From d503425f034479bd7dc9bda456b1dcc7fe613966 Mon Sep 17 00:00:00 2001
From: Sasha Levin <sashal@kernel.org>
Date: Sat, 20 Jan 2024 19:19:12 -0500
Subject: [PATCH] Fixes for 6.7

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 ...-fix-information-leak-in-sec_attest_.patch |  39 ++
 ...r-extended-error-log-status-when-ras.patch |  48 ++
 ...it-avoid-u32-multiplication-overflow.patch |  40 ++
 ...x-the-fractional-clock-divider-flags.patch |  40 ++
 ...-for-error-while-searching-for-backl.patch |  54 ++
 ...add-clamp-in-scarlett2_mixer_ctl_put.patch |  39 ++
 ...dd-missing-error-check-to-scarlett2_.patch |  44 ++
 ...sing-error-check-to-scarlett2_.patch-10152 |  42 ++
 ...add-missing-error-checks-to-_ctl_get.patch | 356 +++++++++++++
 ...dd-missing-mutex-lock-around-get-met.patch |  54 ++
 ...nci-always-select-config_cpu_arm926t.patch |  39 ++
 ...q8064-correct-xoadc-register-address.patch |  40 ++
 ...m8226-provide-dsi-phy-clocks-to-mmcc.patch |  42 ++
 ...qcom-sdx65-correct-pcie-ep-phy-names.patch |  41 ++
 ...ts-qcom-sdx65-correct-spmi-node-name.patch |  39 ++
 ...n-t-mix-scmi-and-non-scmi-board-comp.patch |  86 ++++
 ...con-hikey970-pmic-fix-regulator-cell.patch |  37 ++
 ...s-imx8mm-reduce-gpu-to-nominal-speed.patch |  51 ++
 ...ek-mt8183-correct-mdp3-dma-related-n.patch |  62 +++
 ...ek-mt8186-fix-address-warning-for-ad.patch |  51 ++
 ...ek-mt8186-fix-alias-prefix-for-ovl_2.patch |  38 ++
 ...ek-mt8195-revise-vdosys-rdma-node-na.patch | 131 +++++
 ...cer-aspire1-correct-audio-codec-defi.patch |  64 +++
 ...pq6018-fix-clock-rates-for-gcc_usb0_.patch |  41 ++
 ...s-qcom-qrb2210-rb1-use-usb-host-mode.patch |  45 ++
 ...rb4210-rb2-don-t-force-usb-periphera.patch |  41 ++
 ...rb5165-rb5-correct-led-panic-indicat.patch |  42 ++
 ...a8775p-fix-usb-wakeup-interrupt-type.patch |  67 +++
 ...a8775p-make-watchdog-bark-interrupt-.patch |  42 ++
 ...c7180-make-watchdog-bark-interrupt-e.patch |  58 +++
 ...rm64-dts-qcom-sc7280-fix-up-gpu-sids.patch |  44 ++
 ...c7280-fix-usb_2-wakeup-interrupt-typ.patch |  43 ++
 ...c7280-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...c7280-mark-adreno-smmu-as-dma-cohere.patch |  37 ++
 ...c7280-mark-sdhci-hosts-as-cache-cohe.patch |  44 ++
 ...4-dts-qcom-sc8180x-fix-up-pcie-nodes.patch |  55 ++
 ...c8180x-mark-pcie-hosts-cache-coheren.patch |  59 +++
 ...sc8180x-primus-fix-hall_int-polarity.patch |  41 ++
 ...c8280xp-make-watchdog-bark-interrupt.patch |  41 ++
 ...c8280xp-x13s-add-missing-camera-led-.patch |  53 ++
 ...c8280xp-x13s-use-the-correct-dp-phy-.patch |  39 ++
 ...dm845-db845c-correct-led-panic-indic.patch |  41 ++
 ...dm845-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...m6125-add-interrupts-to-dwc3-usb-con.patch |  46 ++
 ...m6350-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...m6375-fix-usb-wakeup-interrupt-types.patch |  43 ++
 .../arm64-dts-qcom-sm6375-hook-up-mpm.patch   | 115 +++++
 ...com-sm8150-hdk-fix-ss-usb-regulators.patch |  70 +++
 ...m8150-make-dispcc-cast-minimal-vote-.patch |  38 ++
 ...m8150-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...m8250-make-watchdog-bark-interrupt-e.patch |  40 ++
 ...m64-dts-qcom-sm8350-fix-dma0-address.patch |  42 ++
 ...om-sm8450-correct-tx-soundwire-clock.patch |  43 ++
 ...om-sm8550-correct-tx-soundwire-clock.patch |  42 ++
 ...m8550-fix-usb-wakeup-interrupt-types.patch |  45 ++
 ...om-sm8550-separate-out-x3-idle-state.patch |  54 ++
 ...m8550-update-idle-state-time-require.patch |  77 +++
 ...s-white-hawk-cpu-fix-missing-serial-.patch |  39 ++
 ...ckchip-fix-led-pinctrl-of-lubancat-1.patch |  38 ++
 .../arm64-dts-ti-iot2050-re-add-aliases.patch |  44 ++
 ...am62a-main-fix-gpio-pin-count-in-dt-.patch |  47 ++
 ...3-am65-main-fix-dss-irq-trigger-type.patch |  47 ++
 ...s-xilinx-apply-overlays-to-base-dtbs.patch |  49 ++
 ...c-fix-32-bit-__generic_cmpxchg_local.patch |  39 ++
 ...-drop-conflicting-acpi-based-probing.patch | 112 +++++
 ...ix-gpio-name-and-drop-legacy-include.patch |  64 +++
 ...ix-gpio-name-and-drop-legacy-include.patch |  65 +++
 ...sl_rpmsg-update-kconfig-dependencies.patch |  44 ++
 ...t5682_max98357a-fix-board-id-mismatc.patch |  67 +++
 ...dw_rt_sdca_jack_common-ctx-headset_c.patch |  48 ++
 ...-double-ef20-entry-from-dmi_platform.patch |  53 ++
 ...-intel-pci-mtl-fix-arl-s-definitions.patch | 129 +++++
 ...y-use-partial-match-for-disconnectin.patch |  40 ++
 ...81-add-support-for-fw-version-0x0503.patch |  37 ++
 ...x-rcu-lockdep-warning-in-blkg_lookup.patch |  46 ++
 ...of-minors-and-first_minor-in-device_.patch |  45 ++
 ...oc_noio-to-false-on-device_add_disk-.patch |  39 ++
 ...r-fix-reference-leak-of-pnfs_device_.patch |  37 ++
 ...-btmtkuart-fix-recv_buf-return-value.patch |  68 +++
 ...-btnxpuart-fix-recv_buf-return-value.patch |  69 +++
 ...gus-check-for-re-auth-no-supported-w.patch |  88 ++++
 ...d-crosstask-check-to-__bpf_get_stack.patch | 121 +++++
 ...cu-flag-to-bpf_refcount_acquire_impl.patch |  56 +++
 ...need_defer-parameters-to-.map_fd_put.patch | 174 +++++++
 ...the-free-of-inner-map-when-necessary.patch | 141 ++++++
 ...e-precision-of-r0-on-callback-return.patch |  46 ++
 ...ondition-between-btf_put-and-map_fre.patch | 211 ++++++++
 ...f-fix-accesses-to-uninit-stack-slots.patch | 470 ++++++++++++++++++
 ...r-attempt-to-corrupt-spilled-pointer.patch |  42 ++
 ...tion-of-indirect-var-off-stack-acces.patch |  83 ++++
 ...-stack-limits-against-32bit-overflow.patch |  69 +++
 ...mber-of-kprobes-when-attaching-progr.patch |  58 +++
 ...mber-of-uprobes-when-attaching-progr.patch |  60 +++
 ...-check-prefixlen-before-walking-trie.patch |  43 ++
 ...proto-update-hook-to-avoid-dup-calls.patch |  81 +++
 ...ize-to-select-target-cache-during-fr.patch | 271 ++++++++++
 ...mory-leak-in-netlbl_calipso_add_pass.patch | 138 +++++
 ...ix-clk_hw_register_fixed_rate_with_a.patch |  43 ++
 ...spcc-sm8550-update-disp-pll-settings.patch |  50 ++
 ...sm8550-use-the-correct-pll-configura.patch |  39 ++
 ...550-add-the-missing-retain_ff_enable.patch | 100 ++++
 ...550-mark-rcgs-shared-where-applicabl.patch | 414 +++++++++++++++
 ...c-sm8550-mark-the-pcie-gdscs-votable.patch |  67 +++
 ...550-use-collapse-voting-for-pcie-gds.patch |  70 +++
 ...sm8150-update-the-gpu_cc_pll1-config.patch |  40 ++
 ...gpucc-sm8550-update-gpu-pll-settings.patch |  44 ++
 ...-sm8150-add-missing-pll-config-prope.patch |  37 ++
 ...-rzg2l-check-reset-monitor-registers.patch | 138 +++++
 ...2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch |  82 +++
 ...ix-dif-oen-bit-placement-on-9fgv0241.patch |  40 ++
 ...n-error-code-problem-in-si5341_outpu.patch |  41 ++
 ...eturn-value-check-in-sp7021_clk_prob.patch |  50 ++
 ...cess-the-result-of-devm_of_clk_add_h.patch |  43 ++
 ...-do-not-enable-interrupts-when-enter.patch |  53 ++
 ...sallow-multiple-in-flight-aio-reques.patch |  85 ++++
 ...-fix-memleak-in-ccp_init_dm_workarea.patch |  45 ++
 ...-hpre-save-capability-registers-in-p.patch | 211 ++++++++
 ...con-qm-add-a-function-to-set-qm-algs.patch | 385 ++++++++++++++
 ...-qm-save-capability-registers-in-qm-.patch | 257 ++++++++++
 ...-sec2-save-capability-registers-in-p.patch | 151 ++++++
 ...-zip-add-zip-comp-high-perf-mode-con.patch | 125 +++++
 ...-zip-save-capability-registers-in-pr.patch | 159 ++++++
 ...jh7110-correct-deferred-probe-return.patch |  54 ++
 .../crypto-qat-add-null-pointer-check.patch   |  40 ++
 ...pto-qat-add-sysfs_added-flag-for-ras.patch |  89 ++++
 ...d-sysfs_added-flag-for-rate-limiting.patch |  89 ++++
 ...qat-fix-error-path-in-add_update_sla.patch |  58 +++
 ...pto-qat-fix-mutex-ordering-in-adf_rl.patch |  46 ++
 ...at-prevent-underflow-in-rp2srv_store.patch |  39 ++
 ...a-add-a-check-for-allocation-failure.patch |  38 ++
 ...urn-crypto_aead_setkey-to-transfer-t.patch |  38 ++
 ...add-error-handling-for-dma_map_sg-ca.patch |  72 +++
 ...oid-skcipher-fallback-code-duplicati.patch | 148 ++++++
 ...-not-resize-req-src-when-doing-hash-.patch |  99 ++++
 .../crypto-sahara-fix-ahash-reqsize.patch     |  37 ++
 ...to-sahara-fix-ahash-selftest-failure.patch |  41 ++
 ...ypto-sahara-fix-cbc-selftest-failure.patch |  94 ++++
 ...x-error-handling-in-sahara_hw_descri.patch |  54 ++
 ...x-processing-hash-requests-with-req-.patch |  56 +++
 ...x-processing-requests-with-cryptlen-.patch |  72 +++
 ...x-wait_for_completion_timeout-error-.patch |  70 +++
 ...hara-handle-zero-length-aes-requests.patch |  36 ++
 ...prove-error-handling-in-sahara_sha_p.patch |  51 ++
 ...to-sahara-remove-flags_new_key-logic.patch | 105 ++++
 ...to-scomp-fix-req-dst-buffer-overflow.patch |  57 +++
 ...rtio-handle-dataq-logic-with-tasklet.patch |  99 ++++
 ...it-for-tasklet-to-complete-on-device.patch |  43 ++
 ...jump_label_transform_static-override.patch |  45 ++
 queue-6.7/dlm-fix-format-seq-ops-type-4.patch |  38 ++
 ...r-dev-dma_mem-to-null-after-freeing-.patch |  44 ++
 ...ix-a-use-after-free-in-kv_parse_powe.patch |  48 ++
 ...lk-zynqmp-calculate-closest-mux-rate.patch |  61 +++
 ...nqmp-update-divider-round-rate-logic.patch | 121 +++++
 ...i-fix-some-event-id-for-hisilicon-uc.patch |  39 ++
 ...loongson2_thermal-fix-incorrect-ptr_.patch |  94 ++++
 ...avoid-stringop-overflow-warnings-for.patch |  65 +++
 ...check-writeback-connectors-in-create.patch |  50 ++
 ...fix-null-pointer-dereference-at-hibe.patch |  47 ++
 ...return-drm_connector-from-find_first.patch | 108 ++++
 ...use-drm_connector-in-create_stream_f.patch | 211 ++++++++
 ...-double-free-in-amdgpu_parse_extende.patch | 198 ++++++++
 ...-pm-fix-a-double-free-in-si_dpm_init.patch |  45 ++
 ...fix-a-memleak-in-smu7_hwmgr_backend_.patch |  53 ++
 ...fs-fix-error-code-when-smc-register-.patch |  48 ++
 ...rm-list-is-non-empty-before-utilizin.patch |  81 +++
 ...ype-of-dbg_flags-in-struct-kfd_proce.patch |  48 ++
 ...mhdp8546-fix-use-of-uninitialized-va.patch |  38 ++
 ...fix-typo-in-post_disable-description.patch |  36 ++
 ...-mipi-dsi-fix-a-couple-of-building-w.patch |  43 ++
 ...58767-fix-return-value-on-error-case.patch |  39 ++
 ...s015-drop-buggy-__exit-annotation-fo.patch |  52 ++
 ..._mst-fix-fractional-dsc-bpp-handling.patch | 203 ++++++++
 ...e-errors-from-drm_modeset_register_a.patch |  54 ++
 ...-move-releasing-gem-object-away-from.patch |  54 ++
 ...-lcdc-fix-double-free-of-driver-data.patch |  58 +++
 ...add-phy_mtk_dp-module-as-pre-depende.patch |  48 ++
 ...-underrun-in-vdo1-when-switches-off-.patch |  41 ++
 ...ove-the-redundant-driver-data-for-dp.patch |  62 +++
 ...urn-error-if-mdp-rdma-failed-to-enab.patch |  41 ++
 .../drm-msm-a6xx-add-qmp-dependency.patch     |  45 ++
 .../drm-msm-adreno-fix-a680-chip-id.patch     |  40 ++
 ...missing-safe_lut_tbl-in-sc8180x-cata.patch |  42 ++
 ...sm-dpu-correct-clk-bit-for-wb2-block.patch |  74 +++
 ...-enable-and-frame_count-parameters-f.patch | 246 +++++++++
 ...rm-msm-dpu-enable-smartdma-on-sm8450.patch | 101 ++++
 ...u-populate-sspp-scaler-block-version.patch | 349 +++++++++++++
 ...m-msm-dpu-set-input_sel-bit-for-intf.patch | 100 ++++
 ...pm_runtime_resume_and_get-to-prevent.patch |  43 ++
 ...m-mdp4-flush-vblank-event-on-disable.patch |  53 ++
 ...e-fix-warning-directly-dereferencing.patch |  58 +++
 ...kd35t133-hold-panel-in-reset-for-unp.patch |  42 ++
 ...1d-hold-panel-in-reset-for-unprepare.patch |  39 ++
 ...rm-panel-st7701-fix-avcl-calculation.patch |  46 ++
 ...ore-core_mask-for-poweroff-and-disab.patch |  84 ++++
 ...lly-power-off-gpu-cores-in-panfrost_.patch | 127 +++++
 ...eck-return-value-of-radeon_ring_lock.patch |  42 ++
 ...-the-alloc_workqueue-return-value-in.patch |  46 ++
 ...ix-a-memleak-in-sumo_parse_power_tab.patch |  41 ++
 ...fix-integer-overflow-issues-in-r100_.patch |  52 ++
 ...cs-fix-possible-int-overflows-in-r60.patch |  51 ++
 ...ty_dpm-fix-a-memleak-in-trinity_pars.patch |  41 ++
 ...unds-limiting-when-given-a-malformed.patch |  54 ++
 ...-check-for-k2g-in-in-dispc_softreset.patch |  57 +++
 queue-6.7/drm-tidss-fix-dss-reset.patch       | 106 ++++
 ...-move-reset-to-the-end-of-dispc_init.patch |  55 ++
 ...turn-error-value-from-from-softreset.patch |  66 +++
 .../drm-tilcdc-fix-irq-free-on-unload.patch   |  40 ++
 .../dt-bindings-arm-qcom-fix-html-link.patch  |  43 ++
 ...a-mediatek-mdp3-correct-rdma-and-wro.patch | 125 +++++
 ...x-possible-out-of-bounds-string-acce.patch |  91 ++++
 ...o-when-remounting-if-setvariable-is-.patch | 109 ++++
 .../efivarfs-free-s_fs_info-on-unmount.patch  |  43 ++
 ...ry-leak-on-short-lived-bounced-pages.patch |  50 ++
 .../f2fs-fix-to-avoid-dirent-corruption.patch |  60 +++
 ...k-compress-file-in-f2fs_move_file_ra.patch |  40 ++
 ...k-return-value-of-f2fs_recover_xattr.patch |  70 +++
 ...te-iostat-correctly-in-f2fs_filemap_.patch |  36 ++
 ...-on-block-writeback-for-post_read-ca.patch |  69 +++
 ...s-restrict-max-filesize-for-16k-f2fs.patch |  46 ++
 .../fbdev-imxfb-fix-left-margin-setting.patch | 121 +++++
 ...e-correct-initializer-macros-for-str.patch |  77 +++
 ...eecom-fix-memory-leaks-in-error-path.patch |  82 +++
 ...fix-an-off-by-one-in-ti_sci_debugfs_.patch |  55 ++
 ...equest-originates-from-old-mount-api.patch |  61 +++
 ...dep-false-positive-in-watchqueue-pip.patch |  74 +++
 ...fix-kernel-bug-in-gfs2_quota_cleanup.patch |  95 ++++
 ...null-pointer-dereference-in-gfs2_rgr.patch |  40 ++
 ...orward-declaration-of-struct-gpio_de.patch |  41 ++
 ...he-gpio-device-from-the-list-when-it.patch |  53 ++
 ...tatic-functions-that-are-called-with.patch |  66 +++
 ...tex-to-protect-the-list-of-gpio-devi.patch | 400 +++++++++++++++
 ...n-fix-two-memleaks-in-radeon_vm_init.patch |  48 ++
 ...missing-clk_disable_unprepare-in-stm.patch |  36 ++
 ...b-iser-prevent-invalidating-wrong-mr.patch | 133 +++++
 ...l-pointer-dereference-issues-in-ice_.patch |  50 ++
 ...exthdr_fragment-handling-in-ip6_tnl_.patch | 173 +++++++
 ...-ip_pktinfo-on-cache-report-igmp-msg.patch |  72 +++
 ...-size-check-of-v1-server-list-header.patch |  45 ++
 .../keys-encrypted-add-check-for-strsep.patch |  37 ++
 ...onf-stringify-the-printed-errno-in-s.patch |  59 +++
 ...ixer-test-fix-the-number-of-paramete.patch |  58 +++
 ...ixer-test-fix-the-print-format-speci.patch |  64 +++
 ...date-the-zero-field-of-packet-header.patch |  48 ++
 ...x-unchecked-dereference-in-debugfs_p.patch |  50 ++
 ...ndle-errors-from-alloc_string_stream.patch |  86 ++++
 ...v-handle-pending-exceptions-on-guest.patch |  62 +++
 ....c-add-header-file-to-fix-build-erro.patch |  44 ++
 ...-flush-io-with-array-reconfiguration.patch |  96 ++++
 ...edia-amphion-fix-vpu-core-alias-name.patch |  41 ++
 queue-6.7/media-bttv-add-back-vbi-hack.patch  |  66 +++
 ..._streaming-should-return-a-proper-er.patch |  88 ++++
 ...x-fix-a-memleak-in-cx231xx_init_isoc.patch |  51 ++
 ...s-media-rkisp1-fix-the-port-descript.patch |  54 ++
 ...nds-m88ds3103-fix-a-memory-leak-in-a.patch |  54 ++
 ...p-refcount-on-error-path-in-dvb_devi.patch |  35 ++
 ...t9m114-use-fsleep-in-place-of-udelay.patch |  53 ++
 ...sis-drop-extra-clock-enable-at-probe.patch |  81 +++
 ...pi-csis-fix-clock-handling-in-remove.patch |  46 ++
 ...emove-cancel-worker-in-mtk_jpeg_remo.patch |  43 ++
 ...x-use-after-free-on-context-disconne.patch |  46 ++
 ...-rkisp1-fix-media-device-memory-leak.patch |  57 +++
 ...-memory-leaks-in-rkisp1_isp_unregist.patch |  38 ++
 ...k-the-try_-decoder_cmd-stateless-ioc.patch |  42 ++
 ...l-async-fix-duplicated-list-deletion.patch |  42 ++
 ...n-hook-the-try_-decoder_cmd-stateles.patch |  56 +++
 ...f2-request-more-buffers-for-vb2_read.patch |  65 +++
 ...the-try_-decoder_cmd-stateless-ioctl.patch |  42 ++
 ...ble-the-gige-port-in-mlxbf_gige_open.patch |  68 +++
 ...bf_gige-fix-intermittent-no-ip-issue.patch |  92 ++++
 ...-sdhci_am654-fix-ti-soc-dependencies.patch |  48 ++
 ...c-sdhci_omap-fix-ti-soc-dependencies.patch |  48 ++
 ...ull-pointer-dereference-caused-by-ft.patch |  85 ++++
 ...ement-ifc_timeout_msecs-for-nand-con.patch |  49 ++
 ...-netlink-major-minor-version-numbers.patch | 202 ++++++++
 ...-fix-skb-leak-and-crash-on-ooo-frags.patch | 149 ++++++
 ...les-mark-newset-as-dead-on-transacti.patch |  50 ++
 ...les-validate-chain-type-update-if-av.patch |  47 ++
 ...-objective-cred-in-nfs_access_login_.patch |  40 ++
 ...ure-we-handle-the-error-nfs4err_retu.patch |  53 ++
 ...ap-max_hw_sectors-to-blk_def_max_sec.patch |  59 +++
 ...ee-in-of_parse_phandle_with_args_map.patch | 231 +++++++++
 ...of_count_phandle_with_args-expected-.patch |  38 ++
 ...m-cmn-fix-hn-f-class_occup_id-events.patch |  40 ++
 ...ncore-fix-null-pointer-dereference-i.patch |  65 +++
 ...-intel-vsec-fix-xa_alloc-memory-leak.patch | 105 ++++
 ...s-block-driver-s-calculation-of-layo.patch |  92 ++++
 ...powerpc-44x-select-i2c-for-currituck.patch |  43 ++
 ...avres.o-to-always-y-instead-of-extra.patch |  50 ++
 ...add-return-value-check-in-affinity_d.patch |  67 +++
 ...add-a-null-pointer-check-in-update_e.patch |  55 ++
 ...add-a-null-pointer-check-in-opal_eve.patch |  37 ++
 ...add-a-null-pointer-check-in-opal_pow.patch |  41 ++
 ...add-a-null-pointer-check-to-scom_deb.patch |  41 ++
 ...memhp-fix-access-beyond-end-of-drmem.patch | 101 ++++
 ...id-warning-on-invalid-token-argument.patch |  94 ++++
 ...fix-possible-overflow-in-persistent_.patch |  46 ++
 ...2-fix-enable-count-for-clk-in-.probe.patch |  80 +++
 ...eight32-in-stm32_pwm_detect_channels.patch |  66 +++
 ...ppropriate-err-code-for-unsupported-.patch |  52 ++
 ...-hns-fix-memory-leak-in-free_mr_init.patch |  40 ++
 ...ce-uninitialized-symbol-smatch-warni.patch |  82 +++
 ...e-add-200ms-delay-to-wait-fw-hpd-sta.patch |  41 ++
 ...rm-annotate-dma-fence-critical-secti.patch | 191 +++++++
 ...-annotate-dma-fence-critical-section.patch | 176 +++++++
 ...-cleanup-of-call-s-recvmsg_queue-and.patch |  48 ++
 ...390-bpf-fix-gotol-with-large-offsets.patch |  39 ++
 ...e-min_vruntime-for-reweight_entity-c.patch |  58 +++
 ...the-proper-data-type-for-blist-flags.patch |  40 ++
 ...-fnic-return-error-if-vmalloc-failed.patch |  44 ++
 ...check-before-using-pointer-variables.patch |  51 ++
 ...rrect-the-number-of-global-debugfs-r.patch |  42 ++
 ...place-with-standard-error-code-retur.patch |  63 +++
 ...llback-some-operations-if-flr-failed.patch |  55 ++
 ...st_entry-null-check-warning-in-lpfc_.patch |  50 ++
 ...x-the-return-value-of-ufs_qcom_ice_p.patch |  40 ++
 ...x-the-return-value-when-platform_get.patch |  40 ++
 queue-6.7/sctp-fix-busy-polling.patch         |  54 ++
 ...support-msg_errqueue-flag-in-recvmsg.patch |  59 +++
 ...-bpf-fix-erroneous-bitmask-operation.patch |  52 ++
 ...lax-time_tai-test-for-equal-timestam.patch |  53 ++
 ...x-grep-checking-for-fib_nexthop_mult.patch |  68 +++
 ...specify-the-interface-when-do-arping.patch |  48 ++
 ...c-fix-error-handling-in-fpu-vmx-pree.patch |  88 ++++
 ...-fix-for-send_receive_unaligned-test.patch |  93 ++++
 ...r-priority-for-bind-with-af_unspec-o.patch |  55 ++
 queue-6.7/series                              | 381 ++++++++++++++
 ...x-dis_cap_alloc-and-retain_on_pc-con.patch |  70 +++
 ...-llcc-fix-llcc_trp_attr2_cfgn-offset.patch |  39 ++
 ...spi-add-missing-clk_disable_unprepar.patch |  51 ++
 ...siof-enforce-fixed-dtdl-for-r-car-h3.patch |  80 +++
 ...qspi-fix-driver-kconfig-dependencies.patch |  42 ++
 ...xprt_switch_find_current_entry-logic.patch |  35 ++
 ...up-v4.1-backchannel-request-timeouts.patch | 107 ++++
 ...-second-alu64_smod_x-to-alu64_smod_k.patch |  48 ++
 ...-null-pointer-dereference-in-zone-re.patch |  47 ++
 ...-logic-which-reduces-credit-update-m.patch |  69 +++
 ...d-credit-update-during-setting-so_rc.patch | 189 +++++++
 ...35_wdt-fix-wdioc_settimeout-handling.patch |  57 +++
 ...t-only-claim-unknown-nmi-if-from-ilo.patch |  51 ++
 ...-drop-runtime-pm-reference-count-whe.patch |  72 +++
 ...atchdog-set-cdev-owner-before-adding.patch |  61 +++
 ...fi-ath11k-defer-on-rproc_get-failure.patch |  57 +++
 ...x-the-error-handler-of-rfkill-config.patch |  59 +++
 ...fg80211-correct-comment-about-mld-id.patch |  46 ++
 ...rse-all-ml-elements-in-an-ml-probe-r.patch |  98 ++++
 ...ssign-phy_ctxt-before-esr-activation.patch |  55 ++
 ...-t-support-triggered-eht-cqi-feedbac.patch |  39 ++
 ...wifi-fix-out-of-bound-copy_from_user.patch |  44 ++
 ...-do-not-warn-if-valid-link-pair-was-.patch |  40 ++
 ...ifi-mvm-send-tx-path-flush-in-rfkill.patch |  42 ++
 ...-set-siso-mimo-chains-to-1-in-fw-smp.patch |  49 ++
