0@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+index 72075720969c0..3442dfab50b53 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+@@ -103,6 +103,12 @@ static int iwl_dbg_tlv_alloc_debug_info(struct iwl_trans *trans,
+ 	if (le32_to_cpu(tlv->length) != sizeof(*debug_info))
+ 		return -EINVAL;
+ 
++	/* we use this as a string, ensure input was NUL terminated */
++	if (strnlen(debug_info->debug_cfg_name,
++		    sizeof(debug_info->debug_cfg_name)) ==
++			sizeof(debug_info->debug_cfg_name))
++		return -EINVAL;
++
+ 	IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n",
+ 		     debug_info->debug_cfg_name);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-fix-ewrd-table-validity-check.patch b/queue-6.8/wifi-iwlwifi-fix-ewrd-table-validity-check.patch
new file mode 100644
index 00000000000..f6eaf18cb39
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-fix-ewrd-table-validity-check.patch
@@ -0,0 +1,44 @@
+From 1f07f4e1c088fd2c0dc987c2d5206f260b5ee641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 21:21:49 +0200
+Subject: wifi: iwlwifi: fix EWRD table validity check
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit c8d8f3911135921ace8e939ea0956b55f74bf8a0 ]
+
+EWRD ACPI table contains up to 3 additional sar profiles.
+According to the BIOS spec, the table contains a n_profile
+variable indicating how many additional profiles exist in the
+table.
+Currently we check that n_profiles is not <= 0.
+But according to the BIOS spec, 0 is a valid value,
+and it can't be < 0 anyway because we receive that from ACPI as
+an unsigned integer.
+
+Fixes: 39c1a9728f93 ("iwlwifi: refactor the SAR tables from mvm to acpi")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://msgid.link/20240129211905.448ea2f40814.Iffd2aadf8e8693e6cb599bee0406a800a0c1e081@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+index f6ee5afb3320e..e161b44539069 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+@@ -767,7 +767,7 @@ int iwl_sar_get_ewrd_table(struct iwl_fw_runtime *fwrt)
+ 	 * from index 1, so the maximum value allowed here is
+ 	 * ACPI_SAR_PROFILES_NUM - 1.
+ 	 */
+-	if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) {
++	if (n_profiles >= ACPI_SAR_PROFILE_NUM) {
+ 		ret = -EINVAL;
+ 		goto out_free;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-d3-fix-ipn-byte-order.patch b/queue-6.8/wifi-iwlwifi-mvm-d3-fix-ipn-byte-order.patch
new file mode 100644
index 00000000000..2e0c6844182
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-d3-fix-ipn-byte-order.patch
@@ -0,0 +1,57 @@
+From f5b2ea28bf178702e67b7d5f06b5ab958366a836 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 21:21:51 +0200
+Subject: wifi: iwlwifi: mvm: d3: fix IPN byte order
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 0c769cb6b9f364423c255f117774c9ecd5bf23ea ]
+
+The IPN is reported by the firmware in 6 bytes little endian,
+but mac80211 expects big endian so it can do memcmp() on it.
+We used to store this as a u64 which was filled in the right
+way, but never used. When implementing that it's used, we
+changed it to just be 6 bytes, but lost the conversion. Add
+it back.
+
+Fixes: 04f78e242fff ("wifi: iwlwifi: mvm: Add support for IGTK in D3 resume flow")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240129211905.138ed8a698e3.I1b66c386e45b5392696424ec636474bff86fd5ef@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index 05b64176859e8..03d0c9ab73fc0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -2200,7 +2200,10 @@ static void iwl_mvm_convert_gtk_v3(struct iwl_wowlan_status_data *status,
+ static void iwl_mvm_convert_igtk(struct iwl_wowlan_status_data *status,
+ 				 struct iwl_wowlan_igtk_status *data)
+ {
++	int i;
++
+ 	BUILD_BUG_ON(sizeof(status->igtk.key) < sizeof(data->key));
++	BUILD_BUG_ON(sizeof(status->igtk.ipn) != sizeof(data->ipn));
+ 
+ 	if (!data->key_len)
+ 		return;
+@@ -2212,7 +2215,10 @@ static void iwl_mvm_convert_igtk(struct iwl_wowlan_status_data *status,
+ 		+ WOWLAN_IGTK_MIN_INDEX;
+ 
+ 	memcpy(status->igtk.key, data->key, sizeof(data->key));
+-	memcpy(status->igtk.ipn, data->ipn, sizeof(data->ipn));
++
++	/* mac80211 expects big endian for memcmp() to work, convert */
++	for (i = 0; i < sizeof(data->ipn); i++)
++		status->igtk.ipn[i] = data->ipn[sizeof(data->ipn) - i - 1];
+ }
+ 
+ static void iwl_mvm_convert_bigtk(struct iwl_wowlan_status_data *status,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch b/queue-6.8/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
new file mode 100644
index 00000000000..304ec8b666f
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-don-t-set-replay-counters-to-0xff.patch
@@ -0,0 +1,52 @@
+From 442f00d8bbbc43aeb56968e9a1a31ea29f08cf2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 18:02:09 +0200
+Subject: wifi: iwlwifi: mvm: don't set replay counters to 0xff
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit d5bd4041cd70faf26fc9a54bd6f172537bbe77f3 ]
+
+The firmware (later) actually uses the values even for keys
+that are invalid as far as the host is concerned, later in
+rekeying, and then only sets the low 48 bits since the PNs
+are only 48 bits over the air. It does, however, compare the
+full 64 bits later, obviously causing problems.
+
+Remove the memset and use kzalloc instead to avoid any old
+heap data leaking to the firmware. We already init all the
+other fields in the struct anyway. This leaves the data set
+to zero for any unused fields, so the firmware can look at
+them safely even if they're not used right now.
+
+Fixes: 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240206175739.462101146fef.I10f3855b99417af4247cff04af78dcbc6cb75c9c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+index 03d0c9ab73fc0..2a08369238f23 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+@@ -461,12 +461,10 @@ static int iwl_mvm_wowlan_config_rsc_tsc(struct iwl_mvm *mvm,
+ 		struct wowlan_key_rsc_v5_data data = {};
+ 		int i;
+ 
+-		data.rsc = kmalloc(sizeof(*data.rsc), GFP_KERNEL);
++		data.rsc = kzalloc(sizeof(*data.rsc), GFP_KERNEL);
+ 		if (!data.rsc)
+ 			return -ENOMEM;
+ 
+-		memset(data.rsc, 0xff, sizeof(*data.rsc));
+-
+ 		for (i = 0; i < ARRAY_SIZE(data.rsc->mcast_key_id_map); i++)
+ 			data.rsc->mcast_key_id_map[i] =
+ 				IWL_MCAST_KEY_MAP_INVALID;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-don-t-set-the-mfp-flag-for-the-gtk.patch b/queue-6.8/wifi-iwlwifi-mvm-don-t-set-the-mfp-flag-for-the-gtk.patch
new file mode 100644
index 00000000000..3f156362dc1
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-don-t-set-the-mfp-flag-for-the-gtk.patch
@@ -0,0 +1,74 @@
+From 83462afc68cf44a10aafc3c783ad9371c129dd12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Feb 2024 18:02:06 +0200
+Subject: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit e35f316bce9e5733c9826120c1838f4c447b2c4c ]
+
+The firmware doesn't need the MFP flag for the GTK, it can even make the
+firmware crash. in case the AP is configured with: group cipher TKIP and
+MFPC. We would send the GTK with cipher = TKIP and MFP which is of course
+not possible.
+
+Fixes: 5c75a208c244 ("wifi: iwlwifi: mvm: support new key API")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240206175739.2f2c602ab3c6.If13b2e2fa532381d985c07df130bee1478046c89@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/mvm/mld-key.c   | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c
+index ea3e9e9c6e26c..fe4b39b19a612 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ /*
+- * Copyright (C) 2022 - 2023 Intel Corporation
++ * Copyright (C) 2022 - 2024 Intel Corporation
+  */
+ #include <linux/kernel.h>
+ #include <net/mac80211.h>
+@@ -62,11 +62,13 @@ u32 iwl_mvm_get_sec_flags(struct iwl_mvm *mvm,
+ 			  struct ieee80211_key_conf *keyconf)
+ {
+ 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
++	bool pairwise = keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE;
++	bool igtk = keyconf->keyidx == 4 || keyconf->keyidx == 5;
+ 	u32 flags = 0;
+ 
+ 	lockdep_assert_held(&mvm->mutex);
+ 
+-	if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
++	if (!pairwise)
+ 		flags |= IWL_SEC_KEY_FLAG_MCAST_KEY;
+ 
+ 	switch (keyconf->cipher) {
+@@ -96,12 +98,14 @@ u32 iwl_mvm_get_sec_flags(struct iwl_mvm *mvm,
+ 	if (!sta && vif->type == NL80211_IFTYPE_STATION)
+ 		sta = mvmvif->ap_sta;
+ 
+-	/* Set the MFP flag also for an AP interface where the key is an IGTK
+-	 * key as in such a case the station would always be NULL
++	/*
++	 * If we are installing an iGTK (in AP or STA mode), we need to tell
++	 * the firmware this key will en/decrypt MGMT frames.
++	 * Same goes if we are installing a pairwise key for an MFP station.
++	 * In case we're installing a groupwise key (which is not an iGTK),
++	 * then, we will not use this key for MGMT frames.
+ 	 */
+-	if ((!IS_ERR_OR_NULL(sta) && sta->mfp) ||
+-	    (vif->type == NL80211_IFTYPE_AP &&
+-	     (keyconf->keyidx == 4 || keyconf->keyidx == 5)))
++	if ((!IS_ERR_OR_NULL(sta) && sta->mfp && pairwise) || igtk)
+ 		flags |= IWL_SEC_KEY_FLAG_MFP;
+ 
+ 	return flags;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-fix-erroneous-queue-index-mask.patch b/queue-6.8/wifi-iwlwifi-mvm-fix-erroneous-queue-index-mask.patch
new file mode 100644
index 00000000000..5fdff4ad0d8
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-fix-erroneous-queue-index-mask.patch
@@ -0,0 +1,68 @@
+From f39bfb6434a78384d4dddb192244f1e594c87116 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Feb 2024 21:21:14 +0200
+Subject: wifi: iwlwifi: mvm: fix erroneous queue index mask
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 2e0e766bd8a7f14f10c3e70b8203c4c1e6d9ec76 ]
+
+When retrieving the queue index ("SCD SSN") from the TX response,
+it's currently masked with 0xFFF. However, now that we have queues
+longer than 4k, that became wrong, so make the mask depend on the
+hardware family.
+
+This fixes an issue where if we get a single frame reclaim while
+in the top half of an 8k long queue, we'd reclaim-wrap the queue
+twice (once on this and then again on the next non-single reclaim)
+which at least triggers the WARN_ON_ONCE() in iwl_txq_reclaim(),
+but could have other negative side effects (such as unmapping a
+frame that wasn't transmitted yet, and then taking an IOMMU fault)
+as well.
+
+Fixes: 7b3e42ea2ead ("iwlwifi: support multiple tfd queue max sizes for different devices")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240205211151.4148a6ef54e0.I733a70f679c25f9f99097a8dcb3a1f8165da6997@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 461f26d9214e4..930742e75c02a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+ /*
+- * Copyright (C) 2012-2014, 2018-2023 Intel Corporation
++ * Copyright (C) 2012-2014, 2018-2024 Intel Corporation
+  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
+  * Copyright (C) 2016-2017 Intel Deutschland GmbH
+  */
+@@ -1636,12 +1636,18 @@ static void iwl_mvm_tx_status_check_trigger(struct iwl_mvm *mvm,
+  * of the batch. This is why the SSN of the SCD is written at the end of the
+  * whole struct at a variable offset. This function knows how to cope with the
+  * variable offset and returns the SSN of the SCD.
++ *
++ * For 22000-series and lower, this is just 12 bits. For later, 16 bits.
+  */
+ static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm *mvm,
+ 				      struct iwl_mvm_tx_resp *tx_resp)
+ {
+-	return le32_to_cpup((__le32 *)iwl_mvm_get_agg_status(mvm, tx_resp) +
+-			    tx_resp->frame_count) & 0xfff;
++	u32 val = le32_to_cpup((__le32 *)iwl_mvm_get_agg_status(mvm, tx_resp) +
++			       tx_resp->frame_count);
++
++	if (mvm->trans->trans_cfg->device_family >= IWL_DEVICE_FAMILY_AX210)
++		return val & 0xFFFF;
++	return val & 0xFFF;
+ }
+ 
+ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-fix-the-listener-mac-filter-flags.patch b/queue-6.8/wifi-iwlwifi-mvm-fix-the-listener-mac-filter-flags.patch
new file mode 100644
index 00000000000..393bdd46a6d
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-fix-the-listener-mac-filter-flags.patch
@@ -0,0 +1,37 @@
+From 6b73bc344bd16e5bdd709b8fed16f9368c26db39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Feb 2024 18:58:38 +0200
+Subject: wifi: iwlwifi: mvm: Fix the listener MAC filter flags
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit 4cdb86487e3eaddb4b3a7df30ae709e810aac84b ]
+
+One of the flags was from the wrong API.
+
+Fixes: 9be162a7b670 ("wifi: iwlwifi: mvm: add support for the new MAC CTXT command")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240208185302.a338c30ec4e9.Ic2813cdeba4443c692d462fc4859392f069d7e33@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
+index f313a8d771e42..ad78c69cc6cb7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac.c
+@@ -167,7 +167,7 @@ static int iwl_mvm_mld_mac_ctxt_cmd_listener(struct iwl_mvm *mvm,
+ 	iwl_mvm_mld_mac_ctxt_cmd_common(mvm, vif, &cmd, action);
+ 
+ 	cmd.filter_flags = cpu_to_le32(MAC_CFG_FILTER_PROMISC |
+-				       MAC_FILTER_IN_CONTROL_AND_MGMT |
++				       MAC_CFG_FILTER_ACCEPT_CONTROL_AND_MGMT |
+ 				       MAC_CFG_FILTER_ACCEPT_BEACON |
+ 				       MAC_CFG_FILTER_ACCEPT_PROBE_REQ |
+ 				       MAC_CFG_FILTER_ACCEPT_GRP);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-fix-the-tlc-command-after-add_sta.patch b/queue-6.8/wifi-iwlwifi-mvm-fix-the-tlc-command-after-add_sta.patch
new file mode 100644
index 00000000000..57f78a4999a
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-fix-the-tlc-command-after-add_sta.patch
@@ -0,0 +1,54 @@
+From 67b74cf6daba00a4038173e3d04f0825af58a201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 21:21:59 +0200
+Subject: wifi: iwlwifi: mvm: fix the TLC command after ADD_STA
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 0fcdf55fced7121c43fa576433986f1c04115b73 ]
+
+ADD_STA resets the link quality data inside the firmware. This is not
+supposed to happen and has been fixed for newer devices. For older
+devices (AX201 and down), this makes us send frames with rates that are
+not in the TLC table.
+
+Fixes: 5a86dcb4a908 ("wifi: iwlwifi: mvm: update station's MFP flag after association")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240129211905.1deca7eaff14.I597abd7aab36fdab4aa8311a48c98a3d5bd433ba@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 346512696bd1c..f60d4258e1b95 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -3809,13 +3809,17 @@ iwl_mvm_sta_state_assoc_to_authorized(struct iwl_mvm *mvm,
+ 
+ 	mvm_sta->authorized = true;
+ 
+-	iwl_mvm_rs_rate_init_all_links(mvm, vif, sta);
+-
+ 	/* MFP is set by default before the station is authorized.
+ 	 * Clear it here in case it's not used.
+ 	 */
+-	if (!sta->mfp)
+-		return callbacks->update_sta(mvm, vif, sta);
++	if (!sta->mfp) {
++		int ret = callbacks->update_sta(mvm, vif, sta);
++
++		if (ret)
++			return ret;
++	}
++
++	iwl_mvm_rs_rate_init_all_links(mvm, vif, sta);
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-initialize-rates-in-fw-earlier.patch b/queue-6.8/wifi-iwlwifi-mvm-initialize-rates-in-fw-earlier.patch
new file mode 100644
index 00000000000..e521b646e5f
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-initialize-rates-in-fw-earlier.patch
@@ -0,0 +1,56 @@
+From 4f3070727f2df313aed8566f23ca21f11bb2f75e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 08:53:58 +0200
+Subject: wifi: iwlwifi: mvm: initialize rates in FW earlier
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit d3b2c6c65bfd3b9616084e91bd0d402964ea7cef ]
+
+When connecting to an AP, we currently initialize the rate
+control only after associating. Since we now use firmware
+to assign rates to auth/assoc frames rather than using the
+data in the station and the firmware doesn't know, they're
+transmitted using low mandatory rates. However, if the AP
+advertised only higher supported rates we want to use them
+to be nicer (it still must receive mandatory rates though),
+so send the information to the firmware earlier to have it
+know about it and be able to use it.
+
+Fixes: 499d02790495 ("wifi: iwlwifi: Use FW rate for non-data frames")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240128084842.ed7ab1c859c2.I4b4d4fc3905c8d8470fc0fee4648f25c950c9bb7@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 53e26c3c3a9af..346512696bd1c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -3698,6 +3698,19 @@ iwl_mvm_sta_state_notexist_to_none(struct iwl_mvm *mvm,
+ 	if (vif->type == NL80211_IFTYPE_STATION && !sta->tdls)
+ 		mvmvif->ap_sta = sta;
+ 
++	/*
++	 * Initialize the rates here already - this really tells
++	 * the firmware only what the supported legacy rates are
++	 * (may be) since it's initialized already from what the
++	 * AP advertised in the beacon/probe response. This will
++	 * allow the firmware to send auth/assoc frames with one
++	 * of the supported rates already, rather than having to
++	 * use a mandatory rate.
++	 * If we're the AP, we'll just assume mandatory rates at
++	 * this point, but we know nothing about the STA anyway.
++	 */
++	iwl_mvm_rs_rate_init_all_links(mvm, vif, sta);
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch b/queue-6.8/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
new file mode 100644
index 00000000000..f61ba514272
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-mvm-report-beacon-protection-failures.patch
@@ -0,0 +1,105 @@
+From 9c6c4ecbe381a73a060a39293736bd770990d8d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 08:53:48 +0200
+Subject: wifi: iwlwifi: mvm: report beacon protection failures
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 91380f768d7f6e3d003755defa792e9a00a1444a ]
+
+Andrei reports that we just silently drop beacons after we
+report the key counters, but never report to userspace, so
+wpa_supplicant cannot send the WNM action frame. Fix that.
+
+Fixes: b1fdc2505abc ("iwlwifi: mvm: advertise BIGTK client support if available")
+Reported-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240128084842.7d855442cdce.Iba90b26f893dc8c49bfb8be65373cd0a138af12c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 26 +++++++++++--------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index af15d470c69bd..7bf2a5947e5e9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -282,6 +282,7 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 				u32 status,
+ 				struct ieee80211_rx_status *stats)
+ {
++	struct wireless_dev *wdev;
+ 	struct iwl_mvm_sta *mvmsta;
+ 	struct iwl_mvm_vif *mvmvif;
+ 	u8 keyid;
+@@ -303,9 +304,15 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 	if (!ieee80211_is_beacon(hdr->frame_control))
+ 		return 0;
+ 
++	if (!sta)
++		return -1;
++
++	mvmsta = iwl_mvm_sta_from_mac80211(sta);
++	mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
++
+ 	/* key mismatch - will also report !MIC_OK but we shouldn't count it */
+ 	if (!(status & IWL_RX_MPDU_STATUS_KEY_VALID))
+-		return -1;
++		goto report;
+ 
+ 	/* good cases */
+ 	if (likely(status & IWL_RX_MPDU_STATUS_MIC_OK &&
+@@ -314,13 +321,6 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 		return 0;
+ 	}
+ 
+-	if (!sta)
+-		return -1;
+-
+-	mvmsta = iwl_mvm_sta_from_mac80211(sta);
+-
+-	mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
+-
+ 	/*
+ 	 * both keys will have the same cipher and MIC length, use
+ 	 * whichever one is available
+@@ -329,11 +329,11 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 	if (!key) {
+ 		key = rcu_dereference(mvmvif->bcn_prot.keys[1]);
+ 		if (!key)
+-			return -1;
++			goto report;
+ 	}
+ 
+ 	if (len < key->icv_len + IEEE80211_GMAC_PN_LEN + 2)
+-		return -1;
++		goto report;
+ 
+ 	/* get the real key ID */
+ 	keyid = frame[len - key->icv_len - IEEE80211_GMAC_PN_LEN - 2];
+@@ -347,7 +347,7 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 			return -1;
+ 		key = rcu_dereference(mvmvif->bcn_prot.keys[keyid - 6]);
+ 		if (!key)
+-			return -1;
++			goto report;
+ 	}
+ 
+ 	/* Report status to mac80211 */
+@@ -355,6 +355,10 @@ static int iwl_mvm_rx_mgmt_prot(struct ieee80211_sta *sta,
+ 		ieee80211_key_mic_failure(key);
+ 	else if (status & IWL_RX_MPDU_STATUS_REPLAY_ERROR)
+ 		ieee80211_key_replay(key);
++report:
++	wdev = ieee80211_vif_to_wdev(mvmsta->vif);
++	if (wdev->netdev)
++		cfg80211_rx_unprot_mlme_mgmt(wdev->netdev, (void *)hdr, len);
+ 
+ 	return -1;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-properly-check-if-link-is-active.patch b/queue-6.8/wifi-iwlwifi-properly-check-if-link-is-active.patch
new file mode 100644
index 00000000000..373f8c13a95
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-properly-check-if-link-is-active.patch
@@ -0,0 +1,43 @@
+From 6a4058902b03cd1537996f7883a4df0875f063bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Feb 2024 21:21:05 +0200
+Subject: wifi: iwlwifi: properly check if link is active
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 556c7cd721b5262579ba1710c3b4e7ffdb5573ac ]
+
+Before sending SESSION PROTECTION cmd the driver verifies that the
+link for which the cmd is going to be sent is active.
+The existing code is checking it only for MLD vifs,
+but also the deflink (in non-MLD vifs) needs to be active in order
+the have a session protection for it.
+Fix this by checking if the link is active also for non-MLD vifs
+
+Fixes: 135065837310 ("wifi: iwlwifi: support link_id in SESSION_PROTECTION cmd")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://msgid.link/20240205211151.c61820f14ca6.Ibbe0f848f3e71f64313d21642650b6e4bfbe4b39@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+index 98c64ae315e68..da00ef6e4fbcf 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c
+@@ -706,8 +706,7 @@ static int iwl_mvm_get_session_prot_id(struct iwl_mvm *mvm,
+ 		 "Invalid link ID for session protection: %u\n", link_id))
+ 		return -EINVAL;
+ 
+-	if (WARN(ieee80211_vif_is_mld(vif) &&
+-		 !(vif->active_links & BIT(link_id)),
++	if (WARN(!mvmvif->link[link_id]->active,
+ 		 "Session Protection on an inactive link: %u\n", link_id))
+ 		return -EINVAL;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-read-bios-pnvm-only-for-non-intel-sku.patch b/queue-6.8/wifi-iwlwifi-read-bios-pnvm-only-for-non-intel-sku.patch
new file mode 100644
index 00000000000..cc6f7f53bda
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-read-bios-pnvm-only-for-non-intel-sku.patch
@@ -0,0 +1,70 @@
+From 029d606b432a02ff3389f0d8a4496d4db82bdf11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jan 2024 10:24:34 +0200
+Subject: wifi: iwlwifi: read BIOS PNVM only for non-Intel SKU
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit c868a189ecfe8cc0b3173c2eaa7f0b659326c151 ]
+
+The driver is supposed to read the PNVM from BIOS only for non-Intel
+SKUs. For Intel SKUs the OEM ID will be 0.
+Read BIOS PNVM only when a non-Intel SKU is indicated.
+
+Fixes: b99e32cbfdf6 ("wifi: iwlwifi: Take loading and setting of pnvm image out of parsing part")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://msgid.link/20240131091413.3625cf1223d3.Ieffda5f506713b1c979388dd7a0e1c1a0145cfca@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 30 ++++++++++++--------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+index 650e4bde9c17b..56ee0ceed78ab 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+@@ -255,21 +255,27 @@ static u8 *iwl_get_pnvm_image(struct iwl_trans *trans_p, size_t *len)
+ 	struct pnvm_sku_package *package;
+ 	u8 *image = NULL;
+ 
+-	/* First attempt to get the PNVM from BIOS */
+-	package = iwl_uefi_get_pnvm(trans_p, len);
+-	if (!IS_ERR_OR_NULL(package)) {
+-		if (*len >= sizeof(*package)) {
+-			/* we need only the data */
+-			*len -= sizeof(*package);
+-			image = kmemdup(package->data, *len, GFP_KERNEL);
++	/* Get PNVM from BIOS for non-Intel SKU */
++	if (trans_p->sku_id[2]) {
++		package = iwl_uefi_get_pnvm(trans_p, len);
++		if (!IS_ERR_OR_NULL(package)) {
++			if (*len >= sizeof(*package)) {
++				/* we need only the data */
++				*len -= sizeof(*package);
++				image = kmemdup(package->data,
++						*len, GFP_KERNEL);
++			}
++			/*
++			 * free package regardless of whether kmemdup
++			 * succeeded
++			 */
++			kfree(package);
++			if (image)
++				return image;
+ 		}
+-		/* free package regardless of whether kmemdup succeeded */
+-		kfree(package);
+-		if (image)
+-			return image;
+ 	}
+ 
+-	/* If it's not available, try from the filesystem */
++	/* If it's not available, or for Intel SKU, try from the filesystem */
+ 	if (iwl_pnvm_get_from_fs(trans_p, &image, len))
+ 		return NULL;
+ 	return image;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-iwlwifi-support-eht-for-wh.patch b/queue-6.8/wifi-iwlwifi-support-eht-for-wh.patch
new file mode 100644
index 00000000000..44bdc990f89
--- /dev/null
+++ b/queue-6.8/wifi-iwlwifi-support-eht-for-wh.patch
@@ -0,0 +1,37 @@
+From 1f7a683b26872441532d95de440de3bb00a000e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Feb 2024 00:06:13 +0200
+Subject: wifi: iwlwifi: support EHT for WH
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit f51d6431824f0afb9f73d68971d154c47c26b86a ]
+
+sku_cap_11be_enable should be set to true also for WH.
+
+Fixes: e1374ed25324 ("wifi: iwlwifi: Add support for new CNVi (SC)")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Link: https://msgid.link/20240204235836.a6d4097cbaca.I8b00fa7b6226b4116cd91f70fb0b15e79b4dee5a@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index 2f6774ec37b22..501a8cc2134cf 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -2097,7 +2097,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
+ 		!!(mac_flags & NVM_MAC_SKU_FLAGS_BAND_5_2_ENABLED);
+ 	nvm->sku_cap_mimo_disabled =
+ 		!!(mac_flags & NVM_MAC_SKU_FLAGS_MIMO_DISABLED);
+-	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) == IWL_CFG_RF_TYPE_FM)
++	if (CSR_HW_RFID_TYPE(trans->hw_rf_id) >= IWL_CFG_RF_TYPE_FM)
+ 		nvm->sku_cap_11be_enable = true;
+ 
+ 	/* Initialize PHY sku data */
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch b/queue-6.8/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
new file mode 100644
index 00000000000..6a9e2666d2b
--- /dev/null
+++ b/queue-6.8/wifi-libertas-fix-some-memleaks-in-lbs_allocate_cmd_.patch
@@ -0,0 +1,57 @@
+From 747d6215af6f8b403cb354e4064a067d157639d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 15:53:34 +0800
+Subject: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 5f0e4aede01cb01fa633171f0533affd25328c3a ]
+
+In the for statement of lbs_allocate_cmd_buffer(), if the allocation of
+cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to
+be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().
+
+Fixes: 876c9d3aeb98 ("[PATCH] Marvell Libertas 8388 802.11b/g USB driver")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240126075336.2825608-1-alexious@zju.edu.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/cmd.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/cmd.c b/drivers/net/wireless/marvell/libertas/cmd.c
+index 104d2b6dc9af6..5a525da434c28 100644
+--- a/drivers/net/wireless/marvell/libertas/cmd.c
++++ b/drivers/net/wireless/marvell/libertas/cmd.c
+@@ -1132,7 +1132,7 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
+ 		if (!cmdarray[i].cmdbuf) {
+ 			lbs_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n");
+ 			ret = -1;
+-			goto done;
++			goto free_cmd_array;
+ 		}
+ 	}
+ 
+@@ -1140,8 +1140,17 @@ int lbs_allocate_cmd_buffer(struct lbs_private *priv)
+ 		init_waitqueue_head(&cmdarray[i].cmdwait_q);
+ 		lbs_cleanup_and_insert_cmd(priv, &cmdarray[i]);
+ 	}
+-	ret = 0;
++	return 0;
+ 
++free_cmd_array:
++	for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {
++		if (cmdarray[i].cmdbuf) {
++			kfree(cmdarray[i].cmdbuf);
++			cmdarray[i].cmdbuf = NULL;
++		}
++	}
++	kfree(priv->cmd_array);
++	priv->cmd_array = NULL;
+ done:
+ 	return ret;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mac80211-use-deflink-and-fix-typo-in-link-id-ch.patch b/queue-6.8/wifi-mac80211-use-deflink-and-fix-typo-in-link-id-ch.patch
new file mode 100644
index 00000000000..bf34f4f5b1e
--- /dev/null
+++ b/queue-6.8/wifi-mac80211-use-deflink-and-fix-typo-in-link-id-ch.patch
@@ -0,0 +1,44 @@
+From c0a0c7590a4afd6437a835068999cadb0bc148e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 18:17:46 +0200
+Subject: wifi: mac80211: use deflink and fix typo in link ID check
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit e10322810ce0d0d4a5a319458c4e1e052c6fe9be ]
+
+This does not change anything effectively, but it is closer to what the
+code is trying to achieve here. i.e. select the link data if it is an
+MLD and fall back to using the deflink otherwise.
+
+Fixes: 0f99f0878350 ("wifi: mac80211: Print local link address during authentication")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Reviewed-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240111181514.4c4b1c40eb3c.I2771621dee328c618536596b7e56232df42a79c8@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index 2022a26eb8811..20d863370796d 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -7523,10 +7523,10 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+ 	if (err)
+ 		goto err_clear;
+ 
+-	if (req->link_id > 0)
++	if (req->link_id >= 0)
+ 		link = sdata_dereference(sdata->link[req->link_id], sdata);
+ 	else
+-		link = sdata_dereference(sdata->link[0], sdata);
++		link = &sdata->deflink;
+ 
+ 	if (WARN_ON(!link)) {
+ 		err = -ENOLINK;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-fix-the-issue-of-missing-txpwr-settings-fr.patch b/queue-6.8/wifi-mt76-fix-the-issue-of-missing-txpwr-settings-fr.patch
new file mode 100644
index 00000000000..1d65a36f7d3
--- /dev/null
+++ b/queue-6.8/wifi-mt76-fix-the-issue-of-missing-txpwr-settings-fr.patch
@@ -0,0 +1,38 @@
+From ed2a27bfb91dd9b41634aed88f953c8aaa0f66d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Feb 2024 11:31:23 +0800
+Subject: wifi: mt76: fix the issue of missing txpwr settings from ch153 to
+ ch177
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit e9a46175a79fbc591c48d433020444b8fa2750ee ]
+
+Because the number of channels to be configured is calculated using the %,
+and it results in 0 when there's an exact division, this leads to some
+channels not having their tx power configured.
+
+Fixes: 7801da338856 ("wifi: mt76: mt7921: enable set txpower for UNII-4")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+index ea7ffa16a4b12..ae19174b46ee5 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -2101,7 +2101,7 @@ mt76_connac_mcu_rate_txpower_band(struct mt76_phy *phy,
+ 		int j, msg_len, num_ch;
+ 		struct sk_buff *skb;
+ 
+-		num_ch = i == batch_size - 1 ? n_chan % batch_len : batch_len;
++		num_ch = i == batch_size - 1 ? n_chan - i * batch_len : batch_len;
+ 		msg_len = sizeof(tx_power_tlv) + num_ch * sizeof(sku_tlbv);
+ 		skb = mt76_mcu_msg_alloc(dev, NULL, msg_len);
+ 		if (!skb) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-c.patch b/queue-6.8/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-c.patch
new file mode 100644
index 00000000000..e4ebe68594a
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7921-fix-incorrect-type-conversion-for-c.patch
@@ -0,0 +1,47 @@
+From c2bcb64ef7c02abc2a0885980f777644b7ce2a5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 10:48:54 +0800
+Subject: wifi: mt76: mt7921: fix incorrect type conversion for CLC command
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit b6351ef9994ccb93b2447d396a0c517964dff2bc ]
+
+clc->len is defined as 32 bits in length, so it must also be
+operated on with 32 bits, not 16 bits.
+
+Fixes: fa6ad88e023d ("wifi: mt76: mt7921: fix country count limitation for CLC")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202312112104.Zkc3QUHr-lkp@intel.com/
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index f5582477c7e4c..8b4ce32a2cd12 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -1272,7 +1272,7 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
+ 		.mtcl_conf = mt792x_acpi_get_mtcl_conf(&dev->phy, alpha2),
+ 	};
+ 	int ret, valid_cnt = 0;
+-	u16 buf_len = 0;
++	u32 buf_len = 0;
+ 	u8 *pos;
+ 
+ 	if (!clc)
+@@ -1283,7 +1283,7 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
+ 	if (mt76_find_power_limits_node(&dev->mt76))
+ 		req.cap |= CLC_CAP_DTS_EN;
+ 
+-	buf_len = le16_to_cpu(clc->len) - sizeof(*clc);
++	buf_len = le32_to_cpu(clc->len) - sizeof(*clc);
+ 	pos = clc->data;
+ 	while (buf_len > 16) {
+ 		struct mt7921_clc_rule *rule = (struct mt7921_clc_rule *)pos;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch b/queue-6.8/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch
new file mode 100644
index 00000000000..bd6b981c265
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7921e-fix-use-after-free-in-free_irq.patch
@@ -0,0 +1,92 @@
+From baa008238a84dcf31e4a35346ab7e8fc7ea2bf22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 17:00:22 +0800
+Subject: wifi: mt76: mt7921e: fix use-after-free in free_irq()
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit c957280ef6ab6bdf559a91ae693a6b34310697e3 ]
+
+From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test
+to make sure the shared irq handler should be able to handle the unexpected
+event after deregistration. For this case, let's apply MT76_REMOVED flag to
+indicate the device was removed and do not run into the resource access
+anymore.
+
+BUG: KASAN: use-after-free in mt7921_irq_handler+0xd8/0x100 [mt7921e]
+Read of size 8 at addr ffff88824a7d3b78 by task rmmod/11115
+CPU: 28 PID: 11115 Comm: rmmod Tainted: G        W    L    5.17.0 #10
+Hardware name: Micro-Star International Co., Ltd. MS-7D73/MPG B650I
+EDGE WIFI (MS-7D73), BIOS 1.81 01/05/2024
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x6f/0xa0
+ print_address_description.constprop.0+0x1f/0x190
+ ? mt7921_irq_handler+0xd8/0x100 [mt7921e]
+ ? mt7921_irq_handler+0xd8/0x100 [mt7921e]
+ kasan_report.cold+0x7f/0x11b
+ ? mt7921_irq_handler+0xd8/0x100 [mt7921e]
+ mt7921_irq_handler+0xd8/0x100 [mt7921e]
+ free_irq+0x627/0xaa0
+ devm_free_irq+0x94/0xd0
+ ? devm_request_any_context_irq+0x160/0x160
+ ? kobject_put+0x18d/0x4a0
+ mt7921_pci_remove+0x153/0x190 [mt7921e]
+ pci_device_remove+0xa2/0x1d0
+ __device_release_driver+0x346/0x6e0
+ driver_detach+0x1ef/0x2c0
+ bus_remove_driver+0xe7/0x2d0
+ ? __check_object_size+0x57/0x310
+ pci_unregister_driver+0x26/0x250
+ __do_sys_delete_module+0x307/0x510
+ ? free_module+0x6a0/0x6a0
+ ? fpregs_assert_state_consistent+0x4b/0xb0
+ ? rcu_read_lock_sched_held+0x10/0x70
+ ? syscall_enter_from_user_mode+0x20/0x70
+ ? trace_hardirqs_on+0x1c/0x130
+ do_syscall_64+0x5c/0x80
+ ? trace_hardirqs_on_prepare+0x72/0x160
+ ? do_syscall_64+0x68/0x80
+ ? trace_hardirqs_on_prepare+0x72/0x160
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Closes: https://lore.kernel.org/linux-wireless/CABXGCsOdvVwdLmSsC8TZ1jF0UOg_F_W3wqLECWX620PUkvNk=A@mail.gmail.com/
+Fixes: 9270270d6219 ("wifi: mt76: mt7921: fix PCI DMA hang after reboot")
+Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 1 +
+ drivers/net/wireless/mediatek/mt76/mt792x_dma.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index dde26f3274783..82cf3ce90b52f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -387,6 +387,7 @@ static void mt7921_pci_remove(struct pci_dev *pdev)
+ 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
+ 
+ 	mt7921e_unregister_device(dev);
++	set_bit(MT76_REMOVED, &mdev->phy.state);
+ 	devm_free_irq(&pdev->dev, pdev->irq, dev);
+ 	mt76_free_device(&dev->mt76);
+ 	pci_free_irq_vectors(pdev);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_dma.c b/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
+index 8fa36b59e738d..5cc2d59b774af 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
+@@ -12,6 +12,8 @@ irqreturn_t mt792x_irq_handler(int irq, void *dev_instance)
+ {
+ 	struct mt792x_dev *dev = dev_instance;
+ 
++	if (test_bit(MT76_REMOVED, &dev->mt76.phy.state))
++		return IRQ_NONE;
+ 	mt76_wr(dev, dev->irq_map->host_irq_enable, 0);
+ 
+ 	if (!test_bit(MT76_STATE_INITIALIZED, &dev->mphy.state))
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-add-flow-to-avoid-chip-bt-function-.patch b/queue-6.8/wifi-mt76-mt7925-add-flow-to-avoid-chip-bt-function-.patch
new file mode 100644
index 00000000000..6304d2a0402
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-add-flow-to-avoid-chip-bt-function-.patch
@@ -0,0 +1,54 @@
+From 93b7cdcc114e676de23d54f213ee387e0d702e22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:35 +0800
+Subject: wifi: mt76: mt7925: add flow to avoid chip bt function fail
+
+From: Quan Zhou <quan.zhou@mediatek.com>
+
+[ Upstream commit 9300ae0cd9e8f2407b20e0e67ee3ea03dc8b06af ]
+
+A sub-process of Wifi L0.5 reset will make chip common partition
+enter low power, and have chance lead to Bluetooth host-to-chip
+command timeout, modify the software flow according to the chip's
+design to solve the problem.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7925/pci.c  | 2 ++
+ drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+index 1fd99a8565415..74cfba7675beb 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+@@ -386,6 +386,8 @@ static int mt7925_pci_probe(struct pci_dev *pdev,
+ 
+ 	dev_info(mdev->dev, "ASIC revision: %04x\n", mdev->rev);
+ 
++	mt76_rmw_field(dev, MT_HW_EMI_CTL, MT_HW_EMI_CTL_SLPPROT_EN, 1);
++
+ 	ret = mt792x_wfsys_reset(dev);
+ 	if (ret)
+ 		goto err_free_dev;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_regs.h b/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
+index a99af23e4b564..d7f9b24cd665f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
+@@ -389,6 +389,9 @@
+ #define MT_HW_CHIPID			0x70010200
+ #define MT_HW_REV			0x70010204
+ 
++#define MT_HW_EMI_CTL			0x18011100
++#define MT_HW_EMI_CTL_SLPPROT_EN	BIT(1)
++
+ #define MT_PCIE_MAC_BASE		0x10000
+ #define MT_PCIE_MAC(ofs)		(MT_PCIE_MAC_BASE + (ofs))
+ #define MT_PCIE_MAC_INT_ENABLE		MT_PCIE_MAC(0x188)
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-add-support-to-set-ifs-time-by-mcu-.patch b/queue-6.8/wifi-mt76-mt7925-add-support-to-set-ifs-time-by-mcu-.patch
new file mode 100644
index 00000000000..74218db846d
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-add-support-to-set-ifs-time-by-mcu-.patch
@@ -0,0 +1,136 @@
+From ae558122b82fdab5773c403d01e3cee22f872926 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:36 +0800
+Subject: wifi: mt76: mt7925: add support to set ifs time by mcu command
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 8536ef0aeae1177c4a59b043d4b1c41ddaa9df2a ]
+
+There's a race between driver and fw on some tx/rx control registers
+when setting ifs, which will cause accidental hw queue pause problems.
+Avoid this by setting ifs time with bss_info mcu command.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Co-developed-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7925/main.c  |  2 +-
+ .../net/wireless/mediatek/mt76/mt7925/mcu.c   | 33 +++++++++++++++++++
+ .../net/wireless/mediatek/mt76/mt7925/mcu.h   | 19 +++++++++++
+ 3 files changed, 53 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+index c74ba9642fc8d..6179798a8845a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+@@ -711,7 +711,7 @@ static void mt7925_bss_info_changed(struct ieee80211_hw *hw,
+ 
+ 		if (slottime != phy->slottime) {
+ 			phy->slottime = slottime;
+-			mt792x_mac_set_timeing(phy);
++			mt7925_mcu_set_timing(phy, vif);
+ 		}
+ 	}
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index 932ecf38672c4..e1dd89a7a79ca 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -2244,6 +2244,38 @@ mt7925_mcu_bss_color_tlv(struct sk_buff *skb, struct ieee80211_vif *vif,
+ 		vif->bss_conf.he_bss_color.color : 0;
+ }
+ 
++static void
++mt7925_mcu_bss_ifs_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
++{
++	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
++	struct mt792x_phy *phy = mvif->phy;
++	struct bss_ifs_time_tlv *ifs_time;
++	struct tlv *tlv;
++
++	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_IFS_TIME, sizeof(*ifs_time));
++	ifs_time = (struct bss_ifs_time_tlv *)tlv;
++	ifs_time->slot_valid = true;
++	ifs_time->slot_time = cpu_to_le16(phy->slottime);
++}
++
++int mt7925_mcu_set_timing(struct mt792x_phy *phy,
++			  struct ieee80211_vif *vif)
++{
++	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
++	struct mt792x_dev *dev = phy->dev;
++	struct sk_buff *skb;
++
++	skb = __mt7925_mcu_alloc_bss_req(&dev->mt76, &mvif->mt76,
++					 MT7925_BSS_UPDATE_MAX_SIZE);
++	if (IS_ERR(skb))
++		return PTR_ERR(skb);
++
++	mt7925_mcu_bss_ifs_tlv(skb, vif);
++
++	return mt76_mcu_skb_send_msg(&dev->mt76, skb,
++				     MCU_UNI_CMD(BSS_INFO_UPDATE), true);
++}
++
+ int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
+ 			    struct ieee80211_chanctx_conf *ctx,
+ 			    struct ieee80211_vif *vif,
+@@ -2268,6 +2300,7 @@ int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
+ 	mt7925_mcu_bss_bmc_tlv(skb, phy, ctx, vif, sta);
+ 	mt7925_mcu_bss_qos_tlv(skb, vif);
+ 	mt7925_mcu_bss_mld_tlv(skb, vif, sta);
++	mt7925_mcu_bss_ifs_tlv(skb, vif);
+ 
+ 	if (vif->bss_conf.he_support) {
+ 		mt7925_mcu_bss_he_tlv(skb, vif, phy);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+index 9fce054e50657..2cf39276118eb 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+@@ -440,6 +440,22 @@ struct sta_rec_mld {
+ 	} __packed link[2];
+ } __packed;
+ 
++struct bss_ifs_time_tlv {
++	__le16 tag;
++	__le16 len;
++	u8 slot_valid;
++	u8 sifs_valid;
++	u8 rifs_valid;
++	u8 eifs_valid;
++	__le16 slot_time;
++	__le16 sifs_time;
++	__le16 rifs_time;
++	__le16 eifs_time;
++	u8 eifs_cck_valid;
++	u8 rsv;
++	__le16 eifs_cck_time;
++} __packed;
++
+ #define MT7925_STA_UPDATE_MAX_SIZE	(sizeof(struct sta_req_hdr) +		\
+ 					 sizeof(struct sta_rec_basic) +		\
+ 					 sizeof(struct sta_rec_bf) +		\
+@@ -467,6 +483,7 @@ struct sta_rec_mld {
+ 					 sizeof(struct bss_mld_tlv) +			\
+ 					 sizeof(struct bss_info_uni_he) +		\
+ 					 sizeof(struct bss_info_uni_bss_color) +	\
++					 sizeof(struct bss_ifs_time_tlv) +		\
+ 					 sizeof(struct tlv))
+ 
+ #define MT_CONNAC3_SKU_POWER_LIMIT      449
+@@ -564,6 +581,8 @@ int mt7925_mcu_add_bss_info(struct mt792x_phy *phy,
+ 			    struct ieee80211_vif *vif,
+ 			    struct ieee80211_sta *sta,
+ 			    int enable);
++int mt7925_mcu_set_timing(struct mt792x_phy *phy,
++			  struct ieee80211_vif *vif);
+ int mt7925_mcu_set_deep_sleep(struct mt792x_dev *dev, bool enable);
+ int mt7925_mcu_set_channel_domain(struct mt76_phy *phy);
+ int mt7925_mcu_set_radio_en(struct mt792x_phy *phy, bool enable);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-fix-connect-to-80211b-mode-fail-in-.patch b/queue-6.8/wifi-mt76-mt7925-fix-connect-to-80211b-mode-fail-in-.patch
new file mode 100644
index 00000000000..4ebd1757773
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-fix-connect-to-80211b-mode-fail-in-.patch
@@ -0,0 +1,40 @@
+From aa941d591d352e15b697d02067d262bbb366428b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:28 +0800
+Subject: wifi: mt76: mt7925: fix connect to 80211b mode fail in 2Ghz band
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 479146078a21ff2015cdd4e0467cba0559911915 ]
+
+Driver should setting correct phy mode to firmware when in legacy mode.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index c5fd7116929b7..1fc9ecb96bc43 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -1460,12 +1460,10 @@ mt7925_mcu_sta_phy_tlv(struct sk_buff *skb,
+ 	struct tlv *tlv;
+ 	u8 af = 0, mm = 0;
+ 
+-	if (!sta->deflink.ht_cap.ht_supported && !sta->deflink.he_6ghz_capa.capa)
+-		return;
+-
+ 	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_PHY, sizeof(*phy));
+ 	phy = (struct sta_rec_phy *)tlv;
+ 	phy->phy_type = mt76_connac_get_phy_mode_v2(mvif->phy->mt76, vif, chandef->chan->band, sta);
++	phy->basic_rate = cpu_to_le16((u16)vif->bss_conf.basic_rates);
+ 	if (sta->deflink.ht_cap.ht_supported) {
+ 		af = sta->deflink.ht_cap.ampdu_factor;
+ 		mm = sta->deflink.ht_cap.ampdu_density;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-fix-fw-download-fail.patch b/queue-6.8/wifi-mt76-mt7925-fix-fw-download-fail.patch
new file mode 100644
index 00000000000..ac7bf14106c
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-fix-fw-download-fail.patch
@@ -0,0 +1,35 @@
+From c4ea919c0e2e34fe71c995416909116293d68d66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:32 +0800
+Subject: wifi: mt76: mt7925: fix fw download fail
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 6864bc734a48e90012cca8040cd0af72616666ca ]
+
+Add an address of fw region for fw download.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+index 3a20ba0d24928..ea7ffa16a4b12 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
+@@ -66,7 +66,7 @@ int mt76_connac_mcu_init_download(struct mt76_dev *dev, u32 addr, u32 len,
+ 
+ 	if ((!is_connac_v1(dev) && addr == MCU_PATCH_ADDRESS) ||
+ 	    (is_mt7921(dev) && addr == 0x900000) ||
+-	    (is_mt7925(dev) && addr == 0x900000) ||
++	    (is_mt7925(dev) && (addr == 0x900000 || addr == 0xe0002800)) ||
+ 	    (is_mt7996(dev) && addr == 0x900000) ||
+ 	    (is_mt7992(dev) && addr == 0x900000))
+ 		cmd = MCU_CMD(PATCH_START_REQ);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-fix-mcu-query-command-fail.patch b/queue-6.8/wifi-mt76-mt7925-fix-mcu-query-command-fail.patch
new file mode 100644
index 00000000000..58698808fc9
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-fix-mcu-query-command-fail.patch
@@ -0,0 +1,46 @@
+From bdcbca17bb5c05afdf34be34f3b03aa7938d90f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:30 +0800
+Subject: wifi: mt76: mt7925: fix mcu query command fail
+
+From: Hao Zhang <hao.zhang@mediatek.com>
+
+[ Upstream commit 2f475cb63eb304bdbb58c9b07b0547ca6c343012 ]
+
+Apply query command type properly to make the chip send the response back.
+Otherwise, we may see the command timeout in driver side.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Hao Zhang <hao.zhang@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index 9a8db9b1a4f2b..4811fccbe30e8 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -2850,12 +2850,16 @@ int mt7925_mcu_fill_message(struct mt76_dev *mdev, struct sk_buff *skb,
+ 	if (cmd & __MCU_CMD_FIELD_UNI) {
+ 		uni_txd = (struct mt76_connac2_mcu_uni_txd *)txd;
+ 		uni_txd->len = cpu_to_le16(skb->len - sizeof(uni_txd->txd));
+-		uni_txd->option = MCU_CMD_UNI_EXT_ACK;
+ 		uni_txd->cid = cpu_to_le16(mcu_cmd);
+ 		uni_txd->s2d_index = MCU_S2D_H2N;
+ 		uni_txd->pkt_type = MCU_PKT_ID;
+ 		uni_txd->seq = seq;
+ 
++		if (cmd & __MCU_CMD_FIELD_QUERY)
++			uni_txd->option = MCU_CMD_UNI_QUERY_ACK;
++		else
++			uni_txd->option = MCU_CMD_UNI_EXT_ACK;
++
+ 		goto exit;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-fix-sap-no-beacon-issue-in-5ghz-and.patch b/queue-6.8/wifi-mt76-mt7925-fix-sap-no-beacon-issue-in-5ghz-and.patch
new file mode 100644
index 00000000000..b858611b08e
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-fix-sap-no-beacon-issue-in-5ghz-and.patch
@@ -0,0 +1,93 @@
+From 8a2719aeb9997fcc09ec6253bad1407d807e6414 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:29 +0800
+Subject: wifi: mt76: mt7925: fix SAP no beacon issue in 5Ghz and 6Ghz band
+
+From: rong.yan <rong.yan@mediatek.com>
+
+[ Upstream commit 243cecc857735344473ea33a713cd5c2ec1fe347 ]
+
+Driver should configure basic rate and phy mode for SAP mode.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: rong.yan <rong.yan@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt76_connac_mcu.h    |  3 +++
+ drivers/net/wireless/mediatek/mt76/mt7925/mcu.c     | 13 ++++++++++---
+ drivers/net/wireless/mediatek/mt76/mt7925/mcu.h     |  3 ++-
+ 3 files changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index ae6d0179727df..db96ddbeb9e70 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -935,6 +935,9 @@ enum {
+ 	PHY_TYPE_INDEX_NUM
+ };
+ 
++#define HR_DSSS_ERP_BASIC_RATE			GENMASK(3, 0)
++#define OFDM_BASIC_RATE				(BIT(6) | BIT(8) | BIT(10))
++
+ #define PHY_TYPE_BIT_HR_DSSS			BIT(PHY_TYPE_HR_DSSS_INDEX)
+ #define PHY_TYPE_BIT_ERP			BIT(PHY_TYPE_ERP_INDEX)
+ #define PHY_TYPE_BIT_OFDM			BIT(PHY_TYPE_OFDM_INDEX)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index 1fc9ecb96bc43..9a8db9b1a4f2b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -2047,9 +2047,9 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 	struct cfg80211_chan_def *chandef = ctx ? &ctx->def : &phy->chandef;
+ 	enum nl80211_band band = chandef->chan->band;
+ 	struct mt76_connac_bss_basic_tlv *basic_req;
+-	u8 idx, basic_phy;
+ 	struct tlv *tlv;
+ 	int conn_type;
++	u8 idx;
+ 
+ 	tlv = mt76_connac_mcu_add_tlv(skb, UNI_BSS_INFO_BASIC, sizeof(*basic_req));
+ 	basic_req = (struct mt76_connac_bss_basic_tlv *)tlv;
+@@ -2060,8 +2060,10 @@ mt7925_mcu_bss_basic_tlv(struct sk_buff *skb,
+ 
+ 	basic_req->phymode_ext = mt7925_get_phy_mode_ext(phy, vif, band, sta);
+ 
+-	basic_phy = mt76_connac_get_phy_mode_v2(phy, vif, band, sta);
+-	basic_req->nonht_basic_phy = cpu_to_le16(basic_phy);
++	if (band == NL80211_BAND_2GHZ)
++		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_ERP_INDEX);
++	else
++		basic_req->nonht_basic_phy = cpu_to_le16(PHY_TYPE_OFDM_INDEX);
+ 
+ 	memcpy(basic_req->bssid, vif->bss_conf.bssid, ETH_ALEN);
+ 	basic_req->phymode = mt76_connac_get_phy_mode(phy, vif, band, sta);
+@@ -2165,6 +2167,11 @@ mt7925_mcu_bss_bmc_tlv(struct sk_buff *skb, struct mt792x_phy *phy,
+ 
+ 	bmc = (struct bss_rate_tlv *)tlv;
+ 
++	if (band == NL80211_BAND_2GHZ)
++		bmc->basic_rate = cpu_to_le16(HR_DSSS_ERP_BASIC_RATE);
++	else
++		bmc->basic_rate = cpu_to_le16(OFDM_BASIC_RATE);
++
+ 	bmc->short_preamble = (band == NL80211_BAND_2GHZ);
+ 	bmc->bc_fixed_rate = idx;
+ 	bmc->mc_fixed_rate = idx;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+index 3c41e21303b1f..0218fd2a0eb01 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+@@ -334,7 +334,8 @@ struct bss_req_hdr {
+ struct bss_rate_tlv {
+ 	__le16 tag;
+ 	__le16 len;
+-	u8 __rsv1[4];
++	u8 __rsv1[2];
++	__le16 basic_rate;
+ 	__le16 bc_trans;
+ 	__le16 mc_trans;
+ 	u8 short_preamble;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-fix-the-wrong-header-translation-co.patch b/queue-6.8/wifi-mt76-mt7925-fix-the-wrong-header-translation-co.patch
new file mode 100644
index 00000000000..b26961ca628
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-fix-the-wrong-header-translation-co.patch
@@ -0,0 +1,92 @@
+From b92c21a3a14be44d2202a5ef32e05438c6391e0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:34 +0800
+Subject: wifi: mt76: mt7925: fix the wrong header translation config
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit d8cf7e1344727b80b4ec3dc17ca520238d55a88d ]
+
+The header translation config should set to broadcast and unicast
+cases correctly, not only unicast case. And also remove the cmds
+of wtbl (wlan table) series, because these MCU commands have
+already been replaced by other commands in mt7925.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7925/mcu.c   | 32 +++++--------------
+ 1 file changed, 8 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index 8c3233182083f..932ecf38672c4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -814,6 +814,7 @@ mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
+ 			     struct ieee80211_vif *vif,
+ 			     struct ieee80211_sta *sta)
+ {
++	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+ 	struct sta_rec_hdr_trans *hdr_trans;
+ 	struct mt76_wcid *wcid;
+ 	struct tlv *tlv;
+@@ -827,7 +828,11 @@ mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb,
+ 	else
+ 		hdr_trans->from_ds = true;
+ 
+-	wcid = (struct mt76_wcid *)sta->drv_priv;
++	if (sta)
++		wcid = (struct mt76_wcid *)sta->drv_priv;
++	else
++		wcid = &mvif->sta.wcid;
++
+ 	if (!wcid)
+ 		return;
+ 
+@@ -1577,8 +1582,6 @@ mt7925_mcu_sta_cmd(struct mt76_phy *phy,
+ {
+ 	struct mt76_vif *mvif = (struct mt76_vif *)info->vif->drv_priv;
+ 	struct mt76_dev *dev = phy->dev;
+-	struct wtbl_req_hdr *wtbl_hdr;
+-	struct tlv *sta_wtbl;
+ 	struct sk_buff *skb;
+ 
+ 	skb = __mt76_connac_mcu_alloc_sta_req(dev, mvif, info->wcid,
+@@ -1602,30 +1605,11 @@ mt7925_mcu_sta_cmd(struct mt76_phy *phy,
+ 		mt7925_mcu_sta_state_v2_tlv(phy, skb, info->sta,
+ 					    info->vif, info->rcpi,
+ 					    info->state);
+-		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->sta);
+ 		mt7925_mcu_sta_mld_tlv(skb, info->vif, info->sta);
+ 	}
+ 
+-	sta_wtbl = mt76_connac_mcu_add_tlv(skb, STA_REC_WTBL,
+-					   sizeof(struct tlv));
+-
+-	wtbl_hdr = mt76_connac_mcu_alloc_wtbl_req(dev, info->wcid,
+-						  WTBL_RESET_AND_SET,
+-						  sta_wtbl, &skb);
+-	if (IS_ERR(wtbl_hdr))
+-		return PTR_ERR(wtbl_hdr);
+-
+-	if (info->enable) {
+-		mt76_connac_mcu_wtbl_generic_tlv(dev, skb, info->vif,
+-						 info->sta, sta_wtbl,
+-						 wtbl_hdr);
+-		mt76_connac_mcu_wtbl_hdr_trans_tlv(skb, info->vif, info->wcid,
+-						   sta_wtbl, wtbl_hdr);
+-		if (info->sta)
+-			mt76_connac_mcu_wtbl_ht_tlv(dev, skb, info->sta,
+-						    sta_wtbl, wtbl_hdr,
+-						    true, true);
+-	}
++	if (info->enable)
++		mt7925_mcu_sta_hdr_trans_tlv(skb, info->vif, info->sta);
+ 
+ 	return mt76_mcu_skb_send_msg(dev, skb, info->cmd, true);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-fix-wmm-queue-mapping.patch b/queue-6.8/wifi-mt76-mt7925-fix-wmm-queue-mapping.patch
new file mode 100644
index 00000000000..d8f05526a8e
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-fix-wmm-queue-mapping.patch
@@ -0,0 +1,76 @@
+From 9a5a33304048f679cd4fae4192dbb01afacbc91b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:31 +0800
+Subject: wifi: mt76: mt7925: fix wmm queue mapping
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 9d89edb576e385267f40193bd3776157101a504a ]
+
+Firmware uses access class index (ACI) for wmm parameters update,
+so convert mac80211 queue to ACI in mt7925_conf_tx().
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7925/main.c  | 21 ++++++++++++++++++-
+ .../net/wireless/mediatek/mt76/mt7925/mcu.c   |  2 +-
+ 2 files changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+index 125a1be3cb64c..5671e08dec654 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+@@ -1273,6 +1273,25 @@ mt7925_channel_switch_beacon(struct ieee80211_hw *hw,
+ 	mt792x_mutex_release(dev);
+ }
+ 
++static int
++mt7925_conf_tx(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
++	       unsigned int link_id, u16 queue,
++	       const struct ieee80211_tx_queue_params *params)
++{
++	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
++	static const u8 mq_to_aci[] = {
++		    [IEEE80211_AC_VO] = 3,
++		    [IEEE80211_AC_VI] = 2,
++		    [IEEE80211_AC_BE] = 0,
++		    [IEEE80211_AC_BK] = 1,
++	};
++
++	/* firmware uses access class index */
++	mvif->queue_params[mq_to_aci[queue]] = *params;
++
++	return 0;
++}
++
+ static int
+ mt7925_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ 		struct ieee80211_bss_conf *link_conf)
+@@ -1396,7 +1415,7 @@ const struct ieee80211_ops mt7925_ops = {
+ 	.add_interface = mt7925_add_interface,
+ 	.remove_interface = mt792x_remove_interface,
+ 	.config = mt7925_config,
+-	.conf_tx = mt792x_conf_tx,
++	.conf_tx = mt7925_conf_tx,
+ 	.configure_filter = mt7925_configure_filter,
+ 	.bss_info_changed = mt7925_bss_info_changed,
+ 	.start_ap = mt7925_start_ap,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index 4811fccbe30e8..0299045b4b833 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -895,7 +895,7 @@ int mt7925_mcu_set_tx(struct mt792x_dev *dev, struct ieee80211_vif *vif)
+ 
+ 		e = (struct edca *)tlv;
+ 		e->set = WMM_PARAM_SET;
+-		e->queue = ac + mvif->mt76.wmm_idx * MT76_CONNAC_MAX_WMM_SETS;
++		e->queue = ac;
+ 		e->aifs = q->aifs;
+ 		e->txop = cpu_to_le16(q->txop);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-fix-wow-failed-in-encrypted-mode.patch b/queue-6.8/wifi-mt76-mt7925-fix-wow-failed-in-encrypted-mode.patch
new file mode 100644
index 00000000000..d05786a9df7
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-fix-wow-failed-in-encrypted-mode.patch
@@ -0,0 +1,301 @@
+From 30d6f9b309995043408a7f6ef1cd1e2865e27fd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:33 +0800
+Subject: wifi: mt76: mt7925: fix WoW failed in encrypted mode
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 47916693ec7cd1b283ffa7554fc48ff4eec2daa1 ]
+
+When in suspend mode, WoW (Wake-on-WLAN) fails to wake the system remotely
+due to incorrect encryption mode settings. For the new mt7925 chipset, the
+old STA_REC_KEY_V2 command will send incorrect parameters to the firmware.
+Therefore, STA_REC_KEY_V3 has been introduced as a replacement for it.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt76_connac_mcu.h  |  1 +
+ .../net/wireless/mediatek/mt76/mt7925/main.c  |  3 +-
+ .../net/wireless/mediatek/mt76/mt7925/mcu.c   | 86 ++++++++++---------
+ .../net/wireless/mediatek/mt76/mt7925/mcu.h   | 70 +++++++++++----
+ 4 files changed, 103 insertions(+), 57 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+index db96ddbeb9e70..657a4d1f856b2 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h
+@@ -808,6 +808,7 @@ enum {
+ 	STA_REC_MLD = 0x20,
+ 	STA_REC_EHT = 0x22,
+ 	STA_REC_PN_INFO = 0x26,
++	STA_REC_KEY_V3 = 0x27,
+ 	STA_REC_HDRT = 0x28,
+ 	STA_REC_HDR_TRANS = 0x2B,
+ 	STA_REC_MAX_NUM
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+index 5671e08dec654..c74ba9642fc8d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+@@ -359,6 +359,7 @@ mt7925_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
+ 	mvif->sta.wcid.phy_idx = mvif->mt76.band_idx;
+ 	mvif->sta.wcid.hw_key_idx = -1;
+ 	mvif->sta.wcid.tx_info |= MT_WCID_TX_INFO_SET;
++	mvif->sta.vif = mvif;
+ 	mt76_wcid_init(&mvif->sta.wcid);
+ 
+ 	mt7925_mac_wtbl_update(dev, idx,
+@@ -526,7 +527,7 @@ static int mt7925_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ 	if (cmd == SET_KEY && !mvif->mt76.cipher) {
+ 		struct mt792x_phy *phy = mt792x_hw_phy(hw);
+ 
+-		mvif->mt76.cipher = mt76_connac_mcu_get_cipher(key->cipher);
++		mvif->mt76.cipher = mt7925_mcu_get_cipher(key->cipher);
+ 		mt7925_mcu_add_bss_info(phy, mvif->mt76.ctx, vif, sta, true);
+ 	}
+ 
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+index 0299045b4b833..8c3233182083f 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+@@ -921,61 +921,67 @@ mt7925_mcu_sta_key_tlv(struct mt76_wcid *wcid,
+ 		       struct ieee80211_key_conf *key,
+ 		       enum set_key_cmd cmd)
+ {
++	struct mt792x_sta *msta = container_of(wcid, struct mt792x_sta, wcid);
+ 	struct sta_rec_sec_uni *sec;
++	struct mt792x_vif *mvif = msta->vif;
++	struct ieee80211_sta *sta;
++	struct ieee80211_vif *vif;
+ 	struct tlv *tlv;
+ 
+-	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V2, sizeof(*sec));
++	sta = msta == &mvif->sta ?