 .../wifi-libertas-stop-selecting-wext.patch   |  37 ++
 ...80211-fix-advertised-ttlm-scheduling.patch | 112 +++++
 ...po-in-mt76_get_of_eeprom_from_nvmem-.patch |  45 ++
 ...-also-mt7981-is-3t3r-but-nss2-on-5-g.patch |  41 ++
 ...-fallback-to-non-wed-mode-if-platfor.patch |  39 ++
 ...-fix-eeprom-offset-of-tssi-flag-on-m.patch |  38 ++
 ...-fix-clc-command-timeout-when-suspen.patch | 103 ++++
 ...-fix-country-count-limitation-for-cl.patch |  65 +++
 ...t76-mt7921-fix-wrong-6ghz-power-type.patch | 102 ++++
 ...s-fix-workqueue-problem-causes-sta-a.patch | 180 +++++++
 ...7996-fix-alignment-of-sta-info-event.patch |  36 ++
 ...-fix-mt7996_mcu_all_sta_info_event-s.patch |  52 ++
 ...-fix-rate-usage-of-inband-discovery-.patch |  42 ++
 ...-fix-the-size-of-struct-bss_rate_tlv.patch |  36 ++
 ...-fix-uninitialized-variable-in-parsi.patch |  35 ++
 ...k-for-allocation-failure-in-plfxlc_u.patch |  41 ++
 ...wifi-rtlwifi-add-calculate_bit_shift.patch |  43 ++
 ...8188ee-phy-using-calculate_bit_shift.patch |  77 +++
 ...i-rtl8192c-using-calculate_bit_shift.patch |  74 +++
 ...-rtl8192ce-using-calculate_bit_shift.patch |  68 +++
 ...-rtl8192cu-using-calculate_bit_shift.patch |  55 ++
 ...-rtl8192de-using-calculate_bit_shift.patch |  78 +++
 ...-rtl8192ee-using-calculate_bit_shift.patch |  86 ++++
 ...-rtl8192se-using-calculate_bit_shift.patch |  78 +++
 ...8821ae-phy-fix-an-undefined-bitwise-.patch |  59 +++
 ...8-fix-rx-filter-in-fif_allmulti-flag.patch |  42 ++
 ...honor-the-host-max_req_size-in-the-r.patch | 119 +++++
 ...flag_irq_enable-leaking-timer-reprog.patch | 121 +++++
 ...ib-fix-overflow-when-counting-digits.patch |  66 +++
 ...6-mce-inject-clear-test-status-value.patch |  57 +++
 ...tel-set-new-revision-only-after-a-su.patch |  68 +++
 382 files changed, 27425 insertions(+)
 create mode 100644 queue-6.7/accel-habanalabs-fix-information-leak-in-sec_attest_.patch
 create mode 100644 queue-6.7/acpi-extlog-clear-extended-error-log-status-when-ras.patch
 create mode 100644 queue-6.7/acpi-lpit-avoid-u32-multiplication-overflow.patch
 create mode 100644 queue-6.7/acpi-lpss-fix-the-fractional-clock-divider-flags.patch
 create mode 100644 queue-6.7/acpi-video-check-for-error-while-searching-for-backl.patch
 create mode 100644 queue-6.7/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
 create mode 100644 queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
 create mode 100644 queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-10152
 create mode 100644 queue-6.7/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
 create mode 100644 queue-6.7/alsa-scarlett2-add-missing-mutex-lock-around-get-met.patch
 create mode 100644 queue-6.7/arm-davinci-always-select-config_cpu_arm926t.patch
 create mode 100644 queue-6.7/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
 create mode 100644 queue-6.7/arm-dts-qcom-msm8226-provide-dsi-phy-clocks-to-mmcc.patch
 create mode 100644 queue-6.7/arm-dts-qcom-sdx65-correct-pcie-ep-phy-names.patch
 create mode 100644 queue-6.7/arm-dts-qcom-sdx65-correct-spmi-node-name.patch
 create mode 100644 queue-6.7/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
 create mode 100644 queue-6.7/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
 create mode 100644 queue-6.7/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
 create mode 100644 queue-6.7/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
 create mode 100644 queue-6.7/arm64-dts-mediatek-mt8186-fix-address-warning-for-ad.patch
 create mode 100644 queue-6.7/arm64-dts-mediatek-mt8186-fix-alias-prefix-for-ovl_2.patch
 create mode 100644 queue-6.7/arm64-dts-mediatek-mt8195-revise-vdosys-rdma-node-na.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-acer-aspire1-correct-audio-codec-defi.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-qrb2210-rb1-use-usb-host-mode.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-qrb4210-rb2-don-t-force-usb-periphera.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sa8775p-fix-usb-wakeup-interrupt-type.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sa8775p-make-watchdog-bark-interrupt-.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc8180x-fix-up-pcie-nodes.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc8180x-mark-pcie-hosts-cache-coheren.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc8180x-primus-fix-hall_int-polarity.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc8280xp-x13s-add-missing-camera-led-.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sc8280xp-x13s-use-the-correct-dp-phy-.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm6125-add-interrupts-to-dwc3-usb-con.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm6375-fix-usb-wakeup-interrupt-types.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm6375-hook-up-mpm.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8150-make-dispcc-cast-minimal-vote-.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8350-fix-dma0-address.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8450-correct-tx-soundwire-clock.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8550-correct-tx-soundwire-clock.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8550-fix-usb-wakeup-interrupt-types.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8550-separate-out-x3-idle-state.patch
 create mode 100644 queue-6.7/arm64-dts-qcom-sm8550-update-idle-state-time-require.patch
 create mode 100644 queue-6.7/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
 create mode 100644 queue-6.7/arm64-dts-rockchip-fix-led-pinctrl-of-lubancat-1.patch
 create mode 100644 queue-6.7/arm64-dts-ti-iot2050-re-add-aliases.patch
 create mode 100644 queue-6.7/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
 create mode 100644 queue-6.7/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
 create mode 100644 queue-6.7/arm64-dts-xilinx-apply-overlays-to-base-dtbs.patch
 create mode 100644 queue-6.7/asm-generic-fix-32-bit-__generic_cmpxchg_local.patch
 create mode 100644 queue-6.7/asoc-amd-vangogh-drop-conflicting-acpi-based-probing.patch
 create mode 100644 queue-6.7/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
 create mode 100644 queue-6.7/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
 create mode 100644 queue-6.7/asoc-fsl_rpmsg-update-kconfig-dependencies.patch
 create mode 100644 queue-6.7/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
 create mode 100644 queue-6.7/asoc-intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch
 create mode 100644 queue-6.7/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
 create mode 100644 queue-6.7/asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch
 create mode 100644 queue-6.7/asoc-sof-topology-use-partial-match-for-disconnectin.patch
 create mode 100644 queue-6.7/asoc-tas2781-add-support-for-fw-version-0x0503.patch
 create mode 100644 queue-6.7/blk-cgroup-fix-rcu-lockdep-warning-in-blkg_lookup.patch
 create mode 100644 queue-6.7/block-add-check-of-minors-and-first_minor-in-device_.patch
 create mode 100644 queue-6.7/block-set-memalloc_noio-to-false-on-device_add_disk-.patch
 create mode 100644 queue-6.7/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
 create mode 100644 queue-6.7/bluetooth-btmtkuart-fix-recv_buf-return-value.patch
 create mode 100644 queue-6.7/bluetooth-btnxpuart-fix-recv_buf-return-value.patch
 create mode 100644 queue-6.7/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
 create mode 100644 queue-6.7/bpf-add-crosstask-check-to-__bpf_get_stack.patch
 create mode 100644 queue-6.7/bpf-add-kf_rcu-flag-to-bpf_refcount_acquire_impl.patch
 create mode 100644 queue-6.7/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
 create mode 100644 queue-6.7/bpf-defer-the-free-of-inner-map-when-necessary.patch
 create mode 100644 queue-6.7/bpf-enforce-precision-of-r0-on-callback-return.patch
 create mode 100644 queue-6.7/bpf-fix-a-race-condition-between-btf_put-and-map_fre.patch
 create mode 100644 queue-6.7/bpf-fix-accesses-to-uninit-stack-slots.patch
 create mode 100644 queue-6.7/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
 create mode 100644 queue-6.7/bpf-fix-verification-of-indirect-var-off-stack-acces.patch
 create mode 100644 queue-6.7/bpf-guard-stack-limits-against-32bit-overflow.patch
 create mode 100644 queue-6.7/bpf-limit-the-number-of-kprobes-when-attaching-progr.patch
 create mode 100644 queue-6.7/bpf-limit-the-number-of-uprobes-when-attaching-progr.patch
 create mode 100644 queue-6.7/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
 create mode 100644 queue-6.7/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
 create mode 100644 queue-6.7/bpf-use-c-unit_size-to-select-target-cache-during-fr.patch
 create mode 100644 queue-6.7/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
 create mode 100644 queue-6.7/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
 create mode 100644 queue-6.7/clk-qcom-dispcc-sm8550-update-disp-pll-settings.patch
 create mode 100644 queue-6.7/clk-qcom-dispcc-sm8550-use-the-correct-pll-configura.patch
 create mode 100644 queue-6.7/clk-qcom-gcc-sm8550-add-the-missing-retain_ff_enable.patch
 create mode 100644 queue-6.7/clk-qcom-gcc-sm8550-mark-rcgs-shared-where-applicabl.patch
 create mode 100644 queue-6.7/clk-qcom-gcc-sm8550-mark-the-pcie-gdscs-votable.patch
 create mode 100644 queue-6.7/clk-qcom-gcc-sm8550-use-collapse-voting-for-pcie-gds.patch
 create mode 100644 queue-6.7/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
 create mode 100644 queue-6.7/clk-qcom-gpucc-sm8550-update-gpu-pll-settings.patch
 create mode 100644 queue-6.7/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
 create mode 100644 queue-6.7/clk-renesas-rzg2l-check-reset-monitor-registers.patch
 create mode 100644 queue-6.7/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
 create mode 100644 queue-6.7/clk-rs9-fix-dif-oen-bit-placement-on-9fgv0241.patch
 create mode 100644 queue-6.7/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
 create mode 100644 queue-6.7/clk-sp7021-fix-return-value-check-in-sp7021_clk_prob.patch
 create mode 100644 queue-6.7/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
 create mode 100644 queue-6.7/cpuidle-haltpoll-do-not-enable-interrupts-when-enter.patch
 create mode 100644 queue-6.7/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
 create mode 100644 queue-6.7/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
 create mode 100644 queue-6.7/crypto-hisilicon-hpre-save-capability-registers-in-p.patch
 create mode 100644 queue-6.7/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
 create mode 100644 queue-6.7/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
 create mode 100644 queue-6.7/crypto-hisilicon-sec2-save-capability-registers-in-p.patch
 create mode 100644 queue-6.7/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
 create mode 100644 queue-6.7/crypto-hisilicon-zip-save-capability-registers-in-pr.patch
 create mode 100644 queue-6.7/crypto-jh7110-correct-deferred-probe-return.patch
 create mode 100644 queue-6.7/crypto-qat-add-null-pointer-check.patch
 create mode 100644 queue-6.7/crypto-qat-add-sysfs_added-flag-for-ras.patch
 create mode 100644 queue-6.7/crypto-qat-add-sysfs_added-flag-for-rate-limiting.patch
 create mode 100644 queue-6.7/crypto-qat-fix-error-path-in-add_update_sla.patch
 create mode 100644 queue-6.7/crypto-qat-fix-mutex-ordering-in-adf_rl.patch
 create mode 100644 queue-6.7/crypto-qat-prevent-underflow-in-rp2srv_store.patch
 create mode 100644 queue-6.7/crypto-rsa-add-a-check-for-allocation-failure.patch
 create mode 100644 queue-6.7/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
 create mode 100644 queue-6.7/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
 create mode 100644 queue-6.7/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
 create mode 100644 queue-6.7/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
 create mode 100644 queue-6.7/crypto-sahara-fix-ahash-reqsize.patch
 create mode 100644 queue-6.7/crypto-sahara-fix-ahash-selftest-failure.patch
 create mode 100644 queue-6.7/crypto-sahara-fix-cbc-selftest-failure.patch
 create mode 100644 queue-6.7/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
 create mode 100644 queue-6.7/crypto-sahara-fix-processing-hash-requests-with-req-.patch
 create mode 100644 queue-6.7/crypto-sahara-fix-processing-requests-with-cryptlen-.patch
 create mode 100644 queue-6.7/crypto-sahara-fix-wait_for_completion_timeout-error-.patch
 create mode 100644 queue-6.7/crypto-sahara-handle-zero-length-aes-requests.patch
 create mode 100644 queue-6.7/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
 create mode 100644 queue-6.7/crypto-sahara-remove-flags_new_key-logic.patch
 create mode 100644 queue-6.7/crypto-scomp-fix-req-dst-buffer-overflow.patch
 create mode 100644 queue-6.7/crypto-virtio-handle-dataq-logic-with-tasklet.patch
 create mode 100644 queue-6.7/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
 create mode 100644 queue-6.7/csky-fix-arch_jump_label_transform_static-override.patch
 create mode 100644 queue-6.7/dlm-fix-format-seq-ops-type-4.patch
 create mode 100644 queue-6.7/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
 create mode 100644 queue-6.7/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
 create mode 100644 queue-6.7/drivers-clk-zynqmp-calculate-closest-mux-rate.patch
 create mode 100644 queue-6.7/drivers-clk-zynqmp-update-divider-round-rate-logic.patch
 create mode 100644 queue-6.7/drivers-perf-hisi-fix-some-event-id-for-hisilicon-uc.patch
 create mode 100644 queue-6.7/drivers-thermal-loongson2_thermal-fix-incorrect-ptr_.patch
 create mode 100644 queue-6.7/drm-amd-display-avoid-stringop-overflow-warnings-for.patch
 create mode 100644 queue-6.7/drm-amd-display-check-writeback-connectors-in-create.patch
 create mode 100644 queue-6.7/drm-amd-display-fix-null-pointer-dereference-at-hibe.patch
 create mode 100644 queue-6.7/drm-amd-display-return-drm_connector-from-find_first.patch
 create mode 100644 queue-6.7/drm-amd-display-use-drm_connector-in-create_stream_f.patch
 create mode 100644 queue-6.7/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
 create mode 100644 queue-6.7/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
 create mode 100644 queue-6.7/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
 create mode 100644 queue-6.7/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
 create mode 100644 queue-6.7/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
 create mode 100644 queue-6.7/drm-amdkfd-fix-type-of-dbg_flags-in-struct-kfd_proce.patch
 create mode 100644 queue-6.7/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
 create mode 100644 queue-6.7/drm-bridge-fix-typo-in-post_disable-description.patch
 create mode 100644 queue-6.7/drm-bridge-imx93-mipi-dsi-fix-a-couple-of-building-w.patch
 create mode 100644 queue-6.7/drm-bridge-tc358767-fix-return-value-on-error-case.patch
 create mode 100644 queue-6.7/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
 create mode 100644 queue-6.7/drm-dp_mst-fix-fractional-dsc-bpp-handling.patch
 create mode 100644 queue-6.7/drm-drv-propagate-errors-from-drm_modeset_register_a.patch
 create mode 100644 queue-6.7/drm-i915-display-move-releasing-gem-object-away-from.patch
 create mode 100644 queue-6.7/drm-imx-lcdc-fix-double-free-of-driver-data.patch
 create mode 100644 queue-6.7/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
 create mode 100644 queue-6.7/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
 create mode 100644 queue-6.7/drm-mediatek-remove-the-redundant-driver-data-for-dp.patch
 create mode 100644 queue-6.7/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
 create mode 100644 queue-6.7/drm-msm-a6xx-add-qmp-dependency.patch
 create mode 100644 queue-6.7/drm-msm-adreno-fix-a680-chip-id.patch
 create mode 100644 queue-6.7/drm-msm-dpu-add-missing-safe_lut_tbl-in-sc8180x-cata.patch
 create mode 100644 queue-6.7/drm-msm-dpu-correct-clk-bit-for-wb2-block.patch
 create mode 100644 queue-6.7/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
 create mode 100644 queue-6.7/drm-msm-dpu-enable-smartdma-on-sm8450.patch
 create mode 100644 queue-6.7/drm-msm-dpu-populate-sspp-scaler-block-version.patch
 create mode 100644 queue-6.7/drm-msm-dpu-set-input_sel-bit-for-intf.patch
 create mode 100644 queue-6.7/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
 create mode 100644 queue-6.7/drm-msm-mdp4-flush-vblank-event-on-disable.patch
 create mode 100644 queue-6.7/drm-nouveau-fence-fix-warning-directly-dereferencing.patch
 create mode 100644 queue-6.7/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
 create mode 100644 queue-6.7/drm-panel-nv3051d-hold-panel-in-reset-for-unprepare.patch
 create mode 100644 queue-6.7/drm-panel-st7701-fix-avcl-calculation.patch
 create mode 100644 queue-6.7/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
 create mode 100644 queue-6.7/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
 create mode 100644 queue-6.7/drm-radeon-check-return-value-of-radeon_ring_lock.patch
 create mode 100644 queue-6.7/drm-radeon-check-the-alloc_workqueue-return-value-in.patch
 create mode 100644 queue-6.7/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
 create mode 100644 queue-6.7/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
 create mode 100644 queue-6.7/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
 create mode 100644 queue-6.7/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
 create mode 100644 queue-6.7/drm-sched-fix-bounds-limiting-when-given-a-malformed.patch
 create mode 100644 queue-6.7/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
 create mode 100644 queue-6.7/drm-tidss-fix-dss-reset.patch
 create mode 100644 queue-6.7/drm-tidss-move-reset-to-the-end-of-dispc_init.patch
 create mode 100644 queue-6.7/drm-tidss-return-error-value-from-from-softreset.patch
 create mode 100644 queue-6.7/drm-tilcdc-fix-irq-free-on-unload.patch
 create mode 100644 queue-6.7/dt-bindings-arm-qcom-fix-html-link.patch
 create mode 100644 queue-6.7/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
 create mode 100644 queue-6.7/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
 create mode 100644 queue-6.7/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
 create mode 100644 queue-6.7/efivarfs-free-s_fs_info-on-unmount.patch
 create mode 100644 queue-6.7/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
 create mode 100644 queue-6.7/f2fs-fix-to-avoid-dirent-corruption.patch
 create mode 100644 queue-6.7/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
 create mode 100644 queue-6.7/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
 create mode 100644 queue-6.7/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
 create mode 100644 queue-6.7/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
 create mode 100644 queue-6.7/f2fs-restrict-max-filesize-for-16k-f2fs.patch
 create mode 100644 queue-6.7/fbdev-imxfb-fix-left-margin-setting.patch
 create mode 100644 queue-6.7/fbdev-sm712fb-use-correct-initializer-macros-for-str.patch
 create mode 100644 queue-6.7/firmware-qcom-qseecom-fix-memory-leaks-in-error-path.patch
 create mode 100644 queue-6.7/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
 create mode 100644 queue-6.7/fs-indicate-request-originates-from-old-mount-api.patch
 create mode 100644 queue-6.7/fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch
 create mode 100644 queue-6.7/gfs2-fix-kernel-bug-in-gfs2_quota_cleanup.patch
 create mode 100644 queue-6.7/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
 create mode 100644 queue-6.7/gpio-sysfs-fix-forward-declaration-of-struct-gpio_de.patch
 create mode 100644 queue-6.7/gpiolib-remove-the-gpio-device-from-the-list-when-it.patch
 create mode 100644 queue-6.7/gpiolib-rename-static-functions-that-are-called-with.patch
 create mode 100644 queue-6.7/gpiolib-use-a-mutex-to-protect-the-list-of-gpio-devi.patch
 create mode 100644 queue-6.7/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
 create mode 100644 queue-6.7/hwrng-stm32-add-missing-clk_disable_unprepare-in-stm.patch
 create mode 100644 queue-6.7/ib-iser-prevent-invalidating-wrong-mr.patch
 create mode 100644 queue-6.7/ice-fix-some-null-pointer-dereference-issues-in-ice_.patch