++		      NULL :
++		      container_of((void *)msta, struct ieee80211_sta, drv_priv);
++	vif = container_of((void *)mvif, struct ieee80211_vif, drv_priv);
++
++	tlv = mt76_connac_mcu_add_tlv(skb, STA_REC_KEY_V3, sizeof(*sec));
+ 	sec = (struct sta_rec_sec_uni *)tlv;
+-	sec->add = cmd;
++	sec->bss_idx = mvif->mt76.idx;
++	sec->is_authenticator = 0;
++	sec->mgmt_prot = 0;
++	sec->wlan_idx = (u8)wcid->idx;
++
++	if (sta) {
++		sec->tx_key = 1;
++		sec->key_type = 1;
++		memcpy(sec->peer_addr, sta->addr, ETH_ALEN);
++	} else {
++		memcpy(sec->peer_addr, vif->bss_conf.bssid, ETH_ALEN);
++	}
+ 
+ 	if (cmd == SET_KEY) {
+-		struct sec_key_uni *sec_key;
+ 		u8 cipher;
+ 
+-		cipher = mt76_connac_mcu_get_cipher(key->cipher);
+-		if (cipher == MCU_CIPHER_NONE)
++		sec->add = 1;
++		cipher = mt7925_mcu_get_cipher(key->cipher);
++		if (cipher == CONNAC3_CIPHER_NONE)
+ 			return -EOPNOTSUPP;
+ 
+-		sec_key = &sec->key[0];
+-		sec_key->cipher_len = sizeof(*sec_key);
+-
+-		if (cipher == MCU_CIPHER_BIP_CMAC_128) {
+-			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
+-			sec_key->cipher_id = MCU_CIPHER_AES_CCMP;
+-			sec_key->key_id = sta_key_conf->keyidx;
+-			sec_key->key_len = 16;
+-			memcpy(sec_key->key, sta_key_conf->key, 16);
+-
+-			sec_key = &sec->key[1];
+-			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
+-			sec_key->cipher_id = MCU_CIPHER_BIP_CMAC_128;
+-			sec_key->cipher_len = sizeof(*sec_key);
+-			sec_key->key_len = 16;
+-			memcpy(sec_key->key, key->key, 16);
+-			sec->n_cipher = 2;
++		if (cipher == CONNAC3_CIPHER_BIP_CMAC_128) {
++			sec->cipher_id = CONNAC3_CIPHER_BIP_CMAC_128;
++			sec->key_id = sta_key_conf->keyidx;
++			sec->key_len = 32;
++			memcpy(sec->key, sta_key_conf->key, 16);
++			memcpy(sec->key + 16, key->key, 16);
+ 		} else {
+-			sec_key->wlan_idx = cpu_to_le16(wcid->idx);
+-			sec_key->cipher_id = cipher;
+-			sec_key->key_id = key->keyidx;
+-			sec_key->key_len = key->keylen;
+-			memcpy(sec_key->key, key->key, key->keylen);
++			sec->cipher_id = cipher;
++			sec->key_id = key->keyidx;
++			sec->key_len = key->keylen;
++			memcpy(sec->key, key->key, key->keylen);
+ 
+-			if (cipher == MCU_CIPHER_TKIP) {
++			if (cipher == CONNAC3_CIPHER_TKIP) {
+ 				/* Rx/Tx MIC keys are swapped */
+-				memcpy(sec_key->key + 16, key->key + 24, 8);
+-				memcpy(sec_key->key + 24, key->key + 16, 8);
++				memcpy(sec->key + 16, key->key + 24, 8);
++				memcpy(sec->key + 24, key->key + 16, 8);
+ 			}
+ 
+ 			/* store key_conf for BIP batch update */
+-			if (cipher == MCU_CIPHER_AES_CCMP) {
++			if (cipher == CONNAC3_CIPHER_AES_CCMP) {
+ 				memcpy(sta_key_conf->key, key->key, key->keylen);
+ 				sta_key_conf->keyidx = key->keyidx;
+ 			}
+-
+-			sec->n_cipher = 1;
+ 		}
+ 	} else {
+-		sec->n_cipher = 0;
++		sec->add = 0;
+ 	}
+ 
+ 	return 0;
+@@ -2122,21 +2128,21 @@ mt7925_mcu_bss_sec_tlv(struct sk_buff *skb, struct ieee80211_vif *vif)
+ 	sec = (struct bss_sec_tlv *)tlv;
+ 
+ 	switch (mvif->cipher) {
+-	case MCU_CIPHER_GCMP_256:
+-	case MCU_CIPHER_GCMP:
++	case CONNAC3_CIPHER_GCMP_256:
++	case CONNAC3_CIPHER_GCMP:
+ 		sec->mode = MODE_WPA3_SAE;
+ 		sec->status = 8;
+ 		break;
+-	case MCU_CIPHER_AES_CCMP:
++	case CONNAC3_CIPHER_AES_CCMP:
+ 		sec->mode = MODE_WPA2_PSK;
+ 		sec->status = 6;
+ 		break;
+-	case MCU_CIPHER_TKIP:
++	case CONNAC3_CIPHER_TKIP:
+ 		sec->mode = MODE_WPA2_PSK;
+ 		sec->status = 4;
+ 		break;
+-	case MCU_CIPHER_WEP104:
+-	case MCU_CIPHER_WEP40:
++	case CONNAC3_CIPHER_WEP104:
++	case CONNAC3_CIPHER_WEP40:
+ 		sec->mode = MODE_SHARED;
+ 		sec->status = 0;
+ 		break;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+index 0218fd2a0eb01..9fce054e50657 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.h
+@@ -159,6 +159,20 @@ enum {
+ 	UNI_EVENT_SCAN_DONE_NLO = 3,
+ };
+ 
++enum connac3_mcu_cipher_type {
++	CONNAC3_CIPHER_NONE = 0,
++	CONNAC3_CIPHER_WEP40 = 1,
++	CONNAC3_CIPHER_TKIP = 2,
++	CONNAC3_CIPHER_AES_CCMP = 4,
++	CONNAC3_CIPHER_WEP104 = 5,
++	CONNAC3_CIPHER_BIP_CMAC_128 = 6,
++	CONNAC3_CIPHER_WEP128 = 7,
++	CONNAC3_CIPHER_WAPI = 8,
++	CONNAC3_CIPHER_CCMP_256 = 10,
++	CONNAC3_CIPHER_GCMP = 11,
++	CONNAC3_CIPHER_GCMP_256 = 12,
++};
++
+ struct mt7925_mcu_scan_chinfo_event {
+ 	u8 nr_chan;
+ 	u8 alpha2[3];
+@@ -383,25 +397,22 @@ struct sta_rec_eht {
+ 	u8 _rsv2[3];
+ } __packed;
+ 
+-struct sec_key_uni {
+-	__le16 wlan_idx;
+-	u8 mgmt_prot;
+-	u8 cipher_id;
+-	u8 cipher_len;
+-	u8 key_id;
+-	u8 key_len;
+-	u8 need_resp;
+-	u8 key[32];
+-} __packed;
+-
+ struct sta_rec_sec_uni {
+ 	__le16 tag;
+ 	__le16 len;
+ 	u8 add;
+-	u8 n_cipher;
+-	u8 rsv[2];
+-
+-	struct sec_key_uni key[2];
++	u8 tx_key;
++	u8 key_type;
++	u8 is_authenticator;
++	u8 peer_addr[6];
++	u8 bss_idx;
++	u8 cipher_id;
++	u8 key_id;
++	u8 key_len;
++	u8 wlan_idx;
++	u8 mgmt_prot;
++	u8 key[32];
++	u8 key_rsc[16];
+ } __packed;
+ 
+ struct sta_rec_hdr_trans {
+@@ -441,7 +452,7 @@ struct sta_rec_mld {
+ 					 sizeof(struct sta_rec_bfee) +		\
+ 					 sizeof(struct sta_rec_phy) +		\
+ 					 sizeof(struct sta_rec_ra) +		\
+-					 sizeof(struct sta_rec_sec) +		\
++					 sizeof(struct sta_rec_sec_uni) +   \
+ 					 sizeof(struct sta_rec_ra_fixed) +	\
+ 					 sizeof(struct sta_rec_he_6g_capa) +	\
+ 					 sizeof(struct sta_rec_eht) +		\
+@@ -510,6 +521,33 @@ struct mt7925_wow_pattern_tlv {
+ 	u8 rsv[4];
+ } __packed;
+ 
++static inline enum connac3_mcu_cipher_type
++mt7925_mcu_get_cipher(int cipher)
++{
++	switch (cipher) {
++	case WLAN_CIPHER_SUITE_WEP40:
++		return CONNAC3_CIPHER_WEP40;
++	case WLAN_CIPHER_SUITE_WEP104:
++		return CONNAC3_CIPHER_WEP104;
++	case WLAN_CIPHER_SUITE_TKIP:
++		return CONNAC3_CIPHER_TKIP;
++	case WLAN_CIPHER_SUITE_AES_CMAC:
++		return CONNAC3_CIPHER_BIP_CMAC_128;
++	case WLAN_CIPHER_SUITE_CCMP:
++		return CONNAC3_CIPHER_AES_CCMP;
++	case WLAN_CIPHER_SUITE_CCMP_256:
++		return CONNAC3_CIPHER_CCMP_256;
++	case WLAN_CIPHER_SUITE_GCMP:
++		return CONNAC3_CIPHER_GCMP;
++	case WLAN_CIPHER_SUITE_GCMP_256:
++		return CONNAC3_CIPHER_GCMP_256;
++	case WLAN_CIPHER_SUITE_SMS4:
++		return CONNAC3_CIPHER_WAPI;
++	default:
++		return CONNAC3_CIPHER_NONE;
++	}
++}
++
+ int mt7925_mcu_set_dbdc(struct mt76_phy *phy);
+ int mt7925_mcu_hw_scan(struct mt76_phy *phy, struct ieee80211_vif *vif,
+ 		       struct ieee80211_scan_request *scan_req);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925-update-pcie-dma-settings.patch b/queue-6.8/wifi-mt76-mt7925-update-pcie-dma-settings.patch
new file mode 100644
index 00000000000..2194da65baa
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925-update-pcie-dma-settings.patch
@@ -0,0 +1,92 @@
+From 67eb13abc480997b73f7c0e14b0493c7d662ebd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:09:37 +0800
+Subject: wifi: mt76: mt7925: update PCIe DMA settings
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit 0844947ccf64ea45edf6619ae2ba6dd9098b3308 ]
+
+Fix the wrong WFDMA settings to improve TX performance.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt792x_dma.c  | 13 ++++++++++---
+ drivers/net/wireless/mediatek/mt76/mt792x_regs.h |  5 +++++
+ 2 files changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_dma.c b/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
+index 488326ce5ed4d..8fa36b59e738d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_dma.c
+@@ -123,14 +123,13 @@ static void mt792x_dma_prefetch(struct mt792x_dev *dev)
+ 
+ int mt792x_dma_enable(struct mt792x_dev *dev)
+ {
+-	if (is_mt7925(&dev->mt76))
+-		mt76_rmw(dev, MT_UWFDMA0_GLO_CFG_EXT1, BIT(28), BIT(28));
+-
+ 	/* configure perfetch settings */
+ 	mt792x_dma_prefetch(dev);
+ 
+ 	/* reset dma idx */
+ 	mt76_wr(dev, MT_WFDMA0_RST_DTX_PTR, ~0);
++	if (is_mt7925(&dev->mt76))
++		mt76_wr(dev, MT_WFDMA0_RST_DRX_PTR, ~0);
+ 
+ 	/* configure delay interrupt */
+ 	mt76_wr(dev, MT_WFDMA0_PRI_DLY_INT_CFG0, 0);
+@@ -140,12 +139,20 @@ int mt792x_dma_enable(struct mt792x_dev *dev)
+ 		 MT_WFDMA0_GLO_CFG_FIFO_LITTLE_ENDIAN |
+ 		 MT_WFDMA0_GLO_CFG_CLK_GAT_DIS |
+ 		 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
++		 FIELD_PREP(MT_WFDMA0_GLO_CFG_DMA_SIZE, 3) |
++		 MT_WFDMA0_GLO_CFG_FIFO_DIS_CHECK |
++		 MT_WFDMA0_GLO_CFG_RX_WB_DDONE |
+ 		 MT_WFDMA0_GLO_CFG_CSR_DISP_BASE_PTR_CHAIN_EN |
+ 		 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
+ 
+ 	mt76_set(dev, MT_WFDMA0_GLO_CFG,
+ 		 MT_WFDMA0_GLO_CFG_TX_DMA_EN | MT_WFDMA0_GLO_CFG_RX_DMA_EN);
+ 
++	if (is_mt7925(&dev->mt76)) {
++		mt76_rmw(dev, MT_UWFDMA0_GLO_CFG_EXT1, BIT(28), BIT(28));
++		mt76_set(dev, MT_WFDMA0_INT_RX_PRI, 0x0F00);
++		mt76_set(dev, MT_WFDMA0_INT_TX_PRI, 0x7F00);
++	}
+ 	mt76_set(dev, MT_WFDMA_DUMMY_CR, MT_WFDMA_NEED_REINIT);
+ 
+ 	/* enable interrupts for TX/RX rings */
+diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_regs.h b/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
+index d7f9b24cd665f..458cfd0260b13 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
+@@ -292,9 +292,12 @@
+ #define MT_WFDMA0_GLO_CFG_TX_DMA_BUSY	BIT(1)
+ #define MT_WFDMA0_GLO_CFG_RX_DMA_EN	BIT(2)
+ #define MT_WFDMA0_GLO_CFG_RX_DMA_BUSY	BIT(3)
++#define MT_WFDMA0_GLO_CFG_DMA_SIZE	GENMASK(5, 4)
+ #define MT_WFDMA0_GLO_CFG_TX_WB_DDONE	BIT(6)
+ #define MT_WFDMA0_GLO_CFG_FW_DWLD_BYPASS_DMASHDL BIT(9)
++#define MT_WFDMA0_GLO_CFG_FIFO_DIS_CHECK	BIT(11)
+ #define MT_WFDMA0_GLO_CFG_FIFO_LITTLE_ENDIAN	BIT(12)
++#define MT_WFDMA0_GLO_CFG_RX_WB_DDONE	BIT(13)
+ #define MT_WFDMA0_GLO_CFG_CSR_DISP_BASE_PTR_CHAIN_EN BIT(15)
+ #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2	BIT(21)
+ #define MT_WFDMA0_GLO_CFG_OMIT_RX_INFO	BIT(27)
+@@ -322,6 +325,8 @@
+ 
+ #define MT_WFDMA0_RST_DTX_PTR		MT_WFDMA0(0x20c)
+ #define MT_WFDMA0_RST_DRX_PTR		MT_WFDMA0(0x280)
++#define MT_WFDMA0_INT_RX_PRI		MT_WFDMA0(0x298)
++#define MT_WFDMA0_INT_TX_PRI		MT_WFDMA0(0x29c)
+ #define MT_WFDMA0_GLO_CFG_EXT0		MT_WFDMA0(0x2b0)
+ #define MT_WFDMA0_CSR_TX_DMASHDL_ENABLE	BIT(6)
+ #define MT_WFDMA0_PRI_DLY_INT_CFG0	MT_WFDMA0(0x2f0)
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7925e-fix-use-after-free-in-free_irq.patch b/queue-6.8/wifi-mt76-mt7925e-fix-use-after-free-in-free_irq.patch
new file mode 100644
index 00000000000..a2e494ce6b5
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7925e-fix-use-after-free-in-free_irq.patch
@@ -0,0 +1,38 @@
+From aa17bfd32b3d9ee2a5c3a0a9f04a7a22cf9ae6f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jan 2024 17:00:23 +0800
+Subject: wifi: mt76: mt7925e: fix use-after-free in free_irq()
+
+From: Deren Wu <deren.wu@mediatek.com>
+
+[ Upstream commit a5a5f4413d91f395cb2d89829d376d7393ad48b9 ]
+
+From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test
+to make sure the shared irq handler should be able to handle the unexpected
+event after deregistration. For this case, let's apply MT76_REMOVED flag to
+indicate the device was removed and do not run into the resource access
+anymore.
+
+Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7925/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+index 74cfba7675beb..07b74d492ce15 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7925/pci.c
+@@ -427,6 +427,7 @@ static void mt7925_pci_remove(struct pci_dev *pdev)
+ 	struct mt792x_dev *dev = container_of(mdev, struct mt792x_dev, mt76);
+ 
+ 	mt7925e_unregister_device(dev);
++	set_bit(MT76_REMOVED, &mdev->phy.state);
+ 	devm_free_irq(&pdev->dev, pdev->irq, dev);
+ 	mt76_free_device(&dev->mt76);
+ 	pci_free_irq_vectors(pdev);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch b/queue-6.8/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch
new file mode 100644
index 00000000000..f161c547411
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt792x-fix-a-potential-loading-failure-of-.patch
@@ -0,0 +1,83 @@
+From 3b30b15413a1aea4ac25d010f0204f37f60fbdbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jan 2024 10:48:55 +0800
+Subject: wifi: mt76: mt792x: fix a potential loading failure of the 6Ghz
+ channel config from ACPI
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 07ce1d46372489d90f9cccebb3277d1af801c4b9 ]
+
+In some case, the MTCL table will exist, but MTDS table will not.
+So the SAR will init fail. This patch make MTCL and MTDS can exist
+with no dependence.
+
+Fixes: f965333e491e ("mt76: mt7921: introduce ACPI SAR support")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Leon Yen <leon.yen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/mediatek/mt76/mt792x_acpi_sar.c  | 26 ++++++++++---------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
+index e7afea87e82e2..8fee3d481df0d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_acpi_sar.c
+@@ -66,13 +66,15 @@ mt792x_acpi_read(struct mt792x_dev *dev, u8 *method, u8 **tbl, u32 *len)
+ }
+ 
+ /* MTCL : Country List Table for 6G band */
+-static void
++static int
+ mt792x_asar_acpi_read_mtcl(struct mt792x_dev *dev, u8 **table, u8 *version)
+ {
+-	if (mt792x_acpi_read(dev, MT792x_ACPI_MTCL, table, NULL) < 0)
+-		*version = 1;
+-	else
+-		*version = 2;
++	int ret;
++
++	*version = ((ret = mt792x_acpi_read(dev, MT792x_ACPI_MTCL, table, NULL)) < 0)
++		   ? 1 : 2;
++
++	return ret;
+ }
+ 
+ /* MTDS : Dynamic SAR Power Table */
+@@ -166,16 +168,16 @@ int mt792x_init_acpi_sar(struct mt792x_dev *dev)
+ 	if (!asar)
+ 		return -ENOMEM;
+ 
+-	mt792x_asar_acpi_read_mtcl(dev, (u8 **)&asar->countrylist, &asar->ver);
++	ret = mt792x_asar_acpi_read_mtcl(dev, (u8 **)&asar->countrylist, &asar->ver);
++	if (ret) {
++		devm_kfree(dev->mt76.dev, asar->countrylist);
++		asar->countrylist = NULL;
++	}
+ 
+-	/* MTDS is mandatory. Return error if table is invalid */
+ 	ret = mt792x_asar_acpi_read_mtds(dev, (u8 **)&asar->dyn, asar->ver);
+ 	if (ret) {
+ 		devm_kfree(dev->mt76.dev, asar->dyn);
+-		devm_kfree(dev->mt76.dev, asar->countrylist);
+-		devm_kfree(dev->mt76.dev, asar);
+-
+-		return ret;
++		asar->dyn = NULL;
+ 	}
+ 
+ 	/* MTGS is optional */
+@@ -290,7 +292,7 @@ int mt792x_init_acpi_sar_power(struct mt792x_phy *phy, bool set_default)
+ 	const struct cfg80211_sar_capa *capa = phy->mt76->hw->wiphy->sar_capa;
+ 	int i;
+ 
+-	if (!phy->acpisar)
++	if (!phy->acpisar || !((struct mt792x_acpi_sar *)phy->acpisar)->dyn)
+ 		return 0;
+ 
+ 	/* When ACPI SAR enabled in HW, we should apply rules for .frp
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt792x-fix-ethtool-warning.patch b/queue-6.8/wifi-mt76-mt792x-fix-ethtool-warning.patch
new file mode 100644
index 00000000000..ace43f8e341
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt792x-fix-ethtool-warning.patch
@@ -0,0 +1,35 @@
+From bab516a7cc5ee25aa4a4c27784a65cd8fca3b630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Jan 2024 09:04:30 -0800
+Subject: wifi: mt76: mt792x: fix ethtool warning
+
+From: Gen Xu <genxu6@gmail.com>
+
+[ Upstream commit 7b4f9cd6a5fc221895b1d9be83ee3c13c00d09ab ]
+
+Add a missing EHT related field to fix the following ethtool warning:
+[98179.287352] mt7921e 0003:01:00.0: ei: 74  SSTATS_LEN: 73
+
+Fixes: c74df1c067f2 ("wifi: mt76: mt792x: introduce mt792x-lib module")
+Signed-off-by: Gen Xu <genxu6@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt792x_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt792x_core.c b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+index c42101aa9e45e..9ac5161dfff8c 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_core.c
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_core.c
+@@ -354,6 +354,7 @@ static const char mt792x_gstrings_stats[][ETH_GSTRING_LEN] = {
+ 	"v_tx_bw_40",
+ 	"v_tx_bw_80",
+ 	"v_tx_bw_160",
++	"v_tx_bw_320",
+ 	"v_tx_mcs_0",
+ 	"v_tx_mcs_1",
+ 	"v_tx_mcs_2",
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7996-check-txs-format-before-getting-skb.patch b/queue-6.8/wifi-mt76-mt7996-check-txs-format-before-getting-skb.patch
new file mode 100644
index 00000000000..5fb3708bea1
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7996-check-txs-format-before-getting-skb.patch
@@ -0,0 +1,68 @@
+From 56aefd924ce4ae804c9eed71664cd4b512466532 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:09:12 +0800
+Subject: wifi: mt76: mt7996: check txs format before getting skb by pid
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit 9c9c25f1dcdd98fffda564d2073f26219c84a2c3 ]
+
+The PPDU TXS does not include the error bit so it cannot use to report
+status to mac80211. This patch fixes issue that STA wrongly detects if AP
+is still alive.
+
+Fixes: 2569ea5326e2 ("wifi: mt76: mt7996: enable PPDU-TxS to host")
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/mac.c   | 23 +++++++++++--------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 53258488d49f3..a8414fbb07c82 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -1188,25 +1188,28 @@ mt7996_mac_add_txs_skb(struct mt7996_dev *dev, struct mt76_wcid *wcid,
+ 	struct ieee80211_tx_info *info;
+ 	struct sk_buff_head list;
+ 	struct rate_info rate = {};
+-	struct sk_buff *skb;
++	struct sk_buff *skb = NULL;
+ 	bool cck = false;
+ 	u32 txrate, txs, mode, stbc;
+ 
+ 	txs = le32_to_cpu(txs_data[0]);
+ 
+ 	mt76_tx_status_lock(mdev, &list);
+-	skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
+ 
+-	if (skb) {
+-		info = IEEE80211_SKB_CB(skb);
+-		if (!(txs & MT_TXS0_ACK_ERROR_MASK))
+-			info->flags |= IEEE80211_TX_STAT_ACK;
++	/* only report MPDU TXS */
++	if (le32_get_bits(txs_data[0], MT_TXS0_TXS_FORMAT) == 0) {
++		skb = mt76_tx_status_skb_get(mdev, wcid, pid, &list);
++		if (skb) {
++			info = IEEE80211_SKB_CB(skb);
++			if (!(txs & MT_TXS0_ACK_ERROR_MASK))
++				info->flags |= IEEE80211_TX_STAT_ACK;
+ 
+-		info->status.ampdu_len = 1;
+-		info->status.ampdu_ack_len =
+-			!!(info->flags & IEEE80211_TX_STAT_ACK);
++			info->status.ampdu_len = 1;
++			info->status.ampdu_ack_len =
++				!!(info->flags & IEEE80211_TX_STAT_ACK);
+ 
+-		info->status.rates[0].idx = -1;
++			info->status.rates[0].idx = -1;
++		}
+ 	}
+ 
+ 	if (mtk_wed_device_active(&dev->mt76.mmio.wed) && wcid->sta) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7996-fix-efuse-reading-issue.patch b/queue-6.8/wifi-mt76-mt7996-fix-efuse-reading-issue.patch
new file mode 100644
index 00000000000..3ef46eb2ace
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7996-fix-efuse-reading-issue.patch
@@ -0,0 +1,37 @@
+From 014509841e29f897d37a6dfe43498c9511791f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:09:19 +0800
+Subject: wifi: mt76: mt7996: fix efuse reading issue
+
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+
+[ Upstream commit d3ad99be7cc2d174126d908addd6bea2b157aa75 ]
+
+The efuse data starts from the 48th bytes instead of 64th bytes in the
+returned event skb.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index 66351c19dbe41..9e70b960086ac 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -3551,7 +3551,7 @@ int mt7996_mcu_get_eeprom(struct mt7996_dev *dev, u32 offset)
+ 		u32 addr = le32_to_cpu(*(__le32 *)(skb->data + 12));
+ 		u8 *buf = (u8 *)dev->mt76.eeprom.data + addr;
+ 
+-		skb_pull(skb, 64);
++		skb_pull(skb, 48);
+ 		memcpy(buf, skb->data, MT7996_EEPROM_BLOCK_SIZE);
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7996-fix-fw-loading-timeout.patch b/queue-6.8/wifi-mt76-mt7996-fix-fw-loading-timeout.patch
new file mode 100644
index 00000000000..ad929718eb5
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7996-fix-fw-loading-timeout.patch
@@ -0,0 +1,48 @@
+From b77badf4c14682e992c16b43be0279c31e2d588f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 10:41:18 +0100
+Subject: wifi: mt76: mt7996: fix fw loading timeout
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 030d2e287a902b44ef45e660cf1d73af23fe7d2e ]
+
+Fix the following firmware loading error due to a wrong dma register
+configuration if wed is disabled.
+
+[    8.245881] mt7996e_hif 0001:01:00.0: assign IRQ: got 128
+[    8.251308] mt7996e_hif 0001:01:00.0: enabling device (0000 -> 0002)
+[    8.257674] mt7996e_hif 0001:01:00.0: enabling bus mastering
+[    8.263488] mt7996e 0000:01:00.0: assign IRQ: got 126
+[    8.268537] mt7996e 0000:01:00.0: enabling device (0000 -> 0002)
+[    8.274551] mt7996e 0000:01:00.0: enabling bus mastering
+[   28.648773] mt7996e 0000:01:00.0: Message 00000010 (seq 1) timeout
+[   28.654959] mt7996e 0000:01:00.0: Failed to get patch semaphore
+[   29.661033] mt7996e: probe of 0000:01:00.0 failed with error -11
+
+Suggested-by: Sujuan Chen" <sujuan.chen@mediatek.com>
+Fixes: 4920a3a1285f ("wifi: mt76: mt7996: set DMA mask to 36 bits for boards with more than 4GB of RAM")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/dma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
+index 483ad81b6eec6..fe37110e66875 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/dma.c
+@@ -237,7 +237,8 @@ void mt7996_dma_start(struct mt7996_dev *dev, bool reset, bool wed_reset)
+ 				 MT_WFDMA0_GLO_CFG_TX_DMA_EN |
+ 				 MT_WFDMA0_GLO_CFG_RX_DMA_EN |
+ 				 MT_WFDMA0_GLO_CFG_OMIT_TX_INFO |
+-				 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2);
++				 MT_WFDMA0_GLO_CFG_OMIT_RX_INFO_PFET2 |
++				 MT_WFDMA0_GLO_CFG_EXT_EN);
+ 
+ 		if (dev->hif2)
+ 			mt76_set(dev, MT_WFDMA0_GLO_CFG + hif1_ofs,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7996-fix-he-beamformer-phy-cap-for-stati.patch b/queue-6.8/wifi-mt76-mt7996-fix-he-beamformer-phy-cap-for-stati.patch
new file mode 100644
index 00000000000..fe024d4f646
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7996-fix-he-beamformer-phy-cap-for-stati.patch
@@ -0,0 +1,43 @@
+From 5c9bc7be1a84aa419843cf0f1f30e429569206a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:09:17 +0800
+Subject: wifi: mt76: mt7996: fix HE beamformer phy cap for station vif
+
+From: Howard Hsu <howard-yh.hsu@mediatek.com>
+
+[ Upstream commit e1a491e856a8a36c46b39ecd07f3bba5a119d83a ]
+
+Set correct beamformer capabilities for station vif in HE PHY
+capability IE.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Howard Hsu <howard-yh.hsu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index 0cf0d1fe420a2..1a1a60744272d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -1012,11 +1012,12 @@ mt7996_set_stream_he_txbf_caps(struct mt7996_phy *phy,
+ 	/* the maximum cap is 4 x 3, (Nr, Nc) = (3, 2) */
+ 	elem->phy_cap_info[7] |= min_t(int, sts - 1, 2) << 3;
+ 
+-	if (vif != NL80211_IFTYPE_AP)
++	if (!(vif == NL80211_IFTYPE_AP || vif == NL80211_IFTYPE_STATION))
+ 		return;
+ 
+ 	elem->phy_cap_info[3] |= IEEE80211_HE_PHY_CAP3_SU_BEAMFORMER;
+-	elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
++	if (vif == NL80211_IFTYPE_AP)
++		elem->phy_cap_info[4] |= IEEE80211_HE_PHY_CAP4_MU_BEAMFORMER;
+ 
+ 	c = FIELD_PREP(IEEE80211_HE_PHY_CAP5_BEAMFORMEE_NUM_SND_DIM_UNDER_80MHZ_MASK,
+ 		       sts - 1) |
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7996-fix-hif_txd_v2_1-value.patch b/queue-6.8/wifi-mt76-mt7996-fix-hif_txd_v2_1-value.patch
new file mode 100644
index 00000000000..878fd9c8ff5
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7996-fix-hif_txd_v2_1-value.patch
@@ -0,0 +1,37 @@
+From 46a0a180ac43ed5fbbe9d052dd4f661dc440d91b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:09:23 +0800
+Subject: wifi: mt76: mt7996: fix HIF_TXD_V2_1 value
+
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+
+[ Upstream commit de8882775156682ba358afc82cb575c92cf3d092 ]
+
+Sync the value of HIF_TXD_V2_1 with firmware to let it correctly fill
+TXD values for HW path.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+index 1a1a60744272d..a929c657be1c4 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+@@ -493,7 +493,7 @@ static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)
+ 
+ void mt7996_mac_init(struct mt7996_dev *dev)
+ {
+-#define HIF_TXD_V2_1	4
++#define HIF_TXD_V2_1	0x21
+ 	int i;
+ 
+ 	mt76_clear(dev, MT_MDP_DCR2, MT_MDP_DCR2_RX_TRANS_SHORT);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7996-fix-incorrect-interpretation-of-eht.patch b/queue-6.8/wifi-mt76-mt7996-fix-incorrect-interpretation-of-eht.patch
new file mode 100644
index 00000000000..71d564c7ddd
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7996-fix-incorrect-interpretation-of-eht.patch
@@ -0,0 +1,61 @@
+From 06f2df1eccd10c5597df9e6472b5dbd54051774b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:09:15 +0800
+Subject: wifi: mt76: mt7996: fix incorrect interpretation of EHT MCS caps
+
+From: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+
+[ Upstream commit d52c97592f06552a4289008602b5d5b724084ba7 ]
+
+The EHT MCS map subfield of 20 MHz-Only is not present in the EHT
+capability of AP, so STA does not need to parse the subfield.
+Moreover, AP should parse the subfield only if STA is 20 MHz-Only, which
+can be confirmed by checking supported channel width in HE capability.
+
+Fixes: 92aa2da9fa49 ("wifi: mt76: mt7996: enable EHT support in firmware")
+Co-developed-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Benjamin Lin <benjamin-jw.lin@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+index 699be57309c2e..66351c19dbe41 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+@@ -1240,6 +1240,9 @@ mt7996_mcu_sta_he_6g_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ static void
+ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ {
++	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
++	struct ieee80211_vif *vif = container_of((void *)msta->vif,
++						 struct ieee80211_vif, drv_priv);
+ 	struct ieee80211_eht_mcs_nss_supp *mcs_map;
+ 	struct ieee80211_eht_cap_elem_fixed *elem;
+ 	struct sta_rec_eht *eht;
+@@ -1259,8 +1262,17 @@ mt7996_mcu_sta_eht_tlv(struct sk_buff *skb, struct ieee80211_sta *sta)
+ 	eht->phy_cap = cpu_to_le64(*(u64 *)elem->phy_cap_info);
+ 	eht->phy_cap_ext = cpu_to_le64(elem->phy_cap_info[8]);
+ 
+-	if (sta->deflink.bandwidth == IEEE80211_STA_RX_BW_20)
+-		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz, sizeof(eht->mcs_map_bw20));
++	if (vif->type != NL80211_IFTYPE_STATION &&
++	    (sta->deflink.he_cap.he_cap_elem.phy_cap_info[0] &
++	     (IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_IN_2G |
++	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_40MHZ_80MHZ_IN_5G |
++	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_160MHZ_IN_5G |
++	      IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G)) == 0) {
++		memcpy(eht->mcs_map_bw20, &mcs_map->only_20mhz,
++		       sizeof(eht->mcs_map_bw20));
++		return;
++	}
++
+ 	memcpy(eht->mcs_map_bw80, &mcs_map->bw._80, sizeof(eht->mcs_map_bw80));
+ 	memcpy(eht->mcs_map_bw160, &mcs_map->bw._160, sizeof(eht->mcs_map_bw160));
+ 	memcpy(eht->mcs_map_bw320, &mcs_map->bw._320, sizeof(eht->mcs_map_bw320));
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mt76-mt7996-fix-twt-issues.patch b/queue-6.8/wifi-mt76-mt7996-fix-twt-issues.patch
new file mode 100644
index 00000000000..c332e1cac33
--- /dev/null
+++ b/queue-6.8/wifi-mt76-mt7996-fix-twt-issues.patch
@@ -0,0 +1,137 @@
+From 9abd788af87ca7bdefd3bbc17735f6ab93554893 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:09:13 +0800
+Subject: wifi: mt76: mt7996: fix TWT issues
+
+From: Peter Chiu <chui-hao.chiu@mediatek.com>
+
+[ Upstream commit 5c832c228f6a7ba7e900c5296ce0fb3844bafec5 ]
+
+This patch fixes the following TWT issues:
+- Change table_mask to u16 to support up to 16 TWT stations
+- Reject TWT flows for duplicated establishment
+- Fix possible unaligned pointer
+- Remove unsupported TWT_CONTROL_WAKE_DUR_UNIT flag
+- The minimum TWT duration supported by mt7996 chipsets is 64. Reply
+  with TWT_SETUP_CMD_DICTATE if the min_twt_dur is smaller than 64
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7996/mac.c   | 53 ++++++++++++++++---
+ .../wireless/mediatek/mt76/mt7996/mt7996.h    |  3 +-
+ 2 files changed, 47 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index a8414fbb07c82..63d34844c1223 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -2530,6 +2530,34 @@ static int mt7996_mac_check_twt_req(struct ieee80211_twt_setup *twt)
+ 	return 0;
+ }
+ 
++static bool
++mt7996_mac_twt_param_equal(struct mt7996_sta *msta,
++			   struct ieee80211_twt_params *twt_agrt)
++{
++	u16 type = le16_to_cpu(twt_agrt->req_type);
++	u8 exp;
++	int i;
++
++	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, type);
++	for (i = 0; i < MT7996_MAX_STA_TWT_AGRT; i++) {
++		struct mt7996_twt_flow *f;
++
++		if (!(msta->twt.flowid_mask & BIT(i)))
++			continue;
++
++		f = &msta->twt.flow[i];
++		if (f->duration == twt_agrt->min_twt_dur &&
++		    f->mantissa == twt_agrt->mantissa &&
++		    f->exp == exp &&
++		    f->protection == !!(type & IEEE80211_TWT_REQTYPE_PROTECTION) &&
++		    f->flowtype == !!(type & IEEE80211_TWT_REQTYPE_FLOWTYPE) &&
++		    f->trigger == !!(type & IEEE80211_TWT_REQTYPE_TRIGGER))
++			return true;
++	}
++
++	return false;
++}
++
+ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 			      struct ieee80211_sta *sta,
+ 			      struct ieee80211_twt_setup *twt)
+@@ -2541,8 +2569,7 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 	enum ieee80211_twt_setup_cmd sta_setup_cmd;
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ 	struct mt7996_twt_flow *flow;
+-	int flowid, table_id;
+-	u8 exp;
++	u8 flowid, table_id, exp;
+ 
+ 	if (mt7996_mac_check_twt_req(twt))
+ 		goto out;
+@@ -2555,9 +2582,19 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ 	if (hweight8(msta->twt.flowid_mask) == ARRAY_SIZE(msta->twt.flow))
+ 		goto unlock;
+ 
++	if (twt_agrt->min_twt_dur < MT7996_MIN_TWT_DUR) {
++		setup_cmd = TWT_SETUP_CMD_DICTATE;
++		twt_agrt->min_twt_dur = MT7996_MIN_TWT_DUR;
++		goto unlock;
++	}
++
++	if (mt7996_mac_twt_param_equal(msta, twt_agrt))
++		goto unlock;
++
+ 	flowid = ffs(~msta->twt.flowid_mask) - 1;
+-	le16p_replace_bits(&twt_agrt->req_type, flowid,
+-			   IEEE80211_TWT_REQTYPE_FLOWID);
++	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_FLOWID);
++	twt_agrt->req_type |= le16_encode_bits(flowid,
++					       IEEE80211_TWT_REQTYPE_FLOWID);
+ 
+ 	table_id = ffs(~dev->twt.table_mask) - 1;
+ 	exp = FIELD_GET(IEEE80211_TWT_REQTYPE_WAKE_INT_EXP, req_type);
+@@ -2604,10 +2641,10 @@ void mt7996_mac_add_twt_setup(struct ieee80211_hw *hw,
+ unlock:
+ 	mutex_unlock(&dev->mt76.mutex);
+ out:
+-	le16p_replace_bits(&twt_agrt->req_type, setup_cmd,
+-			   IEEE80211_TWT_REQTYPE_SETUP_CMD);
+-	twt->control = (twt->control & IEEE80211_TWT_CONTROL_WAKE_DUR_UNIT) |
+-		       (twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED);
++	twt_agrt->req_type &= ~cpu_to_le16(IEEE80211_TWT_REQTYPE_SETUP_CMD);
++	twt_agrt->req_type |=
++		le16_encode_bits(setup_cmd, IEEE80211_TWT_REQTYPE_SETUP_CMD);
++	twt->control = twt->control & IEEE80211_TWT_CONTROL_RX_DISABLED;
+ }
+ 
+ void mt7996_mac_twt_teardown_flow(struct mt7996_dev *dev,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+index bc73bcb47bf02..8154ad37827f0 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+@@ -53,6 +53,7 @@
+ 
+ #define MT7996_MAX_TWT_AGRT		16
+ #define MT7996_MAX_STA_TWT_AGRT		8
++#define MT7996_MIN_TWT_DUR		64
+ #define MT7996_MAX_QUEUE		(__MT_RXQ_MAX +	__MT_MCUQ_MAX + 3)
+ 
+ /* NOTE: used to map mt76_rates. idx may change if firmware expands table */
+@@ -320,7 +321,7 @@ struct mt7996_dev {
+ 	struct rchan *relay_fwlog;
+ 
+ 	struct {
+-		u8 table_mask;
++		u16 table_mask;
+ 		u8 n_agrt;
+ 	} twt;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch b/queue-6.8/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
new file mode 100644
index 00000000000..55dcec04c0a
--- /dev/null
+++ b/queue-6.8/wifi-mwifiex-debugfs-drop-unnecessary-error-check-fo.patch
@@ -0,0 +1,46 @@
+From 6023edf234261763867dd22102f5707cb9d575c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Sep 2023 11:02:15 +0800
+Subject: wifi: mwifiex: debugfs: Drop unnecessary error check for
+ debugfs_create_dir()
+
+From: Jinjie Ruan <ruanjinjie@huawei.com>
+
+[ Upstream commit 50180c7f8e3de7c2d87f619131776598fcb1478d ]
+
+debugfs_create_dir() returns ERR_PTR and never return NULL.