 create mode 100644 queue-6.7/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
 create mode 100644 queue-6.7/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
 create mode 100644 queue-6.7/keys-dns-fix-size-check-of-v1-server-list-header.patch
 create mode 100644 queue-6.7/keys-encrypted-add-check-for-strsep.patch
 create mode 100644 queue-6.7/kselftest-alsa-conf-stringify-the-printed-errno-in-s.patch
 create mode 100644 queue-6.7/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
 create mode 100644 queue-6.7/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
 create mode 100644 queue-6.7/ksmbd-validate-the-zero-field-of-packet-header.patch
 create mode 100644 queue-6.7/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
 create mode 100644 queue-6.7/kunit-debugfs-handle-errors-from-alloc_string_stream.patch
 create mode 100644 queue-6.7/kvm-ppc-book3s-hv-handle-pending-exceptions-on-guest.patch
 create mode 100644 queue-6.7/loongarch-signal.c-add-header-file-to-fix-build-erro.patch
 create mode 100644 queue-6.7/md-synchronize-flush-io-with-array-reconfiguration.patch
 create mode 100644 queue-6.7/media-amphion-fix-vpu-core-alias-name.patch
 create mode 100644 queue-6.7/media-bttv-add-back-vbi-hack.patch
 create mode 100644 queue-6.7/media-bttv-start_streaming-should-return-a-proper-er.patch
 create mode 100644 queue-6.7/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
 create mode 100644 queue-6.7/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
 create mode 100644 queue-6.7/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
 create mode 100644 queue-6.7/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
 create mode 100644 queue-6.7/media-i2c-mt9m114-use-fsleep-in-place-of-udelay.patch
 create mode 100644 queue-6.7/media-imx-mipi-csis-drop-extra-clock-enable-at-probe.patch
 create mode 100644 queue-6.7/media-imx-mipi-csis-fix-clock-handling-in-remove.patch
 create mode 100644 queue-6.7/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
 create mode 100644 queue-6.7/media-pvrusb2-fix-use-after-free-on-context-disconne.patch
 create mode 100644 queue-6.7/media-rkisp1-fix-media-device-memory-leak.patch
 create mode 100644 queue-6.7/media-rkisp1-fix-memory-leaks-in-rkisp1_isp_unregist.patch
 create mode 100644 queue-6.7/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
 create mode 100644 queue-6.7/media-v4l-async-fix-duplicated-list-deletion.patch
 create mode 100644 queue-6.7/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
 create mode 100644 queue-6.7/media-videobuf2-request-more-buffers-for-vb2_read.patch
 create mode 100644 queue-6.7/media-visl-hook-the-try_-decoder_cmd-stateless-ioctl.patch
 create mode 100644 queue-6.7/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
 create mode 100644 queue-6.7/mlxbf_gige-fix-intermittent-no-ip-issue.patch
 create mode 100644 queue-6.7/mmc-sdhci_am654-fix-ti-soc-dependencies.patch
 create mode 100644 queue-6.7/mmc-sdhci_omap-fix-ti-soc-dependencies.patch
 create mode 100644 queue-6.7/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
 create mode 100644 queue-6.7/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
 create mode 100644 queue-6.7/net-ncsi-fix-netlink-major-minor-version-numbers.patch
 create mode 100644 queue-6.7/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
 create mode 100644 queue-6.7/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
 create mode 100644 queue-6.7/netfilter-nf_tables-validate-chain-type-update-if-av.patch
 create mode 100644 queue-6.7/nfs-use-parent-s-objective-cred-in-nfs_access_login_.patch
 create mode 100644 queue-6.7/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
 create mode 100644 queue-6.7/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
 create mode 100644 queue-6.7/of-fix-double-free-in-of_parse_phandle_with_args_map.patch
 create mode 100644 queue-6.7/of-unittest-fix-of_count_phandle_with_args-expected-.patch
 create mode 100644 queue-6.7/perf-arm-cmn-fix-hn-f-class_occup_id-events.patch
 create mode 100644 queue-6.7/perf-x86-intel-uncore-fix-null-pointer-dereference-i.patch
 create mode 100644 queue-6.7/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
 create mode 100644 queue-6.7/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
 create mode 100644 queue-6.7/powerpc-44x-select-i2c-for-currituck.patch
 create mode 100644 queue-6.7/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
 create mode 100644 queue-6.7/powerpc-hv-gpci-add-return-value-check-in-affinity_d.patch
 create mode 100644 queue-6.7/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
 create mode 100644 queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
 create mode 100644 queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
 create mode 100644 queue-6.7/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
 create mode 100644 queue-6.7/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
 create mode 100644 queue-6.7/powerpc-rtas-avoid-warning-on-invalid-token-argument.patch
 create mode 100644 queue-6.7/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
 create mode 100644 queue-6.7/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
 create mode 100644 queue-6.7/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
 create mode 100644 queue-6.7/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
 create mode 100644 queue-6.7/rdma-hns-fix-memory-leak-in-free_mr_init.patch
 create mode 100644 queue-6.7/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
 create mode 100644 queue-6.7/revert-drm-bridge-add-200ms-delay-to-wait-fw-hpd-sta.patch
 create mode 100644 queue-6.7/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
 create mode 100644 queue-6.7/revert-drm-tidss-annotate-dma-fence-critical-section.patch
 create mode 100644 queue-6.7/rxrpc-fix-skbuff-cleanup-of-call-s-recvmsg_queue-and.patch
 create mode 100644 queue-6.7/s390-bpf-fix-gotol-with-large-offsets.patch
 create mode 100644 queue-6.7/sched-fair-update-min_vruntime-for-reweight_entity-c.patch
 create mode 100644 queue-6.7/scsi-bfa-use-the-proper-data-type-for-blist-flags.patch
 create mode 100644 queue-6.7/scsi-fnic-return-error-if-vmalloc-failed.patch
 create mode 100644 queue-6.7/scsi-hisi_sas-check-before-using-pointer-variables.patch
 create mode 100644 queue-6.7/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
 create mode 100644 queue-6.7/scsi-hisi_sas-replace-with-standard-error-code-retur.patch
 create mode 100644 queue-6.7/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
 create mode 100644 queue-6.7/scsi-lpfc-fix-list_entry-null-check-warning-in-lpfc_.patch
 create mode 100644 queue-6.7/scsi-ufs-qcom-fix-the-return-value-of-ufs_qcom_ice_p.patch
 create mode 100644 queue-6.7/scsi-ufs-qcom-fix-the-return-value-when-platform_get.patch
 create mode 100644 queue-6.7/sctp-fix-busy-polling.patch
 create mode 100644 queue-6.7/sctp-support-msg_errqueue-flag-in-recvmsg.patch
 create mode 100644 queue-6.7/selftests-bpf-fix-erroneous-bitmask-operation.patch
 create mode 100644 queue-6.7/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
 create mode 100644 queue-6.7/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
 create mode 100644 queue-6.7/selftests-net-specify-the-interface-when-do-arping.patch
 create mode 100644 queue-6.7/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
 create mode 100644 queue-6.7/selftests-xsk-fix-for-send_receive_unaligned-test.patch
 create mode 100644 queue-6.7/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
 create mode 100644 queue-6.7/series
 create mode 100644 queue-6.7/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
 create mode 100644 queue-6.7/soc-qcom-llcc-fix-llcc_trp_attr2_cfgn-offset.patch
 create mode 100644 queue-6.7/spi-cadence-quadspi-add-missing-clk_disable_unprepar.patch
 create mode 100644 queue-6.7/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
 create mode 100644 queue-6.7/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
 create mode 100644 queue-6.7/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
 create mode 100644 queue-6.7/sunrpc-fixup-v4.1-backchannel-request-timeouts.patch
 create mode 100644 queue-6.7/test_bpf-rename-second-alu64_smod_x-to-alu64_smod_k.patch
 create mode 100644 queue-6.7/thermal-core-fix-null-pointer-dereference-in-zone-re.patch
 create mode 100644 queue-6.7/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
 create mode 100644 queue-6.7/virtio-vsock-send-credit-update-during-setting-so_rc.patch
 create mode 100644 queue-6.7/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
 create mode 100644 queue-6.7/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
 create mode 100644 queue-6.7/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
 create mode 100644 queue-6.7/watchdog-set-cdev-owner-before-adding.patch
 create mode 100644 queue-6.7/wifi-ath11k-defer-on-rproc_get-failure.patch
 create mode 100644 queue-6.7/wifi-ath12k-fix-the-error-handler-of-rfkill-config.patch
 create mode 100644 queue-6.7/wifi-cfg80211-correct-comment-about-mld-id.patch
 create mode 100644 queue-6.7/wifi-cfg80211-parse-all-ml-elements-in-an-ml-probe-r.patch
 create mode 100644 queue-6.7/wifi-iwlwifi-assign-phy_ctxt-before-esr-activation.patch
 create mode 100644 queue-6.7/wifi-iwlwifi-don-t-support-triggered-eht-cqi-feedbac.patch
 create mode 100644 queue-6.7/wifi-iwlwifi-fix-out-of-bound-copy_from_user.patch
 create mode 100644 queue-6.7/wifi-iwlwifi-mvm-do-not-warn-if-valid-link-pair-was-.patch
 create mode 100644 queue-6.7/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
 create mode 100644 queue-6.7/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
 create mode 100644 queue-6.7/wifi-libertas-stop-selecting-wext.patch
 create mode 100644 queue-6.7/wifi-mac80211-fix-advertised-ttlm-scheduling.patch
 create mode 100644 queue-6.7/wifi-mt76-fix-typo-in-mt76_get_of_eeprom_from_nvmem-.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7915-also-mt7981-is-3t3r-but-nss2-on-5-g.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7915-fallback-to-non-wed-mode-if-platfor.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7915-fix-eeprom-offset-of-tssi-flag-on-m.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7921-fix-clc-command-timeout-when-suspen.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7921-fix-wrong-6ghz-power-type.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7996-fix-alignment-of-sta-info-event.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7996-fix-mt7996_mcu_all_sta_info_event-s.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7996-fix-the-size-of-struct-bss_rate_tlv.patch
 create mode 100644 queue-6.7/wifi-mt76-mt7996-fix-uninitialized-variable-in-parsi.patch
 create mode 100644 queue-6.7/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-add-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
 create mode 100644 queue-6.7/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
 create mode 100644 queue-6.7/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
 create mode 100644 queue-6.7/wifi-rtw88-sdio-honor-the-host-max_req_size-in-the-r.patch
 create mode 100644 queue-6.7/x86-fix-cpuidle_flag_irq_enable-leaking-timer-reprog.patch
 create mode 100644 queue-6.7/x86-lib-fix-overflow-when-counting-digits.patch
 create mode 100644 queue-6.7/x86-mce-inject-clear-test-status-value.patch
 create mode 100644 queue-6.7/x86-microcode-intel-set-new-revision-only-after-a-su.patch

diff --git a/queue-6.7/accel-habanalabs-fix-information-leak-in-sec_attest_.patch b/queue-6.7/accel-habanalabs-fix-information-leak-in-sec_attest_.patch
new file mode 100644
index 00000000000..cc66affc394
--- /dev/null
+++ b/queue-6.7/accel-habanalabs-fix-information-leak-in-sec_attest_.patch
@@ -0,0 +1,39 @@
+From b97c4f79a163658e7fb04d86df7eb311d2fd45f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 21:00:59 +0800
+Subject: accel/habanalabs: fix information leak in sec_attest_info()
+
+From: Xingyuan Mo <hdthky0@gmail.com>
+
+[ Upstream commit a9f07790a4b2250f0140e9a61c7f842fd9b618c7 ]
+
+This function may copy the pad0 field of struct hl_info_sec_attest to user
+mode which has not been initialized, resulting in leakage of kernel heap
+data to user mode. To prevent this, use kzalloc() to allocate and zero out
+the buffer, which can also eliminate other uninitialized holes, if any.
+
+Fixes: 0c88760f8f5e ("habanalabs/gaudi2: add secured attestation info uapi")
+Signed-off-by: Xingyuan Mo <hdthky0@gmail.com>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/accel/habanalabs/common/habanalabs_ioctl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/accel/habanalabs/common/habanalabs_ioctl.c b/drivers/accel/habanalabs/common/habanalabs_ioctl.c
+index 8ef36effb95b..a7cd625d82c0 100644
+--- a/drivers/accel/habanalabs/common/habanalabs_ioctl.c
++++ b/drivers/accel/habanalabs/common/habanalabs_ioctl.c
+@@ -685,7 +685,7 @@ static int sec_attest_info(struct hl_fpriv *hpriv, struct hl_info_args *args)
+ 	if (!sec_attest_info)
+ 		return -ENOMEM;
+ 
+-	info = kmalloc(sizeof(*info), GFP_KERNEL);
++	info = kzalloc(sizeof(*info), GFP_KERNEL);
+ 	if (!info) {
+ 		rc = -ENOMEM;
+ 		goto free_sec_attest_info;
+-- 
+2.43.0
+
diff --git a/queue-6.7/acpi-extlog-clear-extended-error-log-status-when-ras.patch b/queue-6.7/acpi-extlog-clear-extended-error-log-status-when-ras.patch
new file mode 100644
index 00000000000..03240fc720c
--- /dev/null
+++ b/queue-6.7/acpi-extlog-clear-extended-error-log-status-when-ras.patch
@@ -0,0 +1,48 @@
+From dd0d2017f7d896115fa97ff8179feecee67a8374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 13:22:39 -0800
+Subject: ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled
+ the error
+
+From: Tony Luck <tony.luck@intel.com>
+
+[ Upstream commit 38c872a9e96f72f2947affc0526cc05659367d3d ]
+
+When both CONFIG_RAS_CEC and CONFIG_ACPI_EXTLOG are enabled, Linux does
+not clear the status word of the BIOS supplied error record for corrected
+errors. This may prevent logging of subsequent uncorrected errors.
+
+Fix by clearing the status.
+
+Fixes: 23ba710a0864 ("x86/mce: Fix all mce notifiers to update the mce->kflags bitmask")
+Reported-by: Erwin Tsaur <erwin.tsaur@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_extlog.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
+index e120a96e1eae..71e8d4e7a36c 100644
+--- a/drivers/acpi/acpi_extlog.c
++++ b/drivers/acpi/acpi_extlog.c
+@@ -145,9 +145,14 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
+ 	static u32 err_seq;
+ 
+ 	estatus = extlog_elog_entry_check(cpu, bank);
+-	if (estatus == NULL || (mce->kflags & MCE_HANDLED_CEC))
++	if (!estatus)
+ 		return NOTIFY_DONE;
+ 
++	if (mce->kflags & MCE_HANDLED_CEC) {
++		estatus->block_status = 0;
++		return NOTIFY_DONE;
++	}
++
+ 	memcpy(elog_buf, (void *)estatus, ELOG_ENTRY_LEN);
+ 	/* clear record status to enable BIOS to update it again */
+ 	estatus->block_status = 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/acpi-lpit-avoid-u32-multiplication-overflow.patch b/queue-6.7/acpi-lpit-avoid-u32-multiplication-overflow.patch
new file mode 100644
index 00000000000..9223215e34e
--- /dev/null
+++ b/queue-6.7/acpi-lpit-avoid-u32-multiplication-overflow.patch
@@ -0,0 +1,40 @@
+From 3477c5f4e11d529e0c95a25f380ed503d4833282 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 21:08:59 +0300
+Subject: ACPI: LPIT: Avoid u32 multiplication overflow
+
+From: Nikita Kiryushin <kiryushin@ancud.ru>
+
+[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ]
+
+In lpit_update_residency() there is a possibility of overflow
+in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).
+
+Change multiplication to mul_u32_u32().
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: eeb2d80d502a ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support")
+Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c
+index c5598b6d5db8..794962c5c88e 100644
+--- a/drivers/acpi/acpi_lpit.c
++++ b/drivers/acpi/acpi_lpit.c
+@@ -105,7 +105,7 @@ static void lpit_update_residency(struct lpit_residency_info *info,
+ 		return;
+ 
+ 	info->frequency = lpit_native->counter_frequency ?
+-				lpit_native->counter_frequency : tsc_khz * 1000;
++				lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U);
+ 	if (!info->frequency)
+ 		info->frequency = 1;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/acpi-lpss-fix-the-fractional-clock-divider-flags.patch b/queue-6.7/acpi-lpss-fix-the-fractional-clock-divider-flags.patch
new file mode 100644
index 00000000000..37105424242
--- /dev/null
+++ b/queue-6.7/acpi-lpss-fix-the-fractional-clock-divider-flags.patch
@@ -0,0 +1,40 @@
+From 3b5f70b698926b82ef09911362d004ab68d79e4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 13:14:29 +0200
+Subject: ACPI: LPSS: Fix the fractional clock divider flags
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 3ebccf1d1ca74bbb78e6f8c38d1d172e468d91f8 ]
+
+The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags
+in the parameters and hence miscalculates the values in the clock
+divider. Fix this by applying the flag to the proper parameter.
+
+Fixes: 82f53f9ee577 ("clk: fractional-divider: Introduce POWER_OF_TWO_PS flag")
+Reported-by: Alex Vinarskis <alex.vinarskis@gmail.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 875de44961bf..d48407472dfb 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -461,8 +461,9 @@ static int register_device_clock(struct acpi_device *adev,
+ 		if (!clk_name)
+ 			return -ENOMEM;
+ 		clk = clk_register_fractional_divider(NULL, clk_name, parent,
++						      0, prv_base, 1, 15, 16, 15,
+ 						      CLK_FRAC_DIVIDER_POWER_OF_TWO_PS,
+-						      prv_base, 1, 15, 16, 15, 0, NULL);
++						      NULL);
+ 		parent = clk_name;
+ 
+ 		clk_name = kasprintf(GFP_KERNEL, "%s-update", devname);
+-- 
+2.43.0
+
diff --git a/queue-6.7/acpi-video-check-for-error-while-searching-for-backl.patch b/queue-6.7/acpi-video-check-for-error-while-searching-for-backl.patch
new file mode 100644
index 00000000000..9951d57ef6f
--- /dev/null
+++ b/queue-6.7/acpi-video-check-for-error-while-searching-for-backl.patch
@@ -0,0 +1,54 @@
+From 94e94c596b218470362258ebbd5d8cf5d62d85ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 16:49:25 +0300
+Subject: ACPI: video: check for error while searching for backlight device
+ parent
+
+From: Nikita Kiryushin <kiryushin@ancud.ru>
+
+[ Upstream commit ccd45faf4973746c4f30ea41eec864e5cf191099 ]
+
+If acpi_get_parent() called in acpi_video_dev_register_backlight()
+fails, for example, because acpi_ut_acquire_mutex() fails inside
+acpi_get_parent), this can lead to incorrect (uninitialized)
+acpi_parent handle being passed to acpi_get_pci_dev() for detecting
+the parent pci device.
+
+Check acpi_get_parent() result and set parent device only in case of success.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 9661e92c10a9 ("acpi: tie ACPI backlight devices to PCI devices if possible")
+Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_video.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index 6cee536c229a..375010e575d0 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -1713,12 +1713,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)
+ 		return;
+ 	count++;
+ 
+-	acpi_get_parent(device->dev->handle, &acpi_parent);
+-
+-	pdev = acpi_get_pci_dev(acpi_parent);
+-	if (pdev) {
+-		parent = &pdev->dev;
+-		pci_dev_put(pdev);
++	if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) {
++		pdev = acpi_get_pci_dev(acpi_parent);
++		if (pdev) {
++			parent = &pdev->dev;
++			pci_dev_put(pdev);
++		}
+ 	}
+ 
+ 	memset(&props, 0, sizeof(struct backlight_properties));
+-- 
+2.43.0
+
diff --git a/queue-6.7/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch b/queue-6.7/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
new file mode 100644
index 00000000000..7b76f414088
--- /dev/null
+++ b/queue-6.7/alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
@@ -0,0 +1,39 @@
+From 3f937f6cd32e7ce89570f3255584ed81571ad0e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:52 +1030
+Subject: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 04f8f053252b86c7583895c962d66747ecdc61b7 ]
+
+Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and
+SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside
+scarlett2_mixer_values[].