+
+As Russell suggested, this patch removes the error checking for
+debugfs_create_dir(). This is because the DebugFS kernel API is developed
+in a way that the caller can safely ignore the errors that occur during
+the creation of DebugFS nodes. The debugfs APIs have a IS_ERR() judge in
+start_creating() which can handle it gracefully. So these checks are
+unnecessary.
+
+Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
+Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
+Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20230903030216.1509013-3-ruanjinjie@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/debugfs.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index f9c9fec7c792a..d14a0f4c1b6d7 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -970,9 +970,6 @@ mwifiex_dev_debugfs_init(struct mwifiex_private *priv)
+ 	priv->dfs_dev_dir = debugfs_create_dir(priv->netdev->name,
+ 					       mwifiex_dfs_dir);
+ 
+-	if (!priv->dfs_dev_dir)
+-		return;
+-
+ 	MWIFIEX_DFS_ADD_FILE(info);
+ 	MWIFIEX_DFS_ADD_FILE(debug);
+ 	MWIFIEX_DFS_ADD_FILE(getlog);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch b/queue-6.8/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
new file mode 100644
index 00000000000..c0e7dfe6270
--- /dev/null
+++ b/queue-6.8/wifi-rtl8xxxu-add-cancel_work_sync-for-c2hcmd_work.patch
@@ -0,0 +1,37 @@
+From daf54e209a070b783d9e0badd06272e484b6348f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 17:36:27 +0100
+Subject: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
+
+From: Martin Kaistra <martin.kaistra@linutronix.de>
+
+[ Upstream commit 1213acb478a7181cd73eeaf00db430f1e45b1361 ]
+
+The workqueue might still be running, when the driver is stopped. To
+avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().
+
+Fixes: e542e66b7c2e ("rtl8xxxu: add bluetooth co-existence support for single antenna")
+Signed-off-by: Martin Kaistra <martin.kaistra@linutronix.de>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240111163628.320697-2-martin.kaistra@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+index 180907319e8cd..04df0f54aa667 100644
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -7304,6 +7304,7 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw)
+ 	if (priv->usb_interrupts)
+ 		rtl8xxxu_write32(priv, REG_USB_HIMR, 0);
+ 
++	cancel_work_sync(&priv->c2hcmd_work);
+ 	cancel_delayed_work_sync(&priv->ra_watchdog);
+ 
+ 	rtl8xxxu_free_rx_resources(priv);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-rtw88-8821c-fix-beacon-loss-and-disconnect.patch b/queue-6.8/wifi-rtw88-8821c-fix-beacon-loss-and-disconnect.patch
new file mode 100644
index 00000000000..91b98b4d38a
--- /dev/null
+++ b/queue-6.8/wifi-rtw88-8821c-fix-beacon-loss-and-disconnect.patch
@@ -0,0 +1,86 @@
+From 05862f6cae6924771757723c9ba08e44ca9797ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 00:35:09 +0200
+Subject: wifi: rtw88: 8821c: Fix beacon loss and disconnect
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit e1dfa21427baeb813f9a2f9ceab6b7d32c3ca425 ]
+
+Tenda U9 V2.0, which contains RTL8811CU, is practically unusable because
+of frequent disconnections:
+
+Feb 23 14:46:45 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-BEACON-LOSS
+Feb 23 14:46:46 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-DISCONNECTED
+	bssid=90:55:de:__:__:__ reason=4 locally_generated=1
+
+Feb 23 14:46:52 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-CONNECTED
+	- Connection to 90:55:de:__:__:__ completed [id=0 id_str=]
+Feb 23 14:46:54 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-BEACON-LOSS
+Feb 23 14:46:55 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-DISCONNECTED
+	bssid=90:55:de:__:__:__ reason=4 locally_generated=1
+
+Feb 23 14:47:01 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-CONNECTED
+	- Connection to 90:55:de:__:__:__ completed [id=0 id_str=]
+Feb 23 14:47:04 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-BEACON-LOSS
+Feb 23 14:47:05 ideapad2 wpa_supplicant[427]: wlp3s0f3u2: CTRL-EVENT-DISCONNECTED
+	bssid=90:55:de:__:__:__ reason=4 locally_generated=1
+
+This is caused by a mistake in the chip initialisation. This version of
+the chip requires loading an extra AGC table right after the main one,
+but the extra table is being loaded at the wrong time, in
+rtw_chip_board_info_setup().
+
+Move the extra AGC table loading to the right place, in
+rtw_phy_load_tables().
+
+The rtw_chip_board_info_setup() can only do "software" things, and
+rtw_phy_load_tables() can really do IO.
+
+Fixes: 5d6651fe8583 ("rtw88: 8821c: support RFE type2 wifi NIC")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/276c31d8-b9a8-4e54-a3ac-09b74657aff7@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 2 --
+ drivers/net/wireless/realtek/rtw88/phy.c  | 3 +++
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 6d22628129d0d..ffba6b88f392c 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -2032,8 +2032,6 @@ static int rtw_chip_board_info_setup(struct rtw_dev *rtwdev)
+ 	rtw_phy_setup_phy_cond(rtwdev, hal->pkg_type);
+ 
+ 	rtw_phy_init_tx_power(rtwdev);
+-	if (rfe_def->agc_btg_tbl)
+-		rtw_load_table(rtwdev, rfe_def->agc_btg_tbl);
+ 	rtw_load_table(rtwdev, rfe_def->phy_pg_tbl);
+ 	rtw_load_table(rtwdev, rfe_def->txpwr_lmt_tbl);
+ 	rtw_phy_tx_power_by_rate_config(hal);
+diff --git a/drivers/net/wireless/realtek/rtw88/phy.c b/drivers/net/wireless/realtek/rtw88/phy.c
+index 128e75a81bf3c..37ef80c9091db 100644
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -1761,12 +1761,15 @@ static void rtw_load_rfk_table(struct rtw_dev *rtwdev)
+ 
+ void rtw_phy_load_tables(struct rtw_dev *rtwdev)
+ {
++	const struct rtw_rfe_def *rfe_def = rtw_get_rfe_def(rtwdev);
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	u8 rf_path;
+ 
+ 	rtw_load_table(rtwdev, chip->mac_tbl);
+ 	rtw_load_table(rtwdev, chip->bb_tbl);
+ 	rtw_load_table(rtwdev, chip->agc_tbl);
++	if (rfe_def->agc_btg_tbl)
++		rtw_load_table(rtwdev, rfe_def->agc_btg_tbl);
+ 	rtw_load_rfk_table(rtwdev);
+ 
+ 	for (rf_path = 0; rf_path < rtwdev->hal.rf_path_num; rf_path++) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-rtw88-8821c-fix-false-alarm-count.patch b/queue-6.8/wifi-rtw88-8821c-fix-false-alarm-count.patch
new file mode 100644
index 00000000000..0084e91a1c2
--- /dev/null
+++ b/queue-6.8/wifi-rtw88-8821c-fix-false-alarm-count.patch
@@ -0,0 +1,40 @@
+From 703d9990beb36d511513812041113818b8e2f453 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 00:35:58 +0200
+Subject: wifi: rtw88: 8821c: Fix false alarm count
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit c238adbc578eeb70cbc8fdd1bef3666b0f585b13 ]
+
+total_fa_cnt is supposed to include cck_fa_cnt and ofdm_fa_cnt, not just
+ofdm_fa_cnt.
+
+Fixes: 960361238b86 ("rtw88: 8821c: add false alarm statistics")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/f3cb6d17-e4e4-44a7-9c9b-72aed994b5c9@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8821c.c b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+index 429bb420b0563..fe5d8e1883509 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -773,9 +773,9 @@ static void rtw8821c_false_alarm_statistics(struct rtw_dev *rtwdev)
+ 
+ 	dm_info->cck_fa_cnt = cck_fa_cnt;
+ 	dm_info->ofdm_fa_cnt = ofdm_fa_cnt;
++	dm_info->total_fa_cnt = ofdm_fa_cnt;
+ 	if (cck_enable)
+ 		dm_info->total_fa_cnt += cck_fa_cnt;
+-	dm_info->total_fa_cnt = ofdm_fa_cnt;
+ 
+ 	crc32_cnt = rtw_read32(rtwdev, REG_CRC_CCK);
+ 	dm_info->cck_ok_cnt = FIELD_GET(GENMASK(15, 0), crc32_cnt);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-rtw88-8821cu-fix-firmware-upload-fail.patch b/queue-6.8/wifi-rtw88-8821cu-fix-firmware-upload-fail.patch
new file mode 100644
index 00000000000..8b6629053bf
--- /dev/null
+++ b/queue-6.8/wifi-rtw88-8821cu-fix-firmware-upload-fail.patch
@@ -0,0 +1,96 @@
+From ad6fb278ea113845fa66e7e39253b4f1bfa0b2fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2024 00:32:45 +0200
+Subject: wifi: rtw88: 8821cu: Fix firmware upload fail
+
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+
+[ Upstream commit 41a7acb7dde8395f52a707bbba7712a898dfafb0 ]
+
+RTL8822CU, RTL8822BU, and RTL8821CU need an extra register write after
+reading and writing certain addresses.
+
+Without this, the firmware upload fails approximately more than 50% of
+the time.
+
+Tested with RTL8811CU (Tenda U9 V2.0) which is the same as RTL8821CU
+but without Bluetooth.
+
+Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/f12ed39d-28e8-4b8b-8d22-447bcf295afc@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 40 ++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
+index e6ab1ac6d7093..a0188511099a1 100644
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -33,6 +33,36 @@ static void rtw_usb_fill_tx_checksum(struct rtw_usb *rtwusb,
+ 	rtw_tx_fill_txdesc_checksum(rtwdev, &pkt_info, skb->data);
+ }
+ 
++static void rtw_usb_reg_sec(struct rtw_dev *rtwdev, u32 addr, __le32 *data)
++{
++	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
++	struct usb_device *udev = rtwusb->udev;
++	bool reg_on_section = false;
++	u16 t_reg = 0x4e0;
++	u8 t_len = 1;
++	int status;
++
++	/* There are three sections:
++	 * 1. on (0x00~0xFF; 0x1000~0x10FF): this section is always powered on
++	 * 2. off (< 0xFE00, excluding "on" section): this section could be
++	 *    powered off
++	 * 3. local (>= 0xFE00): usb specific registers section
++	 */
++	if (addr <= 0xff || (addr >= 0x1000 && addr <= 0x10ff))
++		reg_on_section = true;
++
++	if (!reg_on_section)
++		return;
++
++	status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
++				 RTW_USB_CMD_REQ, RTW_USB_CMD_WRITE,
++				 t_reg, 0, data, t_len, 500);
++
++	if (status != t_len && status != -ENODEV)
++		rtw_err(rtwdev, "%s: reg 0x%x, usb write %u fail, status: %d\n",
++			__func__, t_reg, t_len, status);
++}
++
+ static u32 rtw_usb_read(struct rtw_dev *rtwdev, u32 addr, u16 len)
+ {
+ 	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
+@@ -58,6 +88,11 @@ static u32 rtw_usb_read(struct rtw_dev *rtwdev, u32 addr, u16 len)
+ 		rtw_err(rtwdev, "read register 0x%x failed with %d\n",
+ 			addr, ret);
+ 
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8822C ||
++	    rtwdev->chip->id == RTW_CHIP_TYPE_8822B ||
++	    rtwdev->chip->id == RTW_CHIP_TYPE_8821C)
++		rtw_usb_reg_sec(rtwdev, addr, data);
++
+ 	return le32_to_cpu(*data);
+ }
+ 
+@@ -102,6 +137,11 @@ static void rtw_usb_write(struct rtw_dev *rtwdev, u32 addr, u32 val, int len)
+ 	if (ret < 0 && ret != -ENODEV && count++ < 4)
+ 		rtw_err(rtwdev, "write register 0x%x failed with %d\n",
+ 			addr, ret);
++
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8822C ||
++	    rtwdev->chip->id == RTW_CHIP_TYPE_8822B ||
++	    rtwdev->chip->id == RTW_CHIP_TYPE_8821C)
++		rtw_usb_reg_sec(rtwdev, addr, data);
+ }
+ 
+ static void rtw_usb_write8(struct rtw_dev *rtwdev, u32 addr, u8 val)
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-wfx-fix-memory-leak-when-starting-ap.patch b/queue-6.8/wifi-wfx-fix-memory-leak-when-starting-ap.patch
new file mode 100644
index 00000000000..9b0199d4d76
--- /dev/null
+++ b/queue-6.8/wifi-wfx-fix-memory-leak-when-starting-ap.patch
@@ -0,0 +1,123 @@
+From 6025ff8a2d117e17f421092e77d9c5e0530cb288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Feb 2024 17:42:13 +0100
+Subject: wifi: wfx: fix memory leak when starting AP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Pouiller <jerome.pouiller@silabs.com>
+
+[ Upstream commit b8cfb7c819dd39965136a66fe3a7fde688d976fc ]
+
+Kmemleak reported this error:
+
+    unreferenced object 0xd73d1180 (size 184):
+      comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s)
+      hex dump (first 32 bytes):
+        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+        00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00  ................
+      backtrace:
+        [<5ca11420>] kmem_cache_alloc+0x20c/0x5ac
+        [<127bdd74>] __alloc_skb+0x144/0x170
+        [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180
+        [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
+        [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
+        [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]
+        [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]
+        [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
+        [<47bd8b68>] genl_rcv_msg+0x198/0x378
+        [<453ef796>] netlink_rcv_skb+0xd0/0x130
+        [<6b7c977a>] genl_rcv+0x34/0x44
+        [<66b2d04d>] netlink_unicast+0x1b4/0x258
+        [<f965b9b6>] netlink_sendmsg+0x1e8/0x428
+        [<aadb8231>] ____sys_sendmsg+0x1e0/0x274
+        [<d2b5212d>] ___sys_sendmsg+0x80/0xb4
+        [<69954f45>] __sys_sendmsg+0x64/0xa8
+    unreferenced object 0xce087000 (size 1024):
+      comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.246s)
+      hex dump (first 32 bytes):
+        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+        10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
+      backtrace:
+        [<9a993714>] __kmalloc_track_caller+0x230/0x600
+        [<f83ea192>] kmalloc_reserve.constprop.0+0x30/0x74
+        [<a2c61343>] __alloc_skb+0xa0/0x170
+        [<fb8a5e38>] __netdev_alloc_skb+0x50/0x180
+        [<0f9fa1d5>] __ieee80211_beacon_get+0x290/0x4d4 [mac80211]
+        [<7accd02d>] ieee80211_beacon_get_tim+0x54/0x18c [mac80211]
+        [<41e25cc3>] wfx_start_ap+0xc8/0x234 [wfx]
+        [<93a70356>] ieee80211_start_ap+0x404/0x6b4 [mac80211]
+        [<a4a661cd>] nl80211_start_ap+0x76c/0x9e0 [cfg80211]
+        [<47bd8b68>] genl_rcv_msg+0x198/0x378
+        [<453ef796>] netlink_rcv_skb+0xd0/0x130
+        [<6b7c977a>] genl_rcv+0x34/0x44
+        [<66b2d04d>] netlink_unicast+0x1b4/0x258
+        [<f965b9b6>] netlink_sendmsg+0x1e8/0x428
+        [<aadb8231>] ____sys_sendmsg+0x1e0/0x274
+        [<d2b5212d>] ___sys_sendmsg+0x80/0xb4
+
+However, since the kernel is build optimized, it seems the stack is not
+accurate. It appears the issue is related to wfx_set_mfp_ap(). The issue
+is obvious in this function: memory allocated by ieee80211_beacon_get()
+is never released. Fixing this leak makes kmemleak happy.
+
+Reported-by: Ulrich Mohr <u.mohr@semex-engcon.com>
+Co-developed-by: Ulrich Mohr <u.mohr@semex-engcon.com>
+Signed-off-by: Ulrich Mohr <u.mohr@semex-engcon.com>
+Fixes: 268bceec1684 ("staging: wfx: fix BA when device is AP and MFP is enabled")
+Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240202164213.1606145-1-jerome.pouiller@silabs.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/silabs/wfx/sta.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/silabs/wfx/sta.c b/drivers/net/wireless/silabs/wfx/sta.c
+index 537caf9d914a7..bb4446b88c12b 100644
+--- a/drivers/net/wireless/silabs/wfx/sta.c
++++ b/drivers/net/wireless/silabs/wfx/sta.c
+@@ -344,6 +344,7 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif)
+ 	const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16);
+ 	const int pairwise_cipher_suite_size = 4 / sizeof(u16);
+ 	const int akm_suite_size = 4 / sizeof(u16);
++	int ret = -EINVAL;
+ 	const u16 *ptr;
+ 
+ 	if (unlikely(!skb))
+@@ -352,22 +353,26 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif)
+ 	ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,
+ 				      skb->len - ieoffset);
+ 	if (unlikely(!ptr))
+-		return -EINVAL;
++		goto free_skb;
+ 
+ 	ptr += pairwise_cipher_suite_count_offset;
+ 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
+-		return -EINVAL;
++		goto free_skb;
+ 
+ 	ptr += 1 + pairwise_cipher_suite_size * *ptr;
+ 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
+-		return -EINVAL;
++		goto free_skb;
+ 
+ 	ptr += 1 + akm_suite_size * *ptr;
+ 	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))
+-		return -EINVAL;
++		goto free_skb;
+ 
+ 	wfx_hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6));
+-	return 0;
++	ret = 0;
++
++free_skb:
++	dev_kfree_skb(skb);
++	return ret;
+ }
+ 
+ int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch b/queue-6.8/wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch
new file mode 100644
index 00000000000..2eca3cef517
--- /dev/null
+++ b/queue-6.8/wifi-wilc1000-do-not-realloc-workqueue-everytime-an-.patch
@@ -0,0 +1,123 @@
+From 7cae1ac568dbe27578b97d25bdb59bd4a08e1570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 15:56:32 +0100
+Subject: wifi: wilc1000: do not realloc workqueue everytime an interface is
+ added
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ajay Singh <ajay.kathat@microchip.com>
+
+[ Upstream commit 328efda22af81130c2ad981c110518cb29ff2f1d ]
+
+Commit 09ed8bfc5215 ("wilc1000: Rename workqueue from "WILC_wq" to
+"NETDEV-wq"") moved workqueue creation in wilc_netdev_ifc_init in order to
+set the interface name in the workqueue name. However, while the driver
+needs only one workqueue, the wilc_netdev_ifc_init is called each time we
+add an interface over a phy, which in turns overwrite the workqueue with a
+new one. This can be observed with the following commands:
+
+for i in $(seq 0 10)
+do
+  iw phy phy0 interface add wlan1 type managed
+  iw dev wlan1 del
+done
+ps -eo pid,comm|grep wlan
+
+ 39 kworker/R-wlan0
+ 98 kworker/R-wlan1
+102 kworker/R-wlan1
+105 kworker/R-wlan1
+108 kworker/R-wlan1
+111 kworker/R-wlan1
+114 kworker/R-wlan1
+117 kworker/R-wlan1
+120 kworker/R-wlan1
+123 kworker/R-wlan1
+126 kworker/R-wlan1
+129 kworker/R-wlan1
+
+Fix this leakage by putting back hif_workqueue allocation in
+wilc_cfg80211_init. Regarding the workqueue name, it is indeed relevant to
+set it lowercase, however it is not  attached to a specific netdev, so
+enforcing netdev name in the name is not so relevant. Still, enrich the
+name with the wiphy name to make it clear which phy is using the workqueue.
+
+Fixes: 09ed8bfc5215 ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"")
+Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
+Co-developed-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240115-wilc_1000_fixes-v1-3-54d29463a738@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/cfg80211.c | 11 ++++++++++-
+ drivers/net/wireless/microchip/wilc1000/netdev.c   | 10 +---------
+ 2 files changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+index ad2509d8c99a4..2d0474e6404e1 100644
+--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c
++++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+@@ -1804,15 +1804,24 @@ int wilc_cfg80211_init(struct wilc **wilc, struct device *dev, int io_type,
+ 	INIT_LIST_HEAD(&wl->rxq_head.list);
+ 	INIT_LIST_HEAD(&wl->vif_list);
+ 
++	wl->hif_workqueue = alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM,
++						    wiphy_name(wl->wiphy));
++	if (!wl->hif_workqueue) {
++		ret = -ENOMEM;
++		goto free_cfg;
++	}
+ 	vif = wilc_netdev_ifc_init(wl, "wlan%d", WILC_STATION_MODE,
+ 				   NL80211_IFTYPE_STATION, false);
+ 	if (IS_ERR(vif)) {
+ 		ret = PTR_ERR(vif);
+-		goto free_cfg;
++		goto free_hq;
+ 	}
+ 
+ 	return 0;
+ 
++free_hq:
++	destroy_workqueue(wl->hif_workqueue);
++
+ free_cfg:
+ 	wilc_wlan_cfg_deinit(wl);
+ 
+diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c
+index 81e8f25863f5b..6c1058e5299c7 100644
+--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
+@@ -989,13 +989,6 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name,
+ 		goto error;
+ 	}
+ 
+-	wl->hif_workqueue = alloc_ordered_workqueue("%s-wq", WQ_MEM_RECLAIM,
+-						    ndev->name);
+-	if (!wl->hif_workqueue) {
+-		ret = -ENOMEM;
+-		goto unregister_netdev;
+-	}
+-
+ 	ndev->needs_free_netdev = true;
+ 	vif->iftype = vif_type;
+ 	vif->idx = wilc_get_available_idx(wl);
+@@ -1008,12 +1001,11 @@ struct wilc_vif *wilc_netdev_ifc_init(struct wilc *wl, const char *name,
+ 
+ 	return vif;
+ 
+-unregister_netdev:
++error:
+ 	if (rtnl_locked)
+ 		cfg80211_unregister_netdevice(ndev);
+ 	else
+ 		unregister_netdev(ndev);
+-  error:
+ 	free_netdev(ndev);
+ 	return ERR_PTR(ret);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-wilc1000-fix-declarations-ordering.patch b/queue-6.8/wifi-wilc1000-fix-declarations-ordering.patch
new file mode 100644
index 00000000000..83a52491978
--- /dev/null
+++ b/queue-6.8/wifi-wilc1000-fix-declarations-ordering.patch
@@ -0,0 +1,49 @@
+From a80d3c894a1b378dcf39df390e8307a395eab923 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 08:57:32 +0100
+Subject: wifi: wilc1000: fix declarations ordering
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexis Lothoré <alexis.lothore@bootlin.com>
+
+[ Upstream commit 535733e90e5d8912ebeccebb05b354a2d06ff459 ]
+
+Reorder parameters declaration in wilc_parse_join_bss_param to enforce
+reverse christmas tree
+
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240105075733.36331-2-alexis.lothore@bootlin.com
+Stable-dep-of: 205c50306acf ("wifi: wilc1000: fix RCU usage in connect path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/hif.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
+index 839f142663e86..6f1218a510610 100644
+--- a/drivers/net/wireless/microchip/wilc1000/hif.c
++++ b/drivers/net/wireless/microchip/wilc1000/hif.c
+@@ -377,13 +377,13 @@ struct wilc_join_bss_param *
+ wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 			  struct cfg80211_crypto_settings *crypto)
+ {
+-	struct wilc_join_bss_param *param;
+-	struct ieee80211_p2p_noa_attr noa_attr;
+-	u8 rates_len = 0;
++	const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies);
+ 	const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
+ 	const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie;
++	struct ieee80211_p2p_noa_attr noa_attr;
++	struct wilc_join_bss_param *param;
++	u8 rates_len = 0;
+ 	int ret;
+-	const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies);
+ 
+ 	param = kzalloc(sizeof(*param), GFP_KERNEL);
+ 	if (!param)
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch b/queue-6.8/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
new file mode 100644
index 00000000000..26164a3b46e
--- /dev/null
+++ b/queue-6.8/wifi-wilc1000-fix-multi-vif-management-when-deleting.patch
@@ -0,0 +1,54 @@
+From a63abaa9ea742d24886680ffd2943ceadb087a50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 15:56:34 +0100
+Subject: wifi: wilc1000: fix multi-vif management when deleting a vif
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ajay Singh <ajay.kathat@microchip.com>
+
+[ Upstream commit 12cfc9c8d3faf887a202c89bc312202445fca7e8 ]
+
+Adding then removing a second vif currently makes the first vif not working
+anymore. This is visible for example when we have a first interface
+connected to some access point:
+- create a wpa_supplicant.conf with some AP credentials
+- wpa_supplicant -Dnl80211 -c /etc/wpa_supplicant.conf -i wlan0
+- dhclient wlan0
+- iw phy phy0 interface add wlan1 type managed
+- iw dev wlan1 del
+wlan0 does not manage properly traffic anymore (eg: ping not working)
+
+This is due to vif mode being incorrectly reconfigured with some default
+values in del_virtual_intf, affecting by default first vif.
+
+Prevent first vif from being affected on second vif removal by removing vif
+mode change command in del_virtual_intf
+
+Fixes: 9bc061e88054 ("staging: wilc1000: added support to dynamically add/remove interfaces")
+Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
+Co-developed-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240115-wilc_1000_fixes-v1-5-54d29463a738@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/cfg80211.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/cfg80211.c b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+index 2d0474e6404e1..f03fd15c0c97a 100644
+--- a/drivers/net/wireless/microchip/wilc1000/cfg80211.c
++++ b/drivers/net/wireless/microchip/wilc1000/cfg80211.c
+@@ -1609,7 +1609,6 @@ static int del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
+ 	cfg80211_unregister_netdevice(vif->ndev);
+ 	vif->monitor_flag = 0;
+ 
+-	wilc_set_operation_mode(vif, 0, 0, 0);
+ 	mutex_lock(&wl->vif_mutex);
+ 	list_del_rcu(&vif->list);
+ 	wl->vif_num--;
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch b/queue-6.8/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
new file mode 100644
index 00000000000..3cfd4556f28
--- /dev/null
+++ b/queue-6.8/wifi-wilc1000-fix-rcu-usage-in-connect-path.patch
@@ -0,0 +1,176 @@
+From 77126274886dc7cadbc458205defd7b97ce2d4de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 08:57:33 +0100
+Subject: wifi: wilc1000: fix RCU usage in connect path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexis Lothoré <alexis.lothore@bootlin.com>
+
+[ Upstream commit 205c50306acf58a335eb19fa84e40140f4fe814f ]
+
+With lockdep enabled, calls to the connect function from cfg802.11 layer
+lead to the following warning:
+
+=============================
+WARNING: suspicious RCU usage
+6.7.0-rc1-wt+ #333 Not tainted
+-----------------------------
+drivers/net/wireless/microchip/wilc1000/hif.c:386
+suspicious rcu_dereference_check() usage!
+[...]
+stack backtrace:
+CPU: 0 PID: 100 Comm: wpa_supplicant Not tainted 6.7.0-rc1-wt+ #333
+Hardware name: Atmel SAMA5
+ unwind_backtrace from show_stack+0x18/0x1c
+ show_stack from dump_stack_lvl+0x34/0x48
+ dump_stack_lvl from wilc_parse_join_bss_param+0x7dc/0x7f4
+ wilc_parse_join_bss_param from connect+0x2c4/0x648
+ connect from cfg80211_connect+0x30c/0xb74
+ cfg80211_connect from nl80211_connect+0x860/0xa94
+ nl80211_connect from genl_rcv_msg+0x3fc/0x59c
+ genl_rcv_msg from netlink_rcv_skb+0xd0/0x1f8
+ netlink_rcv_skb from genl_rcv+0x2c/0x3c
+ genl_rcv from netlink_unicast+0x3b0/0x550
+ netlink_unicast from netlink_sendmsg+0x368/0x688
+ netlink_sendmsg from ____sys_sendmsg+0x190/0x430
+ ____sys_sendmsg from ___sys_sendmsg+0x110/0x158
+ ___sys_sendmsg from sys_sendmsg+0xe8/0x150
+ sys_sendmsg from ret_fast_syscall+0x0/0x1c
+
+This warning is emitted because in the connect path, when trying to parse
+target BSS parameters, we dereference a RCU pointer whithout being in RCU
+critical section.