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
+Link: https://lore.kernel.org/r/3b19fb3da641b587749b85fe1daa1b4e696c0c1b.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index f4351900fbbd..cdaf0470e62b 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -3663,7 +3663,8 @@ static int scarlett2_mixer_ctl_put(struct snd_kcontrol *kctl,
+ 	mutex_lock(&private->data_mutex);
+ 
+ 	oval = private->mix[index];
+-	val = ucontrol->value.integer.value[0];
++	val = clamp(ucontrol->value.integer.value[0],
++		    0L, (long)SCARLETT2_MIXER_MAX_VALUE);
+ 	num_mixer_in = port_count[SCARLETT2_PORT_TYPE_MIX][SCARLETT2_PORT_OUT];
+ 	mix_num = index / num_mixer_in;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch b/queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
new file mode 100644
index 00000000000..c9286e067a1
--- /dev/null
+++ b/queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
@@ -0,0 +1,44 @@
+From ae6805724bc13633b3239b6507e90123258c4605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:00 +1030
+Subject: ALSA: scarlett2: Add missing error check to scarlett2_config_save()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 5f6ff6931a1c0065a55448108940371e1ac8075f ]
+
+scarlett2_config_save() was ignoring the return value from
+scarlett2_usb(). As this function is not called from user-space we
+can't return the error, so call usb_audio_err() instead.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
+Link: https://lore.kernel.org/r/bf0a15332d852d7825fa6da87d2a0d9c0b702053.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index 33a3d1161885..35e45c337383 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -1524,9 +1524,11 @@ static void scarlett2_config_save(struct usb_mixer_interface *mixer)
+ {
+ 	__le32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE);
+ 
+-	scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD,
+-		      &req, sizeof(u32),
+-		      NULL, 0);
++	int err = scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD,
++				&req, sizeof(u32),
++				NULL, 0);
++	if (err < 0)
++		usb_audio_err(mixer->chip, "config save failed: %d\n", err);
+ }
+ 
+ /* Delayed work to save config */
+-- 
+2.43.0
+
diff --git a/queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-10152 b/queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-10152
new file mode 100644
index 00000000000..3eedf580c21
--- /dev/null
+++ b/queue-6.7/alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-10152
@@ -0,0 +1,42 @@
+From ac1fb53a4d3bde92814e4b9431df9738874cc990 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:21 +1030
+Subject: ALSA: scarlett2: Add missing error check to
+ scarlett2_usb_set_config()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit ca459dfa7d4ed9098fcf13e410963be6ae9b6bf3 ]
+
+scarlett2_usb_set_config() calls scarlett2_usb_get() but was not
+checking the result. Return the error if it fails rather than
+continuing with an invalid value.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e15fae6c51a ("ALSA: usb-audio: scarlett2: Allow bit-level access to config")
+Link: https://lore.kernel.org/r/def110c5c31dbdf0a7414d258838a0a31c0fab67.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index 35e45c337383..a6e72862d30f 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -1577,7 +1577,10 @@ static int scarlett2_usb_set_config(
+ 		size = 1;
+ 		offset = config_item->offset;
+ 
+-		scarlett2_usb_get(mixer, offset, &tmp, 1);
++		err = scarlett2_usb_get(mixer, offset, &tmp, 1);
++		if (err < 0)
++			return err;
++
+ 		if (value)
+ 			tmp |= (1 << index);
+ 		else
+-- 
+2.43.0
+
diff --git a/queue-6.7/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch b/queue-6.7/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
new file mode 100644
index 00000000000..b8c7882a934
--- /dev/null
+++ b/queue-6.7/alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
@@ -0,0 +1,356 @@
+From 5d5d83257b0c504579bd4b8b7d10a7dabfced9d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:07:37 +1030
+Subject: ALSA: scarlett2: Add missing error checks to *_ctl_get()
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 50603a67daef161c78c814580d57f7f0be57167e ]
+
+The *_ctl_get() functions which call scarlett2_update_*() were not
+checking the return value. Fix to check the return value and pass to
+the caller.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
+Link: https://lore.kernel.org/r/32a5fdc83b05fa74e0fcdd672fbf71d75c5f0a6d.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 182 +++++++++++++++++++++++++-----------
+ 1 file changed, 130 insertions(+), 52 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index a6e72862d30f..f4351900fbbd 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -2100,14 +2100,20 @@ static int scarlett2_sync_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->sync_updated)
+-		scarlett2_update_sync(mixer);
++
++	if (private->sync_updated) {
++		err = scarlett2_update_sync(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->sync;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static const struct snd_kcontrol_new scarlett2_sync_ctl = {
+@@ -2190,14 +2196,20 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->master_vol;
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int line_out_remap(struct scarlett2_data *private, int index)
+@@ -2223,14 +2235,20 @@ static int scarlett2_volume_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+ 	int index = line_out_remap(private, elem->control);
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->vol[index];
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_volume_ctl_put(struct snd_kcontrol *kctl,
+@@ -2297,14 +2315,20 @@ static int scarlett2_mute_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+ 	int index = line_out_remap(private, elem->control);
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->mute_switch[index];
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_mute_ctl_put(struct snd_kcontrol *kctl,
+@@ -2550,14 +2574,20 @@ static int scarlett2_level_enum_ctl_get(struct snd_kcontrol *kctl,
+ 	const struct scarlett2_device_info *info = private->info;
+ 
+ 	int index = elem->control + info->level_input_first;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->level_switch[index];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_level_enum_ctl_put(struct snd_kcontrol *kctl,
+@@ -2608,15 +2638,21 @@ static int scarlett2_pad_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] =
+ 		private->pad_switch[elem->control];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_pad_ctl_put(struct snd_kcontrol *kctl,
+@@ -2666,14 +2702,20 @@ static int scarlett2_air_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->air_switch[elem->control];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_air_ctl_put(struct snd_kcontrol *kctl,
+@@ -2723,15 +2765,21 @@ static int scarlett2_phantom_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->input_other_updated)
+-		scarlett2_update_input_other(mixer);
++
++	if (private->input_other_updated) {
++		err = scarlett2_update_input_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] =
+ 		private->phantom_switch[elem->control];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_phantom_ctl_put(struct snd_kcontrol *kctl,
+@@ -2903,14 +2951,20 @@ static int scarlett2_direct_monitor_ctl_get(
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = elem->head.mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->monitor_other_updated)
+-		scarlett2_update_monitor_other(mixer);
++
++	if (private->monitor_other_updated) {
++		err = scarlett2_update_monitor_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->direct_monitor_switch;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_direct_monitor_ctl_put(
+@@ -3010,14 +3064,20 @@ static int scarlett2_speaker_switch_enum_ctl_get(
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->monitor_other_updated)
+-		scarlett2_update_monitor_other(mixer);
++
++	if (private->monitor_other_updated) {
++		err = scarlett2_update_monitor_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->speaker_switching_switch;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ /* when speaker switching gets enabled, switch the main/alt speakers
+@@ -3165,14 +3225,20 @@ static int scarlett2_talkback_enum_ctl_get(
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->monitor_other_updated)
+-		scarlett2_update_monitor_other(mixer);
++
++	if (private->monitor_other_updated) {
++		err = scarlett2_update_monitor_other(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->talkback_switch;
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_talkback_enum_ctl_put(
+@@ -3320,14 +3386,20 @@ static int scarlett2_dim_mute_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_elem_info *elem = kctl->private_data;
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->vol_updated)
+-		scarlett2_update_volumes(mixer);
+-	mutex_unlock(&private->data_mutex);
+ 
++	if (private->vol_updated) {
++		err = scarlett2_update_volumes(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.integer.value[0] = private->dim_mute[elem->control];
+-	return 0;
++
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_dim_mute_ctl_put(struct snd_kcontrol *kctl,
+@@ -3698,14 +3770,20 @@ static int scarlett2_mux_src_enum_ctl_get(struct snd_kcontrol *kctl,
+ 	struct usb_mixer_interface *mixer = elem->head.mixer;
+ 	struct scarlett2_data *private = mixer->private_data;
+ 	int index = line_out_remap(private, elem->control);
++	int err = 0;
+ 
+ 	mutex_lock(&private->data_mutex);
+-	if (private->mux_updated)
+-		scarlett2_usb_get_mux(mixer);
++
++	if (private->mux_updated) {
++		err = scarlett2_usb_get_mux(mixer);
++		if (err < 0)
++			goto unlock;
++	}
+ 	ucontrol->value.enumerated.item[0] = private->mux[index];
+-	mutex_unlock(&private->data_mutex);
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++	return err;
+ }
+ 
+ static int scarlett2_mux_src_enum_ctl_put(struct snd_kcontrol *kctl,
+-- 
+2.43.0
+
diff --git a/queue-6.7/alsa-scarlett2-add-missing-mutex-lock-around-get-met.patch b/queue-6.7/alsa-scarlett2-add-missing-mutex-lock-around-get-met.patch
new file mode 100644
index 00000000000..77e6b0dc7bd
--- /dev/null
+++ b/queue-6.7/alsa-scarlett2-add-missing-mutex-lock-around-get-met.patch
@@ -0,0 +1,54 @@
+From 45460f8a8699b848522fbbeef21cc7512925671c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 04:08:09 +1030
+Subject: ALSA: scarlett2: Add missing mutex lock around get meter levels
+
+From: Geoffrey D. Bennett <g@b4.vu>
+
+[ Upstream commit 993f7b42fa066b055e3a19b7f76ad8157c0927a0 ]
+
+As scarlett2_meter_ctl_get() uses meter_level_map[], the data_mutex
+should be locked while accessing it.
+
+Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
+Fixes: 3473185f31df ("ALSA: scarlett2: Remap Level Meter values")
+Link: https://lore.kernel.org/r/77e093c27402c83d0730681448fa4f57583349dd.1703001053.git.g@b4.vu
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_scarlett2.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/mixer_scarlett2.c b/sound/usb/mixer_scarlett2.c
+index cdaf0470e62b..3b7fcd0907e6 100644
+--- a/sound/usb/mixer_scarlett2.c
++++ b/sound/usb/mixer_scarlett2.c
+@@ -3880,10 +3880,12 @@ static int scarlett2_meter_ctl_get(struct snd_kcontrol *kctl,
+ 	u16 meter_levels[SCARLETT2_MAX_METERS];
+ 	int i, err;
+ 
++	mutex_lock(&private->data_mutex);
++
+ 	err = scarlett2_usb_get_meter_levels(elem->head.mixer, elem->channels,
+ 					     meter_levels);
+ 	if (err < 0)
+-		return err;
++		goto unlock;
+ 
+ 	/* copy & translate from meter_levels[] using meter_level_map[] */
+ 	for (i = 0; i < elem->channels; i++) {
+@@ -3898,7 +3900,10 @@ static int scarlett2_meter_ctl_get(struct snd_kcontrol *kctl,
+ 		ucontrol->value.integer.value[i] = value;
+ 	}
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&private->data_mutex);
++
++	return err;
+ }
+ 
+ static const struct snd_kcontrol_new scarlett2_meter_ctl = {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm-davinci-always-select-config_cpu_arm926t.patch b/queue-6.7/arm-davinci-always-select-config_cpu_arm926t.patch
new file mode 100644
index 00000000000..532e8413bfb
--- /dev/null
+++ b/queue-6.7/arm-davinci-always-select-config_cpu_arm926t.patch
@@ -0,0 +1,39 @@
+From 819387346511868dae2ed9d6d6189fbcbfeca386 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Jan 2024 12:00:36 +0100
+Subject: ARM: davinci: always select CONFIG_CPU_ARM926T
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 40974ee421b4d1fc74ac733d86899ce1b83d8f65 ]
+
+The select was lost by accident during the multiplatform conversion.
+Any davinci-only
+
+arm-linux-gnueabi-ld: arch/arm/mach-davinci/sleep.o: in function `CACHE_FLUSH':
+(.text+0x168): undefined reference to `arm926_flush_kern_cache_all'
+
+Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5")
+Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/r/20240108110055.1531153-1-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-davinci/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
+index 4316e1370627..59de137c6f53 100644
+--- a/arch/arm/mach-davinci/Kconfig
++++ b/arch/arm/mach-davinci/Kconfig
+@@ -4,6 +4,7 @@ menuconfig ARCH_DAVINCI
+ 	bool "TI DaVinci"
+ 	depends on ARCH_MULTI_V5
+ 	depends on CPU_LITTLE_ENDIAN
++	select CPU_ARM926T
+ 	select DAVINCI_TIMER
+ 	select ZONE_DMA
+ 	select PM_GENERIC_DOMAINS if PM
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch b/queue-6.7/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
new file mode 100644
index 00000000000..0eac1e8a029
--- /dev/null
+++ b/queue-6.7/arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
@@ -0,0 +1,40 @@
+From 71f2eb9834dbd81cb2a0b651938202417c9ebe5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Sep 2023 14:02:35 +0300
+Subject: ARM: dts: qcom: apq8064: correct XOADC register address
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 554557542e709e190eff8a598f0cde02647d533a ]
+
+The XOADC is present at the address 0x197 rather than just 197. It
+doesn't change a lot (since the driver hardcodes all register
+addresses), but the DT should present correct address anyway.
+
+Fixes: c4b70883ee33 ("ARM: dts: add XOADC and IIO HWMON to APQ8064")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230928110309.1212221-3-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom/qcom-apq8064.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi
+index 59fd86b9fb47..099a16c34e1f 100644
+--- a/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi
++++ b/arch/arm/boot/dts/qcom/qcom-apq8064.dtsi
+@@ -738,7 +738,7 @@ pwrkey@1c {
+ 
+ 				xoadc: xoadc@197 {
+ 					compatible = "qcom,pm8921-adc";
+-					reg = <197>;
++					reg = <0x197>;
+ 					interrupts-extended = <&pmicintc 78 IRQ_TYPE_EDGE_RISING>;
+ 					#address-cells = <2>;
+ 					#size-cells = <0>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm-dts-qcom-msm8226-provide-dsi-phy-clocks-to-mmcc.patch b/queue-6.7/arm-dts-qcom-msm8226-provide-dsi-phy-clocks-to-mmcc.patch
new file mode 100644
index 00000000000..6fe9c114a51
--- /dev/null
+++ b/queue-6.7/arm-dts-qcom-msm8226-provide-dsi-phy-clocks-to-mmcc.patch
@@ -0,0 +1,42 @@
+From 600d71604ff0ceea99d7756641096a483fb53515 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jul 2023 09:52:07 +0200
+Subject: ARM: dts: qcom: msm8226: provide dsi phy clocks to mmcc
+
+From: Luca Weiss <luca@z3ntu.xyz>
+
+[ Upstream commit 836d083524888069cd358776a4e6c4ceec04962e ]
+
+Some mmcc clocks have dsi0pll & dsi0pllbyte as clock parents so we
+should provide them in the dt, which I missed in the commit adding the
+mdss nodes.
+
+Fixes: d5fb01ad5eb4 ("ARM: dts: qcom: msm8226: Add mdss nodes")
+Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230712-msm8226-dsi-clock-fixup-v1-1-71010b0b89ca@z3ntu.xyz
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom/qcom-msm8226.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom/qcom-msm8226.dtsi b/arch/arm/boot/dts/qcom/qcom-msm8226.dtsi
+index 97a377b5a0ec..5cd03ea7b084 100644
+--- a/arch/arm/boot/dts/qcom/qcom-msm8226.dtsi
++++ b/arch/arm/boot/dts/qcom/qcom-msm8226.dtsi
+@@ -442,8 +442,8 @@ mmcc: clock-controller@fd8c0000 {
+ 				 <&gcc GPLL0_VOTE>,
+ 				 <&gcc GPLL1_VOTE>,
+ 				 <&rpmcc RPM_SMD_GFX3D_CLK_SRC>,
+-				 <0>,
+-				 <0>;
++				 <&mdss_dsi0_phy 1>,
++				 <&mdss_dsi0_phy 0>;
+ 			clock-names = "xo",
+ 				      "mmss_gpll0_vote",
+ 				      "gpll0_vote",
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm-dts-qcom-sdx65-correct-pcie-ep-phy-names.patch b/queue-6.7/arm-dts-qcom-sdx65-correct-pcie-ep-phy-names.patch
new file mode 100644
index 00000000000..347b1bfc1b7
--- /dev/null
+++ b/queue-6.7/arm-dts-qcom-sdx65-correct-pcie-ep-phy-names.patch
@@ -0,0 +1,41 @@
+From 84a6dbf8713b6044c94a26aa8a658ba102bfc146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Sep 2023 20:31:01 +0200
+Subject: ARM: dts: qcom: sdx65: correct PCIe EP phy-names
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 94da379dba88c4cdd562bad21c9ba5656e5ed5df ]
+
+Qualcomm PCIe endpoint bindings expect phy-names to be "pciephy":
+
+  arch/arm/boot/dts/qcom/qcom-sdx65-mtp.dtb: pcie-ep@1c00000: phy-names:0: 'pciephy' was expected
+
+Fixes: 9c0bb38414a4 ("ARM: dts: qcom: sdx65: Add support for PCIe EP")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230924183103.49487-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom/qcom-sdx65.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi b/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
+index e559adaaeee7..648899b5220f 100644
+--- a/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
++++ b/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
+@@ -338,7 +338,7 @@ pcie_ep: pcie-ep@1c00000 {
+ 			power-domains = <&gcc PCIE_GDSC>;
+ 
+ 			phys = <&pcie_phy>;
+-			phy-names = "pcie-phy";
++			phy-names = "pciephy";
+ 
+ 			max-link-speed = <3>;
+ 			num-lanes = <2>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm-dts-qcom-sdx65-correct-spmi-node-name.patch b/queue-6.7/arm-dts-qcom-sdx65-correct-spmi-node-name.patch
new file mode 100644
index 00000000000..5e95b6e6a80
--- /dev/null
+++ b/queue-6.7/arm-dts-qcom-sdx65-correct-spmi-node-name.patch
@@ -0,0 +1,39 @@
+From 9d074c2dc9f2bde181a1ae7886af3c56f9ea33ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Sep 2023 20:31:03 +0200
+Subject: ARM: dts: qcom: sdx65: correct SPMI node name
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit a900ad783f507cb396e402827052e70c0c565ae9 ]
+
+Node names should not have vendor prefixes:
+
+  qcom-sdx65-mtp.dtb: qcom,spmi@c440000: $nodename:0: 'qcom,spmi@c440000' does not match '^spmi@.*
+
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230924183103.49487-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom/qcom-sdx65.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi b/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
+index 648899b5220f..27b7f50a1832 100644
+--- a/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
++++ b/arch/arm/boot/dts/qcom/qcom-sdx65.dtsi
+@@ -530,7 +530,7 @@ restart@c264000 {
+ 			reg = <0x0c264000 0x1000>;
+ 		};
+ 
+-		spmi_bus: qcom,spmi@c440000 {
++		spmi_bus: spmi@c440000 {
+ 			compatible = "qcom,spmi-pmic-arb";
+ 			reg = <0xc440000 0xd00>,
+ 				<0xc600000 0x2000000>,
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch b/queue-6.7/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
new file mode 100644
index 00000000000..38e80a03b36
--- /dev/null
+++ b/queue-6.7/arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
@@ -0,0 +1,86 @@
+From 0c2439e3006b3bc61db52825fa0e6995c1a9d7bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 19:52:34 +0100
+Subject: ARM: dts: stm32: don't mix SCMI and non-SCMI board compatibles
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+[ Upstream commit bfc3c6743de0ecb169026c36cbdbc0d12d22a528 ]
+
+The binding erroneously decreed that the SCMI variants of the ST
+evaluation kits are compatible with the non-SCMI variants.
+
+This is not correct, as a kernel or bootloader compatible with the non-SCMI
+variant is not necessarily able to function, when direct access
+to resources is replaced by having to talk SCMI to the secure monitor.
+
+The binding has been adjusted to reflect thus, so synchronize the device
+trees now.
+
+Fixes: 5b7e58313a77 ("ARM: dts: stm32: Add SCMI version of STM32 boards (DK1/DK2/ED1/EV1)")
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts | 2 +-
+ arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts | 2 +-
+ arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts | 2 +-
+ arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts | 3 +--
+ 4 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts b/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts
+index afcd6285890c..c27963898b5e 100644
+--- a/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts
++++ b/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts
+@@ -11,7 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157A-DK1 SCMI Discovery Board";
+-	compatible = "st,stm32mp157a-dk1-scmi", "st,stm32mp157a-dk1", "st,stm32mp157";
++	compatible = "st,stm32mp157a-dk1-scmi", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@de000000 {
+diff --git a/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts b/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts
+index 39358d902000..622618943134 100644
+--- a/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts
++++ b/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts
+@@ -11,7 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157C-DK2 SCMI Discovery Board";
+-	compatible = "st,stm32mp157c-dk2-scmi", "st,stm32mp157c-dk2", "st,stm32mp157";
++	compatible = "st,stm32mp157c-dk2-scmi", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@de000000 {
+diff --git a/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts b/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts
+index 07ea765a4553..c7c4d7e89d61 100644
+--- a/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts
++++ b/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts
+@@ -11,7 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157C-ED1 SCMI eval daughter";
+-	compatible = "st,stm32mp157c-ed1-scmi", "st,stm32mp157c-ed1", "st,stm32mp157";
++	compatible = "st,stm32mp157c-ed1-scmi", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@fe000000 {
+diff --git a/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts b/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts
+index 813086ec2489..2ab77e64f1bb 100644
+--- a/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts
++++ b/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts
+@@ -11,8 +11,7 @@
+ 
+ / {
+ 	model = "STMicroelectronics STM32MP157C-EV1 SCMI eval daughter on eval mother";
+-	compatible = "st,stm32mp157c-ev1-scmi", "st,stm32mp157c-ev1", "st,stm32mp157c-ed1",
+-		     "st,stm32mp157";
++	compatible = "st,stm32mp157c-ev1-scmi", "st,stm32mp157c-ed1", "st,stm32mp157";
+ 
+ 	reserved-memory {
+ 		optee@fe000000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch b/queue-6.7/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
new file mode 100644
index 00000000000..f2a3f5296a3
--- /dev/null
+++ b/queue-6.7/arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
@@ -0,0 +1,37 @@
+From 0515b2a7d89189239c0b667c8cca44201ab808c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 18:56:34 +0100
+Subject: arm64: dts: hisilicon: hikey970-pmic: fix regulator cells properties
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 44ab3ee76a5a977864ba0bb6c352dcf6206804e0 ]
+
+The Hi6421 PMIC regulator child nodes do not have unit addresses so drop
+the incorrect '#address-cells' and '#size-cells' properties.
+
+Fixes: 6219b20e1ecd ("arm64: dts: hisilicon: Add support for Hikey 970 PMIC")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi b/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi
+index 970047f2dabd..c06e011a6c3f 100644
+--- a/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi
++++ b/arch/arm64/boot/dts/hisilicon/hikey970-pmic.dtsi
+@@ -25,9 +25,6 @@ pmic: pmic@0 {
+ 			gpios = <&gpio28 0 0>;
+ 
+ 			regulators {
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-
+ 				ldo3: ldo3 { /* HDMI */
+ 					regulator-name = "ldo3";
+ 					regulator-min-microvolt = <1500000>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch b/queue-6.7/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
new file mode 100644
index 00000000000..8c4f5e3e1da
--- /dev/null
+++ b/queue-6.7/arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
@@ -0,0 +1,51 @@
+From da98518003ca62aab2efdd1ce3ec66850bc38d43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 14:02:16 -0600
+Subject: arm64: dts: imx8mm: Reduce GPU to nominal speed
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 1f794d3eed5345413c2b0cf1bcccc92d77681220 ]
+
+When the GPU nodes were added, the GPU_PLL_OUT was configured
+for 1000MHz, but this requires the SoC to run in overdrive mode
+which requires an elevated voltage operating point.
+
+Since this may run some boards out of spec, the default clock
+should be set to 800MHz for nominal operating mode. Boards
+that run at the higher voltage can update their clocks
+accordingly.