+Fix RCU dereference usage by moving it to a RCU read critical section. To
+avoid wrapping the whole wilc_parse_join_bss_param under the critical
+section, just use the critical section to copy ies data
+
+Fixes: c460495ee072 ("staging: wilc1000: fix incorrent type in initializer")
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240105075733.36331-3-alexis.lothore@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/hif.c | 36 ++++++++++++-------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
+index 6f1218a510610..d2b8c26308198 100644
+--- a/drivers/net/wireless/microchip/wilc1000/hif.c
++++ b/drivers/net/wireless/microchip/wilc1000/hif.c
+@@ -377,38 +377,49 @@ struct wilc_join_bss_param *
+ wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 			  struct cfg80211_crypto_settings *crypto)
+ {
+-	const struct cfg80211_bss_ies *ies = rcu_dereference(bss->ies);
+-	const u8 *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
++	const u8 *ies_data, *tim_elm, *ssid_elm, *rates_ie, *supp_rates_ie;
+ 	const u8 *ht_ie, *wpa_ie, *wmm_ie, *rsn_ie;
+ 	struct ieee80211_p2p_noa_attr noa_attr;
++	const struct cfg80211_bss_ies *ies;
+ 	struct wilc_join_bss_param *param;
+-	u8 rates_len = 0;
++	u8 rates_len = 0, ies_len;
+ 	int ret;
+ 
+ 	param = kzalloc(sizeof(*param), GFP_KERNEL);
+ 	if (!param)
+ 		return NULL;
+ 
++	rcu_read_lock();
++	ies = rcu_dereference(bss->ies);
++	ies_data = kmemdup(ies->data, ies->len, GFP_ATOMIC);
++	if (!ies_data) {
++		rcu_read_unlock();
++		kfree(param);
++		return NULL;
++	}
++	ies_len = ies->len;
++	rcu_read_unlock();
++
+ 	param->beacon_period = cpu_to_le16(bss->beacon_interval);
+ 	param->cap_info = cpu_to_le16(bss->capability);
+ 	param->bss_type = WILC_FW_BSS_TYPE_INFRA;
+ 	param->ch = ieee80211_frequency_to_channel(bss->channel->center_freq);
+ 	ether_addr_copy(param->bssid, bss->bssid);
+ 
+-	ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies->data, ies->len);
++	ssid_elm = cfg80211_find_ie(WLAN_EID_SSID, ies_data, ies_len);
+ 	if (ssid_elm) {
+ 		if (ssid_elm[1] <= IEEE80211_MAX_SSID_LEN)
+ 			memcpy(param->ssid, ssid_elm + 2, ssid_elm[1]);
+ 	}
+ 
+-	tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies->data, ies->len);
++	tim_elm = cfg80211_find_ie(WLAN_EID_TIM, ies_data, ies_len);
+ 	if (tim_elm && tim_elm[1] >= 2)
+ 		param->dtim_period = tim_elm[3];
+ 
+ 	memset(param->p_suites, 0xFF, 3);
+ 	memset(param->akm_suites, 0xFF, 3);
+ 
+-	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies->data, ies->len);
++	rates_ie = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies_data, ies_len);
+ 	if (rates_ie) {
+ 		rates_len = rates_ie[1];
+ 		if (rates_len > WILC_MAX_RATES_SUPPORTED)
+@@ -419,7 +430,7 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 
+ 	if (rates_len < WILC_MAX_RATES_SUPPORTED) {
+ 		supp_rates_ie = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,
+-						 ies->data, ies->len);
++						 ies_data, ies_len);
+ 		if (supp_rates_ie) {
+ 			u8 ext_rates = supp_rates_ie[1];
+ 
+@@ -434,11 +445,11 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 		}
+ 	}
+ 
+-	ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies->data, ies->len);
++	ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies_data, ies_len);
+ 	if (ht_ie)
+ 		param->ht_capable = true;
+ 
+-	ret = cfg80211_get_p2p_attr(ies->data, ies->len,
++	ret = cfg80211_get_p2p_attr(ies_data, ies_len,
+ 				    IEEE80211_P2P_ATTR_ABSENCE_NOTICE,
+ 				    (u8 *)&noa_attr, sizeof(noa_attr));
+ 	if (ret > 0) {
+@@ -462,7 +473,7 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 	}
+ 	wmm_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+ 					 WLAN_OUI_TYPE_MICROSOFT_WMM,
+-					 ies->data, ies->len);
++					 ies_data, ies_len);
+ 	if (wmm_ie) {
+ 		struct ieee80211_wmm_param_ie *ie;
+ 
+@@ -477,13 +488,13 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 
+ 	wpa_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
+ 					 WLAN_OUI_TYPE_MICROSOFT_WPA,
+-					 ies->data, ies->len);
++					 ies_data, ies_len);
+ 	if (wpa_ie) {
+ 		param->mode_802_11i = 1;
+ 		param->rsn_found = true;
+ 	}
+ 
+-	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len);
++	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies_data, ies_len);
+ 	if (rsn_ie) {
+ 		int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
+ 		int offset = 8;
+@@ -517,6 +528,7 @@ wilc_parse_join_bss_param(struct cfg80211_bss *bss,
+ 			param->akm_suites[i] = crypto->akm_suites[i] & 0xFF;
+ 	}
+ 
++	kfree(ies_data);
+ 	return (void *)param;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch b/queue-6.8/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
new file mode 100644
index 00000000000..a7020544b3b
--- /dev/null
+++ b/queue-6.8/wifi-wilc1000-prevent-use-after-free-on-vif-when-cle.patch
@@ -0,0 +1,172 @@
+From 76eea0ddbae32e113130ee37582423dbb7f7ba0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Feb 2024 13:57:37 +0100
+Subject: wifi: wilc1000: prevent use-after-free on vif when cleaning up all
+ interfaces
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexis Lothoré <alexis.lothore@bootlin.com>
+
+[ Upstream commit cb5942b77c05d54310a0420cac12935e9b6aa21c ]
+
+wilc_netdev_cleanup currently triggers a KASAN warning, which can be
+observed on interface registration error path, or simply by
+removing the module/unbinding device from driver:
+
+echo spi0.1 > /sys/bus/spi/drivers/wilc1000_spi/unbind
+
+==================================================================
+BUG: KASAN: slab-use-after-free in wilc_netdev_cleanup+0x508/0x5cc
+Read of size 4 at addr c54d1ce8 by task sh/86
+
+CPU: 0 PID: 86 Comm: sh Not tainted 6.8.0-rc1+ #117
+Hardware name: Atmel SAMA5
+ unwind_backtrace from show_stack+0x18/0x1c
+ show_stack from dump_stack_lvl+0x34/0x58
+ dump_stack_lvl from print_report+0x154/0x500
+ print_report from kasan_report+0xac/0xd8
+ kasan_report from wilc_netdev_cleanup+0x508/0x5cc
+ wilc_netdev_cleanup from wilc_bus_remove+0xc8/0xec
+ wilc_bus_remove from spi_remove+0x8c/0xac
+ spi_remove from device_release_driver_internal+0x434/0x5f8
+ device_release_driver_internal from unbind_store+0xbc/0x108
+ unbind_store from kernfs_fop_write_iter+0x398/0x584
+ kernfs_fop_write_iter from vfs_write+0x728/0xf88
+ vfs_write from ksys_write+0x110/0x1e4
+ ksys_write from ret_fast_syscall+0x0/0x1c
+
+[...]
+
+Allocated by task 1:
+ kasan_save_track+0x30/0x5c
+ __kasan_kmalloc+0x8c/0x94
+ __kmalloc_node+0x1cc/0x3e4
+ kvmalloc_node+0x48/0x180
+ alloc_netdev_mqs+0x68/0x11dc
+ alloc_etherdev_mqs+0x28/0x34
+ wilc_netdev_ifc_init+0x34/0x8ec
+ wilc_cfg80211_init+0x690/0x910
+ wilc_bus_probe+0xe0/0x4a0
+ spi_probe+0x158/0x1b0
+ really_probe+0x270/0xdf4
+ __driver_probe_device+0x1dc/0x580
+ driver_probe_device+0x60/0x140
+ __driver_attach+0x228/0x5d4
+ bus_for_each_dev+0x13c/0x1a8
+ bus_add_driver+0x2a0/0x608
+ driver_register+0x24c/0x578
+ do_one_initcall+0x180/0x310
+ kernel_init_freeable+0x424/0x484
+ kernel_init+0x20/0x148
+ ret_from_fork+0x14/0x28
+
+Freed by task 86:
+ kasan_save_track+0x30/0x5c
+ kasan_save_free_info+0x38/0x58
+ __kasan_slab_free+0xe4/0x140
+ kfree+0xb0/0x238
+ device_release+0xc0/0x2a8
+ kobject_put+0x1d4/0x46c
+ netdev_run_todo+0x8fc/0x11d0
+ wilc_netdev_cleanup+0x1e4/0x5cc
+ wilc_bus_remove+0xc8/0xec
+ spi_remove+0x8c/0xac
+ device_release_driver_internal+0x434/0x5f8
+ unbind_store+0xbc/0x108
+ kernfs_fop_write_iter+0x398/0x584
+ vfs_write+0x728/0xf88
+ ksys_write+0x110/0x1e4
+ ret_fast_syscall+0x0/0x1c
+ [...]
+
+David Mosberger-Tan initial investigation [1] showed that this
+use-after-free is due to netdevice unregistration during vif list
+traversal. When unregistering a net device, since the needs_free_netdev has
+been set to true during registration, the netdevice object is also freed,
+and as a consequence, the corresponding vif object too, since it is
+attached to it as private netdevice data. The next occurrence of the loop
+then tries to access freed vif pointer to the list to move forward in the
+list.
+
+Fix this use-after-free thanks to two mechanisms:
+- navigate in the list with list_for_each_entry_safe, which allows to
+  safely modify the list as we go through each element. For each element,
+  remove it from the list with list_del_rcu
+- make sure to wait for RCU grace period end after each vif removal to make
+  sure it is safe to free the corresponding vif too (through
+  unregister_netdev)
+
+Since we are in a RCU "modifier" path (not a "reader" path), and because
+such path is expected not to be concurrent to any other modifier (we are
+using the vif_mutex lock), we do not need to use RCU list API, that's why
+we can benefit from list_for_each_entry_safe.
+
+[1] https://lore.kernel.org/linux-wireless/ab077dbe58b1ea5de0a3b2ca21f275a07af967d2.camel@egauge.net/
+
+Fixes: 8399918f3056 ("staging: wilc1000: use RCU list to maintain vif interfaces list")
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240212-wilc_rework_deinit-v1-1-9203ae56c27f@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/microchip/wilc1000/netdev.c  | 28 +++++--------------
+ 1 file changed, 7 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/netdev.c b/drivers/net/wireless/microchip/wilc1000/netdev.c
+index 6c1058e5299c7..6068699e44109 100644
+--- a/drivers/net/wireless/microchip/wilc1000/netdev.c
++++ b/drivers/net/wireless/microchip/wilc1000/netdev.c
+@@ -890,8 +890,7 @@ static const struct net_device_ops wilc_netdev_ops = {
+ 
+ void wilc_netdev_cleanup(struct wilc *wilc)
+ {
+-	struct wilc_vif *vif;
+-	int srcu_idx, ifc_cnt = 0;
++	struct wilc_vif *vif, *vif_tmp;
+ 
+ 	if (!wilc)
+ 		return;
+@@ -901,32 +900,19 @@ void wilc_netdev_cleanup(struct wilc *wilc)
+ 		wilc->firmware = NULL;
+ 	}
+ 
+-	srcu_idx = srcu_read_lock(&wilc->srcu);
+-	list_for_each_entry_rcu(vif, &wilc->vif_list, list) {
++	list_for_each_entry_safe(vif, vif_tmp, &wilc->vif_list, list) {
++		mutex_lock(&wilc->vif_mutex);
++		list_del_rcu(&vif->list);
++		wilc->vif_num--;
++		mutex_unlock(&wilc->vif_mutex);
++		synchronize_srcu(&wilc->srcu);
+ 		if (vif->ndev)
+ 			unregister_netdev(vif->ndev);
+ 	}
+-	srcu_read_unlock(&wilc->srcu, srcu_idx);
+ 
+ 	wilc_wfi_deinit_mon_interface(wilc, false);
+ 	destroy_workqueue(wilc->hif_workqueue);
+ 
+-	while (ifc_cnt < WILC_NUM_CONCURRENT_IFC) {
+-		mutex_lock(&wilc->vif_mutex);
+-		if (wilc->vif_num <= 0) {
+-			mutex_unlock(&wilc->vif_mutex);
+-			break;
+-		}
+-		vif = wilc_get_wl_to_vif(wilc);
+-		if (!IS_ERR(vif))
+-			list_del_rcu(&vif->list);
+-
+-		wilc->vif_num--;
+-		mutex_unlock(&wilc->vif_mutex);
+-		synchronize_srcu(&wilc->srcu);
+-		ifc_cnt++;
+-	}
+-
+ 	wilc_wlan_cfg_deinit(wilc);
+ 	wlan_deinit_locks(wilc);
+ 	wiphy_unregister(wilc->wiphy);
+-- 
+2.43.0
+
diff --git a/queue-6.8/wifi-wilc1000-revert-reset-line-logic-flip.patch b/queue-6.8/wifi-wilc1000-revert-reset-line-logic-flip.patch
new file mode 100644
index 00000000000..4263650b699
--- /dev/null
+++ b/queue-6.8/wifi-wilc1000-revert-reset-line-logic-flip.patch
@@ -0,0 +1,70 @@
+From a4bd4704d4d75d5c9e8eeb307d74a583478381cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Feb 2024 14:22:41 +0100
+Subject: wifi: wilc1000: revert reset line logic flip
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexis Lothoré <alexis.lothore@bootlin.com>
+
+[ Upstream commit f3ec643947634bed41b97bd56b248f7c78498eab ]
+
+This reverts commit fcf690b0b47494df51d214db5c5a714a400b0257.
+
+When using a wilc1000 chip over a spi bus, users can optionally define a
+reset gpio and a chip enable gpio. The reset line of wilc1000 is active
+low, so to hold the chip in reset, a low (physical) value must be applied.
+
+The corresponding device tree binding documentation was introduced by
+commit f31ee3c0a555 ("wilc1000: Document enable-gpios and reset-gpios
+properties") and correctly indicates that the reset line is an active-low
+signal. The corresponding driver part, brought by commit ec031ac4792c
+("wilc1000: Add reset/enable GPIO support to SPI driver") was applying the
+correct logic. But commit fcf690b0b474 ("wifi: wilc1000: use correct
+sequence of RESET for chip Power-UP/Down") eventually flipped this logic
+and started misusing the gpiod APIs, applying an inverted logic when
+powering up/down the chip (for example, setting the reset line to a logic
+"1" during power up, which in fact asserts the reset line when device tree
+describes the reset line as GPIO_ACTIVE_LOW). As a consequence, any
+platform currently using the driver in SPI mode must use a faulty reset
+line description in device tree, or else chip will be maintained in reset
+and will not even allow to bring up the chip.
+
+Fix reset line usage by inverting back the gpiod APIs usage, setting the
+reset line to the logic value "0" when powering the chip, and the logic
+value "1" when powering off the chip.
+
+Fixes: fcf690b0b474 ("wifi: wilc1000: use correct sequence of RESET for chip Power-UP/Down")
+Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Acked-by: Ajay Singh <ajay.kathat@microchip.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20240217-wilc_1000_reset_line-v2-1-b216f433d7d5@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/microchip/wilc1000/spi.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/microchip/wilc1000/spi.c b/drivers/net/wireless/microchip/wilc1000/spi.c
+index 1d8b241ce43ca..6a82b6ca2769e 100644
+--- a/drivers/net/wireless/microchip/wilc1000/spi.c
++++ b/drivers/net/wireless/microchip/wilc1000/spi.c
+@@ -192,11 +192,11 @@ static void wilc_wlan_power(struct wilc *wilc, bool on)
+ 		/* assert ENABLE: */
+ 		gpiod_set_value(gpios->enable, 1);
+ 		mdelay(5);
+-		/* assert RESET: */
+-		gpiod_set_value(gpios->reset, 1);
+-	} else {
+ 		/* deassert RESET: */
+ 		gpiod_set_value(gpios->reset, 0);
++	} else {
++		/* assert RESET: */
++		gpiod_set_value(gpios->reset, 1);
+ 		/* deassert ENABLE: */
+ 		gpiod_set_value(gpios->enable, 0);
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-don-t-call-cpumask_test_cpu-with-1-cpu-in-.patch b/queue-6.8/workqueue-don-t-call-cpumask_test_cpu-with-1-cpu-in-.patch
new file mode 100644
index 00000000000..7fab31489a3
--- /dev/null
+++ b/queue-6.8/workqueue-don-t-call-cpumask_test_cpu-with-1-cpu-in-.patch
@@ -0,0 +1,61 @@
+From 3ad8330c1b4833caf8daa203b40b34c334f9691c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jan 2024 18:55:55 -1000
+Subject: workqueue: Don't call cpumask_test_cpu() with -1 CPU in
+ wq_update_node_max_active()
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit 15930da42f8981dc42c19038042947b475b19f47 ]
+
+For wq_update_node_max_active(), @off_cpu of -1 indicates that no CPU is
+going down. The function was incorrectly calling cpumask_test_cpu() with -1
+CPU leading to oopses like the following on some archs:
+
+  Unable to handle kernel paging request at virtual address ffff0002100296e0
+  ..
+  pc : wq_update_node_max_active+0x50/0x1fc
+  lr : wq_update_node_max_active+0x1f0/0x1fc
+  ...
+  Call trace:
+    wq_update_node_max_active+0x50/0x1fc
+    apply_wqattrs_commit+0xf0/0x114
+    apply_workqueue_attrs_locked+0x58/0xa0
+    alloc_workqueue+0x5ac/0x774
+    workqueue_init_early+0x460/0x540
+    start_kernel+0x258/0x684
+    __primary_switched+0xb8/0xc0
+  Code: 9100a273 35000d01 53067f00 d0016dc1 (f8607a60)
+  ---[ end trace 0000000000000000 ]---
+  Kernel panic - not syncing: Attempted to kill the idle task!
+  ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
+
+Fix it.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Tested-by: Nathan Chancellor <nathan@kernel.org>
+Link: http://lkml.kernel.org/r/91eacde0-df99-4d5c-a980-91046f66e612@samsung.com
+Fixes: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 4f3425ed62ed9..ed8ebc9776016 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1506,7 +1506,7 @@ static void wq_update_node_max_active(struct workqueue_struct *wq, int off_cpu)
+ 
+ 	lockdep_assert_held(&wq->mutex);
+ 
+-	if (!cpumask_test_cpu(off_cpu, effective))
++	if (off_cpu >= 0 && !cpumask_test_cpu(off_cpu, effective))
+ 		off_cpu = -1;
+ 
+ 	total_cpus = cpumask_weight_and(effective, cpu_online_mask);
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-factor-out-pwq_is_empty.patch b/queue-6.8/workqueue-factor-out-pwq_is_empty.patch
new file mode 100644
index 00000000000..f2be5b47cfd
--- /dev/null
+++ b/queue-6.8/workqueue-factor-out-pwq_is_empty.patch
@@ -0,0 +1,75 @@
+From 083362f8dc49f543dbb028279226120252b698c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:24 -1000
+Subject: workqueue: Factor out pwq_is_empty()
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit afa87ce85379e2d93863fce595afdb5771a84004 ]
+
+"!pwq->nr_active && list_empty(&pwq->inactive_works)" test is repeated
+multiple times. Let's factor it out into pwq_is_empty().
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 8ee754dd319da..6d0f64b5918ba 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1456,6 +1456,11 @@ static void put_pwq_unlocked(struct pool_workqueue *pwq)
+ 	}
+ }
+ 
++static bool pwq_is_empty(struct pool_workqueue *pwq)
++{
++	return !pwq->nr_active && list_empty(&pwq->inactive_works);
++}
++
+ static void pwq_activate_inactive_work(struct work_struct *work)
+ {
+ 	struct pool_workqueue *pwq = get_work_pwq(work);
+@@ -3325,7 +3330,7 @@ void drain_workqueue(struct workqueue_struct *wq)
+ 		bool drained;
+ 
+ 		raw_spin_lock_irq(&pwq->pool->lock);
+-		drained = !pwq->nr_active && list_empty(&pwq->inactive_works);
++		drained = pwq_is_empty(pwq);
+ 		raw_spin_unlock_irq(&pwq->pool->lock);
+ 
+ 		if (drained)
+@@ -4772,7 +4777,7 @@ static bool pwq_busy(struct pool_workqueue *pwq)
+ 
+ 	if ((pwq != pwq->wq->dfl_pwq) && (pwq->refcnt > 1))
+ 		return true;
+-	if (pwq->nr_active || !list_empty(&pwq->inactive_works))
++	if (!pwq_is_empty(pwq))
+ 		return true;
+ 
+ 	return false;
+@@ -5210,7 +5215,7 @@ void show_one_workqueue(struct workqueue_struct *wq)
+ 	unsigned long flags;
+ 
+ 	for_each_pwq(pwq, wq) {
+-		if (pwq->nr_active || !list_empty(&pwq->inactive_works)) {
++		if (!pwq_is_empty(pwq)) {
+ 			idle = false;
+ 			break;
+ 		}
+@@ -5222,7 +5227,7 @@ void show_one_workqueue(struct workqueue_struct *wq)
+ 
+ 	for_each_pwq(pwq, wq) {
+ 		raw_spin_lock_irqsave(&pwq->pool->lock, flags);
+-		if (pwq->nr_active || !list_empty(&pwq->inactive_works)) {
++		if (!pwq_is_empty(pwq)) {
+ 			/*
+ 			 * Defer printing to avoid deadlocks in console
+ 			 * drivers that queue work while holding locks
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-implement-system-wide-nr_active-enforcemen.patch b/queue-6.8/workqueue-implement-system-wide-nr_active-enforcemen.patch
new file mode 100644
index 00000000000..3166671e29c
--- /dev/null
+++ b/queue-6.8/workqueue-implement-system-wide-nr_active-enforcemen.patch
@@ -0,0 +1,753 @@
+From 3c9d8af4aeb06fe4e967358157ba38c43b4a169e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:25 -1000
+Subject: workqueue: Implement system-wide nr_active enforcement for unbound
+ workqueues
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit 5797b1c18919cd9c289ded7954383e499f729ce0 ]
+
+A pool_workqueue (pwq) represents the connection between a workqueue and a
+worker_pool. One of the roles that a pwq plays is enforcement of the
+max_active concurrency limit. Before 636b927eba5b ("workqueue: Make unbound
+workqueues to use per-cpu pool_workqueues"), there was one pwq per each CPU
+for per-cpu workqueues and per each NUMA node for unbound workqueues, which
+was a natural result of per-cpu workqueues being served by per-cpu pools and
+unbound by per-NUMA pools.
+
+In terms of max_active enforcement, this was, while not perfect, workable.
+For per-cpu workqueues, it was fine. For unbound, it wasn't great in that
+NUMA machines would get max_active that's multiplied by the number of nodes
+but didn't cause huge problems because NUMA machines are relatively rare and
+the node count is usually pretty low.
+
+However, cache layouts are more complex now and sharing a worker pool across
+a whole node didn't really work well for unbound workqueues. Thus, a series
+of commits culminating on 8639ecebc9b1 ("workqueue: Make unbound workqueues
+to use per-cpu pool_workqueues") implemented more flexible affinity
+mechanism for unbound workqueues which enables using e.g. last-level-cache
+aligned pools. In the process, 636b927eba5b ("workqueue: Make unbound
+workqueues to use per-cpu pool_workqueues") made unbound workqueues use
+per-cpu pwqs like per-cpu workqueues.
+
+While the change was necessary to enable more flexible affinity scopes, this
+came with the side effect of blowing up the effective max_active for unbound
+workqueues. Before, the effective max_active for unbound workqueues was
+multiplied by the number of nodes. After, by the number of CPUs.
+
+636b927eba5b ("workqueue: Make unbound workqueues to use per-cpu
+pool_workqueues") claims that this should generally be okay. It is okay for
+users which self-regulates concurrency level which are the vast majority;
+however, there are enough use cases which actually depend on max_active to
+prevent the level of concurrency from going bonkers including several IO
+handling workqueues that can issue a work item for each in-flight IO. With
+targeted benchmarks, the misbehavior can easily be exposed as reported in
+http://lkml.kernel.org/r/dbu6wiwu3sdhmhikb2w6lns7b27gbobfavhjj57kwi2quafgwl@htjcc5oikcr3.
+
+Unfortunately, there is no way to express what these use cases need using
+per-cpu max_active. A CPU may issue most of in-flight IOs, so we don't want
+to set max_active too low but as soon as we increase max_active a bit, we
+can end up with unreasonable number of in-flight work items when many CPUs
+issue IOs at the same time. ie. The acceptable lowest max_active is higher
+than the acceptable highest max_active.
+
+Ideally, max_active for an unbound workqueue should be system-wide so that
+the users can regulate the total level of concurrency regardless of node and
+cache layout. The reasons workqueue hasn't implemented that yet are:
+
+- One max_active enforcement decouples from pool boundaires, chaining
+  execution after a work item finishes requires inter-pool operations which
+  would require lock dancing, which is nasty.
+
+- Sharing a single nr_active count across the whole system can be pretty
+  expensive on NUMA machines.
+
+- Per-pwq enforcement had been more or less okay while we were using
+  per-node pools.
+
+It looks like we no longer can avoid decoupling max_active enforcement from
+pool boundaries. This patch implements system-wide nr_active mechanism with
+the following design characteristics:
+
+- To avoid sharing a single counter across multiple nodes, the configured
+  max_active is split across nodes according to the proportion of each
+  workqueue's online effective CPUs per node. e.g. A node with twice more
+  online effective CPUs will get twice higher portion of max_active.
+
+- Workqueue used to be able to process a chain of interdependent work items
+  which is as long as max_active. We can't do this anymore as max_active is
+  distributed across the nodes. Instead, a new parameter min_active is
+  introduced which determines the minimum level of concurrency within a node
+  regardless of how max_active distribution comes out to be.
+
+  It is set to the smaller of max_active and WQ_DFL_MIN_ACTIVE which is 8.
+  This can lead to higher effective max_weight than configured and also
+  deadlocks if a workqueue was depending on being able to handle chains of
+  interdependent work items that are longer than 8.
+
+  I believe these should be fine given that the number of CPUs in each NUMA
+  node is usually higher than 8 and work item chain longer than 8 is pretty
+  unlikely. However, if these assumptions turn out to be wrong, we'll need
+  to add an interface to adjust min_active.
+
+- Each unbound wq has an array of struct wq_node_nr_active which tracks
+  per-node nr_active. When its pwq wants to run a work item, it has to
+  obtain the matching node's nr_active. If over the node's max_active, the
+  pwq is queued on wq_node_nr_active->pending_pwqs. As work items finish,
+  the completion path round-robins the pending pwqs activating the first
+  inactive work item of each, which involves some pool lock dancing and
+  kicking other pools. It's not the simplest code but doesn't look too bad.
+
+v4: - wq_adjust_max_active() updated to invoke wq_update_node_max_active().
+
+    - wq_adjust_max_active() is now protected by wq->mutex instead of
+      wq_pool_mutex.
+
+v3: - wq_node_max_active() used to calculate per-node max_active on the fly
+      based on system-wide CPU online states. Lai pointed out that this can
+      lead to skewed distributions for workqueues with restricted cpumasks.
+      Update the max_active distribution to use per-workqueue effective
+      online CPU counts instead of system-wide and cache the calculation
+      results in node_nr_active->max.
+
+v2: - wq->min/max_active now uses WRITE/READ_ONCE() as suggested by Lai.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Naohiro Aota <Naohiro.Aota@wdc.com>
+Link: http://lkml.kernel.org/r/dbu6wiwu3sdhmhikb2w6lns7b27gbobfavhjj57kwi2quafgwl@htjcc5oikcr3
+Fixes: 636b927eba5b ("workqueue: Make unbound workqueues to use per-cpu pool_workqueues")
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/workqueue.h |  35 +++-
+ kernel/workqueue.c        | 341 ++++++++++++++++++++++++++++++++++----
+ 2 files changed, 341 insertions(+), 35 deletions(-)
+
+diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
+index 2cc0a9606175f..515e7958c6c10 100644
+--- a/include/linux/workqueue.h
++++ b/include/linux/workqueue.h
+@@ -391,6 +391,13 @@ enum {
+ 	WQ_MAX_ACTIVE		= 512,	  /* I like 512, better ideas? */
+ 	WQ_UNBOUND_MAX_ACTIVE	= WQ_MAX_ACTIVE,
+ 	WQ_DFL_ACTIVE		= WQ_MAX_ACTIVE / 2,
++
++	/*
++	 * Per-node default cap on min_active. Unless explicitly set, min_active
++	 * is set to min(max_active, WQ_DFL_MIN_ACTIVE). For more details, see
++	 * workqueue_struct->min_active definition.
++	 */
++	WQ_DFL_MIN_ACTIVE	= 8,
+ };
+ 
+ /*
+@@ -433,11 +440,33 @@ extern struct workqueue_struct *system_freezable_power_efficient_wq;
+  * alloc_workqueue - allocate a workqueue
+  * @fmt: printf format for the name of the workqueue
+  * @flags: WQ_* flags
+- * @max_active: max in-flight work items per CPU, 0 for default
++ * @max_active: max in-flight work items, 0 for default
+  * remaining args: args for @fmt
+  *
+- * Allocate a workqueue with the specified parameters.  For detailed
+- * information on WQ_* flags, please refer to
++ * For a per-cpu workqueue, @max_active limits the number of in-flight work
++ * items for each CPU. e.g. @max_active of 1 indicates that each CPU can be
++ * executing at most one work item for the workqueue.
++ *
++ * For unbound workqueues, @max_active limits the number of in-flight work items
++ * for the whole system. e.g. @max_active of 16 indicates that that there can be
++ * at most 16 work items executing for the workqueue in the whole system.
++ *
++ * As sharing the same active counter for an unbound workqueue across multiple
++ * NUMA nodes can be expensive, @max_active is distributed to each NUMA node
++ * according to the proportion of the number of online CPUs and enforced
++ * independently.
++ *
++ * Depending on online CPU distribution, a node may end up with per-node
++ * max_active which is significantly lower than @max_active, which can lead to
++ * deadlocks if the per-node concurrency limit is lower than the maximum number
++ * of interdependent work items for the workqueue.
++ *
++ * To guarantee forward progress regardless of online CPU distribution, the
++ * concurrency limit on every node is guaranteed to be equal to or greater than
++ * min_active which is set to min(@max_active, %WQ_DFL_MIN_ACTIVE). This means
++ * that the sum of per-node max_active's may be larger than @max_active.
++ *
++ * For detailed information on %WQ_* flags, please refer to
+  * Documentation/core-api/workqueue.rst.
+  *
+  * RETURNS:
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 686899845475f..4f3425ed62ed9 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -122,6 +122,9 @@ enum {
+  *
+  * L: pool->lock protected.  Access with pool->lock held.
+  *
++ * LN: pool->lock and wq_node_nr_active->lock protected for writes. Either for
++ *     reads.
++ *
+  * K: Only modified by worker while holding pool->lock. Can be safely read by
+  *    self, while holding pool->lock or from IRQ context if %current is the
+  *    kworker.
+@@ -243,17 +246,18 @@ struct pool_workqueue {
+ 	 * pwq->inactive_works instead of pool->worklist and marked with
+ 	 * WORK_STRUCT_INACTIVE.
+ 	 *
+-	 * All work items marked with WORK_STRUCT_INACTIVE do not participate
+-	 * in pwq->nr_active and all work items in pwq->inactive_works are
+-	 * marked with WORK_STRUCT_INACTIVE.  But not all WORK_STRUCT_INACTIVE
+-	 * work items are in pwq->inactive_works.  Some of them are ready to
+-	 * run in pool->worklist or worker->scheduled.  Those work itmes are
+-	 * only struct wq_barrier which is used for flush_work() and should
+-	 * not participate in pwq->nr_active.  For non-barrier work item, it
+-	 * is marked with WORK_STRUCT_INACTIVE iff it is in pwq->inactive_works.
++	 * All work items marked with WORK_STRUCT_INACTIVE do not participate in
++	 * nr_active and all work items in pwq->inactive_works are marked with
++	 * WORK_STRUCT_INACTIVE. But not all WORK_STRUCT_INACTIVE work items are
++	 * in pwq->inactive_works. Some of them are ready to run in
++	 * pool->worklist or worker->scheduled. Those work itmes are only struct
++	 * wq_barrier which is used for flush_work() and should not participate
++	 * in nr_active. For non-barrier work item, it is marked with
++	 * WORK_STRUCT_INACTIVE iff it is in pwq->inactive_works.
+ 	 */
+ 	int			nr_active;	/* L: nr of active works */
+ 	struct list_head	inactive_works;	/* L: inactive works */
++	struct list_head	pending_node;	/* LN: node on wq_node_nr_active->pending_pwqs */
+ 	struct list_head	pwqs_node;	/* WR: node on wq->pwqs */
+ 	struct list_head	mayday_node;	/* MD: node on wq->maydays */
+ 
+@@ -285,9 +289,19 @@ struct wq_device;
+  * on each CPU, in an unbound workqueue, max_active applies to the whole system.
+  * As sharing a single nr_active across multiple sockets can be very expensive,
+  * the counting and enforcement is per NUMA node.
++ *
++ * The following struct is used to enforce per-node max_active. When a pwq wants
++ * to start executing a work item, it should increment ->nr using
++ * tryinc_node_nr_active(). If acquisition fails due to ->nr already being over
++ * ->max, the pwq is queued on ->pending_pwqs. As in-flight work items finish
++ * and decrement ->nr, node_activate_pending_pwq() activates the pending pwqs in
++ * round-robin order.
+  */
+ struct wq_node_nr_active {
+-	atomic_t		nr;		/* per-node nr_active count */
++	int			max;		/* per-node max_active */
++	atomic_t		nr;		/* per-node nr_active */
++	raw_spinlock_t		lock;		/* nests inside pool locks */
++	struct list_head	pending_pwqs;	/* LN: pwqs with inactive works */
+ };
+ 
+ /*
+@@ -310,8 +324,12 @@ struct workqueue_struct {
+ 	struct worker		*rescuer;	/* MD: rescue worker */
+ 
+ 	int			nr_drainers;	/* WQ: drain in progress */
++
++	/* See alloc_workqueue() function comment for info on min/max_active */
+ 	int			max_active;	/* WO: max active works */
++	int			min_active;	/* WO: min active works */
+ 	int			saved_max_active; /* WQ: saved max_active */
++	int			saved_min_active; /* WQ: saved min_active */
+ 
+ 	struct workqueue_attrs	*unbound_attrs;	/* PW: only for unbound wqs */
+ 	struct pool_workqueue __rcu *dfl_pwq;   /* PW: only for unbound wqs */
+@@ -663,6 +681,19 @@ static struct pool_workqueue *unbound_pwq(struct workqueue_struct *wq, int cpu)
+ 				     lockdep_is_held(&wq->mutex));
+ }
+ 
++/**
++ * unbound_effective_cpumask - effective cpumask of an unbound workqueue
++ * @wq: workqueue of interest
++ *
++ * @wq->unbound_attrs->cpumask contains the cpumask requested by the user which
++ * is masked with wq_unbound_cpumask to determine the effective cpumask. The
++ * default pwq is always mapped to the pool with the current effective cpumask.
++ */
++static struct cpumask *unbound_effective_cpumask(struct workqueue_struct *wq)
++{
++	return unbound_pwq(wq, -1)->pool->attrs->__pod_cpumask;
++}
++
+ static unsigned int work_color_to_flags(int color)
+ {
+ 	return color << WORK_STRUCT_COLOR_SHIFT;
+@@ -1457,6 +1488,46 @@ static struct wq_node_nr_active *wq_node_nr_active(struct workqueue_struct *wq,
+ 	return wq->node_nr_active[node];
+ }
+ 
++/**
++ * wq_update_node_max_active - Update per-node max_actives to use
++ * @wq: workqueue to update
++ * @off_cpu: CPU that's going down, -1 if a CPU is not going down
++ *
++ * Update @wq->node_nr_active[]->max. @wq must be unbound. max_active is
++ * distributed among nodes according to the proportions of numbers of online
++ * cpus. The result is always between @wq->min_active and max_active.
++ */
++static void wq_update_node_max_active(struct workqueue_struct *wq, int off_cpu)
++{
++	struct cpumask *effective = unbound_effective_cpumask(wq);
++	int min_active = READ_ONCE(wq->min_active);
++	int max_active = READ_ONCE(wq->max_active);
++	int total_cpus, node;
++
++	lockdep_assert_held(&wq->mutex);
++
++	if (!cpumask_test_cpu(off_cpu, effective))
++		off_cpu = -1;
++
++	total_cpus = cpumask_weight_and(effective, cpu_online_mask);
++	if (off_cpu >= 0)
++		total_cpus--;
++
++	for_each_node(node) {
++		int node_cpus;
++
++		node_cpus = cpumask_weight_and(effective, cpumask_of_node(node));
++		if (off_cpu >= 0 && cpu_to_node(off_cpu) == node)
++			node_cpus--;
++
++		wq_node_nr_active(wq, node)->max =
++			clamp(DIV_ROUND_UP(max_active * node_cpus, total_cpus),
++			      min_active, max_active);
++	}
++
++	wq_node_nr_active(wq, NUMA_NO_NODE)->max = min_active;
++}
++
+ /**
+  * get_pwq - get an extra reference on the specified pool_workqueue
+  * @pwq: pool_workqueue to get
+@@ -1554,35 +1625,98 @@ static bool pwq_activate_work(struct pool_workqueue *pwq,
+ 	return true;
+ }
+ 
++static bool tryinc_node_nr_active(struct wq_node_nr_active *nna)
++{
++	int max = READ_ONCE(nna->max);
++
++	while (true) {
++		int old, tmp;
++
++		old = atomic_read(&nna->nr);
++		if (old >= max)
++			return false;
++		tmp = atomic_cmpxchg_relaxed(&nna->nr, old, old + 1);
++		if (tmp == old)
++			return true;
++	}
++}
++
+ /**
+  * pwq_tryinc_nr_active - Try to increment nr_active for a pwq
+  * @pwq: pool_workqueue of interest
++ * @fill: max_active may have increased, try to increase concurrency level
+  *
+  * Try to increment nr_active for @pwq. Returns %true if an nr_active count is
+  * successfully obtained. %false otherwise.
+  */
+-static bool pwq_tryinc_nr_active(struct pool_workqueue *pwq)
++static bool pwq_tryinc_nr_active(struct pool_workqueue *pwq, bool fill)
+ {
+ 	struct workqueue_struct *wq = pwq->wq;
+ 	struct worker_pool *pool = pwq->pool;
+ 	struct wq_node_nr_active *nna = wq_node_nr_active(wq, pool->node);
+-	bool obtained;
++	bool obtained = false;
+ 
+ 	lockdep_assert_held(&pool->lock);
+ 
+-	obtained = pwq->nr_active < READ_ONCE(wq->max_active);
++	if (!nna) {
++		/* per-cpu workqueue, pwq->nr_active is sufficient */
++		obtained = pwq->nr_active < READ_ONCE(wq->max_active);
++		goto out;
++	}
++
++	/*
++	 * Unbound workqueue uses per-node shared nr_active $nna. If @pwq is
++	 * already waiting on $nna, pwq_dec_nr_active() will maintain the
++	 * concurrency level. Don't jump the line.
++	 *
++	 * We need to ignore the pending test after max_active has increased as
++	 * pwq_dec_nr_active() can only maintain the concurrency level but not
++	 * increase it. This is indicated by @fill.
++	 */
++	if (!list_empty(&pwq->pending_node) && likely(!fill))
++		goto out;
++
++	obtained = tryinc_node_nr_active(nna);
++	if (obtained)
++		goto out;
++
++	/*
++	 * Lockless acquisition failed. Lock, add ourself to $nna->pending_pwqs
++	 * and try again. The smp_mb() is paired with the implied memory barrier
++	 * of atomic_dec_return() in pwq_dec_nr_active() to ensure that either
++	 * we see the decremented $nna->nr or they see non-empty
++	 * $nna->pending_pwqs.
++	 */
++	raw_spin_lock(&nna->lock);
++
++	if (list_empty(&pwq->pending_node))
++		list_add_tail(&pwq->pending_node, &nna->pending_pwqs);
++	else if (likely(!fill))
++		goto out_unlock;
++
++	smp_mb();
++
++	obtained = tryinc_node_nr_active(nna);
+ 
+-	if (obtained) {
++	/*
++	 * If @fill, @pwq might have already been pending. Being spuriously
++	 * pending in cold paths doesn't affect anything. Let's leave it be.
++	 */
++	if (obtained && likely(!fill))
++		list_del_init(&pwq->pending_node);
++
++out_unlock:
++	raw_spin_unlock(&nna->lock);
++out:
++	if (obtained)
+ 		pwq->nr_active++;
+-		if (nna)
+-			atomic_inc(&nna->nr);
+-	}
+ 	return obtained;
+ }
+ 
+ /**
+  * pwq_activate_first_inactive - Activate the first inactive work item on a pwq
+  * @pwq: pool_workqueue of interest
++ * @fill: max_active may have increased, try to increase concurrency level
+  *
+  * Activate the first inactive work item of @pwq if available and allowed by
+  * max_active limit.
+@@ -1590,13 +1724,13 @@ static bool pwq_tryinc_nr_active(struct pool_workqueue *pwq)
+  * Returns %true if an inactive work item has been activated. %false if no
+  * inactive work item is found or max_active limit is reached.
+  */
+-static bool pwq_activate_first_inactive(struct pool_workqueue *pwq)
++static bool pwq_activate_first_inactive(struct pool_workqueue *pwq, bool fill)
+ {
+ 	struct work_struct *work =
+ 		list_first_entry_or_null(&pwq->inactive_works,
+ 					 struct work_struct, entry);
+ 
+-	if (work && pwq_tryinc_nr_active(pwq)) {
++	if (work && pwq_tryinc_nr_active(pwq, fill)) {
+ 		__pwq_activate_work(pwq, work);
+ 		return true;
+ 	} else {
+@@ -1604,11 +1738,93 @@ static bool pwq_activate_first_inactive(struct pool_workqueue *pwq)
+ 	}
+ }
+ 
++/**
++ * node_activate_pending_pwq - Activate a pending pwq on a wq_node_nr_active
++ * @nna: wq_node_nr_active to activate a pending pwq for
++ * @caller_pool: worker_pool the caller is locking
++ *
++ * Activate a pwq in @nna->pending_pwqs. Called with @caller_pool locked.
++ * @caller_pool may be unlocked and relocked to lock other worker_pools.
++ */
++static void node_activate_pending_pwq(struct wq_node_nr_active *nna,
++				      struct worker_pool *caller_pool)
++{
++	struct worker_pool *locked_pool = caller_pool;
++	struct pool_workqueue *pwq;
++	struct work_struct *work;
++
++	lockdep_assert_held(&caller_pool->lock);
++
++	raw_spin_lock(&nna->lock);
++retry:
++	pwq = list_first_entry_or_null(&nna->pending_pwqs,
++				       struct pool_workqueue, pending_node);
++	if (!pwq)
++		goto out_unlock;
++
++	/*
++	 * If @pwq is for a different pool than @locked_pool, we need to lock
++	 * @pwq->pool->lock. Let's trylock first. If unsuccessful, do the unlock
++	 * / lock dance. For that, we also need to release @nna->lock as it's
++	 * nested inside pool locks.
++	 */
++	if (pwq->pool != locked_pool) {
++		raw_spin_unlock(&locked_pool->lock);
++		locked_pool = pwq->pool;
++		if (!raw_spin_trylock(&locked_pool->lock)) {
++			raw_spin_unlock(&nna->lock);
++			raw_spin_lock(&locked_pool->lock);
++			raw_spin_lock(&nna->lock);
++			goto retry;
++		}
++	}
++
++	/*
++	 * $pwq may not have any inactive work items due to e.g. cancellations.
++	 * Drop it from pending_pwqs and see if there's another one.
++	 */
++	work = list_first_entry_or_null(&pwq->inactive_works,
++					struct work_struct, entry);
++	if (!work) {
++		list_del_init(&pwq->pending_node);
++		goto retry;
++	}
++
++	/*
++	 * Acquire an nr_active count and activate the inactive work item. If
++	 * $pwq still has inactive work items, rotate it to the end of the
++	 * pending_pwqs so that we round-robin through them. This means that
++	 * inactive work items are not activated in queueing order which is fine
++	 * given that there has never been any ordering across different pwqs.
++	 */
++	if (likely(tryinc_node_nr_active(nna))) {
++		pwq->nr_active++;
++		__pwq_activate_work(pwq, work);
++
++		if (list_empty(&pwq->inactive_works))
++			list_del_init(&pwq->pending_node);
++		else
++			list_move_tail(&pwq->pending_node, &nna->pending_pwqs);
++
++		/* if activating a foreign pool, make sure it's running */
++		if (pwq->pool != caller_pool)
++			kick_pool(pwq->pool);
++	}
++
++out_unlock:
++	raw_spin_unlock(&nna->lock);
++	if (locked_pool != caller_pool) {
++		raw_spin_unlock(&locked_pool->lock);
++		raw_spin_lock(&caller_pool->lock);
++	}
++}
++
+ /**
+  * pwq_dec_nr_active - Retire an active count
+  * @pwq: pool_workqueue of interest
+  *
+  * Decrement @pwq's nr_active and try to activate the first inactive work item.
++ * For unbound workqueues, this function may temporarily drop @pwq->pool->lock.
+  */
+ static void pwq_dec_nr_active(struct pool_workqueue *pwq)
+ {
+@@ -1628,12 +1844,29 @@ static void pwq_dec_nr_active(struct pool_workqueue *pwq)
+ 	 * inactive work item on @pwq itself.
+ 	 */
+ 	if (!nna) {
+-		pwq_activate_first_inactive(pwq);
++		pwq_activate_first_inactive(pwq, false);
+ 		return;
+ 	}
+ 
+-	atomic_dec(&nna->nr);
+-	pwq_activate_first_inactive(pwq);
++	/*
++	 * If @pwq is for an unbound workqueue, it's more complicated because
++	 * multiple pwqs and pools may be sharing the nr_active count. When a
++	 * pwq needs to wait for an nr_active count, it puts itself on
++	 * $nna->pending_pwqs. The following atomic_dec_return()'s implied
++	 * memory barrier is paired with smp_mb() in pwq_tryinc_nr_active() to
++	 * guarantee that either we see non-empty pending_pwqs or they see
++	 * decremented $nna->nr.
++	 *
++	 * $nna->max may change as CPUs come online/offline and @pwq->wq's
++	 * max_active gets updated. However, it is guaranteed to be equal to or
++	 * larger than @pwq->wq->min_active which is above zero unless freezing.
++	 * This maintains the forward progress guarantee.
++	 */
++	if (atomic_dec_return(&nna->nr) >= READ_ONCE(nna->max))
++		return;
++
++	if (!list_empty(&nna->pending_pwqs))
++		node_activate_pending_pwq(nna, pool);
+ }
+ 
+ /**
+@@ -1954,7 +2187,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ 	 * @work must also queue behind existing inactive work items to maintain
+ 	 * ordering when max_active changes. See wq_adjust_max_active().
+ 	 */
+-	if (list_empty(&pwq->inactive_works) && pwq_tryinc_nr_active(pwq)) {
++	if (list_empty(&pwq->inactive_works) && pwq_tryinc_nr_active(pwq, false)) {
+ 		if (list_empty(&pool->worklist))
+ 			pool->watchdog_ts = jiffies;
+ 
+@@ -3187,7 +3420,7 @@ static void insert_wq_barrier(struct pool_workqueue *pwq,
+ 
+ 	barr->task = current;
+ 
+-	/* The barrier work item does not participate in pwq->nr_active. */
++	/* The barrier work item does not participate in nr_active. */
+ 	work_flags |= WORK_STRUCT_INACTIVE;
+ 
+ 	/*
+@@ -4103,6 +4336,8 @@ static void free_node_nr_active(struct wq_node_nr_active **nna_ar)
+ static void init_node_nr_active(struct wq_node_nr_active *nna)
+ {
+ 	atomic_set(&nna->nr, 0);
++	raw_spin_lock_init(&nna->lock);
++	INIT_LIST_HEAD(&nna->pending_pwqs);
+ }
+ 
+ /*
+@@ -4342,6 +4577,15 @@ static void pwq_release_workfn(struct kthread_work *work)
+ 		mutex_unlock(&wq_pool_mutex);
+ 	}
+ 
++	if (!list_empty(&pwq->pending_node)) {
++		struct wq_node_nr_active *nna =
++			wq_node_nr_active(pwq->wq, pwq->pool->node);
++
++		raw_spin_lock_irq(&nna->lock);
++		list_del_init(&pwq->pending_node);
++		raw_spin_unlock_irq(&nna->lock);
++	}
++
+ 	call_rcu(&pwq->rcu, rcu_free_pwq);
+ 
+ 	/*
+@@ -4367,6 +4611,7 @@ static void init_pwq(struct pool_workqueue *pwq, struct workqueue_struct *wq,
+ 	pwq->flush_color = -1;
+ 	pwq->refcnt = 1;
+ 	INIT_LIST_HEAD(&pwq->inactive_works);
++	INIT_LIST_HEAD(&pwq->pending_node);
+ 	INIT_LIST_HEAD(&pwq->pwqs_node);
+ 	INIT_LIST_HEAD(&pwq->mayday_node);
+ 	kthread_init_work(&pwq->release_work, pwq_release_workfn);
+@@ -4574,6 +4819,9 @@ static void apply_wqattrs_commit(struct apply_wqattrs_ctx *ctx)
+ 							ctx->pwq_tbl[cpu]);
+ 	ctx->dfl_pwq = install_unbound_pwq(ctx->wq, -1, ctx->dfl_pwq);
+ 
++	/* update node_nr_active->max */
++	wq_update_node_max_active(ctx->wq, -1);
++
+ 	mutex_unlock(&ctx->wq->mutex);
+ }
+ 
+@@ -4834,24 +5082,35 @@ static int init_rescuer(struct workqueue_struct *wq)
+ static void wq_adjust_max_active(struct workqueue_struct *wq)
+ {
+ 	bool activated;
++	int new_max, new_min;
+ 
+ 	lockdep_assert_held(&wq->mutex);
+ 
+ 	if ((wq->flags & WQ_FREEZABLE) && workqueue_freezing) {
+-		WRITE_ONCE(wq->max_active, 0);
+-		return;
++		new_max = 0;
++		new_min = 0;
++	} else {
++		new_max = wq->saved_max_active;
++		new_min = wq->saved_min_active;
+ 	}
+ 
+-	if (wq->max_active == wq->saved_max_active)
++	if (wq->max_active == new_max && wq->min_active == new_min)
+ 		return;
+ 
+ 	/*
+-	 * Update @wq->max_active and then kick inactive work items if more
++	 * Update @wq->max/min_active and then kick inactive work items if more
+ 	 * active work items are allowed. This doesn't break work item ordering
+ 	 * because new work items are always queued behind existing inactive
+ 	 * work items if there are any.
+ 	 */
+-	WRITE_ONCE(wq->max_active, wq->saved_max_active);
++	WRITE_ONCE(wq->max_active, new_max);
++	WRITE_ONCE(wq->min_active, new_min);
++
++	if (wq->flags & WQ_UNBOUND)
++		wq_update_node_max_active(wq, -1);
++
++	if (new_max == 0)
++		return;
+ 
+ 	/*
+ 	 * Round-robin through pwq's activating the first inactive work item
+@@ -4866,7 +5125,7 @@ static void wq_adjust_max_active(struct workqueue_struct *wq)
+ 
+ 			/* can be called during early boot w/ irq disabled */
+ 			raw_spin_lock_irqsave(&pwq->pool->lock, flags);
+-			if (pwq_activate_first_inactive(pwq)) {
++			if (pwq_activate_first_inactive(pwq, true)) {
+ 				activated = true;
+ 				kick_pool(pwq->pool);
+ 			}
+@@ -4928,7 +5187,9 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 	/* init wq */
+ 	wq->flags = flags;
+ 	wq->max_active = max_active;
+-	wq->saved_max_active = max_active;
++	wq->min_active = min(max_active, WQ_DFL_MIN_ACTIVE);
++	wq->saved_max_active = wq->max_active;
++	wq->saved_min_active = wq->min_active;
+ 	mutex_init(&wq->mutex);
+ 	atomic_set(&wq->nr_pwqs_to_flush, 0);
+ 	INIT_LIST_HEAD(&wq->pwqs);
+@@ -5094,7 +5355,8 @@ EXPORT_SYMBOL_GPL(destroy_workqueue);
+  * @wq: target workqueue
+  * @max_active: new max_active value.
+  *
+- * Set max_active of @wq to @max_active.
++ * Set max_active of @wq to @max_active. See the alloc_workqueue() function
++ * comment.
+  *
+  * CONTEXT:
+  * Don't call from IRQ context.
+@@ -5111,6 +5373,9 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
+ 
+ 	wq->flags &= ~__WQ_ORDERED;
+ 	wq->saved_max_active = max_active;
++	if (wq->flags & WQ_UNBOUND)
++		wq->saved_min_active = min(wq->saved_min_active, max_active);
++
+ 	wq_adjust_max_active(wq);
+ 
+ 	mutex_unlock(&wq->mutex);
+@@ -5792,6 +6057,10 @@ int workqueue_online_cpu(unsigned int cpu)
+ 
+ 			for_each_cpu(tcpu, pt->pod_cpus[pt->cpu_pod[cpu]])
+ 				wq_update_pod(wq, tcpu, cpu, true);
++
++			mutex_lock(&wq->mutex);
++			wq_update_node_max_active(wq, -1);
++			mutex_unlock(&wq->mutex);
+ 		}
+ 	}
+ 
+@@ -5820,6 +6089,10 @@ int workqueue_offline_cpu(unsigned int cpu)
+ 
+ 			for_each_cpu(tcpu, pt->pod_cpus[pt->cpu_pod[cpu]])
+ 				wq_update_pod(wq, tcpu, cpu, false);
++
++			mutex_lock(&wq->mutex);
++			wq_update_node_max_active(wq, cpu);
++			mutex_unlock(&wq->mutex);
+ 		}
+ 	}
+ 	mutex_unlock(&wq_pool_mutex);
+@@ -7100,8 +7373,12 @@ void __init workqueue_init_topology(void)
+ 	 * combinations to apply per-pod sharing.
+ 	 */
+ 	list_for_each_entry(wq, &workqueues, list) {
+-		for_each_online_cpu(cpu) {
++		for_each_online_cpu(cpu)
+ 			wq_update_pod(wq, cpu, cpu, true);
++		if (wq->flags & WQ_UNBOUND) {
++			mutex_lock(&wq->mutex);
++			wq_update_node_max_active(wq, -1);
++			mutex_unlock(&wq->mutex);
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-introduce-struct-wq_node_nr_active.patch b/queue-6.8/workqueue-introduce-struct-wq_node_nr_active.patch
new file mode 100644
index 00000000000..1a0051997da
--- /dev/null
+++ b/queue-6.8/workqueue-introduce-struct-wq_node_nr_active.patch
@@ -0,0 +1,306 @@
+From 057f9b770db605f533275c31f81db6a7bc939197 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:24 -1000
+Subject: workqueue: Introduce struct wq_node_nr_active
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit 91ccc6e7233bb10a9c176aa4cc70d6f432a441a5 ]
+
+Currently, for both percpu and unbound workqueues, max_active applies
+per-cpu, which is a recent change for unbound workqueues. The change for
+unbound workqueues was a significant departure from the previous behavior of
+per-node application. It made some use cases create undesirable number of
+concurrent work items and left no good way of fixing them. To address the
+problem, workqueue is implementing a NUMA node segmented global nr_active
+mechanism, which will be explained further in the next patch.
+
+As a preparation, this patch introduces struct wq_node_nr_active. It's a
+data structured allocated for each workqueue and NUMA node pair and
+currently only tracks the workqueue's number of active work items on the
+node. This is split out from the next patch to make it easier to understand
+and review.
+
+Note that there is an extra wq_node_nr_active allocated for the invalid node
+nr_node_ids which is used to track nr_active for pools which don't have NUMA
+node associated such as the default fallback system-wide pool.
+
+This doesn't cause any behavior changes visible to userland yet. The next
+patch will expand to implement the control mechanism on top.
+
+v4: - Fixed out-of-bound access when freeing per-cpu workqueues.
+
+v3: - Use flexible array for wq->node_nr_active as suggested by Lai.
+
+v2: - wq->max_active now uses WRITE/READ_ONCE() as suggested by Lai.
+
+    - Lai pointed out that pwq_tryinc_nr_active() incorrectly dropped
+      pwq->max_active check. Restored. As the next patch replaces the
+      max_active enforcement mechanism, this doesn't change the end result.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 142 ++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 135 insertions(+), 7 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 5cfc04dd05ad6..686899845475f 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -280,6 +280,16 @@ struct wq_flusher {
+ 
+ struct wq_device;
+ 
++/*
++ * Unlike in a per-cpu workqueue where max_active limits its concurrency level
++ * on each CPU, in an unbound workqueue, max_active applies to the whole system.
++ * As sharing a single nr_active across multiple sockets can be very expensive,
++ * the counting and enforcement is per NUMA node.
++ */
++struct wq_node_nr_active {
++	atomic_t		nr;		/* per-node nr_active count */
++};
++
+ /*
+  * The externally visible workqueue.  It relays the issued work items to
+  * the appropriate worker_pool through its pool_workqueues.
+@@ -326,6 +336,7 @@ struct workqueue_struct {
+ 	/* hot fields used during command issue, aligned to cacheline */
+ 	unsigned int		flags ____cacheline_aligned; /* WQ: WQ_* flags */
+ 	struct pool_workqueue __percpu __rcu **cpu_pwq; /* I: per-cpu pwqs */
++	struct wq_node_nr_active *node_nr_active[]; /* I: per-node nr_active */
+ };
+ 
+ static struct kmem_cache *pwq_cache;
+@@ -1421,6 +1432,31 @@ work_func_t wq_worker_last_func(struct task_struct *task)
+ 	return worker->last_func;
+ }
+ 
++/**
++ * wq_node_nr_active - Determine wq_node_nr_active to use
++ * @wq: workqueue of interest
++ * @node: NUMA node, can be %NUMA_NO_NODE
++ *
++ * Determine wq_node_nr_active to use for @wq on @node. Returns:
++ *
++ * - %NULL for per-cpu workqueues as they don't need to use shared nr_active.
++ *
++ * - node_nr_active[nr_node_ids] if @node is %NUMA_NO_NODE.
++ *
++ * - Otherwise, node_nr_active[@node].
++ */
++static struct wq_node_nr_active *wq_node_nr_active(struct workqueue_struct *wq,
++						   int node)
++{
++	if (!(wq->flags & WQ_UNBOUND))
++		return NULL;
++
++	if (node == NUMA_NO_NODE)
++		node = nr_node_ids;
++
++	return wq->node_nr_active[node];
++}
++
+ /**
+  * get_pwq - get an extra reference on the specified pool_workqueue
+  * @pwq: pool_workqueue to get
+@@ -1502,12 +1538,17 @@ static bool pwq_activate_work(struct pool_workqueue *pwq,
+ 			      struct work_struct *work)
+ {
+ 	struct worker_pool *pool = pwq->pool;
++	struct wq_node_nr_active *nna;
+ 
+ 	lockdep_assert_held(&pool->lock);
+ 
+ 	if (!(*work_data_bits(work) & WORK_STRUCT_INACTIVE))
+ 		return false;
+ 
++	nna = wq_node_nr_active(pwq->wq, pool->node);
++	if (nna)
++		atomic_inc(&nna->nr);
++
+ 	pwq->nr_active++;
+ 	__pwq_activate_work(pwq, work);
+ 	return true;
+@@ -1524,14 +1565,18 @@ static bool pwq_tryinc_nr_active(struct pool_workqueue *pwq)
+ {
+ 	struct workqueue_struct *wq = pwq->wq;
+ 	struct worker_pool *pool = pwq->pool;
++	struct wq_node_nr_active *nna = wq_node_nr_active(wq, pool->node);
+ 	bool obtained;
+ 
+ 	lockdep_assert_held(&pool->lock);
+ 
+ 	obtained = pwq->nr_active < READ_ONCE(wq->max_active);
+ 
+-	if (obtained)
++	if (obtained) {
+ 		pwq->nr_active++;
++		if (nna)
++			atomic_inc(&nna->nr);
++	}
+ 	return obtained;
+ }
+ 
+@@ -1568,10 +1613,26 @@ static bool pwq_activate_first_inactive(struct pool_workqueue *pwq)
+ static void pwq_dec_nr_active(struct pool_workqueue *pwq)
+ {
+ 	struct worker_pool *pool = pwq->pool;
++	struct wq_node_nr_active *nna = wq_node_nr_active(pwq->wq, pool->node);
+ 
+ 	lockdep_assert_held(&pool->lock);
+ 
++	/*
++	 * @pwq->nr_active should be decremented for both percpu and unbound
++	 * workqueues.
++	 */
+ 	pwq->nr_active--;
++
++	/*
++	 * For a percpu workqueue, it's simple. Just need to kick the first
++	 * inactive work item on @pwq itself.
++	 */
++	if (!nna) {
++		pwq_activate_first_inactive(pwq);
++		return;
++	}
++
++	atomic_dec(&nna->nr);
+ 	pwq_activate_first_inactive(pwq);
+ }
+ 
+@@ -4026,11 +4087,63 @@ static void wq_free_lockdep(struct workqueue_struct *wq)
+ }
+ #endif
+ 
++static void free_node_nr_active(struct wq_node_nr_active **nna_ar)
++{
++	int node;
++
++	for_each_node(node) {
++		kfree(nna_ar[node]);
++		nna_ar[node] = NULL;
++	}
++
++	kfree(nna_ar[nr_node_ids]);
++	nna_ar[nr_node_ids] = NULL;
++}
++
++static void init_node_nr_active(struct wq_node_nr_active *nna)
++{
++	atomic_set(&nna->nr, 0);
++}
++
++/*
++ * Each node's nr_active counter will be accessed mostly from its own node and
++ * should be allocated in the node.
++ */
++static int alloc_node_nr_active(struct wq_node_nr_active **nna_ar)
++{
++	struct wq_node_nr_active *nna;
++	int node;
++
++	for_each_node(node) {
++		nna = kzalloc_node(sizeof(*nna), GFP_KERNEL, node);
++		if (!nna)
++			goto err_free;
++		init_node_nr_active(nna);
++		nna_ar[node] = nna;
++	}
++
++	/* [nr_node_ids] is used as the fallback */
++	nna = kzalloc_node(sizeof(*nna), GFP_KERNEL, NUMA_NO_NODE);
++	if (!nna)
++		goto err_free;
++	init_node_nr_active(nna);
++	nna_ar[nr_node_ids] = nna;
++
++	return 0;
++
++err_free:
++	free_node_nr_active(nna_ar);
++	return -ENOMEM;
++}
++
+ static void rcu_free_wq(struct rcu_head *rcu)
+ {
+ 	struct workqueue_struct *wq =
+ 		container_of(rcu, struct workqueue_struct, rcu);
+ 
++	if (wq->flags & WQ_UNBOUND)
++		free_node_nr_active(wq->node_nr_active);
++
+ 	wq_free_lockdep(wq);
+ 	free_percpu(wq->cpu_pwq);
+ 	free_workqueue_attrs(wq->unbound_attrs);
+@@ -4769,7 +4882,8 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ {
+ 	va_list args;
+ 	struct workqueue_struct *wq;
+-	int len;
++	size_t wq_size;
++	int name_len;
+ 
+ 	/*
+ 	 * Unbound && max_active == 1 used to imply ordered, which is no longer
+@@ -4785,7 +4899,12 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 		flags |= WQ_UNBOUND;
+ 
+ 	/* allocate wq and format name */
+-	wq = kzalloc(sizeof(*wq), GFP_KERNEL);
++	if (flags & WQ_UNBOUND)
++		wq_size = struct_size(wq, node_nr_active, nr_node_ids + 1);
++	else
++		wq_size = sizeof(*wq);
++
++	wq = kzalloc(wq_size, GFP_KERNEL);
+ 	if (!wq)
+ 		return NULL;
+ 
+@@ -4796,11 +4915,12 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 	}
+ 
+ 	va_start(args, max_active);
+-	len = vsnprintf(wq->name, sizeof(wq->name), fmt, args);
++	name_len = vsnprintf(wq->name, sizeof(wq->name), fmt, args);
+ 	va_end(args);
+ 
+-	if (len >= WQ_NAME_LEN)
+-		pr_warn_once("workqueue: name exceeds WQ_NAME_LEN. Truncating to: %s\n", wq->name);
++	if (name_len >= WQ_NAME_LEN)
++		pr_warn_once("workqueue: name exceeds WQ_NAME_LEN. Truncating to: %s\n",
++			     wq->name);
+ 
+ 	max_active = max_active ?: WQ_DFL_ACTIVE;
+ 	max_active = wq_clamp_max_active(max_active, flags, wq->name);
+@@ -4819,8 +4939,13 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 	wq_init_lockdep(wq);
+ 	INIT_LIST_HEAD(&wq->list);
+ 
++	if (flags & WQ_UNBOUND) {
++		if (alloc_node_nr_active(wq->node_nr_active) < 0)
++			goto err_unreg_lockdep;
++	}
++
+ 	if (alloc_and_link_pwqs(wq) < 0)
+-		goto err_unreg_lockdep;
++		goto err_free_node_nr_active;
+ 
+ 	if (wq_online && init_rescuer(wq) < 0)
+ 		goto err_destroy;
+@@ -4845,6 +4970,9 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 
+ 	return wq;
+ 
++err_free_node_nr_active:
++	if (wq->flags & WQ_UNBOUND)
++		free_node_nr_active(wq->node_nr_active);
+ err_unreg_lockdep:
+ 	wq_unregister_lockdep(wq);
+ 	wq_free_lockdep(wq);
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-make-wq_adjust_max_active-round-robin-pwqs.patch b/queue-6.8/workqueue-make-wq_adjust_max_active-round-robin-pwqs.patch
new file mode 100644
index 00000000000..32eb498c776
--- /dev/null
+++ b/queue-6.8/workqueue-make-wq_adjust_max_active-round-robin-pwqs.patch
@@ -0,0 +1,82 @@
+From 4438a19b7f5e3b95df3793fd71d7e60aa65f45da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:24 -1000
+Subject: workqueue: Make wq_adjust_max_active() round-robin pwqs while
+ activating
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit c5404d4e6df6faba1007544b5f4e62c7c14416dd ]
+
+wq_adjust_max_active() needs to activate work items after max_active is
+increased. Previously, it did that by visiting each pwq once activating all
+that could be activated. While this makes sense with per-pwq nr_active,
+nr_active will be shared across multiple pwqs for unbound wqs. Then, we'd
+want to round-robin through pwqs to be fairer.
+
+In preparation, this patch makes wq_adjust_max_active() round-robin pwqs
+while activating. While the activation ordering changes, this shouldn't
+cause user-noticeable behavior changes.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 80733046ee012..1659cd4a36c62 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -4703,7 +4703,7 @@ static int init_rescuer(struct workqueue_struct *wq)
+  */
+ static void wq_adjust_max_active(struct workqueue_struct *wq)
+ {
+-	struct pool_workqueue *pwq;
++	bool activated;
+ 
+ 	lockdep_assert_held(&wq->mutex);
+ 
+@@ -4723,19 +4723,26 @@ static void wq_adjust_max_active(struct workqueue_struct *wq)
+ 	 */
+ 	WRITE_ONCE(wq->max_active, wq->saved_max_active);
+ 
+-	for_each_pwq(pwq, wq) {
+-		unsigned long flags;
+-
+-		/* this function can be called during early boot w/ irq disabled */
+-		raw_spin_lock_irqsave(&pwq->pool->lock, flags);
+-
+-		while (pwq_activate_first_inactive(pwq))
+-			;
++	/*
++	 * Round-robin through pwq's activating the first inactive work item
++	 * until max_active is filled.