+
+Fixes: 4523be8e46be ("arm64: dts: imx8mm: Add GPU nodes for 2D and 3D core")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index 738024baaa57..54faf83cb436 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -1408,7 +1408,7 @@ gpu_3d: gpu@38000000 {
+ 			assigned-clocks = <&clk IMX8MM_CLK_GPU3D_CORE>,
+ 					  <&clk IMX8MM_GPU_PLL_OUT>;
+ 			assigned-clock-parents = <&clk IMX8MM_GPU_PLL_OUT>;
+-			assigned-clock-rates = <0>, <1000000000>;
++			assigned-clock-rates = <0>, <800000000>;
+ 			power-domains = <&pgc_gpu>;
+ 		};
+ 
+@@ -1423,7 +1423,7 @@ gpu_2d: gpu@38008000 {
+ 			assigned-clocks = <&clk IMX8MM_CLK_GPU2D_CORE>,
+ 					  <&clk IMX8MM_GPU_PLL_OUT>;
+ 			assigned-clock-parents = <&clk IMX8MM_GPU_PLL_OUT>;
+-			assigned-clock-rates = <0>, <1000000000>;
++			assigned-clock-rates = <0>, <800000000>;
+ 			power-domains = <&pgc_gpu>;
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch b/queue-6.7/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
new file mode 100644
index 00000000000..8e5697cffe4
--- /dev/null
+++ b/queue-6.7/arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
@@ -0,0 +1,62 @@
+From 44a3da1013fb549d0679a8340b997652e8ab89ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 17:48:38 +0800
+Subject: arm64: dts: mediatek: mt8183: correct MDP3 DMA-related nodes
+
+From: Moudy Ho <moudy.ho@mediatek.com>
+
+[ Upstream commit 188ffcd7fea79af3cac441268fc99f60e87f03b3 ]
+
+In order to generalize the node names, the DMA-related nodes
+corresponding to MT8183 MDP3 need to be corrected.
+
+Fixes: 60a2fb8d202a ("arm64: dts: mt8183: add MediaTek MDP3 nodes")
+Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8183.dtsi | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+index 976dc968b3ca..df6e9990cd5f 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+@@ -1660,7 +1660,7 @@ mmsys: syscon@14000000 {
+ 			mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0 0x1000>;
+ 		};
+ 
+-		mdp3-rdma0@14001000 {
++		dma-controller0@14001000 {
+ 			compatible = "mediatek,mt8183-mdp3-rdma";
+ 			reg = <0 0x14001000 0 0x1000>;
+ 			mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>;
+@@ -1672,6 +1672,7 @@ mdp3-rdma0@14001000 {
+ 			iommus = <&iommu M4U_PORT_MDP_RDMA0>;
+ 			mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST 0>,
+ 				 <&gce 21 CMDQ_THR_PRIO_LOWEST 0>;
++			#dma-cells = <1>;
+ 		};
+ 
+ 		mdp3-rsz0@14003000 {
+@@ -1692,7 +1693,7 @@ mdp3-rsz1@14004000 {
+ 			clocks = <&mmsys CLK_MM_MDP_RSZ1>;
+ 		};
+ 
+-		mdp3-wrot0@14005000 {
++		dma-controller@14005000 {
+ 			compatible = "mediatek,mt8183-mdp3-wrot";
+ 			reg = <0 0x14005000 0 0x1000>;
+ 			mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>;
+@@ -1701,6 +1702,7 @@ mdp3-wrot0@14005000 {
+ 			power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+ 			clocks = <&mmsys CLK_MM_MDP_WROT0>;
+ 			iommus = <&iommu M4U_PORT_MDP_WROT0>;
++			#dma-cells = <1>;
+ 		};
+ 
+ 		mdp3-wdma@14006000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-mediatek-mt8186-fix-address-warning-for-ad.patch b/queue-6.7/arm64-dts-mediatek-mt8186-fix-address-warning-for-ad.patch
new file mode 100644
index 00000000000..d23cf1eae40
--- /dev/null
+++ b/queue-6.7/arm64-dts-mediatek-mt8186-fix-address-warning-for-ad.patch
@@ -0,0 +1,51 @@
+From 6c8c1b9b5e8b92279c1f7d67c3ae207f122e2dad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:55:33 +0200
+Subject: arm64: dts: mediatek: mt8186: fix address warning for ADSP mailboxes
+
+From: Eugen Hristev <eugen.hristev@collabora.com>
+
+[ Upstream commit 840e341bed3c4331061031dc9db0aff04abafb4b ]
+
+Fix warnings reported by dtbs_check :
+
+arch/arm64/boot/dts/mediatek/mt8186.dtsi:1163.35-1168.5: Warning (simple_bus_reg):
+ /soc/mailbox@10686000: simple-bus unit address format error, expected "10686100"
+arch/arm64/boot/dts/mediatek/mt8186.dtsi:1170.35-1175.5: Warning (simple_bus_reg):
+ /soc/mailbox@10687000: simple-bus unit address format error, expected "10687100"
+
+by having the right bus address as node name.
+
+Fixes: 379cf0e639ae ("arm64: dts: mediatek: mt8186: Add ADSP mailbox nodes")
+Signed-off-by: Eugen Hristev <eugen.hristev@collabora.com>
+Link: https://lore.kernel.org/r/20231204135533.21327-1-eugen.hristev@collabora.com
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index 021397671099..2fec6fd1c1a7 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -1160,14 +1160,14 @@ adsp: adsp@10680000 {
+ 			status = "disabled";
+ 		};
+ 
+-		adsp_mailbox0: mailbox@10686000 {
++		adsp_mailbox0: mailbox@10686100 {
+ 			compatible = "mediatek,mt8186-adsp-mbox";
+ 			#mbox-cells = <0>;
+ 			reg = <0 0x10686100 0 0x1000>;
+ 			interrupts = <GIC_SPI 361 IRQ_TYPE_LEVEL_HIGH 0>;
+ 		};
+ 
+-		adsp_mailbox1: mailbox@10687000 {
++		adsp_mailbox1: mailbox@10687100 {
+ 			compatible = "mediatek,mt8186-adsp-mbox";
+ 			#mbox-cells = <0>;
+ 			reg = <0 0x10687100 0 0x1000>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-mediatek-mt8186-fix-alias-prefix-for-ovl_2.patch b/queue-6.7/arm64-dts-mediatek-mt8186-fix-alias-prefix-for-ovl_2.patch
new file mode 100644
index 00000000000..c8362f6cc37
--- /dev/null
+++ b/queue-6.7/arm64-dts-mediatek-mt8186-fix-alias-prefix-for-ovl_2.patch
@@ -0,0 +1,38 @@
+From 4d0739679096d22d002efa57023df9b59c71964f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 15:40:31 +0800
+Subject: arm64: dts: mediatek: mt8186: Fix alias prefix for ovl_2l0
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 6ed159e499bc2ebedf94c9086244220824e71672 ]
+
+The alias prefix for ovl_2l (2 layer overlay) is "ovl-2l", not "ovl_2l".
+
+Fix this.
+
+Fixes: 7e07d3322de2 ("arm64: dts: mediatek: mt8186: Add display nodes")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20231130074032.913511-4-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8186.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8186.dtsi b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+index df0c04f2ba1d..021397671099 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8186.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8186.dtsi
+@@ -22,7 +22,7 @@ / {
+ 
+ 	aliases {
+ 		ovl0 = &ovl0;
+-		ovl_2l0 = &ovl_2l0;
++		ovl-2l0 = &ovl_2l0;
+ 		rdma0 = &rdma0;
+ 		rdma1 = &rdma1;
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-mediatek-mt8195-revise-vdosys-rdma-node-na.patch b/queue-6.7/arm64-dts-mediatek-mt8195-revise-vdosys-rdma-node-na.patch
new file mode 100644
index 00000000000..e697c073df7
--- /dev/null
+++ b/queue-6.7/arm64-dts-mediatek-mt8195-revise-vdosys-rdma-node-na.patch
@@ -0,0 +1,131 @@
+From da64b0e3c498976e4b69ec6ab4a3ab05bb4aae35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 17:48:39 +0800
+Subject: arm64: dts: mediatek: mt8195: revise VDOSYS RDMA node name
+
+From: Moudy Ho <moudy.ho@mediatek.com>
+
+[ Upstream commit 52f4a10f2a860402c130c5c21d055e721d63a7e9 ]
+
+DMA-related nodes have their own standardized naming. Therefore,
+the MT8195 VDOSYS RDMA has been unified and corrected.
+Additionally, these modifications will facilitate the further
+integration of bindings.
+
+Fixes: 92d2c23dc269 ("arm64: dts: mt8195: add display node for vdosys1")
+Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8195.dtsi | 24 ++++++++++++++++--------
+ 1 file changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8195.dtsi b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+index e0ac2e9f5b72..6708c4d21abf 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8195.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8195.dtsi
+@@ -2873,7 +2873,7 @@ larb3: larb@1c103000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 		};
+ 
+-		vdo1_rdma0: rdma@1c104000 {
++		vdo1_rdma0: dma-controller@1c104000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c104000 0 0x1000>;
+ 			interrupts = <GIC_SPI 495 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2881,9 +2881,10 @@ vdo1_rdma0: rdma@1c104000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vdo M4U_PORT_L2_MDP_RDMA0>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x4000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+-		vdo1_rdma1: rdma@1c105000 {
++		vdo1_rdma1: dma-controller@1c105000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c105000 0 0x1000>;
+ 			interrupts = <GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2891,9 +2892,10 @@ vdo1_rdma1: rdma@1c105000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vpp M4U_PORT_L3_MDP_RDMA1>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x5000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+-		vdo1_rdma2: rdma@1c106000 {
++		vdo1_rdma2: dma-controller@1c106000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c106000 0 0x1000>;
+ 			interrupts = <GIC_SPI 497 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2901,9 +2903,10 @@ vdo1_rdma2: rdma@1c106000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vdo M4U_PORT_L2_MDP_RDMA2>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x6000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+-		vdo1_rdma3: rdma@1c107000 {
++		vdo1_rdma3: dma-controller@1c107000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c107000 0 0x1000>;
+ 			interrupts = <GIC_SPI 498 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2911,9 +2914,10 @@ vdo1_rdma3: rdma@1c107000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vpp M4U_PORT_L3_MDP_RDMA3>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x7000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+-		vdo1_rdma4: rdma@1c108000 {
++		vdo1_rdma4: dma-controller@1c108000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c108000 0 0x1000>;
+ 			interrupts = <GIC_SPI 499 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2921,9 +2925,10 @@ vdo1_rdma4: rdma@1c108000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vdo M4U_PORT_L2_MDP_RDMA4>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x8000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+-		vdo1_rdma5: rdma@1c109000 {
++		vdo1_rdma5: dma-controller@1c109000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c109000 0 0x1000>;
+ 			interrupts = <GIC_SPI 500 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2931,9 +2936,10 @@ vdo1_rdma5: rdma@1c109000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vpp M4U_PORT_L3_MDP_RDMA5>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0x9000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+-		vdo1_rdma6: rdma@1c10a000 {
++		vdo1_rdma6: dma-controller@1c10a000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c10a000 0 0x1000>;
+ 			interrupts = <GIC_SPI 501 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2941,9 +2947,10 @@ vdo1_rdma6: rdma@1c10a000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vdo M4U_PORT_L2_MDP_RDMA6>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0xa000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+-		vdo1_rdma7: rdma@1c10b000 {
++		vdo1_rdma7: dma-controller@1c10b000 {
+ 			compatible = "mediatek,mt8195-vdo1-rdma";
+ 			reg = <0 0x1c10b000 0 0x1000>;
+ 			interrupts = <GIC_SPI 502 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -2951,6 +2958,7 @@ vdo1_rdma7: rdma@1c10b000 {
+ 			power-domains = <&spm MT8195_POWER_DOMAIN_VDOSYS1>;
+ 			iommus = <&iommu_vpp M4U_PORT_L3_MDP_RDMA7>;
+ 			mediatek,gce-client-reg = <&gce0 SUBSYS_1c10XXXX 0xb000 0x1000>;
++			#dma-cells = <1>;
+ 		};
+ 
+ 		merge1: vpp-merge@1c10c000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-acer-aspire1-correct-audio-codec-defi.patch b/queue-6.7/arm64-dts-qcom-acer-aspire1-correct-audio-codec-defi.patch
new file mode 100644
index 00000000000..0c3f0ae9031
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-acer-aspire1-correct-audio-codec-defi.patch
@@ -0,0 +1,64 @@
+From a8eb37975638c0758b8853a4659b3a3121c56886 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 16:48:11 +0500
+Subject: arm64: dts: qcom: acer-aspire1: Correct audio codec definition
+
+From: Nikita Travkin <nikita@trvn.ru>
+
+[ Upstream commit feec9f0add432a867f23e29afcd2f7088889b8e2 ]
+
+When initially added, a mistake was made in the definition of the codec.
+
+Despite the fact that the DMIC line is connected on the side of the
+codec chip, and relevant passive components, including 0-ohm resistors
+connecting the dmics, are present, the dmic line is still cut in
+another place on the board, which was overlooked.
+
+Correct this by replacing the dmic configuration with a comment
+describing this hardware detail.
+
+While at it, also add missing regulators definitions. This is not a
+functional change as all the relevant regulators were already added via
+the other rail supplies.
+
+Fixes: 4a9f8f8f2ada ("arm64: dts: qcom: Add Acer Aspire 1")
+Signed-off-by: Nikita Travkin <nikita@trvn.ru>
+Link: https://lore.kernel.org/r/20231205-aspire1-sound-v2-2-443b7ac0a06f@trvn.ru
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../arm64/boot/dts/qcom/sc7180-acer-aspire1.dts | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-acer-aspire1.dts b/arch/arm64/boot/dts/qcom/sc7180-acer-aspire1.dts
+index dbb48934d499..3342cb048038 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-acer-aspire1.dts
++++ b/arch/arm64/boot/dts/qcom/sc7180-acer-aspire1.dts
+@@ -209,9 +209,22 @@ alc5682: codec@1a {
+ 		AVDD-supply = <&vreg_l15a_1p8>;
+ 		MICVDD-supply = <&reg_codec_3p3>;
+ 		VBAT-supply = <&reg_codec_3p3>;
++		DBVDD-supply = <&vreg_l15a_1p8>;
++		LDO1-IN-supply = <&vreg_l15a_1p8>;
++
++		/*
++		 * NOTE: The board has a path from this codec to the
++		 * DMIC microphones in the lid, however some of the option
++		 * resistors are absent and the microphones are connected
++		 * to the SoC instead.
++		 *
++		 * If the resistors were to be changed by the user to
++		 * connect the codec, the following could be used:
++		 *
++		 * realtek,dmic1-data-pin = <1>;
++		 * realtek,dmic1-clk-pin = <1>;
++		 */
+ 
+-		realtek,dmic1-data-pin = <1>;
+-		realtek,dmic1-clk-pin = <1>;
+ 		realtek,jd-src = <1>;
+ 	};
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch b/queue-6.7/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
new file mode 100644
index 00000000000..6cabce24dc7
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
@@ -0,0 +1,41 @@
+From 3e346a852970c6f9f5bf4f6604e19e635c2110fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 23:08:05 +0800
+Subject: arm64: dts: qcom: ipq6018: fix clock rates for GCC_USB0_MOCK_UTMI_CLK
+
+From: Chukun Pan <amadeus@jmu.edu.cn>
+
+[ Upstream commit 5c0dbe8b058436ad5daecb19c60869f832607ea3 ]
+
+The downstream QSDK kernel [1] and GCC_USB1_MOCK_UTMI_CLK are both 24MHz.
+Adjust GCC_USB0_MOCK_UTMI_CLK to 24MHz to avoid the following error:
+
+clk: couldn't set gcc_usb0_mock_utmi_clk clk rate to 20000000 (-22), current rate: 24000000
+
+1. https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/commit/486c8485f59
+
+Fixes: 5726079cd486 ("arm64: dts: ipq6018: Use reference clock to set dwc3 period")
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Link: https://lore.kernel.org/r/20231218150805.1228160-1-amadeus@jmu.edu.cn
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/ipq6018.dtsi b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+index e59b9df96c7e..0b1330b521df 100644
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -557,7 +557,7 @@ usb3: usb@8af8800 {
+ 					  <&gcc GCC_USB0_MOCK_UTMI_CLK>;
+ 			assigned-clock-rates = <133330000>,
+ 					       <133330000>,
+-					       <20000000>;
++					       <24000000>;
+ 
+ 			resets = <&gcc GCC_USB0_BCR>;
+ 			status = "disabled";
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-qrb2210-rb1-use-usb-host-mode.patch b/queue-6.7/arm64-dts-qcom-qrb2210-rb1-use-usb-host-mode.patch
new file mode 100644
index 00000000000..7182fa16a8d
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-qrb2210-rb1-use-usb-host-mode.patch
@@ -0,0 +1,45 @@
+From 6bb67aa6e3bbf58b426455a93a77c1560422375c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Oct 2023 12:58:00 +0100
+Subject: arm64: dts: qcom: qrb2210-rb1: use USB host mode
+
+From: Caleb Connolly <caleb.connolly@linaro.org>
+
+[ Upstream commit e0cee8dc6757f9f18718eec553be9fffa503e103 ]
+
+The default for the QCM2290 platform that this board is based on is OTG
+mode, however the role detection logic is not hooked up for this board
+and the dwc3 driver is configured to not allow role switching from
+userspace.
+
+Force this board to host mode as this is the preferred usecase until we
+get role switching hooked up.
+
+Fixes: e18771961336 ("arm64: dts: qcom: Add initial QTI RB1 device tree")
+Signed-off-by: Caleb Connolly <caleb.connolly@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231025-b4-rb1-usb-host-v1-1-522616c575ef@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb2210-rb1.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
+index 94885b9c21c8..fd38a6278f2f 100644
+--- a/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
++++ b/arch/arm64/boot/dts/qcom/qrb2210-rb1.dts
+@@ -415,6 +415,10 @@ &usb_qmpphy {
+ 	status = "okay";
+ };
+ 
++&usb_dwc3 {
++	dr_mode = "host";
++};
++
+ &usb_hsphy {
+ 	vdd-supply = <&pm2250_l12>;
+ 	vdda-pll-supply = <&pm2250_l13>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-qrb4210-rb2-don-t-force-usb-periphera.patch b/queue-6.7/arm64-dts-qcom-qrb4210-rb2-don-t-force-usb-periphera.patch
new file mode 100644
index 00000000000..82fed433439
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-qrb4210-rb2-don-t-force-usb-periphera.patch
@@ -0,0 +1,41 @@
+From c3612d86c038910d8ccfaa7cae9aeccc0374a843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Oct 2023 11:46:58 +0100
+Subject: arm64: dts: qcom: qrb4210-rb2: don't force usb peripheral mode
+
+From: Caleb Connolly <caleb.connolly@linaro.org>
+
+[ Upstream commit 27c2ca90e2f34cd3c4849af996e1a96a69e700d3 ]
+
+The rb2 only has a single USB controller, it can be switched between a
+type-c port and an internal USB hub via a DIP switch. Until dynamic
+role switching is available it's preferable to put the USB controller
+in host mode so that the type-A ports and ethernet are available.
+
+Signed-off-by: Caleb Connolly <caleb.connolly@linaro.org>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Fixes: eaa53a85748d ("arm64: dts: qcom: qrb4210-rb2: Enable USB node")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Link: https://lore.kernel.org/r/20231010-caleb-rb2-host-mode-v1-1-b057d443cd62@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb4210-rb2.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
+index a7278a9472ed..9738c0dacd58 100644
+--- a/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
++++ b/arch/arm64/boot/dts/qcom/qrb4210-rb2.dts
+@@ -518,7 +518,6 @@ &usb {
+ 
+ &usb_dwc3 {
+ 	maximum-speed = "super-speed";
+-	dr_mode = "peripheral";
+ };
+ 
+ &usb_hsphy {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch b/queue-6.7/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
new file mode 100644
index 00000000000..98ffffa118f
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
@@ -0,0 +1,42 @@
+From decc351e9b3dd31e9075bfba5f35c05bc7d10428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 10:46:23 +0100
+Subject: arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit dc6b5562acbac0285ab3b2dad23930b6434bdfc6 ]
+
+There is no "panic-indicator" default trigger but a property with that
+name:
+
+  qrb5165-rb5.dtb: leds: led-user4: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
+
+Fixes: b5cbd84e499a ("arm64: dts: qcom: qrb5165-rb5: Add onboard LED support")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231111094623.12476-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+index c8cd40a462a3..f9464caddacc 100644
+--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
++++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+@@ -64,8 +64,8 @@ led-user4 {
+ 			function = LED_FUNCTION_INDICATOR;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&pm8150_gpios 10 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "panic-indicator";
+ 			default-state = "off";
++			panic-indicator;
+ 		};
+ 
+ 		led-wlan {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sa8775p-fix-usb-wakeup-interrupt-type.patch b/queue-6.7/arm64-dts-qcom-sa8775p-fix-usb-wakeup-interrupt-type.patch
new file mode 100644
index 00000000000..169fc488a7a
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sa8775p-fix-usb-wakeup-interrupt-type.patch
@@ -0,0 +1,67 @@
+From 7d9b541a8dd6589613a935b3d014f90f9d39e6fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 17:43:22 +0100
+Subject: arm64: dts: qcom: sa8775p: fix USB wakeup interrupt types
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 0984bc0165f7c5203dfffe8cdb5186995f628a80 ]
+
+The DP/DM wakeup interrupts are edge triggered and which edge to trigger
+on depends on use-case and whether a Low speed or Full/High speed device
+is connected.
+
+Note that only triggering on rising edges can be used to detect resume
+events but not disconnect events.