++	 */
++	do {
++		struct pool_workqueue *pwq;
+ 
+-		kick_pool(pwq->pool);
++		activated = false;
++		for_each_pwq(pwq, wq) {
++			unsigned long flags;
+ 
+-		raw_spin_unlock_irqrestore(&pwq->pool->lock, flags);
+-	}
++			/* can be called during early boot w/ irq disabled */
++			raw_spin_lock_irqsave(&pwq->pool->lock, flags);
++			if (pwq_activate_first_inactive(pwq)) {
++				activated = true;
++				kick_pool(pwq->pool);
++			}
++			raw_spin_unlock_irqrestore(&pwq->pool->lock, flags);
++		}
++	} while (activated);
+ }
+ 
+ __printf(1, 4)
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-move-nr_active-handling-into-helpers.patch b/queue-6.8/workqueue-move-nr_active-handling-into-helpers.patch
new file mode 100644
index 00000000000..5b5f446d103
--- /dev/null
+++ b/queue-6.8/workqueue-move-nr_active-handling-into-helpers.patch
@@ -0,0 +1,183 @@
+From 16711ba07f2c914bb1a7da525ac6d526cad8fbf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:24 -1000
+Subject: workqueue: Move nr_active handling into helpers
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit 1c270b79ce0b8290f146255ea9057243f6dd3c17 ]
+
+__queue_work(), pwq_dec_nr_in_flight() and wq_adjust_max_active() were
+open-coding nr_active handling, which is fine given that the operations are
+trivial. However, the planned unbound nr_active update will make them more
+complicated, so let's move them into helpers.
+
+- pwq_tryinc_nr_active() is added. It increments nr_active if under
+  max_active limit and return a boolean indicating whether inc was
+  successful. Note that the function is structured to accommodate future
+  changes. __queue_work() is updated to use the new helper.
+
+- pwq_activate_first_inactive() is updated to use pwq_tryinc_nr_active() and
+  thus no longer assumes that nr_active is under max_active and returns a
+  boolean to indicate whether a work item has been activated.
+
+- wq_adjust_max_active() no longer tests directly whether a work item can be
+  activated. Instead, it's updated to use the return value of
+  pwq_activate_first_inactive() to tell whether a work item has been
+  activated.
+
+- nr_active decrement and activating the first inactive work item is
+  factored into pwq_dec_nr_active().
+
+v3: - WARN_ON_ONCE(!WORK_STRUCT_INACTIVE) added to __pwq_activate_work() as
+      now we're calling the function unconditionally from
+      pwq_activate_first_inactive().
+
+v2: - wq->max_active now uses WRITE/READ_ONCE() as suggested by Lai.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 86 ++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 67 insertions(+), 19 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 7e1b0238158ea..80733046ee012 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1464,11 +1464,14 @@ static bool pwq_is_empty(struct pool_workqueue *pwq)
+ static void __pwq_activate_work(struct pool_workqueue *pwq,
+ 				struct work_struct *work)
+ {
++	unsigned long *wdb = work_data_bits(work);
++
++	WARN_ON_ONCE(!(*wdb & WORK_STRUCT_INACTIVE));
+ 	trace_workqueue_activate_work(work);
+ 	if (list_empty(&pwq->pool->worklist))
+ 		pwq->pool->watchdog_ts = jiffies;
+ 	move_linked_works(work, &pwq->pool->worklist, NULL);
+-	__clear_bit(WORK_STRUCT_INACTIVE_BIT, work_data_bits(work));
++	__clear_bit(WORK_STRUCT_INACTIVE_BIT, wdb);
+ }
+ 
+ /**
+@@ -1493,12 +1496,66 @@ static bool pwq_activate_work(struct pool_workqueue *pwq,
+ 	return true;
+ }
+ 
+-static void pwq_activate_first_inactive(struct pool_workqueue *pwq)
++/**
++ * pwq_tryinc_nr_active - Try to increment nr_active for a pwq
++ * @pwq: pool_workqueue of interest
++ *
++ * Try to increment nr_active for @pwq. Returns %true if an nr_active count is
++ * successfully obtained. %false otherwise.
++ */
++static bool pwq_tryinc_nr_active(struct pool_workqueue *pwq)
++{
++	struct workqueue_struct *wq = pwq->wq;
++	struct worker_pool *pool = pwq->pool;
++	bool obtained;
++
++	lockdep_assert_held(&pool->lock);
++
++	obtained = pwq->nr_active < READ_ONCE(wq->max_active);
++
++	if (obtained)
++		pwq->nr_active++;
++	return obtained;
++}
++
++/**
++ * pwq_activate_first_inactive - Activate the first inactive work item on a pwq
++ * @pwq: pool_workqueue of interest
++ *
++ * Activate the first inactive work item of @pwq if available and allowed by
++ * max_active limit.
++ *
++ * Returns %true if an inactive work item has been activated. %false if no
++ * inactive work item is found or max_active limit is reached.
++ */
++static bool pwq_activate_first_inactive(struct pool_workqueue *pwq)
++{
++	struct work_struct *work =
++		list_first_entry_or_null(&pwq->inactive_works,
++					 struct work_struct, entry);
++
++	if (work && pwq_tryinc_nr_active(pwq)) {
++		__pwq_activate_work(pwq, work);
++		return true;
++	} else {
++		return false;
++	}
++}
++
++/**
++ * pwq_dec_nr_active - Retire an active count
++ * @pwq: pool_workqueue of interest
++ *
++ * Decrement @pwq's nr_active and try to activate the first inactive work item.
++ */
++static void pwq_dec_nr_active(struct pool_workqueue *pwq)
+ {
+-	struct work_struct *work = list_first_entry(&pwq->inactive_works,
+-						    struct work_struct, entry);
++	struct worker_pool *pool = pwq->pool;
+ 
+-	pwq_activate_work(pwq, work);
++	lockdep_assert_held(&pool->lock);
++
++	pwq->nr_active--;
++	pwq_activate_first_inactive(pwq);
+ }
+ 
+ /**
+@@ -1516,14 +1573,8 @@ static void pwq_dec_nr_in_flight(struct pool_workqueue *pwq, unsigned long work_
+ {
+ 	int color = get_work_color(work_data);
+ 
+-	if (!(work_data & WORK_STRUCT_INACTIVE)) {
+-		pwq->nr_active--;
+-		if (!list_empty(&pwq->inactive_works)) {
+-			/* one down, submit an inactive one */
+-			if (pwq->nr_active < READ_ONCE(pwq->wq->max_active))
+-				pwq_activate_first_inactive(pwq);
+-		}
+-	}
++	if (!(work_data & WORK_STRUCT_INACTIVE))
++		pwq_dec_nr_active(pwq);
+ 
+ 	pwq->nr_in_flight[color]--;
+ 
+@@ -1825,13 +1876,11 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ 	 * @work must also queue behind existing inactive work items to maintain
+ 	 * ordering when max_active changes. See wq_adjust_max_active().
+ 	 */
+-	if (list_empty(&pwq->inactive_works) &&
+-	    pwq->nr_active < READ_ONCE(pwq->wq->max_active)) {
++	if (list_empty(&pwq->inactive_works) && pwq_tryinc_nr_active(pwq)) {
+ 		if (list_empty(&pool->worklist))
+ 			pool->watchdog_ts = jiffies;
+ 
+ 		trace_workqueue_activate_work(work);
+-		pwq->nr_active++;
+ 		insert_work(pwq, work, &pool->worklist, work_flags);
+ 		kick_pool(pool);
+ 	} else {
+@@ -4680,9 +4729,8 @@ static void wq_adjust_max_active(struct workqueue_struct *wq)
+ 		/* this function can be called during early boot w/ irq disabled */
+ 		raw_spin_lock_irqsave(&pwq->pool->lock, flags);
+ 
+-		while (!list_empty(&pwq->inactive_works) &&
+-		       pwq->nr_active < wq->max_active)
+-			pwq_activate_first_inactive(pwq);
++		while (pwq_activate_first_inactive(pwq))
++			;
+ 
+ 		kick_pool(pwq->pool);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-move-pwq-max_active-to-wq-max_active.patch b/queue-6.8/workqueue-move-pwq-max_active-to-wq-max_active.patch
new file mode 100644
index 00000000000..9cd5e4b16e6
--- /dev/null
+++ b/queue-6.8/workqueue-move-pwq-max_active-to-wq-max_active.patch
@@ -0,0 +1,299 @@
+From eae71cbda38106ad318c0369a32922b5f20b9f43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:24 -1000
+Subject: workqueue: Move pwq->max_active to wq->max_active
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit a045a272d887575da17ad86d6573e82871b50c27 ]
+
+max_active is a workqueue-wide setting and the configured value is stored in
+wq->saved_max_active; however, the effective value was stored in
+pwq->max_active. While this is harmless, it makes max_active update process
+more complicated and gets in the way of the planned max_active semantic
+updates for unbound workqueues.
+
+This patches moves pwq->max_active to wq->max_active. This simplifies the
+code and makes freezing and noop max_active updates cheaper too. No
+user-visible behavior change is intended.
+
+As wq->max_active is updated while holding wq mutex but read without any
+locking, it now uses WRITE/READ_ONCE(). A new locking locking rule WO is
+added for it.
+
+v2: wq->max_active now uses WRITE/READ_ONCE() as suggested by Lai.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 133 ++++++++++++++++++++++-----------------------
+ 1 file changed, 66 insertions(+), 67 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 8a06fddb23e66..8ee754dd319da 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -143,6 +143,9 @@ enum {
+  *
+  * WR: wq->mutex protected for writes.  RCU protected for reads.
+  *
++ * WO: wq->mutex protected for writes. Updated with WRITE_ONCE() and can be read
++ *     with READ_ONCE() without locking.
++ *
+  * MD: wq_mayday_lock protected.
+  *
+  * WD: Used internally by the watchdog.
+@@ -250,7 +253,6 @@ struct pool_workqueue {
+ 	 * is marked with WORK_STRUCT_INACTIVE iff it is in pwq->inactive_works.
+ 	 */
+ 	int			nr_active;	/* L: nr of active works */
+-	int			max_active;	/* L: max active works */
+ 	struct list_head	inactive_works;	/* L: inactive works */
+ 	struct list_head	pwqs_node;	/* WR: node on wq->pwqs */
+ 	struct list_head	mayday_node;	/* MD: node on wq->maydays */
+@@ -298,7 +300,8 @@ struct workqueue_struct {
+ 	struct worker		*rescuer;	/* MD: rescue worker */
+ 
+ 	int			nr_drainers;	/* WQ: drain in progress */
+-	int			saved_max_active; /* WQ: saved pwq max_active */
++	int			max_active;	/* WO: max active works */
++	int			saved_max_active; /* WQ: saved max_active */
+ 
+ 	struct workqueue_attrs	*unbound_attrs;	/* PW: only for unbound wqs */
+ 	struct pool_workqueue	*dfl_pwq;	/* PW: only for unbound wqs */
+@@ -1492,7 +1495,7 @@ static void pwq_dec_nr_in_flight(struct pool_workqueue *pwq, unsigned long work_
+ 		pwq->nr_active--;
+ 		if (!list_empty(&pwq->inactive_works)) {
+ 			/* one down, submit an inactive one */
+-			if (pwq->nr_active < pwq->max_active)
++			if (pwq->nr_active < READ_ONCE(pwq->wq->max_active))
+ 				pwq_activate_first_inactive(pwq);
+ 		}
+ 	}
+@@ -1793,7 +1796,13 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+ 	pwq->nr_in_flight[pwq->work_color]++;
+ 	work_flags = work_color_to_flags(pwq->work_color);
+ 
+-	if (likely(pwq->nr_active < pwq->max_active)) {
++	/*
++	 * Limit the number of concurrently active work items to max_active.
++	 * @work must also queue behind existing inactive work items to maintain
++	 * ordering when max_active changes. See wq_adjust_max_active().
++	 */
++	if (list_empty(&pwq->inactive_works) &&
++	    pwq->nr_active < READ_ONCE(pwq->wq->max_active)) {
+ 		if (list_empty(&pool->worklist))
+ 			pool->watchdog_ts = jiffies;
+ 
+@@ -4142,50 +4151,6 @@ static void pwq_release_workfn(struct kthread_work *work)
+ 	}
+ }
+ 
+-/**
+- * pwq_adjust_max_active - update a pwq's max_active to the current setting
+- * @pwq: target pool_workqueue
+- *
+- * If @pwq isn't freezing, set @pwq->max_active to the associated
+- * workqueue's saved_max_active and activate inactive work items
+- * accordingly.  If @pwq is freezing, clear @pwq->max_active to zero.
+- */
+-static void pwq_adjust_max_active(struct pool_workqueue *pwq)
+-{
+-	struct workqueue_struct *wq = pwq->wq;
+-	bool freezable = wq->flags & WQ_FREEZABLE;
+-	unsigned long flags;
+-
+-	/* for @wq->saved_max_active */
+-	lockdep_assert_held(&wq->mutex);
+-
+-	/* fast exit for non-freezable wqs */
+-	if (!freezable && pwq->max_active == wq->saved_max_active)
+-		return;
+-
+-	/* this function can be called during early boot w/ irq disabled */
+-	raw_spin_lock_irqsave(&pwq->pool->lock, flags);
+-
+-	/*
+-	 * During [un]freezing, the caller is responsible for ensuring that
+-	 * this function is called at least once after @workqueue_freezing
+-	 * is updated and visible.
+-	 */
+-	if (!freezable || !workqueue_freezing) {
+-		pwq->max_active = wq->saved_max_active;
+-
+-		while (!list_empty(&pwq->inactive_works) &&
+-		       pwq->nr_active < pwq->max_active)
+-			pwq_activate_first_inactive(pwq);
+-
+-		kick_pool(pwq->pool);
+-	} else {
+-		pwq->max_active = 0;
+-	}
+-
+-	raw_spin_unlock_irqrestore(&pwq->pool->lock, flags);
+-}
+-
+ /* initialize newly allocated @pwq which is associated with @wq and @pool */
+ static void init_pwq(struct pool_workqueue *pwq, struct workqueue_struct *wq,
+ 		     struct worker_pool *pool)
+@@ -4218,9 +4183,6 @@ static void link_pwq(struct pool_workqueue *pwq)
+ 	/* set the matching work_color */
+ 	pwq->work_color = wq->work_color;
+ 
+-	/* sync max_active to the current setting */
+-	pwq_adjust_max_active(pwq);
+-
+ 	/* link in @pwq */
+ 	list_add_rcu(&pwq->pwqs_node, &wq->pwqs);
+ }
+@@ -4658,6 +4620,52 @@ static int init_rescuer(struct workqueue_struct *wq)
+ 	return 0;
+ }
+ 
++/**
++ * wq_adjust_max_active - update a wq's max_active to the current setting
++ * @wq: target workqueue
++ *
++ * If @wq isn't freezing, set @wq->max_active to the saved_max_active and
++ * activate inactive work items accordingly. If @wq is freezing, clear
++ * @wq->max_active to zero.
++ */
++static void wq_adjust_max_active(struct workqueue_struct *wq)
++{
++	struct pool_workqueue *pwq;
++
++	lockdep_assert_held(&wq->mutex);
++
++	if ((wq->flags & WQ_FREEZABLE) && workqueue_freezing) {
++		WRITE_ONCE(wq->max_active, 0);
++		return;
++	}
++
++	if (wq->max_active == wq->saved_max_active)
++		return;
++
++	/*
++	 * Update @wq->max_active and then kick inactive work items if more
++	 * active work items are allowed. This doesn't break work item ordering
++	 * because new work items are always queued behind existing inactive
++	 * work items if there are any.
++	 */
++	WRITE_ONCE(wq->max_active, wq->saved_max_active);
++
++	for_each_pwq(pwq, wq) {
++		unsigned long flags;
++
++		/* this function can be called during early boot w/ irq disabled */
++		raw_spin_lock_irqsave(&pwq->pool->lock, flags);
++
++		while (!list_empty(&pwq->inactive_works) &&
++		       pwq->nr_active < wq->max_active)
++			pwq_activate_first_inactive(pwq);
++
++		kick_pool(pwq->pool);
++
++		raw_spin_unlock_irqrestore(&pwq->pool->lock, flags);
++	}
++}
++
+ __printf(1, 4)
+ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 					 unsigned int flags,
+@@ -4665,7 +4673,6 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ {
+ 	va_list args;
+ 	struct workqueue_struct *wq;
+-	struct pool_workqueue *pwq;
+ 	int len;
+ 
+ 	/*
+@@ -4704,6 +4711,7 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 
+ 	/* init wq */
+ 	wq->flags = flags;
++	wq->max_active = max_active;
+ 	wq->saved_max_active = max_active;
+ 	mutex_init(&wq->mutex);
+ 	atomic_set(&wq->nr_pwqs_to_flush, 0);
+@@ -4732,8 +4740,7 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 	mutex_lock(&wq_pool_mutex);
+ 
+ 	mutex_lock(&wq->mutex);
+-	for_each_pwq(pwq, wq)
+-		pwq_adjust_max_active(pwq);
++	wq_adjust_max_active(wq);
+ 	mutex_unlock(&wq->mutex);
+ 
+ 	list_add_tail_rcu(&wq->list, &workqueues);
+@@ -4871,8 +4878,6 @@ EXPORT_SYMBOL_GPL(destroy_workqueue);
+  */
+ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
+ {
+-	struct pool_workqueue *pwq;
+-
+ 	/* disallow meddling with max_active for ordered workqueues */
+ 	if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT))
+ 		return;
+@@ -4883,9 +4888,7 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active)
+ 
+ 	wq->flags &= ~__WQ_ORDERED;
+ 	wq->saved_max_active = max_active;
+-
+-	for_each_pwq(pwq, wq)
+-		pwq_adjust_max_active(pwq);
++	wq_adjust_max_active(wq);
+ 
+ 	mutex_unlock(&wq->mutex);
+ }
+@@ -5132,8 +5135,8 @@ static void show_pwq(struct pool_workqueue *pwq)
+ 	pr_info("  pwq %d:", pool->id);
+ 	pr_cont_pool_info(pool);
+ 
+-	pr_cont(" active=%d/%d refcnt=%d%s\n",
+-		pwq->nr_active, pwq->max_active, pwq->refcnt,
++	pr_cont(" active=%d refcnt=%d%s\n",
++		pwq->nr_active, pwq->refcnt,
+ 		!list_empty(&pwq->mayday_node) ? " MAYDAY" : "");
+ 
+ 	hash_for_each(pool->busy_hash, bkt, worker, hentry) {
+@@ -5681,7 +5684,6 @@ EXPORT_SYMBOL_GPL(work_on_cpu_safe_key);
+ void freeze_workqueues_begin(void)
+ {
+ 	struct workqueue_struct *wq;
+-	struct pool_workqueue *pwq;
+ 
+ 	mutex_lock(&wq_pool_mutex);
+ 
+@@ -5690,8 +5692,7 @@ void freeze_workqueues_begin(void)
+ 
+ 	list_for_each_entry(wq, &workqueues, list) {
+ 		mutex_lock(&wq->mutex);
+-		for_each_pwq(pwq, wq)
+-			pwq_adjust_max_active(pwq);
++		wq_adjust_max_active(wq);
+ 		mutex_unlock(&wq->mutex);
+ 	}
+ 
+@@ -5756,7 +5757,6 @@ bool freeze_workqueues_busy(void)
+ void thaw_workqueues(void)
+ {
+ 	struct workqueue_struct *wq;
+-	struct pool_workqueue *pwq;
+ 
+ 	mutex_lock(&wq_pool_mutex);
+ 
+@@ -5768,8 +5768,7 @@ void thaw_workqueues(void)
+ 	/* restore max_active and repopulate worklist */
+ 	list_for_each_entry(wq, &workqueues, list) {
+ 		mutex_lock(&wq->mutex);
+-		for_each_pwq(pwq, wq)
+-			pwq_adjust_max_active(pwq);
++		wq_adjust_max_active(wq);
+ 		mutex_unlock(&wq->mutex);
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-rcu-protect-wq-dfl_pwq-and-implement-acces.patch b/queue-6.8/workqueue-rcu-protect-wq-dfl_pwq-and-implement-acces.patch
new file mode 100644
index 00000000000..9415c2bcbd9
--- /dev/null
+++ b/queue-6.8/workqueue-rcu-protect-wq-dfl_pwq-and-implement-acces.patch
@@ -0,0 +1,184 @@
+From 53a243df0ee0b1dc8924aef70927b30e40367953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:24 -1000
+Subject: workqueue: RCU protect wq->dfl_pwq and implement accessors for it
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit 9f66cff212bb3c1cd25996aaa0dfd0c9e9d8baab ]
+
+wq->cpu_pwq is RCU protected but wq->dfl_pwq isn't. This is okay because
+currently wq->dfl_pwq is used only accessed to install it into wq->cpu_pwq
+which doesn't require RCU access. However, we want to be able to access
+wq->dfl_pwq under RCU in the future to access its __pod_cpumask and the code
+can be made easier to read by making the two pwq fields behave in the same
+way.
+
+- Make wq->dfl_pwq RCU protected.
+
+- Add unbound_pwq_slot() and unbound_pwq() which can access both ->dfl_pwq
+  and ->cpu_pwq. The former returns the double pointer that can be used
+  access and update the pwqs. The latter performs locking check and
+  dereferences the double pointer.
+
+- pwq accesses and updates are converted to use unbound_pwq[_slot]().
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 64 +++++++++++++++++++++++++++++-----------------
+ 1 file changed, 40 insertions(+), 24 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 1659cd4a36c62..5cfc04dd05ad6 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -304,7 +304,7 @@ struct workqueue_struct {
+ 	int			saved_max_active; /* WQ: saved max_active */
+ 
+ 	struct workqueue_attrs	*unbound_attrs;	/* PW: only for unbound wqs */
+-	struct pool_workqueue	*dfl_pwq;	/* PW: only for unbound wqs */
++	struct pool_workqueue __rcu *dfl_pwq;   /* PW: only for unbound wqs */
+ 
+ #ifdef CONFIG_SYSFS
+ 	struct wq_device	*wq_dev;	/* I: for sysfs interface */
+@@ -635,6 +635,23 @@ static int worker_pool_assign_id(struct worker_pool *pool)
+ 	return ret;
+ }
+ 
++static struct pool_workqueue __rcu **
++unbound_pwq_slot(struct workqueue_struct *wq, int cpu)
++{
++       if (cpu >= 0)
++               return per_cpu_ptr(wq->cpu_pwq, cpu);
++       else
++               return &wq->dfl_pwq;
++}
++
++/* @cpu < 0 for dfl_pwq */
++static struct pool_workqueue *unbound_pwq(struct workqueue_struct *wq, int cpu)
++{
++	return rcu_dereference_check(*unbound_pwq_slot(wq, cpu),
++				     lockdep_is_held(&wq_pool_mutex) ||
++				     lockdep_is_held(&wq->mutex));
++}
++
+ static unsigned int work_color_to_flags(int color)
+ {
+ 	return color << WORK_STRUCT_COLOR_SHIFT;
+@@ -4324,10 +4341,11 @@ static void wq_calc_pod_cpumask(struct workqueue_attrs *attrs, int cpu,
+ 				"possible intersect\n");
+ }
+ 
+-/* install @pwq into @wq's cpu_pwq and return the old pwq */
++/* install @pwq into @wq and return the old pwq, @cpu < 0 for dfl_pwq */
+ static struct pool_workqueue *install_unbound_pwq(struct workqueue_struct *wq,
+ 					int cpu, struct pool_workqueue *pwq)
+ {
++	struct pool_workqueue __rcu **slot = unbound_pwq_slot(wq, cpu);
+ 	struct pool_workqueue *old_pwq;
+ 
+ 	lockdep_assert_held(&wq_pool_mutex);
+@@ -4336,8 +4354,8 @@ static struct pool_workqueue *install_unbound_pwq(struct workqueue_struct *wq,
+ 	/* link_pwq() can handle duplicate calls */
+ 	link_pwq(pwq);
+ 
+-	old_pwq = rcu_access_pointer(*per_cpu_ptr(wq->cpu_pwq, cpu));
+-	rcu_assign_pointer(*per_cpu_ptr(wq->cpu_pwq, cpu), pwq);
++	old_pwq = rcu_access_pointer(*slot);
++	rcu_assign_pointer(*slot, pwq);
+ 	return old_pwq;
+ }
+ 
+@@ -4437,14 +4455,11 @@ static void apply_wqattrs_commit(struct apply_wqattrs_ctx *ctx)
+ 
+ 	copy_workqueue_attrs(ctx->wq->unbound_attrs, ctx->attrs);
+ 
+-	/* save the previous pwq and install the new one */
++	/* save the previous pwqs and install the new ones */
+ 	for_each_possible_cpu(cpu)
+ 		ctx->pwq_tbl[cpu] = install_unbound_pwq(ctx->wq, cpu,
+ 							ctx->pwq_tbl[cpu]);
+-
+-	/* @dfl_pwq might not have been used, ensure it's linked */
+-	link_pwq(ctx->dfl_pwq);
+-	swap(ctx->wq->dfl_pwq, ctx->dfl_pwq);
++	ctx->dfl_pwq = install_unbound_pwq(ctx->wq, -1, ctx->dfl_pwq);
+ 
+ 	mutex_unlock(&ctx->wq->mutex);
+ }
+@@ -4554,9 +4569,7 @@ static void wq_update_pod(struct workqueue_struct *wq, int cpu,
+ 
+ 	/* nothing to do if the target cpumask matches the current pwq */
+ 	wq_calc_pod_cpumask(target_attrs, cpu, off_cpu);
+-	pwq = rcu_dereference_protected(*per_cpu_ptr(wq->cpu_pwq, cpu),
+-					lockdep_is_held(&wq_pool_mutex));
+-	if (wqattrs_equal(target_attrs, pwq->pool->attrs))
++	if (wqattrs_equal(target_attrs, unbound_pwq(wq, cpu)->pool->attrs))
+ 		return;
+ 
+ 	/* create a new pwq */
+@@ -4574,10 +4587,11 @@ static void wq_update_pod(struct workqueue_struct *wq, int cpu,
+ 
+ use_dfl_pwq:
+ 	mutex_lock(&wq->mutex);
+-	raw_spin_lock_irq(&wq->dfl_pwq->pool->lock);
+-	get_pwq(wq->dfl_pwq);
+-	raw_spin_unlock_irq(&wq->dfl_pwq->pool->lock);
+-	old_pwq = install_unbound_pwq(wq, cpu, wq->dfl_pwq);
++	pwq = unbound_pwq(wq, -1);
++	raw_spin_lock_irq(&pwq->pool->lock);
++	get_pwq(pwq);
++	raw_spin_unlock_irq(&pwq->pool->lock);
++	old_pwq = install_unbound_pwq(wq, cpu, pwq);
+ out_unlock:
+ 	mutex_unlock(&wq->mutex);
+ 	put_pwq_unlocked(old_pwq);
+@@ -4615,10 +4629,13 @@ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
+ 
+ 	cpus_read_lock();
+ 	if (wq->flags & __WQ_ORDERED) {
++		struct pool_workqueue *dfl_pwq;
++
+ 		ret = apply_workqueue_attrs(wq, ordered_wq_attrs[highpri]);
+ 		/* there should only be single pwq for ordering guarantee */
+-		WARN(!ret && (wq->pwqs.next != &wq->dfl_pwq->pwqs_node ||
+-			      wq->pwqs.prev != &wq->dfl_pwq->pwqs_node),
++		dfl_pwq = rcu_access_pointer(wq->dfl_pwq);
++		WARN(!ret && (wq->pwqs.next != &dfl_pwq->pwqs_node ||
++			      wq->pwqs.prev != &dfl_pwq->pwqs_node),
+ 		     "ordering guarantee broken for workqueue %s\n", wq->name);
+ 	} else {
+ 		ret = apply_workqueue_attrs(wq, unbound_std_wq_attrs[highpri]);
+@@ -4849,7 +4866,7 @@ static bool pwq_busy(struct pool_workqueue *pwq)
+ 		if (pwq->nr_in_flight[i])
+ 			return true;
+ 
+-	if ((pwq != pwq->wq->dfl_pwq) && (pwq->refcnt > 1))
++	if ((pwq != rcu_access_pointer(pwq->wq->dfl_pwq)) && (pwq->refcnt > 1))
+ 		return true;
+ 	if (!pwq_is_empty(pwq))
+ 		return true;
+@@ -4933,13 +4950,12 @@ void destroy_workqueue(struct workqueue_struct *wq)
+ 	rcu_read_lock();
+ 
+ 	for_each_possible_cpu(cpu) {
+-		pwq = rcu_access_pointer(*per_cpu_ptr(wq->cpu_pwq, cpu));
+-		RCU_INIT_POINTER(*per_cpu_ptr(wq->cpu_pwq, cpu), NULL);
+-		put_pwq_unlocked(pwq);
++		put_pwq_unlocked(unbound_pwq(wq, cpu));
++		RCU_INIT_POINTER(*unbound_pwq_slot(wq, cpu), NULL);
+ 	}
+ 
+-	put_pwq_unlocked(wq->dfl_pwq);
+-	wq->dfl_pwq = NULL;
++	put_pwq_unlocked(unbound_pwq(wq, -1));
++	RCU_INIT_POINTER(*unbound_pwq_slot(wq, -1), NULL);
+ 
+ 	rcu_read_unlock();
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue-replace-pwq_activate_inactive_work-with-__.patch b/queue-6.8/workqueue-replace-pwq_activate_inactive_work-with-__.patch
new file mode 100644
index 00000000000..af307bf3f85
--- /dev/null
+++ b/queue-6.8/workqueue-replace-pwq_activate_inactive_work-with-__.patch
@@ -0,0 +1,93 @@
+From bc000cd15853004eec4ce5c0d7c8b0c7267e795d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jan 2024 08:11:24 -1000
+Subject: workqueue: Replace pwq_activate_inactive_work() with
+ [__]pwq_activate_work()
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit 4c6380305d21e36581b451f7337a36c93b64e050 ]
+
+To prepare for unbound nr_active handling improvements, move work activation
+part of pwq_activate_inactive_work() into __pwq_activate_work() and add
+pwq_activate_work() which tests WORK_STRUCT_INACTIVE and updates nr_active.
+
+pwq_activate_first_inactive() and try_to_grab_pending() are updated to use
+pwq_activate_work(). The latter conversion is functionally identical. For
+the former, this conversion adds an unnecessary WORK_STRUCT_INACTIVE
+testing. This is temporary and will be removed by the next patch.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 31 +++++++++++++++++++++++++------
+ 1 file changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 6d0f64b5918ba..7e1b0238158ea 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1461,16 +1461,36 @@ static bool pwq_is_empty(struct pool_workqueue *pwq)
+ 	return !pwq->nr_active && list_empty(&pwq->inactive_works);
+ }
+ 
+-static void pwq_activate_inactive_work(struct work_struct *work)
++static void __pwq_activate_work(struct pool_workqueue *pwq,
++				struct work_struct *work)
+ {
+-	struct pool_workqueue *pwq = get_work_pwq(work);
+-
+ 	trace_workqueue_activate_work(work);
+ 	if (list_empty(&pwq->pool->worklist))
+ 		pwq->pool->watchdog_ts = jiffies;
+ 	move_linked_works(work, &pwq->pool->worklist, NULL);
+ 	__clear_bit(WORK_STRUCT_INACTIVE_BIT, work_data_bits(work));
++}
++
++/**
++ * pwq_activate_work - Activate a work item if inactive
++ * @pwq: pool_workqueue @work belongs to
++ * @work: work item to activate
++ *
++ * Returns %true if activated. %false if already active.
++ */
++static bool pwq_activate_work(struct pool_workqueue *pwq,
++			      struct work_struct *work)
++{
++	struct worker_pool *pool = pwq->pool;
++
++	lockdep_assert_held(&pool->lock);
++
++	if (!(*work_data_bits(work) & WORK_STRUCT_INACTIVE))
++		return false;
++
+ 	pwq->nr_active++;
++	__pwq_activate_work(pwq, work);
++	return true;
+ }
+ 
+ static void pwq_activate_first_inactive(struct pool_workqueue *pwq)
+@@ -1478,7 +1498,7 @@ static void pwq_activate_first_inactive(struct pool_workqueue *pwq)
+ 	struct work_struct *work = list_first_entry(&pwq->inactive_works,
+ 						    struct work_struct, entry);
+ 
+-	pwq_activate_inactive_work(work);
++	pwq_activate_work(pwq, work);
+ }
+ 
+ /**
+@@ -1616,8 +1636,7 @@ static int try_to_grab_pending(struct work_struct *work, bool is_dwork,
+ 		 * management later on and cause stall.  Make sure the work
+ 		 * item is activated before grabbing.
+ 		 */
+-		if (*work_data_bits(work) & WORK_STRUCT_INACTIVE)
+-			pwq_activate_inactive_work(work);
++		pwq_activate_work(pwq, work);
+ 
+ 		list_del_init(&work->entry);
+ 		pwq_dec_nr_in_flight(pwq, *work_data_bits(work));
+-- 
+2.43.0
+
diff --git a/queue-6.8/workqueue.c-increase-workqueue-name-length.patch b/queue-6.8/workqueue.c-increase-workqueue-name-length.patch
new file mode 100644
index 00000000000..8950cde1193
--- /dev/null
+++ b/queue-6.8/workqueue.c-increase-workqueue-name-length.patch
@@ -0,0 +1,60 @@
+From c8060a71ff766982f46c5bb36d9f6cf1f1907707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 12:08:22 -0500
+Subject: workqueue.c: Increase workqueue name length
+
+From: Audra Mitchell <audra@redhat.com>
+
+[ Upstream commit 31c89007285d365aa36f71d8fb0701581c770a27 ]
+
+Currently we limit the size of the workqueue name to 24 characters due to
+commit ecf6881ff349 ("workqueue: make workqueue->name[] fixed len")
+Increase the size to 32 characters and print a warning in the event
+the requested name is larger than the limit of 32 characters.