+
+Fixes: de1001525c1a ("arm64: dts: qcom: sa8775p: add USB nodes")
+Cc: Shazad Hussain <quic_shazhuss@quicinc.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Link: https://lore.kernel.org/r/20231120164331.8116-3-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sa8775p.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sa8775p.dtsi b/arch/arm64/boot/dts/qcom/sa8775p.dtsi
+index 5e1d6756f245..1274dcda2256 100644
+--- a/arch/arm64/boot/dts/qcom/sa8775p.dtsi
++++ b/arch/arm64/boot/dts/qcom/sa8775p.dtsi
+@@ -1610,8 +1610,8 @@ usb_0: usb@a6f8800 {
+ 			assigned-clock-rates = <19200000>, <200000000>;
+ 
+ 			interrupts-extended = <&intc GIC_SPI 287 IRQ_TYPE_LEVEL_HIGH>,
+-					      <&pdc 14 IRQ_TYPE_EDGE_RISING>,
+-					      <&pdc 15 IRQ_TYPE_EDGE_RISING>,
++					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>,
++					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
+ 					      <&pdc 12 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "pwr_event",
+ 					  "dp_hs_phy_irq",
+@@ -1697,8 +1697,8 @@ usb_1: usb@a8f8800 {
+ 			assigned-clock-rates = <19200000>, <200000000>;
+ 
+ 			interrupts-extended = <&intc GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>,
+-					      <&pdc 8 IRQ_TYPE_EDGE_RISING>,
+-					      <&pdc 7 IRQ_TYPE_EDGE_RISING>,
++					      <&pdc 8 IRQ_TYPE_EDGE_BOTH>,
++					      <&pdc 7 IRQ_TYPE_EDGE_BOTH>,
+ 					      <&pdc 13 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "pwr_event",
+ 					  "dp_hs_phy_irq",
+@@ -1760,8 +1760,8 @@ usb_2: usb@a4f8800 {
+ 			assigned-clock-rates = <19200000>, <200000000>;
+ 
+ 			interrupts-extended = <&intc GIC_SPI 444 IRQ_TYPE_LEVEL_HIGH>,
+-					      <&pdc 10 IRQ_TYPE_EDGE_RISING>,
+-					      <&pdc 9 IRQ_TYPE_EDGE_RISING>;
++					      <&pdc 10 IRQ_TYPE_EDGE_BOTH>,
++					      <&pdc 9 IRQ_TYPE_EDGE_BOTH>;
+ 			interrupt-names = "pwr_event",
+ 					  "dp_hs_phy_irq",
+ 					  "dm_hs_phy_irq";
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sa8775p-make-watchdog-bark-interrupt-.patch b/queue-6.7/arm64-dts-qcom-sa8775p-make-watchdog-bark-interrupt-.patch
new file mode 100644
index 00000000000..1ea511f4e53
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sa8775p-make-watchdog-bark-interrupt-.patch
@@ -0,0 +1,42 @@
+From 32f4667826d662cec918de3ba698e8635de88f7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:33 -0800
+Subject: arm64: dts: qcom: sa8775p: Make watchdog bark interrupt edge
+ triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 48d5cf4772ec6268853158d9ffc54612e988ebe6 ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 09b701b89a76 ("arm64: dts: qcom: sa8775p: add the watchdog node")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.6.I909b7c4453d7b7fb0db4b6e49aa21666279d827d@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sa8775p.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sa8775p.dtsi b/arch/arm64/boot/dts/qcom/sa8775p.dtsi
+index b6a93b11cbbd..5e1d6756f245 100644
+--- a/arch/arm64/boot/dts/qcom/sa8775p.dtsi
++++ b/arch/arm64/boot/dts/qcom/sa8775p.dtsi
+@@ -2181,7 +2181,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sa8775p", "qcom,kpss-wdt";
+ 			reg = <0x0 0x17c10000 0x0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		memtimer: timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch b/queue-6.7/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..8e787d9a53b
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,58 @@
+From b9707f221e0de1854d13912677d8e9578c41539c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:28 -0800
+Subject: arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 7ac90b4cf107a3999b30844d7899e0331686b33b ]
+
+On sc7180 when the watchdog timer fires your logs get filled with:
+  watchdog0: pretimeout event
+  watchdog0: pretimeout event
+  watchdog0: pretimeout event
+  ...
+  watchdog0: pretimeout event
+
+If you're using console-ramoops to debug crashes the above gets quite
+annoying since it blows away any other log messages that might have
+been there.
+
+The issue is that the "bark" interrupt (AKA the "pretimeout"
+interrupt) remains high until the watchdog is pet. Since we've got
+things configured as "level" triggered we'll keep getting interrupted
+over and over.
+
+Let's switch to edge triggered. Now we'll get one interrupt when the
+"bark" interrupt goes off and won't get another one until the "bark"
+interrupt is cleared and asserts again.
+
+This matches how many older Qualcomm SoCs have things configured.
+
+Fixes: 28cc13e4060c ("arm64: dts: qcom: sc7180: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.1.Ic7577567baff921347d423b722de8b857602efb1@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+index 11f353d416b4..c0365832c315 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
+@@ -3576,7 +3576,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sc7180", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch b/queue-6.7/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
new file mode 100644
index 00000000000..b6b49336038
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
@@ -0,0 +1,44 @@
+From 127fd247cad390278a1ca174b90b53d7353fb6c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:12:53 +0100
+Subject: arm64: dts: qcom: sc7280: Fix up GPU SIDs
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 94085049fdad7a36fe14dd55e72e712fe55d6bca ]
+
+GPU_SMMU SID 1 is meant for Adreno LPAC (Low Priority Async Compute).
+On platforms that support it (in firmware), it is necessary to
+describe that link, or Adreno register access will hang the board.
+
+The current settings are functionally identical, *but* due to what is
+likely hardcoded security policies, the secure firmware rejects them,
+resulting in the board hanging. To avoid that, alter the settings such
+that SID 0 and 1 are described separately.
+
+Fixes: 96c471970b7b ("arm64: dts: qcom: sc7280: Add gpu support")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230926-topic-a643-v2-2-06fa3d899c0a@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 6d01262199dc..ea183eadf700 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2598,7 +2598,8 @@ gpu: gpu@3d00000 {
+ 				    "cx_mem",
+ 				    "cx_dbgc";
+ 			interrupts = <GIC_SPI 300 IRQ_TYPE_LEVEL_HIGH>;
+-			iommus = <&adreno_smmu 0 0x401>;
++			iommus = <&adreno_smmu 0 0x400>,
++				 <&adreno_smmu 1 0x400>;
+ 			operating-points-v2 = <&gpu_opp_table>;
+ 			qcom,gmu = <&gmu>;
+ 			interconnects = <&gem_noc MASTER_GFX3D 0 &mc_virt SLAVE_EBI1 0>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch b/queue-6.7/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
new file mode 100644
index 00000000000..c1d85e5d4a5
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
@@ -0,0 +1,43 @@
+From 99228996e313483b443405b8e9e1a5be021726a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 17:43:25 +0100
+Subject: arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 24f8aba9a7c77c7e9d814a5754798e8346c7dd28 ]
+
+The DP/DM wakeup interrupts are edge triggered and which edge to trigger
+on depends on use-case and whether a Low speed or Full/High speed device
+is connected.
+
+Note that only triggering on rising edges can be used to detect resume
+events but not disconnect events.
+
+Fixes: bb9efa59c665 ("arm64: dts: qcom: sc7280: Add USB related nodes")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20231120164331.8116-6-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 1a3db2579806..1dac0b10582e 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -3428,8 +3428,8 @@ usb_2: usb@8cf8800 {
+ 			assigned-clock-rates = <19200000>, <200000000>;
+ 
+ 			interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
+-					      <&pdc 12 IRQ_TYPE_EDGE_RISING>,
+-					      <&pdc 13 IRQ_TYPE_EDGE_RISING>;
++					      <&pdc 12 IRQ_TYPE_EDGE_BOTH>,
++					      <&pdc 13 IRQ_TYPE_EDGE_BOTH>;
+ 			interrupt-names = "hs_phy_irq",
+ 					  "dp_hs_phy_irq",
+ 					  "dm_hs_phy_irq";
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch b/queue-6.7/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..b1582cf0b94
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From cf1785b8d40640a840e0f1595a3eb86b9a621409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:29 -0800
+Subject: arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 6897fac411db7b43243f67d4fd4d3f95abf7f656 ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 0e51f883daa9 ("arm64: dts: qcom: sc7280: Add APSS watchdog node")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.2.I11f77956d2492c88aca0ef5462123f225caf4fb4@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 66f1eb83cca7..6d01262199dc 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -5222,7 +5222,7 @@ watchdog: watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sc7280", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 			status = "reserved"; /* Owned by Gunyah hyp */
+ 		};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch b/queue-6.7/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
new file mode 100644
index 00000000000..b0fbaa21962
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
@@ -0,0 +1,37 @@
+From 07e18a25ca98c1b7c3e956079a217f7bcf8086f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 13:12:54 +0100
+Subject: arm64: dts: qcom: sc7280: Mark Adreno SMMU as DMA coherent
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 31edad478534186a2718be9206ce7b19f2735f6e ]
+
+The SMMUs on sc7280 are cache-coherent. APPS_SMMU is marked as such,
+mark the GPU one as well.
+
+Fixes: 96c471970b7b ("arm64: dts: qcom: sc7280: Add gpu support")
+Reviewed-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230926-topic-a643-v2-3-06fa3d899c0a@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index ea183eadf700..1a3db2579806 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -2773,6 +2773,7 @@ adreno_smmu: iommu@3da0000 {
+ 					"gpu_cc_hub_aon_clk";
+ 
+ 			power-domains = <&gpucc GPU_CC_CX_GDSC>;
++			dma-coherent;
+ 		};
+ 
+ 		remoteproc_mpss: remoteproc@4080000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch b/queue-6.7/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
new file mode 100644
index 00000000000..c363f93f1c4
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
@@ -0,0 +1,44 @@
+From 48b6206c3d3eb8f5bf13d97fc844c164e2e01863 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 15:38:33 +0100
+Subject: arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 827f5fc8d912203c1f971e47d61130b13c6820ba ]
+
+The SDHCI hosts on SC7280 are cache-coherent, just like on most fairly
+recent Qualcomm SoCs. Mark them as such.
+
+Fixes: 298c81a7d44f ("arm64: dts: qcom: sc7280: Add nodes for eMMC and SD card")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-7280_dmac_sdhci-v1-1-97af7efd64a1@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+index 1dac0b10582e..f7f616906f6f 100644
+--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
+@@ -974,6 +974,7 @@ sdhc_1: mmc@7c4000 {
+ 
+ 			bus-width = <8>;
+ 			supports-cqe;
++			dma-coherent;
+ 
+ 			qcom,dll-config = <0x0007642c>;
+ 			qcom,ddr-config = <0x80040868>;
+@@ -3331,6 +3332,7 @@ sdhc_2: mmc@8804000 {
+ 			operating-points-v2 = <&sdhc2_opp_table>;
+ 
+ 			bus-width = <4>;
++			dma-coherent;
+ 
+ 			qcom,dll-config = <0x0007642c>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-fix-up-pcie-nodes.patch b/queue-6.7/arm64-dts-qcom-sc8180x-fix-up-pcie-nodes.patch
new file mode 100644
index 00000000000..3a2c9f431d8
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc8180x-fix-up-pcie-nodes.patch
@@ -0,0 +1,55 @@
+From 0f7878e03e2c8ae3772776f9aafa2b7562b3205c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:05:06 +0100
+Subject: arm64: dts: qcom: sc8180x: Fix up PCIe nodes
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 78403b37f6770441f80a78d13772394731afe055 ]
+
+Duplicated clock output names cause probe errors and wrong clocks cause
+hardware not to work. Fix such issues.
+
+Fixes: d20b6c84f56a ("arm64: dts: qcom: sc8180x: Add PCIe instances")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231219-topic-8180_pcie-v1-1-c2acbba4723c@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index 59ab5428348d..b5eb84287870 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -1762,7 +1762,7 @@ pcie0_phy: phy@1c06000 {
+ 			clocks = <&gcc GCC_PCIE_PHY_AUX_CLK>,
+ 				 <&gcc GCC_PCIE_0_CFG_AHB_CLK>,
+ 				 <&gcc GCC_PCIE_0_CLKREF_CLK>,
+-				 <&gcc GCC_PCIE1_PHY_REFGEN_CLK>,
++				 <&gcc GCC_PCIE0_PHY_REFGEN_CLK>,
+ 				 <&gcc GCC_PCIE_0_PIPE_CLK>;
+ 			clock-names = "aux",
+ 				      "cfg_ahb",
+@@ -1860,7 +1860,7 @@ pcie3_phy: phy@1c0c000 {
+ 			clocks = <&gcc GCC_PCIE_PHY_AUX_CLK>,
+ 				 <&gcc GCC_PCIE_3_CFG_AHB_CLK>,
+ 				 <&gcc GCC_PCIE_3_CLKREF_CLK>,
+-				 <&gcc GCC_PCIE2_PHY_REFGEN_CLK>,
++				 <&gcc GCC_PCIE3_PHY_REFGEN_CLK>,
+ 				 <&gcc GCC_PCIE_3_PIPE_CLK>;
+ 			clock-names = "aux",
+ 				      "cfg_ahb",
+@@ -2066,7 +2066,7 @@ pcie2_phy: phy@1c1c000 {
+ 				      "refgen",
+ 				      "pipe";
+ 			#clock-cells = <0>;
+-			clock-output-names = "pcie_3_pipe_clk";
++			clock-output-names = "pcie_2_pipe_clk";
+ 
+ 			#phy-cells = <0>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-mark-pcie-hosts-cache-coheren.patch b/queue-6.7/arm64-dts-qcom-sc8180x-mark-pcie-hosts-cache-coheren.patch
new file mode 100644
index 00000000000..82e99acf0b1
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc8180x-mark-pcie-hosts-cache-coheren.patch
@@ -0,0 +1,59 @@
+From f43c1ceb90005dd22c4a2eb8bdfd30c9e93378da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 19:40:21 +0100
+Subject: arm64: dts: qcom: sc8180x: Mark PCIe hosts cache-coherent
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 45e8c72712345263208f7c94f334fa718634f557 ]
+
+The PCIe controllers on 8180 are cache-coherent. Mark them as such.
+
+Fixes: d20b6c84f56a ("arm64: dts: qcom: sc8180x: Add PCIe instances")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231219-topic-8180_pcie_dmac-v1-1-5d00fc1b23fd@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x.dtsi b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+index a34f438ef2d9..59ab5428348d 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8180x.dtsi
+@@ -1751,6 +1751,7 @@ pcie0: pci@1c00000 {
+ 
+ 			phys = <&pcie0_phy>;
+ 			phy-names = "pciephy";
++			dma-coherent;
+ 
+ 			status = "disabled";
+ 		};
+@@ -1848,6 +1849,7 @@ pcie3: pci@1c08000 {
+ 
+ 			phys = <&pcie3_phy>;
+ 			phy-names = "pciephy";
++			dma-coherent;
+ 
+ 			status = "disabled";
+ 		};
+@@ -1946,6 +1948,7 @@ pcie1: pci@1c10000 {
+ 
+ 			phys = <&pcie1_phy>;
+ 			phy-names = "pciephy";
++			dma-coherent;
+ 
+ 			status = "disabled";
+ 		};
+@@ -2044,6 +2047,7 @@ pcie2: pci@1c18000 {
+ 
+ 			phys = <&pcie2_phy>;
+ 			phy-names = "pciephy";
++			dma-coherent;
+ 
+ 			status = "disabled";
+ 		};
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc8180x-primus-fix-hall_int-polarity.patch b/queue-6.7/arm64-dts-qcom-sc8180x-primus-fix-hall_int-polarity.patch
new file mode 100644
index 00000000000..e9fa8db004d
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc8180x-primus-fix-hall_int-polarity.patch
@@ -0,0 +1,41 @@
+From c853ab2c489e57a411177592aafc68584b14d48f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 16:11:10 -0800
+Subject: arm64: dts: qcom: sc8180x-primus: Fix HALL_INT polarity
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit 1aaa08e8de365cce59203541cafadb5053b1ec1a ]
+
+The hall sensor interrupt on the Primus is active low, which means that
+with the current configuration the device attempts to suspend when the
+LID is open.
+
+Fix the polarity of the HALL_INT GPIO to avoid this.
+
+Fixes: 2ce38cc1e8fe ("arm64: dts: qcom: sc8180x: Introduce Primus")
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231130-sc8180x-primus-lid-polarity-v1-1-da917b59604b@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8180x-primus.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8180x-primus.dts b/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
+index fd2fab4895b3..a40ef23a2a4f 100644
+--- a/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
++++ b/arch/arm64/boot/dts/qcom/sc8180x-primus.dts
+@@ -43,7 +43,7 @@ gpio-keys {
+ 		pinctrl-0 = <&hall_int_active_state>;
+ 
+ 		lid-switch {
+-			gpios = <&tlmm 121 GPIO_ACTIVE_HIGH>;
++			gpios = <&tlmm 121 GPIO_ACTIVE_LOW>;
+ 			linux,input-type = <EV_SW>;
+ 			linux,code = <SW_LID>;
+ 			wakeup-source;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch b/queue-6.7/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
new file mode 100644
index 00000000000..858892fb0d0
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
@@ -0,0 +1,41 @@
+From b079510e778cbfb805dcdb71d4229f21333d90a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:34 -0800
+Subject: arm64: dts: qcom: sc8280xp: Make watchdog bark interrupt edge
+ triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 6c4a9c7ea486da490400c84ba2768c90d228c283 ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.7.I1c8ab71570f6906fd020decb80675f05fbe1fe74@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index cad59af7ccef..b8081513176a 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -4225,7 +4225,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sc8280xp", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc8280xp-x13s-add-missing-camera-led-.patch b/queue-6.7/arm64-dts-qcom-sc8280xp-x13s-add-missing-camera-led-.patch
new file mode 100644
index 00000000000..9d2966e2f91
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc8280xp-x13s-add-missing-camera-led-.patch
@@ -0,0 +1,53 @@
+From d287a3278949307a9cada1a2e21097b6e81fde3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Oct 2023 11:36:47 +0200
+Subject: arm64: dts: qcom: sc8280xp-x13s: add missing camera LED pin config
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit a3457cc5bc30ad053c90ae9f14e9b7723d204a98 ]
+
+Add the missing pin configuration for the recently added camera
+indicator LED.
+
+Fixes: 1c63dd1c5fda ("arm64: dts: qcom: sc8280xp-x13s: Add camera activity LED")
+Cc: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20231003093647.3840-1-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts    | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+index 6a4c6cc19c09..f2055899ae7a 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
++++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+@@ -82,6 +82,9 @@ switch-lid {
+ 	leds {
+ 		compatible = "gpio-leds";
+ 
++		pinctrl-names = "default";
++		pinctrl-0 = <&cam_indicator_en>;
++
+ 		led-camera-indicator {
+ 			label = "white:camera-indicator";
+ 			function = LED_FUNCTION_INDICATOR;
+@@ -1278,6 +1281,13 @@ hstp-sw-ctrl-pins {
+ 		};
+ 	};
+ 
++	cam_indicator_en: cam-indicator-en-state {
++		pins = "gpio28";
++		function = "gpio";
++		drive-strength = <2>;
++		bias-disable;
++	};
++
+ 	edp_reg_en: edp-reg-en-state {
+ 		pins = "gpio25";
+ 		function = "gpio";
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sc8280xp-x13s-use-the-correct-dp-phy-.patch b/queue-6.7/arm64-dts-qcom-sc8280xp-x13s-use-the-correct-dp-phy-.patch
new file mode 100644
index 00000000000..30557a35589
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sc8280xp-x13s-use-the-correct-dp-phy-.patch
@@ -0,0 +1,39 @@
+From 985a8bb88c39229b312a9577ac080e43a69c438a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Sep 2023 18:02:57 +0200
+Subject: arm64: dts: qcom: sc8280xp-x13s: Use the correct DP PHY compatible
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 0cd080dd6d08817c9980d2069197b066636b0f23 ]
+
+The DP PHY needs different settings when an eDP display is used.
+Make sure these apply on the X13s.
+
+FWIW
+I could not notice any user-facing change stemming from this commit.
+
+Fixes: f48c70b111b4 ("arm64: dts: qcom: sc8280xp-x13s: enable eDP display")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20230929-topic-x13s_edpphy-v1-1-ce59f9eb4226@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+index 38edaf51aa34..6a4c6cc19c09 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
++++ b/arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts
+@@ -601,6 +601,7 @@ mdss0_dp3_out: endpoint {
+ };
+ 
+ &mdss0_dp3_phy {
++	compatible = "qcom,sc8280xp-edp-phy";
+ 	vdda-phy-supply = <&vreg_l6b>;
+ 	vdda-pll-supply = <&vreg_l3b>;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch b/queue-6.7/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
new file mode 100644
index 00000000000..4f31e819f9d
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
@@ -0,0 +1,41 @@
+From 17fd88982dd3704d3a72a62ae3fed4c26266d7c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 10:56:16 +0100
+Subject: arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 0c90c75e663246203a2b7f6dd9e08a110f4c3c43 ]
+
+There is no "panic-indicator" default trigger but a property with that
+name:
+
+  sdm845-db845c.dtb: leds: led-0: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
+
+Fixes: 3f72e2d3e682 ("arm64: dts: qcom: Add Dragonboard 845c")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231111095617.16496-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index c7eba6c491be..7e7bf3fb3be6 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -67,8 +67,8 @@ led-0 {
+ 			function = LED_FUNCTION_INDICATOR;
+ 			color = <LED_COLOR_ID_GREEN>;
+ 			gpios = <&pm8998_gpios 13 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "panic-indicator";
+ 			default-state = "off";
++			panic-indicator;
+ 		};
+ 
+ 		led-1 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch b/queue-6.7/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..c8c40e0eb03
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From 0200f1a3bf99395ae59e37f8cb00a70955631327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:30 -0800
+Subject: arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 263b348499454f38d36b9442c3cf9279c571bb54 ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 36c436b03c58 ("arm64: dts: qcom: sdm845: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.3.I16675ebe5517c68453a1bd7f4334ff885f806c03@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+index bf5e6eb9d313..9648505644ff 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
+@@ -5088,7 +5088,7 @@ watchdog@17980000 {
+ 			compatible = "qcom,apss-wdt-sdm845", "qcom,kpss-wdt";
+ 			reg = <0 0x17980000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		apss_shared: mailbox@17990000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm6125-add-interrupts-to-dwc3-usb-con.patch b/queue-6.7/arm64-dts-qcom-sm6125-add-interrupts-to-dwc3-usb-con.patch
new file mode 100644
index 00000000000..6fe5359a25b
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm6125-add-interrupts-to-dwc3-usb-con.patch
@@ -0,0 +1,46 @@
+From 4e6b937e1ae87e622ca3201a25839485b2bbf141 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 17:42:28 +0100
+Subject: arm64: dts: qcom: sm6125: add interrupts to DWC3 USB controller
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 67e4656f4487b95a39e45884c99235f62ebfaa47 ]
+
+Add interrupts to SM6125 DWC3 USB controller, based on downstream/vendor
+code of Trinket DTSI from Xiaomi Laurel device, to fix dtbs_check
+warnings:
+
+  sm6125-xiaomi-laurel-sprout.dtb: usb@4ef8800: 'interrupt-names' is a required property
+  sm6125-xiaomi-laurel-sprout.dtb: usb@4ef8800: 'oneOf' conditional failed, one must be fixed:
+    'interrupts' is a required property
+    'interrupts-extended' is a required property
+
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Fixes: cff4bbaf2a2d ("arm64: dts: qcom: Add support for SM6125")
+Reviewed-by: Marijn Suijten <marijn.suijten@somainline.org>
+Link: https://lore.kernel.org/r/20231111164229.63803-5-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6125.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6125.dtsi b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+index eb07eca3a48d..1dd3a4056e26 100644
+--- a/arch/arm64/boot/dts/qcom/sm6125.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6125.dtsi
+@@ -1185,6 +1185,10 @@ usb3: usb@4ef8800 {
+ 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
+ 			assigned-clock-rates = <19200000>, <66666667>;
+ 
++			interrupts = <GIC_SPI 260 IRQ_TYPE_LEVEL_HIGH>,
++				     <GIC_SPI 422 IRQ_TYPE_LEVEL_HIGH>;
++			interrupt-names = "hs_phy_irq", "ss_phy_irq";
++
+ 			power-domains = <&gcc USB30_PRIM_GDSC>;
+ 			qcom,select-utmi-as-pipe-clk;
+ 			status = "disabled";
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch b/queue-6.7/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..4571241d2f4
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From b80d680f36fa44349a7ec91adc4cae9174cf0726 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:35 -0800
+Subject: arm64: dts: qcom: sm6350: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 5b84bb2b8d86595544fc8272364b0f1a34b68a4f ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 5f82b9cda61e ("arm64: dts: qcom: Add SM6350 device tree")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.8.Ic1d4402e99c70354d501ccd98105e908a902f671@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6350.dtsi b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+index 8fd6f4d03490..6464e144c228 100644
+--- a/arch/arm64/boot/dts/qcom/sm6350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6350.dtsi
+@@ -2524,7 +2524,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sm6350", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm6375-fix-usb-wakeup-interrupt-types.patch b/queue-6.7/arm64-dts-qcom-sm6375-fix-usb-wakeup-interrupt-types.patch
new file mode 100644
index 00000000000..778c00ff2bf
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm6375-fix-usb-wakeup-interrupt-types.patch
@@ -0,0 +1,43 @@
+From 76ac014a70d1f754ea933151b068d1c71423f384 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 17:43:29 +0100
+Subject: arm64: dts: qcom: sm6375: fix USB wakeup interrupt types
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 41952be6661b20f56c2c5b06c431880dd975b747 ]
+
+The DP/DM wakeup interrupts are edge triggered and which edge to trigger
+on depends on use-case and whether a Low speed or Full/High speed device
+is connected.
+
+Fixes: 59d34ca97f91 ("arm64: dts: qcom: Add initial device tree for SM6375")
+Cc: stable@vger.kernel.org      # 6.2
+Cc: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20231120164331.8116-10-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Stable-dep-of: d3246a0cf43f ("arm64: dts: qcom: sm6375: Hook up MPM")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6375.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6375.dtsi b/arch/arm64/boot/dts/qcom/sm6375.dtsi
+index e7ff55443da7..b479f3d9a3a8 100644
+--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi
+@@ -1362,8 +1362,8 @@ usb_1: usb@4ef8800 {
+ 
+ 			interrupts = <GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
++				     <GIC_SPI 93 IRQ_TYPE_EDGE_BOTH>,
++				     <GIC_SPI 94 IRQ_TYPE_EDGE_BOTH>;
+ 			interrupt-names = "hs_phy_irq",
+ 					  "ss_phy_irq",
+ 					  "dm_hs_phy_irq",
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm6375-hook-up-mpm.patch b/queue-6.7/arm64-dts-qcom-sm6375-hook-up-mpm.patch
new file mode 100644
index 00000000000..d6272c4cab1
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm6375-hook-up-mpm.patch
@@ -0,0 +1,115 @@
+From 961f39ad85c8c9fa83464e03aedd6276aed05c52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 01:01:08 +0100
+Subject: arm64: dts: qcom: sm6375: Hook up MPM
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit d3246a0cf43fd24a1986163284edd2389143809d ]
+
+Add a node for MPM and wire it up on consumers that use it. This also
+fixes a very bad and sad assumption I made when initially porting this
+SoC that the downstream MPM-TLMM mappings were 1-1. That apparently
+changed some time ago, so with this patch the MPM consumers will actually
+be hooked up to the correct interrupt lines.
+
+Fixes: 59d34ca97f91 ("arm64: dts: qcom: Add initial device tree for SM6375")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231215-topic-mpm_dt-v1-1-c6636fc75ce3@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6375.dtsi | 41 +++++++++++++++++++++++-----
+ 1 file changed, 34 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6375.dtsi b/arch/arm64/boot/dts/qcom/sm6375.dtsi
+index b479f3d9a3a8..e56f7ea4ebc6 100644
+--- a/arch/arm64/boot/dts/qcom/sm6375.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm6375.dtsi
+@@ -311,6 +311,25 @@ scm {
+ 		};
+ 	};
+ 
++	mpm: interrupt-controller {
++		compatible = "qcom,mpm";
++		qcom,rpm-msg-ram = <&apss_mpm>;
++		interrupts = <GIC_SPI 197 IRQ_TYPE_EDGE_RISING>;
++		mboxes = <&ipcc IPCC_CLIENT_AOP IPCC_MPROC_SIGNAL_SMP2P>;
++		interrupt-controller;
++		#interrupt-cells = <2>;
++		#power-domain-cells = <0>;
++		interrupt-parent = <&intc>;
++		qcom,mpm-pin-count = <96>;
++		qcom,mpm-pin-map = <5 296>,  /* Soundwire wake_irq */
++				   <12 422>, /* DWC3 ss_phy_irq */
++				   <86 183>, /* MPM wake, SPMI */
++				   <89 314>, /* TSENS0 0C */
++				   <90 315>, /* TSENS1 0C */
++				   <93 164>, /* DWC3 dm_hs_phy_irq */
++				   <94 165>; /* DWC3 dp_hs_phy_irq */
++	};
++
+ 	memory@80000000 {
+ 		device_type = "memory";
+ 		/* We expect the bootloader to fill in the size */
+@@ -486,6 +505,7 @@ CPU_PD7: power-domain-cpu7 {
+ 
+ 		CLUSTER_PD: power-domain-cpu-cluster0 {
+ 			#power-domain-cells = <0>;
++			power-domains = <&mpm>;
+ 			domain-idle-states = <&CLUSTER_SLEEP_0>;
+ 		};
+ 	};
+@@ -808,7 +828,7 @@ tlmm: pinctrl@500000 {
+ 			reg = <0 0x00500000 0 0x800000>;
+ 			interrupts = <GIC_SPI 227 IRQ_TYPE_LEVEL_HIGH>;
+ 			gpio-ranges = <&tlmm 0 0 157>;
+-			/* TODO: Hook up MPM as wakeup-parent when it's there */
++			wakeup-parent = <&mpm>;
+ 			interrupt-controller;
+ 			gpio-controller;
+ 			#interrupt-cells = <2>;
+@@ -930,7 +950,7 @@ spmi_bus: spmi@1c40000 {
+ 			      <0 0x01c0a000 0 0x26000>;
+ 			reg-names = "core", "chnls", "obsrvr", "intr", "cnfg";
+ 			interrupt-names = "periph_irq";
+-			interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts-extended = <&mpm 86 IRQ_TYPE_LEVEL_HIGH>;
+ 			qcom,ee = <0>;
+ 			qcom,channel = <0>;
+ 			#address-cells = <2>;
+@@ -962,8 +982,15 @@ tsens1: thermal-sensor@4413000 {
+ 		};
+ 
+ 		rpm_msg_ram: sram@45f0000 {
+-			compatible = "qcom,rpm-msg-ram";
++			compatible = "qcom,rpm-msg-ram", "mmio-sram";
+ 			reg = <0 0x045f0000 0 0x7000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges = <0 0x0 0x045f0000 0x7000>;
++
++			apss_mpm: sram@1b8 {
++				reg = <0x1b8 0x48>;
++			};
+ 		};
+ 
+ 		sram@4690000 {
+@@ -1360,10 +1387,10 @@ usb_1: usb@4ef8800 {
+ 					  <&gcc GCC_USB30_PRIM_MASTER_CLK>;
+ 			assigned-clock-rates = <19200000>, <133333333>;
+ 
+-			interrupts = <GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 93 IRQ_TYPE_EDGE_BOTH>,
+-				     <GIC_SPI 94 IRQ_TYPE_EDGE_BOTH>;
++			interrupts-extended = <&intc GIC_SPI 302 IRQ_TYPE_LEVEL_HIGH>,
++					      <&mpm 12 IRQ_TYPE_LEVEL_HIGH>,
++					      <&mpm 93 IRQ_TYPE_EDGE_BOTH>,
++					      <&mpm 94 IRQ_TYPE_EDGE_BOTH>;
+ 			interrupt-names = "hs_phy_irq",
+ 					  "ss_phy_irq",
+ 					  "dm_hs_phy_irq",
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch b/queue-6.7/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
new file mode 100644
index 00000000000..ef952922bc7
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
@@ -0,0 +1,70 @@
+From 13072f8348069493f1183cd355cfde0916065fef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 19:40:35 +0200
+Subject: arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a509adf05b2aac31b22781f5aa09e4768a5b6c39 ]
+
+The SM8150-HDK uses two different regulators to power up SuperSpeed USB
+PHYs. The L5A regulator is used for the second USB host, while the first
+(OTG) USB host uses different regulator, L18A. Fix the regulator for the
+usb_1 QMPPHY and (to remove possible confusion) drop the
+usb_ss_dp_core_1/_2 labels.
+
+Fixes: 0ab1b2d10afe ("arm64: dts: qcom: add sm8150 hdk dts")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20231215174152.315403-4-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
+index bb161b536da4..f4c6e1309a7e 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
++++ b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
+@@ -127,8 +127,6 @@ vdda_qrefs_0p875_5:
+ 		vdda_sp_sensor:
+ 		vdda_ufs_2ln_core_1:
+ 		vdda_ufs_2ln_core_2:
+-		vdda_usb_ss_dp_core_1:
+-		vdda_usb_ss_dp_core_2:
+ 		vdda_qlink_lv:
+ 		vdda_qlink_lv_ck:
+ 		vreg_l5a_0p875: ldo5 {
+@@ -210,6 +208,12 @@ vreg_l17a_3p0: ldo17 {
+ 			regulator-max-microvolt = <3008000>;
+ 			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ 		};
++
++		vreg_l18a_0p8: ldo18 {
++			regulator-min-microvolt = <880000>;
++			regulator-max-microvolt = <880000>;
++			regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
++		};
+ 	};
+ 
+ 	regulators-1 {
+@@ -445,13 +449,13 @@ &usb_2_hsphy {
+ &usb_1_qmpphy {
+ 	status = "okay";
+ 	vdda-phy-supply = <&vreg_l3c_1p2>;
+-	vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
++	vdda-pll-supply = <&vreg_l18a_0p8>;
+ };
+ 
+ &usb_2_qmpphy {
+ 	status = "okay";
+ 	vdda-phy-supply = <&vreg_l3c_1p2>;
+-	vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
++	vdda-pll-supply = <&vreg_l5a_0p875>;
+ };
+ 
+ &usb_1 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8150-make-dispcc-cast-minimal-vote-.patch b/queue-6.7/arm64-dts-qcom-sm8150-make-dispcc-cast-minimal-vote-.patch
new file mode 100644
index 00000000000..d7dc1a94f9e
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8150-make-dispcc-cast-minimal-vote-.patch
@@ -0,0 +1,38 @@
+From 396f7a90c18df7c9982b42a3a01ff1f69f9f8f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 19:40:33 +0200
+Subject: arm64: dts: qcom: sm8150: make dispcc cast minimal vote on MMCX
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 617de4ce7b1c4b41c1316e493d4717cd2f208def ]
+
+Add required-opps property to the display clock controller. This makes
+it cast minimal vote on the MMCX lane and prevents further 'clock stuck'
+errors when enabling the display.
+
+Fixes: 2ef3bb17c45c ("arm64: dts: qcom: sm8150: Add DISPCC node")
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20231215174152.315403-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index ad4fab61222b..0e1aa8675879 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -3932,6 +3932,7 @@ dispcc: clock-controller@af00000 {
+ 				      "dp_phy_pll_link_clk",
+ 				      "dp_phy_pll_vco_div_clk";
+ 			power-domains = <&rpmhpd SM8150_MMCX>;
++			required-opps = <&rpmhpd_opp_low_svs>;
+ 			#clock-cells = <1>;
+ 			#reset-cells = <1>;
+ 			#power-domain-cells = <1>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch b/queue-6.7/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..a493b49a77a
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From dce666cfe8ad6a70c51267e5401a71048e53c868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:31 -0800
+Subject: arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 9204e9a4099212c850e1703c374ef4538080825b ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: b094c8f8dd2a ("arm64: dts: qcom: sm8150: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.4.I23d0aa6c8f1fec5c26ad9b3c610df6f4c5392850@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+index 97623af13464..ad4fab61222b 100644
+--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
+@@ -4170,7 +4170,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sm8150", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch b/queue-6.7/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
new file mode 100644
index 00000000000..dc138974af4
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
@@ -0,0 +1,40 @@
+From ec8a18fb788e9de821ef7aec81ed614156cad815 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 14:43:32 -0800
+Subject: arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 735d80e2e8e5d073ae8b1fff8b1589ea284aa5af ]
+
+As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
+bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
+interrupt should be configured as edge triggered. Make the change.
+
+Fixes: 46a4359f9156 ("arm64: dts: qcom: sm8250: Add watchdog bark interrupt")
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20231106144335.v2.5.I2910e7c10493d896841e9785c1817df9b9a58701@changeid
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+index be970472f6c4..72db75ca7731 100644
+--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
+@@ -6018,7 +6018,7 @@ watchdog@17c10000 {
+ 			compatible = "qcom,apss-wdt-sm8250", "qcom,kpss-wdt";
+ 			reg = <0 0x17c10000 0 0x1000>;
+ 			clocks = <&sleep_clk>;
+-			interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
++			interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
+ 		};
+ 
+ 		timer@17c20000 {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8350-fix-dma0-address.patch b/queue-6.7/arm64-dts-qcom-sm8350-fix-dma0-address.patch
new file mode 100644
index 00000000000..d7ef641642e
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8350-fix-dma0-address.patch
@@ -0,0 +1,42 @@
+From cc4b812bc501639cb0a034dc5c4093f2f37773e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 23:07:40 +0100
+Subject: arm64: dts: qcom: sm8350: Fix DMA0 address
+
+From: Nia Espera <nespera@igalia.com>
+
+[ Upstream commit 01a9e9eb6cdbce175ddea3cbe1163daed6d54344 ]
+
+DMA0 node downstream is specified at 0x900000, so fix the typo. Without
+this, enabling any i2c node using DMA0 causes a hang.
+
+Fixes: bc08fbf49bc8 ("arm64: dts: qcom: sm8350: Define GPI DMA engines")
+Fixes: 41d6bca799b3 ("arm64: dts: qcom: sm8350: correct DMA controller unit address")
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Nia Espera <nespera@igalia.com>
+Link: https://lore.kernel.org/r/20231111-nia-sm8350-for-upstream-v4-2-3a638b02eea5@igalia.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8350.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+index b46236235b7f..1d597af15bb3 100644
+--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
+@@ -919,9 +919,9 @@ spi19: spi@894000 {
+ 			};
+ 		};
+ 
+-		gpi_dma0: dma-controller@9800000 {
++		gpi_dma0: dma-controller@900000 {
+ 			compatible = "qcom,sm8350-gpi-dma", "qcom,sm6350-gpi-dma";
+-			reg = <0 0x09800000 0 0x60000>;
++			reg = <0 0x00900000 0 0x60000>;
+ 			interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 245 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 246 IRQ_TYPE_LEVEL_HIGH>,
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8450-correct-tx-soundwire-clock.patch b/queue-6.7/arm64-dts-qcom-sm8450-correct-tx-soundwire-clock.patch
new file mode 100644
index 00000000000..441fe835498
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8450-correct-tx-soundwire-clock.patch
@@ -0,0 +1,43 @@
+From 26b5b382b0a00dd7efe0190761f94ecb3d0ce16c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 15:05:36 +0100
+Subject: arm64: dts: qcom: sm8450: correct TX Soundwire clock
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 20e886590a310665244a354e3b693b881544edec ]
+
+The TX Soundwire controller should take clock from TX macro codec, not
+VA macro codec clock, otherwise the clock stays disabled.  This looks
+like a copy-paste issue, because the SC8280xp code uses here correctly
+clock from TX macro.  The VA macro clock is already consumed by TX macro
+codec, thus it won't be disabled by this change.
+
+Fixes: 14341e76dbc7 ("arm64: dts: qcom: sm8450: add Soundwire and LPASS")
+Reported-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231129140537.161720-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8450.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8450.dtsi b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+index 1783fa78bdbc..dc904ccb3d6c 100644
+--- a/arch/arm64/boot/dts/qcom/sm8450.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8450.dtsi
+@@ -2309,7 +2309,7 @@ swr2: soundwire-controller@33b0000 {
+ 				     <GIC_SPI 520 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "core", "wakeup";
+ 
+-			clocks = <&vamacro>;
++			clocks = <&txmacro>;
+ 			clock-names = "iface";
+ 			label = "TX";
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8550-correct-tx-soundwire-clock.patch b/queue-6.7/arm64-dts-qcom-sm8550-correct-tx-soundwire-clock.patch
new file mode 100644
index 00000000000..212b276e47d
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8550-correct-tx-soundwire-clock.patch
@@ -0,0 +1,42 @@
+From 18c82ac499b59e3d0d2e43b11a5b952d3f0c1fb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 15:05:37 +0100
+Subject: arm64: dts: qcom: sm8550: correct TX Soundwire clock
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit ead0f132fc494b46fcd94788456f9b264fd631bb ]
+
+The TX Soundwire controller should take clock from TX macro codec, not
+VA macro codec clock, otherwise the clock stays disabled.  This looks
+like a copy-paste issue, because the SC8280xp code uses here correctly
+clock from TX macro.  The VA macro clock is already consumed by TX macro
+codec, thus it won't be disabled by this change.
+
+Fixes: 61b006389bb7 ("arm64: dts: qcom: sm8550: add Soundwire controllers")
+Reported-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20231129140537.161720-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index 7b9ddde0b2c9..09353b27bcad 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -2194,7 +2194,7 @@ swr2: soundwire-controller@6d30000 {
+ 			interrupts = <GIC_SPI 496 IRQ_TYPE_LEVEL_HIGH>,
+ 				     <GIC_SPI 520 IRQ_TYPE_LEVEL_HIGH>;
+ 			interrupt-names = "core", "wakeup";
+-			clocks = <&lpass_vamacro>;
++			clocks = <&lpass_txmacro>;
+ 			clock-names = "iface";
+ 			label = "TX";
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8550-fix-usb-wakeup-interrupt-types.patch b/queue-6.7/arm64-dts-qcom-sm8550-fix-usb-wakeup-interrupt-types.patch
new file mode 100644
index 00000000000..88690a20cf5
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8550-fix-usb-wakeup-interrupt-types.patch
@@ -0,0 +1,45 @@
+From 3a9713788a76dc15751acfc534ec49b735054e39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 17:43:31 +0100
+Subject: arm64: dts: qcom: sm8550: fix USB wakeup interrupt types
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit 29d91ecf530a4ef0b7f94cb8cde07ed69731e45d ]
+
+The DP/DM wakeup interrupts are edge triggered and which edge to trigger
+on depends on use-case and whether a Low speed or Full/High speed device
+is connected.
+
+Note that only triggering on rising edges can be used to detect resume
+events but not disconnect events.
+
+Fixes: 7f7e5c1b037f ("arm64: dts: qcom: sm8550: Add USB PHYs and controller nodes")
+Cc: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20231120164331.8116-12-johan+linaro@kernel.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index 09353b27bcad..6c2b4da8e90a 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -2923,8 +2923,8 @@ usb_1: usb@a6f8800 {
+ 
+ 			interrupts-extended = <&intc GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>,
+ 					      <&pdc 17 IRQ_TYPE_LEVEL_HIGH>,
+-					      <&pdc 15 IRQ_TYPE_EDGE_RISING>,
+-					      <&pdc 14 IRQ_TYPE_EDGE_RISING>;
++					      <&pdc 15 IRQ_TYPE_EDGE_BOTH>,
++					      <&pdc 14 IRQ_TYPE_EDGE_BOTH>;
+ 			interrupt-names = "hs_phy_irq",
+ 					  "ss_phy_irq",
+ 					  "dm_hs_phy_irq",
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8550-separate-out-x3-idle-state.patch b/queue-6.7/arm64-dts-qcom-sm8550-separate-out-x3-idle-state.patch
new file mode 100644
index 00000000000..1118b75886d
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8550-separate-out-x3-idle-state.patch
@@ -0,0 +1,54 @@
+From e32edc46f6660e18ad040ab439a895b82050037d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:12 +0100
+Subject: arm64: dts: qcom: sm8550: Separate out X3 idle state
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 28b735232d5e16a34f98dbac1e7b5401c1c16d89 ]
+
+The X3 core has different entry/exit/residency time requirements than
+the big cluster. Denote them to stop confusing the scheduler.
+
+Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-11-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index 6c2b4da8e90a..a3aba04e4c4a 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -300,6 +300,16 @@ BIG_CPU_SLEEP_0: cpu-sleep-1-0 {
+ 				min-residency-us = <4791>;
+ 				local-timer-stop;
+ 			};
++
++			PRIME_CPU_SLEEP_0: cpu-sleep-2-0 {
++				compatible = "arm,idle-state";
++				idle-state-name = "goldplus-rail-power-collapse";
++				arm,psci-suspend-param = <0x40000004>;
++				entry-latency-us = <500>;
++				exit-latency-us = <1350>;
++				min-residency-us = <7480>;
++				local-timer-stop;
++			};
+ 		};
+ 
+ 		domain-idle-states {
+@@ -400,7 +410,7 @@ CPU_PD6: power-domain-cpu6 {
+ 		CPU_PD7: power-domain-cpu7 {
+ 			#power-domain-cells = <0>;
+ 			power-domains = <&CLUSTER_PD>;
+-			domain-idle-states = <&BIG_CPU_SLEEP_0>;
++			domain-idle-states = <&PRIME_CPU_SLEEP_0>;
+ 		};
+ 
+ 		CLUSTER_PD: power-domain-cluster {
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-qcom-sm8550-update-idle-state-time-require.patch b/queue-6.7/arm64-dts-qcom-sm8550-update-idle-state-time-require.patch
new file mode 100644
index 00000000000..4b2d78d4eb6
--- /dev/null
+++ b/queue-6.7/arm64-dts-qcom-sm8550-update-idle-state-time-require.patch
@@ -0,0 +1,77 @@
+From 18f4d768b6d8877fc0e488d241e1d81bce6e8a53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:13 +0100
+Subject: arm64: dts: qcom: sm8550: Update idle state time requirements
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit ad6556fb45d4ab91ad786a2025cbe2b0f2e6cf77 ]
+
+The idle state entry/exit/residency times differ from what shipped on
+production devices, mostly being overly optimistic in entry times and
+overly pessimistic in minimal residency times. Align them with
+downstream sources.