+
+Signed-off-by: Audra Mitchell <audra@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Stable-dep-of: 5797b1c18919 ("workqueue: Implement system-wide nr_active enforcement for unbound workqueues")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 7b482a26d7419..8a06fddb23e66 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -108,7 +108,7 @@ enum {
+ 	RESCUER_NICE_LEVEL	= MIN_NICE,
+ 	HIGHPRI_NICE_LEVEL	= MIN_NICE,
+ 
+-	WQ_NAME_LEN		= 24,
++	WQ_NAME_LEN		= 32,
+ };
+ 
+ /*
+@@ -4666,6 +4666,7 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 	va_list args;
+ 	struct workqueue_struct *wq;
+ 	struct pool_workqueue *pwq;
++	int len;
+ 
+ 	/*
+ 	 * Unbound && max_active == 1 used to imply ordered, which is no longer
+@@ -4692,9 +4693,12 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
+ 	}
+ 
+ 	va_start(args, max_active);
+-	vsnprintf(wq->name, sizeof(wq->name), fmt, args);
++	len = vsnprintf(wq->name, sizeof(wq->name), fmt, args);
+ 	va_end(args);
+ 
++	if (len >= WQ_NAME_LEN)
++		pr_warn_once("workqueue: name exceeds WQ_NAME_LEN. Truncating to: %s\n", wq->name);
++
+ 	max_active = max_active ?: WQ_DFL_ACTIVE;
+ 	max_active = wq_clamp_max_active(max_active, flags, wq->name);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.8/x86-asm-remove-the-__iomem-annotation-of-movdir64b-s.patch b/queue-6.8/x86-asm-remove-the-__iomem-annotation-of-movdir64b-s.patch
new file mode 100644
index 00000000000..e2baf6b064b
--- /dev/null
+++ b/queue-6.8/x86-asm-remove-the-__iomem-annotation-of-movdir64b-s.patch
@@ -0,0 +1,117 @@
+From 7a77e9605f272be8ff82d4188f4db810fcf83763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 15:38:52 +1300
+Subject: x86/asm: Remove the __iomem annotation of movdir64b()'s dst argument
+
+From: Kai Huang <kai.huang@intel.com>
+
+[ Upstream commit 5bdd181821b2c65b074cfad07d7c7d5d3cfe20bf ]
+
+Commit e56d28df2f66 ("x86/virt/tdx: Configure global KeyID on all
+packages") causes a sparse warning:
+
+  arch/x86/virt/vmx/tdx/tdx.c:683:27: warning: incorrect type in argument 1 (different address spaces)
+  arch/x86/virt/vmx/tdx/tdx.c:683:27:    expected void [noderef] __iomem *dst
+  arch/x86/virt/vmx/tdx/tdx.c:683:27:    got void *
+
+The reason is TDX must use the MOVDIR64B instruction to convert TDX
+private memory (which is normal RAM but not MMIO) back to normal.  The
+TDX code uses existing movdir64b() helper to do that, but the first
+argument @dst of movdir64b() is annotated with __iomem.
+
+When movdir64b() was firstly introduced in commit 0888e1030d3e
+("x86/asm: Carve out a generic movdir64b() helper for general usage"),
+it didn't have the __iomem annotation.  But this commit also introduced
+the same "incorrect type" sparse warning because the iosubmit_cmds512(),
+which was the solo caller of movdir64b(), has the __iomem annotation.
+
+This was later fixed by commit 6ae58d871319 ("x86/asm: Annotate
+movdir64b()'s dst argument with __iomem").  That fix was reasonable
+because until TDX code the movdir64b() was only used to move data to
+MMIO location, as described by the commit message:
+
+  ... The current usages send a 64-bytes command descriptor to an MMIO
+  location (portal) on a device for consumption. When future usages for
+  the MOVDIR64B instruction warrant a separate variant of a memory to
+  memory operation, the argument annotation can be revisited.
+
+Now TDX code uses MOVDIR64B to move data to normal memory so it's time
+to revisit.
+
+The SDM says the destination of MOVDIR64B is "memory location specified
+in a general register", thus it's more reasonable that movdir64b() does
+not have the __iomem annotation on the @dst.
+
+Remove the __iomem annotation from the @dst argument of movdir64b() to
+fix the sparse warning in TDX code.  Similar to memset_io(), introduce a
+new movdir64b_io() to cover the case where the destination is an MMIO
+location, and change the solo caller iosubmit_cmds512() to use the new
+movdir64b_io().
+
+In movdir64b_io() explicitly use __force in the type casting otherwise
+there will be below sparse warning:
+
+  warning: cast removes address space '__iomem' of expression
+
+[ dhansen: normal changelog tweaks ]
+
+Closes: https://lore.kernel.org/oe-kbuild-all/202312311924.tGjsBIQD-lkp@intel.com/
+Fixes: e56d28df2f66 ("x86/virt/tdx: Configure global KeyID on all packages")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Kai Huang <kai.huang@intel.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reviewed-by: Yuan Yao <yuan.yao@intel.com>
+Link: https://lore.kernel.org/all/20240126023852.11065-1-kai.huang%40intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/io.h            | 2 +-
+ arch/x86/include/asm/special_insns.h | 9 +++++++--
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
+index 3814a9263d64e..294cd2a408181 100644
+--- a/arch/x86/include/asm/io.h
++++ b/arch/x86/include/asm/io.h
+@@ -379,7 +379,7 @@ static inline void iosubmit_cmds512(void __iomem *dst, const void *src,
+ 	const u8 *end = from + count * 64;
+ 
+ 	while (from < end) {
+-		movdir64b(dst, from);
++		movdir64b_io(dst, from);
+ 		from += 64;
+ 	}
+ }
+diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h
+index 48f8dd47cf688..09a5461d72439 100644
+--- a/arch/x86/include/asm/special_insns.h
++++ b/arch/x86/include/asm/special_insns.h
+@@ -224,10 +224,10 @@ static inline void serialize(void)
+ }
+ 
+ /* The dst parameter must be 64-bytes aligned */
+-static inline void movdir64b(void __iomem *dst, const void *src)
++static inline void movdir64b(void *dst, const void *src)
+ {
+ 	const struct { char _[64]; } *__src = src;
+-	struct { char _[64]; } __iomem *__dst = dst;
++	struct { char _[64]; } *__dst = dst;
+ 
+ 	/*
+ 	 * MOVDIR64B %(rdx), rax.
+@@ -245,6 +245,11 @@ static inline void movdir64b(void __iomem *dst, const void *src)
+ 		     :  "m" (*__src), "a" (__dst), "d" (__src));
+ }
+ 
++static inline void movdir64b_io(void __iomem *dst, const void *src)
++{
++	movdir64b((void __force *)dst, src);
++}
++
+ /**
+  * enqcmds - Enqueue a command in supervisor (CPL0) mode
+  * @dst: destination, in MMIO space (must be 512-bit aligned)
+-- 
+2.43.0
+
diff --git a/queue-6.8/x86-mm-ensure-input-to-pfn_to_kaddr-is-treated-as-a-.patch b/queue-6.8/x86-mm-ensure-input-to-pfn_to_kaddr-is-treated-as-a-.patch
new file mode 100644
index 00000000000..95e00c98703
--- /dev/null
+++ b/queue-6.8/x86-mm-ensure-input-to-pfn_to_kaddr-is-treated-as-a-.patch
@@ -0,0 +1,73 @@
+From 508ffc5c32485f3e4b5cf985e482b2c02d360c79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 10:37:00 -0600
+Subject: x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type
+
+From: Michael Roth <michael.roth@amd.com>
+
+[ Upstream commit 8e5647a723c49d73b9f108a8bb38e8c29d3948ea ]
+
+On 64-bit platforms, the pfn_to_kaddr() macro requires that the input
+value is 64 bits in order to ensure that valid address bits don't get
+lost when shifting that input by PAGE_SHIFT to calculate the physical
+address to provide a virtual address for.
+
+One such example is in pvalidate_pages() (used by SEV-SNP guests), where
+the GFN in the struct used for page-state change requests is a 40-bit
+bit-field, so attempts to pass this GFN field directly into
+pfn_to_kaddr() ends up causing guest crashes when dealing with addresses
+above the 1TB range due to the above.
+
+Fix this issue with SEV-SNP guests, as well as any similar cases that
+might cause issues in current/future code, by using an inline function,
+instead of a macro, so that the input is implicitly cast to the
+expected 64-bit input type prior to performing the shift operation.
+
+While it might be argued that the issue is on the caller side, other
+archs/macros have taken similar approaches to deal with instances like
+this, such as ARM explicitly casting the input to phys_addr_t:
+
+  e48866647b48 ("ARM: 8396/1: use phys_addr_t in pfn_to_kaddr()")
+
+A C inline function is even better though.
+
+[ mingo: Refined the changelog some more & added __always_inline. ]
+
+Fixes: 6c3211796326 ("x86/sev: Add SNP-specific unaccepted memory support")
+Suggested-by: Dave Hansen <dave.hansen@intel.com>
+Suggested-by: H. Peter Anvin <hpa@zytor.com>
+Signed-off-by: Michael Roth <michael.roth@amd.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20231122163700.400507-1-michael.roth@amd.com
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/page.h | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h
+index d18e5c332cb9f..1b93ff80b43bc 100644
+--- a/arch/x86/include/asm/page.h
++++ b/arch/x86/include/asm/page.h
+@@ -66,10 +66,14 @@ static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
+  * virt_addr_valid(kaddr) returns true.
+  */
+ #define virt_to_page(kaddr)	pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
+-#define pfn_to_kaddr(pfn)      __va((pfn) << PAGE_SHIFT)
+ extern bool __virt_addr_valid(unsigned long kaddr);
+ #define virt_addr_valid(kaddr)	__virt_addr_valid((unsigned long) (kaddr))
+ 
++static __always_inline void *pfn_to_kaddr(unsigned long pfn)
++{
++	return __va(pfn << PAGE_SHIFT);
++}
++
+ static __always_inline u64 __canonical_address(u64 vaddr, u8 vaddr_bits)
+ {
+ 	return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);
+-- 
+2.43.0
+
diff --git a/queue-6.8/x86-relocs-ignore-relocations-in-.notes-section.patch b/queue-6.8/x86-relocs-ignore-relocations-in-.notes-section.patch
new file mode 100644
index 00000000000..ff7807c1468
--- /dev/null
+++ b/queue-6.8/x86-relocs-ignore-relocations-in-.notes-section.patch
@@ -0,0 +1,54 @@
+From 9afdcee76882da733c688854b097bd1f4a76d72b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Feb 2024 09:51:12 -0800
+Subject: x86, relocs: Ignore relocations in .notes section
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit aaa8736370db1a78f0e8434344a484f9fd20be3b ]
+
+When building with CONFIG_XEN_PV=y, .text symbols are emitted into
+the .notes section so that Xen can find the "startup_xen" entry point.
+This information is used prior to booting the kernel, so relocations
+are not useful. In fact, performing relocations against the .notes
+section means that the KASLR base is exposed since /sys/kernel/notes
+is world-readable.
+
+To avoid leaking the KASLR base without breaking unprivileged tools that
+are expecting to read /sys/kernel/notes, skip performing relocations in
+the .notes section. The values readable in .notes are then identical to
+those found in System.map.
+
+Reported-by: Guixiong Wei <guixiongwei@gmail.com>
+Closes: https://lore.kernel.org/all/20240218073501.54555-1-guixiongwei@gmail.com/
+Fixes: 5ead97c84fa7 ("xen: Core Xen implementation")
+Fixes: da1a679cde9b ("Add /sys/kernel/notes")
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/tools/relocs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index a3bae2b24626b..b029fb81ebeee 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -653,6 +653,14 @@ static void print_absolute_relocs(void)
+ 		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
+ 			continue;
+ 		}
++		/*
++		 * Do not perform relocations in .notes section; any
++		 * values there are meant for pre-boot consumption (e.g.
++		 * startup_xen).
++		 */
++		if (sec_applies->shdr.sh_type == SHT_NOTE) {
++			continue;
++		}
+ 		sh_symtab  = sec_symtab->symtab;
+ 		sym_strtab = sec_symtab->link->strtab;
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {
+-- 
+2.43.0
+
diff --git a/queue-6.8/x86-resctrl-implement-new-mba_mbps-throttling-heuris.patch b/queue-6.8/x86-resctrl-implement-new-mba_mbps-throttling-heuris.patch
new file mode 100644
index 00000000000..7a730d104df
--- /dev/null
+++ b/queue-6.8/x86-resctrl-implement-new-mba_mbps-throttling-heuris.patch
@@ -0,0 +1,162 @@
+From 73d59730dee7ea89ad4a6af22ef13d27ce7325c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jan 2024 10:08:07 -0800
+Subject: x86/resctrl: Implement new mba_MBps throttling heuristic
+
+From: Tony Luck <tony.luck@intel.com>
+
+[ Upstream commit c2427e70c1630d98966375fffc2b713ab9768a94 ]
+
+The mba_MBps feedback loop increases throttling when a group is using
+more bandwidth than the target set by the user in the schemata file, and
+decreases throttling when below target.
+
+To avoid possibly stepping throttling up and down on every poll a flag
+"delta_comp" is set whenever throttling is changed to indicate that the
+actual change in bandwidth should be recorded on the next poll in
+"delta_bw". Throttling is only reduced if the current bandwidth plus
+delta_bw is below the user target.
+
+This algorithm works well if the workload has steady bandwidth needs.
+But it can go badly wrong if the workload moves to a different phase
+just as the throttling level changed. E.g. if the workload becomes
+essentially idle right as throttling level is increased, the value
+calculated for delta_bw will be more or less the old bandwidth level.
+If the workload then resumes, Linux may never reduce throttling because
+current bandwidth plus delta_bw is above the target set by the user.
+
+Implement a simpler heuristic by assuming that in the worst case the
+currently measured bandwidth is being controlled by the current level of
+throttling. Compute how much it may increase if throttling is relaxed to
+the next higher level. If that is still below the user target, then it
+is ok to reduce the amount of throttling.
+
+Fixes: ba0f26d8529c ("x86/intel_rdt/mba_sc: Prepare for feedback loop")
+Reported-by: Xiaochen Shen <xiaochen.shen@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Tested-by: Xiaochen Shen <xiaochen.shen@intel.com>
+Link: https://lore.kernel.org/r/20240122180807.70518-1-tony.luck@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/resctrl/internal.h |  4 ---
+ arch/x86/kernel/cpu/resctrl/monitor.c  | 42 ++++++--------------------
+ 2 files changed, 10 insertions(+), 36 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/resctrl/internal.h b/arch/x86/kernel/cpu/resctrl/internal.h
+index e3dc35a00a197..52e7e7deee106 100644
+--- a/arch/x86/kernel/cpu/resctrl/internal.h
++++ b/arch/x86/kernel/cpu/resctrl/internal.h
+@@ -295,14 +295,10 @@ struct rftype {
+  * struct mbm_state - status for each MBM counter in each domain
+  * @prev_bw_bytes: Previous bytes value read for bandwidth calculation
+  * @prev_bw:	The most recent bandwidth in MBps
+- * @delta_bw:	Difference between the current and previous bandwidth
+- * @delta_comp:	Indicates whether to compute the delta_bw
+  */
+ struct mbm_state {
+ 	u64	prev_bw_bytes;
+ 	u32	prev_bw;
+-	u32	delta_bw;
+-	bool	delta_comp;
+ };
+ 
+ /**
+diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c
+index acca577e2b066..3a6c069614eb8 100644
+--- a/arch/x86/kernel/cpu/resctrl/monitor.c
++++ b/arch/x86/kernel/cpu/resctrl/monitor.c
+@@ -440,9 +440,6 @@ static void mbm_bw_count(u32 rmid, struct rmid_read *rr)
+ 
+ 	cur_bw = bytes / SZ_1M;
+ 
+-	if (m->delta_comp)
+-		m->delta_bw = abs(cur_bw - m->prev_bw);
+-	m->delta_comp = false;
+ 	m->prev_bw = cur_bw;
+ }
+ 
+@@ -520,11 +517,11 @@ static void update_mba_bw(struct rdtgroup *rgrp, struct rdt_domain *dom_mbm)
+ {
+ 	u32 closid, rmid, cur_msr_val, new_msr_val;
+ 	struct mbm_state *pmbm_data, *cmbm_data;
+-	u32 cur_bw, delta_bw, user_bw;
+ 	struct rdt_resource *r_mba;
+ 	struct rdt_domain *dom_mba;
+ 	struct list_head *head;
+ 	struct rdtgroup *entry;
++	u32 cur_bw, user_bw;
+ 
+ 	if (!is_mbm_local_enabled())
+ 		return;
+@@ -543,7 +540,6 @@ static void update_mba_bw(struct rdtgroup *rgrp, struct rdt_domain *dom_mbm)
+ 
+ 	cur_bw = pmbm_data->prev_bw;
+ 	user_bw = dom_mba->mbps_val[closid];
+-	delta_bw = pmbm_data->delta_bw;
+ 
+ 	/* MBA resource doesn't support CDP */
+ 	cur_msr_val = resctrl_arch_get_config(r_mba, dom_mba, closid, CDP_NONE);
+@@ -555,49 +551,31 @@ static void update_mba_bw(struct rdtgroup *rgrp, struct rdt_domain *dom_mbm)
+ 	list_for_each_entry(entry, head, mon.crdtgrp_list) {
+ 		cmbm_data = &dom_mbm->mbm_local[entry->mon.rmid];
+ 		cur_bw += cmbm_data->prev_bw;
+-		delta_bw += cmbm_data->delta_bw;
+ 	}
+ 
+ 	/*
+ 	 * Scale up/down the bandwidth linearly for the ctrl group.  The
+ 	 * bandwidth step is the bandwidth granularity specified by the
+ 	 * hardware.
+-	 *
+-	 * The delta_bw is used when increasing the bandwidth so that we
+-	 * dont alternately increase and decrease the control values
+-	 * continuously.
+-	 *
+-	 * For ex: consider cur_bw = 90MBps, user_bw = 100MBps and if
+-	 * bandwidth step is 20MBps(> user_bw - cur_bw), we would keep
+-	 * switching between 90 and 110 continuously if we only check
+-	 * cur_bw < user_bw.
++	 * Always increase throttling if current bandwidth is above the
++	 * target set by user.
++	 * But avoid thrashing up and down on every poll by checking
++	 * whether a decrease in throttling is likely to push the group
++	 * back over target. E.g. if currently throttling to 30% of bandwidth
++	 * on a system with 10% granularity steps, check whether moving to
++	 * 40% would go past the limit by multiplying current bandwidth by
++	 * "(30 + 10) / 30".
+ 	 */
+ 	if (cur_msr_val > r_mba->membw.min_bw && user_bw < cur_bw) {
+ 		new_msr_val = cur_msr_val - r_mba->membw.bw_gran;
+ 	} else if (cur_msr_val < MAX_MBA_BW &&
+-		   (user_bw > (cur_bw + delta_bw))) {
++		   (user_bw > (cur_bw * (cur_msr_val + r_mba->membw.min_bw) / cur_msr_val))) {
+ 		new_msr_val = cur_msr_val + r_mba->membw.bw_gran;
+ 	} else {
+ 		return;
+ 	}
+ 
+ 	resctrl_arch_update_one(r_mba, dom_mba, closid, CDP_NONE, new_msr_val);
+-
+-	/*
+-	 * Delta values are updated dynamically package wise for each
+-	 * rdtgrp every time the throttle MSR changes value.
+-	 *
+-	 * This is because (1)the increase in bandwidth is not perfectly
+-	 * linear and only "approximately" linear even when the hardware
+-	 * says it is linear.(2)Also since MBA is a core specific
+-	 * mechanism, the delta values vary based on number of cores used
+-	 * by the rdtgrp.
+-	 */
+-	pmbm_data->delta_comp = true;
+-	list_for_each_entry(entry, head, mon.crdtgrp_list) {
+-		cmbm_data = &dom_mbm->mbm_local[entry->mon.rmid];
+-		cmbm_data->delta_comp = true;
+-	}
+ }
+ 
+ static void mbm_update(struct rdt_resource *r, struct rdt_domain *d, int rmid)
+-- 
+2.43.0
+
diff --git a/queue-6.8/x86-resctrl-read-supported-bandwidth-sources-from-cp.patch b/queue-6.8/x86-resctrl-read-supported-bandwidth-sources-from-cp.patch
new file mode 100644
index 00000000000..94695f1596f
--- /dev/null
+++ b/queue-6.8/x86-resctrl-read-supported-bandwidth-sources-from-cp.patch
@@ -0,0 +1,119 @@
+From 9feb659bb1f68a33087447b19cce1a00937f41f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 16:52:28 -0600
+Subject: x86/resctrl: Read supported bandwidth sources from CPUID
+
+From: Babu Moger <babu.moger@amd.com>
+
+[ Upstream commit 54e35eb8611cce5550d3d7689679b1a91c864f28 ]
+
+If the BMEC (Bandwidth Monitoring Event Configuration) feature is
+supported, the bandwidth events can be configured. The maximum supported
+bandwidth bitmask can be read from CPUID:
+
+  CPUID_Fn80000020_ECX_x03 [Platform QoS Monitoring Bandwidth Event Configuration]
+  Bits    Description
+  31:7    Reserved
+   6:0    Identifies the bandwidth sources that can be tracked.
+
+While at it, move the mask checking to mon_config_write() before
+iterating over all the domains. Also, print the valid bitmask when the
+user tries to configure invalid event configuration value.
+
+The CPUID details are documented in the Processor Programming Reference
+(PPR) Vol 1.1 for AMD Family 19h Model 11h B1 - 55901 Rev 0.25 in the
+Link tag.
+
+Fixes: dc2a3e857981 ("x86/resctrl: Add interface to read mbm_total_bytes_config")
+Signed-off-by: Babu Moger <babu.moger@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
+Link: https://lore.kernel.org/r/669896fa512c7451319fa5ca2fdb6f7e015b5635.1705359148.git.babu.moger@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/resctrl/internal.h |  3 +++
+ arch/x86/kernel/cpu/resctrl/monitor.c  |  6 ++++++
+ arch/x86/kernel/cpu/resctrl/rdtgroup.c | 14 ++++++++------
+ 3 files changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/resctrl/internal.h b/arch/x86/kernel/cpu/resctrl/internal.h
+index d2979748fae47..e3dc35a00a197 100644
+--- a/arch/x86/kernel/cpu/resctrl/internal.h
++++ b/arch/x86/kernel/cpu/resctrl/internal.h
+@@ -394,6 +394,8 @@ struct rdt_parse_data {
+  * @msr_update:		Function pointer to update QOS MSRs
+  * @mon_scale:		cqm counter * mon_scale = occupancy in bytes
+  * @mbm_width:		Monitor width, to detect and correct for overflow.
++ * @mbm_cfg_mask:	Bandwidth sources that can be tracked when Bandwidth
++ *			Monitoring Event Configuration (BMEC) is supported.
+  * @cdp_enabled:	CDP state of this resource
+  *
+  * Members of this structure are either private to the architecture
+@@ -408,6 +410,7 @@ struct rdt_hw_resource {
+ 				 struct rdt_resource *r);
+ 	unsigned int		mon_scale;
+ 	unsigned int		mbm_width;
++	unsigned int		mbm_cfg_mask;
+ 	bool			cdp_enabled;
+ };
+ 
+diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c
+index f136ac046851c..acca577e2b066 100644
+--- a/arch/x86/kernel/cpu/resctrl/monitor.c
++++ b/arch/x86/kernel/cpu/resctrl/monitor.c
+@@ -813,6 +813,12 @@ int __init rdt_get_mon_l3_config(struct rdt_resource *r)
+ 		return ret;
+ 
+ 	if (rdt_cpu_has(X86_FEATURE_BMEC)) {
++		u32 eax, ebx, ecx, edx;
++
++		/* Detect list of bandwidth sources that can be tracked */
++		cpuid_count(0x80000020, 3, &eax, &ebx, &ecx, &edx);
++		hw_res->mbm_cfg_mask = ecx & MAX_EVT_CONFIG_BITS;
++
+ 		if (rdt_cpu_has(X86_FEATURE_CQM_MBM_TOTAL)) {
+ 			mbm_total_event.configurable = true;
+ 			mbm_config_rftype_init("mbm_total_bytes_config");
+diff --git a/arch/x86/kernel/cpu/resctrl/rdtgroup.c b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+index 69a1de92384ab..2b69e560b05f1 100644
+--- a/arch/x86/kernel/cpu/resctrl/rdtgroup.c
++++ b/arch/x86/kernel/cpu/resctrl/rdtgroup.c
+@@ -1620,12 +1620,6 @@ static int mbm_config_write_domain(struct rdt_resource *r,
+ 	struct mon_config_info mon_info = {0};
+ 	int ret = 0;
+ 
+-	/* mon_config cannot be more than the supported set of events */
+-	if (val > MAX_EVT_CONFIG_BITS) {
+-		rdt_last_cmd_puts("Invalid event configuration\n");
+-		return -EINVAL;
+-	}
+-
+ 	/*
+ 	 * Read the current config value first. If both are the same then
+ 	 * no need to write it again.
+@@ -1663,6 +1657,7 @@ static int mbm_config_write_domain(struct rdt_resource *r,
+ 
+ static int mon_config_write(struct rdt_resource *r, char *tok, u32 evtid)
+ {
++	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
+ 	char *dom_str = NULL, *id_str;
+ 	unsigned long dom_id, val;
+ 	struct rdt_domain *d;
+@@ -1686,6 +1681,13 @@ static int mon_config_write(struct rdt_resource *r, char *tok, u32 evtid)
+ 		return -EINVAL;
+ 	}
+ 
++	/* Value from user cannot be more than the supported set of events */
++	if ((val & hw_res->mbm_cfg_mask) != val) {
++		rdt_last_cmd_printf("Invalid event configuration: max valid mask is 0x%02x\n",
++				    hw_res->mbm_cfg_mask);
++		return -EINVAL;
++	}
++
+ 	list_for_each_entry(d, &r->domains, list) {
+ 		if (d->id == dom_id) {
+ 			ret = mbm_config_write_domain(r, d, evtid, val);
+-- 
+2.43.0
+
diff --git a/queue-6.8/x86-resctrl-remove-hard-coded-memory-bandwidth-limit.patch b/queue-6.8/x86-resctrl-remove-hard-coded-memory-bandwidth-limit.patch
new file mode 100644
index 00000000000..bc8008baba8
--- /dev/null
+++ b/queue-6.8/x86-resctrl-remove-hard-coded-memory-bandwidth-limit.patch
@@ -0,0 +1,79 @@
+From 487333a710a06455d76b3083f60869c17bc721cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jan 2024 16:52:27 -0600
+Subject: x86/resctrl: Remove hard-coded memory bandwidth limit
+
+From: Babu Moger <babu.moger@amd.com>
+
+[ Upstream commit 0976783bb123f30981bc1e7a14d9626a6f63aeac ]
+
+The QOS Memory Bandwidth Enforcement Limit is reported by
+CPUID_Fn80000020_EAX_x01 and CPUID_Fn80000020_EAX_x02:
+
+  Bits	 Description
+  31:0	 BW_LEN: Size of the QOS Memory Bandwidth Enforcement Limit.
+
+Newer processors can support higher bandwidth limit than the current
+hard-coded value. Remove latter and detect using CPUID instead. Also,
+update the register variables eax and edx to match the AMD CPUID
+definition.
+
+The CPUID details are documented in the Processor Programming Reference
+(PPR) Vol 1.1 for AMD Family 19h Model 11h B1 - 55901 Rev 0.25 in the
+Link tag below.
+
+Fixes: 4d05bf71f157 ("x86/resctrl: Introduce AMD QOS feature")
+Signed-off-by: Babu Moger <babu.moger@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537
+Link: https://lore.kernel.org/r/c26a8ca79d399ed076cf8bf2e9fbc58048808289.1705359148.git.babu.moger@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/resctrl/core.c     | 10 ++++------
+ arch/x86/kernel/cpu/resctrl/internal.h |  1 -
+ 2 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/resctrl/core.c b/arch/x86/kernel/cpu/resctrl/core.c
+index 19e0681f04356..d04371e851b4c 100644
+--- a/arch/x86/kernel/cpu/resctrl/core.c
++++ b/arch/x86/kernel/cpu/resctrl/core.c
+@@ -231,9 +231,7 @@ static bool __get_mem_config_intel(struct rdt_resource *r)
+ static bool __rdt_get_mem_config_amd(struct rdt_resource *r)
+ {
+ 	struct rdt_hw_resource *hw_res = resctrl_to_arch_res(r);
+-	union cpuid_0x10_3_eax eax;
+-	union cpuid_0x10_x_edx edx;
+-	u32 ebx, ecx, subleaf;
++	u32 eax, ebx, ecx, edx, subleaf;
+ 
+ 	/*
+ 	 * Query CPUID_Fn80000020_EDX_x01 for MBA and
+@@ -241,9 +239,9 @@ static bool __rdt_get_mem_config_amd(struct rdt_resource *r)
+ 	 */
+ 	subleaf = (r->rid == RDT_RESOURCE_SMBA) ? 2 :  1;
+ 
+-	cpuid_count(0x80000020, subleaf, &eax.full, &ebx, &ecx, &edx.full);
+-	hw_res->num_closid = edx.split.cos_max + 1;
+-	r->default_ctrl = MAX_MBA_BW_AMD;
++	cpuid_count(0x80000020, subleaf, &eax, &ebx, &ecx, &edx);
++	hw_res->num_closid = edx + 1;
++	r->default_ctrl = 1 << eax;
+ 
+ 	/* AMD does not use delay */
+ 	r->membw.delay_linear = false;
+diff --git a/arch/x86/kernel/cpu/resctrl/internal.h b/arch/x86/kernel/cpu/resctrl/internal.h
+index a4f1aa15f0a2a..d2979748fae47 100644
+--- a/arch/x86/kernel/cpu/resctrl/internal.h
++++ b/arch/x86/kernel/cpu/resctrl/internal.h
+@@ -18,7 +18,6 @@
+ #define MBM_OVERFLOW_INTERVAL		1000
+ #define MAX_MBA_BW			100u
+ #define MBA_IS_LINEAR			0x4
+-#define MAX_MBA_BW_AMD			0x800
+ #define MBM_CNTR_WIDTH_OFFSET_AMD	20
+ 
+ #define RMID_VAL_ERROR			BIT_ULL(63)
+-- 
+2.43.0
+
diff --git a/queue-6.8/x86-sme-fix-memory-encryption-setting-if-enabled-by-.patch b/queue-6.8/x86-sme-fix-memory-encryption-setting-if-enabled-by-.patch
new file mode 100644
index 00000000000..497cbb24ca1
--- /dev/null
+++ b/queue-6.8/x86-sme-fix-memory-encryption-setting-if-enabled-by-.patch
@@ -0,0 +1,82 @@
+From fbcfff26f59eb7a7eaa057ef463ef7617c04fb9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jan 2024 17:39:19 +0100
+Subject: x86/sme: Fix memory encryption setting if enabled by default and not
+ overridden
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit e814b59e6c2b11f5a3d007b2e61f7d550c354c3a ]
+
+Commit
+
+  cbebd68f59f0 ("x86/mm: Fix use of uninitialized buffer in sme_enable()")
+
+'fixed' an issue in sme_enable() detected by static analysis, and broke
+the common case in the process.
+
+cmdline_find_option() will return < 0 on an error, or when the command
+line argument does not appear at all. In this particular case, the
+latter is not an error condition, and so the early exit is wrong.
+
+Instead, without mem_encrypt= on the command line, the compile time
+default should be honoured, which could be to enable memory encryption,
+and this is currently broken.
+
+Fix it by setting sme_me_mask to a preliminary value based on the
+compile time default, and only omitting the command line argument test
+when cmdline_find_option() returns an error.
+
+  [ bp: Drop active_by_default while at it. ]
+
+Fixes: cbebd68f59f0 ("x86/mm: Fix use of uninitialized buffer in sme_enable()")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
+Link: https://lore.kernel.org/r/20240126163918.2908990-2-ardb+git@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/mem_encrypt_identity.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c
+index d73aeb16417fc..7f72472a34d6d 100644
+--- a/arch/x86/mm/mem_encrypt_identity.c
++++ b/arch/x86/mm/mem_encrypt_identity.c
+@@ -507,7 +507,6 @@ void __init sme_enable(struct boot_params *bp)
+ 	const char *cmdline_ptr, *cmdline_arg, *cmdline_on, *cmdline_off;
+ 	unsigned int eax, ebx, ecx, edx;
+ 	unsigned long feature_mask;
+-	bool active_by_default;
+ 	unsigned long me_mask;
+ 	char buffer[16];
+ 	bool snp;
+@@ -593,22 +592,19 @@ void __init sme_enable(struct boot_params *bp)
+ 	     : "p" (sme_cmdline_off));
+ 
+ 	if (IS_ENABLED(CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT))
+-		active_by_default = true;
+-	else
+-		active_by_default = false;
++		sme_me_mask = me_mask;
+ 
+ 	cmdline_ptr = (const char *)((u64)bp->hdr.cmd_line_ptr |
+ 				     ((u64)bp->ext_cmd_line_ptr << 32));
+ 
+ 	if (cmdline_find_option(cmdline_ptr, cmdline_arg, buffer, sizeof(buffer)) < 0)
+-		return;
++		goto out;
+ 
+ 	if (!strncmp(buffer, cmdline_on, sizeof(buffer)))
+ 		sme_me_mask = me_mask;
+ 	else if (!strncmp(buffer, cmdline_off, sizeof(buffer)))
+ 		sme_me_mask = 0;
+-	else
+-		sme_me_mask = active_by_default ? me_mask : 0;
++
+ out:
+ 	if (sme_me_mask) {
+ 		physical_mask &= ~sme_me_mask;
+-- 
+2.43.0
+
-- 
2.47.2