+
+Fixes: ffc50b2d3828 ("arm64: dts: qcom: Add base SM8550 dtsi")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-12-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm8550.dtsi | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm8550.dtsi b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+index a3aba04e4c4a..5cf813a579d5 100644
+--- a/arch/arm64/boot/dts/qcom/sm8550.dtsi
++++ b/arch/arm64/boot/dts/qcom/sm8550.dtsi
+@@ -285,9 +285,9 @@ LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 {
+ 				compatible = "arm,idle-state";
+ 				idle-state-name = "silver-rail-power-collapse";
+ 				arm,psci-suspend-param = <0x40000004>;
+-				entry-latency-us = <800>;
++				entry-latency-us = <550>;
+ 				exit-latency-us = <750>;
+-				min-residency-us = <4090>;
++				min-residency-us = <6700>;
+ 				local-timer-stop;
+ 			};
+ 
+@@ -296,8 +296,8 @@ BIG_CPU_SLEEP_0: cpu-sleep-1-0 {
+ 				idle-state-name = "gold-rail-power-collapse";
+ 				arm,psci-suspend-param = <0x40000004>;
+ 				entry-latency-us = <600>;
+-				exit-latency-us = <1550>;
+-				min-residency-us = <4791>;
++				exit-latency-us = <1300>;
++				min-residency-us = <8136>;
+ 				local-timer-stop;
+ 			};
+ 
+@@ -316,17 +316,17 @@ domain-idle-states {
+ 			CLUSTER_SLEEP_0: cluster-sleep-0 {
+ 				compatible = "domain-idle-state";
+ 				arm,psci-suspend-param = <0x41000044>;
+-				entry-latency-us = <1050>;
+-				exit-latency-us = <2500>;
+-				min-residency-us = <5309>;
++				entry-latency-us = <750>;
++				exit-latency-us = <2350>;
++				min-residency-us = <9144>;
+ 			};
+ 
+ 			CLUSTER_SLEEP_1: cluster-sleep-1 {
+ 				compatible = "domain-idle-state";
+ 				arm,psci-suspend-param = <0x4100c344>;
+-				entry-latency-us = <2700>;
+-				exit-latency-us = <3500>;
+-				min-residency-us = <13959>;
++				entry-latency-us = <2800>;
++				exit-latency-us = <4400>;
++				min-residency-us = <10150>;
+ 			};
+ 		};
+ 	};
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch b/queue-6.7/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
new file mode 100644
index 00000000000..319c99bcbe1
--- /dev/null
+++ b/queue-6.7/arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
@@ -0,0 +1,39 @@
+From 5be513523ad6eb3de0551fe009c77ca1693be400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 10:32:25 +0100
+Subject: arm64: dts: renesas: white-hawk-cpu: Fix missing serial console pin
+ control
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit fc67495680f60e88bb8ca43421c1dd628928d581 ]
+
+The pin control description for the serial console was added, but not
+enabled, due to missing pinctrl properties in the serial port device
+node.
+
+Fixes: 7a8d590de8132853 ("arm64: dts: renesas: white-hawk-cpu: Add serial port pin control")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/8a51516581cd71ecbfa174af9c7cebad1fc83c5b.1702459865.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi
+index bb4a5270f71b..913f70fe6c5c 100644
+--- a/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a779g0-white-hawk-cpu.dtsi
+@@ -187,6 +187,9 @@ &extalr_clk {
+ };
+ 
+ &hscif0 {
++	pinctrl-0 = <&hscif0_pins>;
++	pinctrl-names = "default";
++
+ 	status = "okay";
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-rockchip-fix-led-pinctrl-of-lubancat-1.patch b/queue-6.7/arm64-dts-rockchip-fix-led-pinctrl-of-lubancat-1.patch
new file mode 100644
index 00000000000..7e34001310e
--- /dev/null
+++ b/queue-6.7/arm64-dts-rockchip-fix-led-pinctrl-of-lubancat-1.patch
@@ -0,0 +1,38 @@
+From 0e1fe7cca133812cfa0986e47b8e24cd023b7668 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Dec 2023 08:50:55 +0800
+Subject: arm64: dts: rockchip: Fix led pinctrl of lubancat 1
+
+From: Andy Yan <andyshrk@163.com>
+
+[ Upstream commit 8586a5d217ef7bfeee24943c600a8a7890d6f477 ]
+
+According to the schematics, the gpio control sys_led is GPIO0_C5.
+
+Fixes: 8d94da58de53 ("arm64: dts: rockchip: Add EmbedFire LubanCat 1")
+Reported-by: Zhang Ning <zhangn1985@outlook.com>
+Closes: https://lore.kernel.org/linux-rockchip/OS0P286MB06412D049D8BF7B063D41350CD95A@OS0P286MB0641.JPNP286.PROD.OUTLOOK.COM/T/#u
+Signed-off-by: Andy Yan <andyshrk@163.com>
+Link: https://lore.kernel.org/r/20231225005055.3102743-1-andyshrk@163.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
+index 1c6d83b47cd2..6ecdf5d28339 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts
+@@ -455,7 +455,7 @@ &pcie2x1 {
+ &pinctrl {
+ 	leds {
+ 		sys_led_pin: sys-status-led-pin {
+-			rockchip,pins = <0 RK_PC7 RK_FUNC_GPIO &pcfg_pull_none>;
++			rockchip,pins = <0 RK_PC5 RK_FUNC_GPIO &pcfg_pull_none>;
+ 		};
+ 	};
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-ti-iot2050-re-add-aliases.patch b/queue-6.7/arm64-dts-ti-iot2050-re-add-aliases.patch
new file mode 100644
index 00000000000..f9d92d7bee0
--- /dev/null
+++ b/queue-6.7/arm64-dts-ti-iot2050-re-add-aliases.patch
@@ -0,0 +1,44 @@
+From fc9f314945be6d0d374418b2aff016a3090e4491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Nov 2023 09:52:15 +0100
+Subject: arm64: dts: ti: iot2050: Re-add aliases
+
+From: Jan Kiszka <jan.kiszka@siemens.com>
+
+[ Upstream commit ad8edf4ff37ab157f6547da173aedc9f4e5c4015 ]
+
+Lost while dropping them from the common dtsi.
+
+Fixes: ffc449e016e2 ("arm64: dts: ti: k3-am65: Drop aliases")
+Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Link: https://lore.kernel.org/r/1edbc1b56ed4ff2256d7afb7db3cab4b3a423692.1699087938.git.jan.kiszka@siemens.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
+index ba1c14a54acf..b849648d51f9 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-iot2050-common.dtsi
+@@ -14,6 +14,16 @@
+ 
+ / {
+ 	aliases {
++		serial0 = &wkup_uart0;
++		serial1 = &mcu_uart0;
++		serial2 = &main_uart0;
++		serial3 = &main_uart1;
++		i2c0 = &wkup_i2c0;
++		i2c1 = &mcu_i2c0;
++		i2c2 = &main_i2c0;
++		i2c3 = &main_i2c1;
++		i2c4 = &main_i2c2;
++		i2c5 = &main_i2c3;
+ 		spi0 = &mcu_spi0;
+ 		mmc0 = &sdhci1;
+ 		mmc1 = &sdhci0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch b/queue-6.7/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
new file mode 100644
index 00000000000..03d25c4656e
--- /dev/null
+++ b/queue-6.7/arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
@@ -0,0 +1,47 @@
+From d6388a19e13f7f50931c42e0032d3132df282612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 12:29:30 +0530
+Subject: arm64: dts: ti: k3-am62a-main: Fix GPIO pin count in DT nodes
+
+From: Nitin Yadav <n-yadav@ti.com>
+
+[ Upstream commit 7dc4af358cc382c5d20bd5b726e53ef0f526eb6d ]
+
+Fix number of gpio pins in main_gpio0 & main_gpio1 DT nodes according
+to AM62A7 datasheet[0].
+
+[0] https://www.ti.com/lit/gpn/am62a3 Section: 6.3.10 GPIO (Page No. 52-55)
+Fixes: 5fc6b1b62639 ("arm64: dts: ti: Introduce AM62A7 family of SoCs")
+Signed-off-by: Nitin Yadav <n-yadav@ti.com>
+Link: https://lore.kernel.org/r/20231027065930.1187405-1-n-yadav@ti.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am62a-main.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
+index 4ae7fdc5221b..ccd708b09acd 100644
+--- a/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am62a-main.dtsi
+@@ -462,7 +462,7 @@ main_gpio0: gpio@600000 {
+ 			     <193>, <194>, <195>;
+ 		interrupt-controller;
+ 		#interrupt-cells = <2>;
+-		ti,ngpio = <87>;
++		ti,ngpio = <92>;
+ 		ti,davinci-gpio-unbanked = <0>;
+ 		power-domains = <&k3_pds 77 TI_SCI_PD_EXCLUSIVE>;
+ 		clocks = <&k3_clks 77 0>;
+@@ -480,7 +480,7 @@ main_gpio1: gpio@601000 {
+ 			     <183>, <184>, <185>;
+ 		interrupt-controller;
+ 		#interrupt-cells = <2>;
+-		ti,ngpio = <88>;
++		ti,ngpio = <52>;
+ 		ti,davinci-gpio-unbanked = <0>;
+ 		power-domains = <&k3_pds 78 TI_SCI_PD_EXCLUSIVE>;
+ 		clocks = <&k3_clks 78 0>;
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch b/queue-6.7/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
new file mode 100644
index 00000000000..346e0581807
--- /dev/null
+++ b/queue-6.7/arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
@@ -0,0 +1,47 @@
+From d238cb1729b206566d86c35cd2e063f1bc600866 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 11:57:48 +0200
+Subject: arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit b57160859263c083c49482b0d083a586b1517f78 ]
+
+DSS irq trigger type is set to IRQ_TYPE_EDGE_RISING in the DT file, but
+the TRM says it is level triggered.
+
+For some reason triggering on rising edge results in double the amount
+of expected interrupts, e.g. for normal page flipping test the number of
+interrupts per second is 2 * fps. It is as if the IRQ triggers on both
+edges. There are no other side effects to this issue than slightly
+increased CPU & power consumption due to the extra interrupt.
+
+Switching to IRQ_TYPE_LEVEL_HIGH is correct and fixes the issue, so
+let's do that.
+
+Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231106-am65-dss-clk-edge-v1-1-4a959fec0e1e@ideasonboard.com
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+index 5ebb87f467de..29048d6577cf 100644
+--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+@@ -1034,7 +1034,7 @@ dss: dss@4a00000 {
+ 		assigned-clocks = <&k3_clks 67 2>;
+ 		assigned-clock-parents = <&k3_clks 67 5>;
+ 
+-		interrupts = <GIC_SPI 166 IRQ_TYPE_EDGE_RISING>;
++		interrupts = <GIC_SPI 166 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		dma-coherent;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/arm64-dts-xilinx-apply-overlays-to-base-dtbs.patch b/queue-6.7/arm64-dts-xilinx-apply-overlays-to-base-dtbs.patch
new file mode 100644
index 00000000000..49fdcc034e3
--- /dev/null
+++ b/queue-6.7/arm64-dts-xilinx-apply-overlays-to-base-dtbs.patch
@@ -0,0 +1,49 @@
+From 36c4ea2fcde42be3dc41a80a2006925fd7e70eaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Sep 2023 16:47:47 -0500
+Subject: arm64: dts: xilinx: Apply overlays to base dtbs
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 23b697ec85f3e7beed271b9f344c54821de2251e ]
+
+DT overlays in tree need to be applied to a base DTB to validate they
+apply, to run schema checks on them, and to catch any errors at compile
+time. Defining the "-dtbs" variable is not enough as the combined DT must
+be added to dtbs-y.
+
+zynqmp-sck-kr-g-revA.dtso and zynqmp-sck-kr-g-revB.dtso don't exist, so drop
+them.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Fixes: 45fe0dc4ea2e ("arm64: xilinx: Use zynqmp prefix for SOM dt overlays")
+Link: https://lore.kernel.org/r/20230911214751.2202913-1-robh@kernel.org
+Signed-off-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/Makefile | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/Makefile b/arch/arm64/boot/dts/xilinx/Makefile
+index 5e40c0b4fa0a..1068b0fa8e98 100644
+--- a/arch/arm64/boot/dts/xilinx/Makefile
++++ b/arch/arm64/boot/dts/xilinx/Makefile
+@@ -22,11 +22,10 @@ dtb-$(CONFIG_ARCH_ZYNQMP) += zynqmp-sm-k26-revA.dtb
+ dtb-$(CONFIG_ARCH_ZYNQMP) += zynqmp-smk-k26-revA.dtb
+ 
+ zynqmp-sm-k26-revA-sck-kv-g-revA-dtbs := zynqmp-sm-k26-revA.dtb zynqmp-sck-kv-g-revA.dtbo
++dtb-$(CONFIG_ARCH_ZYNQMP) += zynqmp-sm-k26-revA-sck-kv-g-revA.dtb
+ zynqmp-sm-k26-revA-sck-kv-g-revB-dtbs := zynqmp-sm-k26-revA.dtb zynqmp-sck-kv-g-revB.dtbo
++dtb-$(CONFIG_ARCH_ZYNQMP) += zynqmp-sm-k26-revA-sck-kv-g-revB.dtb
+ zynqmp-smk-k26-revA-sck-kv-g-revA-dtbs := zynqmp-smk-k26-revA.dtb zynqmp-sck-kv-g-revA.dtbo
++dtb-$(CONFIG_ARCH_ZYNQMP) += zynqmp-smk-k26-revA-sck-kv-g-revA.dtb
+ zynqmp-smk-k26-revA-sck-kv-g-revB-dtbs := zynqmp-smk-k26-revA.dtb zynqmp-sck-kv-g-revB.dtbo
+-
+-zynqmp-sm-k26-revA-sck-kr-g-revA-dtbs := zynqmp-sm-k26-revA.dtb zynqmp-sck-kr-g-revA.dtbo
+-zynqmp-sm-k26-revA-sck-kr-g-revB-dtbs := zynqmp-sm-k26-revA.dtb zynqmp-sck-kr-g-revB.dtbo
+-zynqmp-smk-k26-revA-sck-kr-g-revA-dtbs := zynqmp-smk-k26-revA.dtb zynqmp-sck-kr-g-revA.dtbo
+-zynqmp-smk-k26-revA-sck-kr-g-revB-dtbs := zynqmp-smk-k26-revA.dtb zynqmp-sck-kr-g-revB.dtbo
++dtb-$(CONFIG_ARCH_ZYNQMP) += zynqmp-smk-k26-revA-sck-kv-g-revB.dtb
+-- 
+2.43.0
+
diff --git a/queue-6.7/asm-generic-fix-32-bit-__generic_cmpxchg_local.patch b/queue-6.7/asm-generic-fix-32-bit-__generic_cmpxchg_local.patch
new file mode 100644
index 00000000000..0203628a87b
--- /dev/null
+++ b/queue-6.7/asm-generic-fix-32-bit-__generic_cmpxchg_local.patch
@@ -0,0 +1,39 @@
+From c0e437618e19e30830e7e4a33e5b6832c480b842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 09:40:10 +0000
+Subject: asm-generic: Fix 32 bit __generic_cmpxchg_local
+
+From: David McKay <david.mckay@codasip.com>
+
+[ Upstream commit d93cca2f3109f88c94a32d3322ec8b2854a9c339 ]
+
+Commit 656e9007ef58 ("asm-generic: avoid __generic_cmpxchg_local
+warnings") introduced a typo that means the code is incorrect for 32 bit
+values. It will work fine for postive numbers, but will fail for
+negative numbers on a system where longs are 64 bit.
+
+Fixes: 656e9007ef58 ("asm-generic: avoid __generic_cmpxchg_local warnings")
+Signed-off-by: David McKay <david.mckay@codasip.com>
+Signed-off-by: Stuart Menefy <stuart.menefy@codasip.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/cmpxchg-local.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/asm-generic/cmpxchg-local.h b/include/asm-generic/cmpxchg-local.h
+index 3df9f59a544e..f27d66fdc00a 100644
+--- a/include/asm-generic/cmpxchg-local.h
++++ b/include/asm-generic/cmpxchg-local.h
+@@ -34,7 +34,7 @@ static inline unsigned long __generic_cmpxchg_local(volatile void *ptr,
+ 			*(u16 *)ptr = (new & 0xffffu);
+ 		break;
+ 	case 4: prev = *(u32 *)ptr;
+-		if (prev == (old & 0xffffffffffu))
++		if (prev == (old & 0xffffffffu))
+ 			*(u32 *)ptr = (new & 0xffffffffu);
+ 		break;
+ 	case 8: prev = *(u64 *)ptr;
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-amd-vangogh-drop-conflicting-acpi-based-probing.patch b/queue-6.7/asoc-amd-vangogh-drop-conflicting-acpi-based-probing.patch
new file mode 100644
index 00000000000..bef589b5bf4
--- /dev/null
+++ b/queue-6.7/asoc-amd-vangogh-drop-conflicting-acpi-based-probing.patch
@@ -0,0 +1,112 @@
+From 8979e4bfb3f2bcde5f92f64ce82db3163e79694d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Dec 2023 22:32:19 +0200
+Subject: ASoC: amd: vangogh: Drop conflicting ACPI-based probing
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit ddd1ee12a8fb6e4d6f86eddeba64c135eee56623 ]
+
+The Vangogh machine driver variant based on the MAX98388 amplifier, as
+found on Valve's Steam Deck OLED, relies on probing via an ACPI match
+table.  This worked fine until commit 197b1f7f0df1 ("ASoC: amd: Add new
+dmi entries to config entry") enabled SOF support for the target machine
+(i.e. Galileo product), causing the sound card to enter the deferred
+probe state indefinitely:
+
+$ cat /sys/kernel/debug/devices_deferred
+AMDI8821:00	acp5x_mach: Register card (acp5x-max98388) failed
+
+The issue is related to commit e89f45edb747 ("ASoC: amd: vangogh: Add
+check for acp config flags in vangogh platform"), which tries to
+mitigate potential conflicts between SOF and generic ACP Vangogh
+drivers, due to sharing the PCI device IDs.
+
+However, the solution is effective only if the machine driver is
+directly probed by pci-acp5x through platform_device_register_full().
+
+Hence, remove the conflicting ACPI based probing and rely exclusively on
+DMI quirks for sound card setup.
+
+Fixes: dba22efd0d17 ("ASoC: amd: vangogh: Add support for NAU8821/MAX98388 variant")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
+Link: https://msgid.link/r/20231209203229.878730-2-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/vangogh/acp5x-mach.c | 35 +++++++++++-------------------
+ 1 file changed, 13 insertions(+), 22 deletions(-)
+
+diff --git a/sound/soc/amd/vangogh/acp5x-mach.c b/sound/soc/amd/vangogh/acp5x-mach.c
+index de4b478a983d..7878e061ecb9 100644
+--- a/sound/soc/amd/vangogh/acp5x-mach.c
++++ b/sound/soc/amd/vangogh/acp5x-mach.c
+@@ -439,7 +439,15 @@ static const struct dmi_system_id acp5x_vg_quirk_table[] = {
+ 		.matches = {
+ 			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Valve"),
+ 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Jupiter"),
+-		}
++		},
++		.driver_data = (void *)&acp5x_8821_35l41_card,
++	},
++	{
++		.matches = {
++			DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Valve"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Galileo"),
++		},
++		.driver_data = (void *)&acp5x_8821_98388_card,
+ 	},
+ 	{}
+ };
+@@ -452,25 +460,15 @@ static int acp5x_probe(struct platform_device *pdev)
+ 	struct snd_soc_card *card;
+ 	int ret;
+ 
+-	card = (struct snd_soc_card *)device_get_match_data(dev);
+-	if (!card) {
+-		/*
+-		 * This is normally the result of directly probing the driver
+-		 * in pci-acp5x through platform_device_register_full(), which
+-		 * is necessary for the CS35L41 variant, as it doesn't support
+-		 * ACPI probing and relies on DMI quirks.
+-		 */
+-		dmi_id = dmi_first_match(acp5x_vg_quirk_table);
+-		if (!dmi_id)
+-			return -ENODEV;
+-
+-		card = &acp5x_8821_35l41_card;
+-	}
++	dmi_id = dmi_first_match(acp5x_vg_quirk_table);
++	if (!dmi_id || !dmi_id->driver_data)
++		return -ENODEV;
+ 
+ 	machine = devm_kzalloc(dev, sizeof(*machine), GFP_KERNEL);
+ 	if (!machine)
+ 		return -ENOMEM;
+ 
++	card = dmi_id->driver_data;
+ 	card->dev = dev;
+ 	platform_set_drvdata(pdev, card);
+ 	snd_soc_card_set_drvdata(card, machine);
+@@ -482,17 +480,10 @@ static int acp5x_probe(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-static const struct acpi_device_id acp5x_acpi_match[] = {
+-	{ "AMDI8821", (kernel_ulong_t)&acp5x_8821_98388_card },
+-	{},
+-};
+-MODULE_DEVICE_TABLE(acpi, acp5x_acpi_match);
+-
+ static struct platform_driver acp5x_mach_driver = {
+ 	.driver = {
+ 		.name = DRV_NAME,
+ 		.pm = &snd_soc_pm_ops,
+-		.acpi_match_table = acp5x_acpi_match,
+ 	},
+ 	.probe = acp5x_probe,
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch b/queue-6.7/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
new file mode 100644
index 00000000000..84a0d204360
--- /dev/null
+++ b/queue-6.7/asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
@@ -0,0 +1,64 @@
+From d971ba4076338dc3f5e96d9a0baffeb0436896a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 14:20:31 +0100
+Subject: ASoC: cs35l33: Fix GPIO name and drop legacy include
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 50678d339d670a92658e5538ebee30447c88ccb3 ]
+
+This driver includes the legacy GPIO APIs <linux/gpio.h> and
+<linux/of_gpio.h> but does not use any symbols from any of
+them.
+
+Drop the includes.
+
+Further the driver is requesting "reset-gpios" rather than
+just "reset" from the GPIO framework. This is wrong because
+the gpiolib core will add "-gpios" before processing the
+request from e.g. device tree. Drop the suffix.
+
+The last problem means that the optional RESET GPIO has
+never been properly retrieved and used even if it existed,
+but nobody noticed.
+
+Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.")
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-2-ee9f9d4655eb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l33.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c
+index 4010a2d33a33..a19a2bafb37c 100644
+--- a/sound/soc/codecs/cs35l33.c
++++ b/sound/soc/codecs/cs35l33.c
+@@ -22,13 +22,11 @@
+ #include <sound/soc-dapm.h>
+ #include <sound/initval.h>
+ #include <sound/tlv.h>
+-#include <linux/gpio.h>
+ #include <linux/gpio/consumer.h>
+ #include <sound/cs35l33.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/regulator/machine.h>
+-#include <linux/of_gpio.h>
+ #include <linux/of.h>
+ 
+ #include "cs35l33.h"
+@@ -1165,7 +1163,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client)
+ 
+ 	/* We could issue !RST or skip it based on AMP topology */
+ 	cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
+-			"reset-gpios", GPIOD_OUT_HIGH);
++			"reset", GPIOD_OUT_HIGH);
+ 	if (IS_ERR(cs35l33->reset_gpio)) {
+ 		dev_err(&i2c_client->dev, "%s ERROR: Can't get reset GPIO\n",
+ 			__func__);
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch b/queue-6.7/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
new file mode 100644
index 00000000000..2f262852f3c
--- /dev/null
+++ b/queue-6.7/asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
@@ -0,0 +1,65 @@
+From 93d0ee67f6e8fb35eb89940fca6039a8f7b35e37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 14:20:32 +0100
+Subject: ASoC: cs35l34: Fix GPIO name and drop legacy include
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit a6122b0b4211d132934ef99e7b737910e6d54d2f ]
+
+This driver includes the legacy GPIO APIs <linux/gpio.h> and
+<linux/of_gpio.h> but does not use any symbols from any of
+them.
+
+Drop the includes.
+
+Further the driver is requesting "reset-gpios" rather than
+just "reset" from the GPIO framework. This is wrong because
+the gpiolib core will add "-gpios" before processing the
+request from e.g. device tree. Drop the suffix.
+
+The last problem means that the optional RESET GPIO has
+never been properly retrieved and used even if it existed,
+but nobody noticed.
+
+Fixes: c1124c09e103 ("ASoC: cs35l34: Initial commit of the cs35l34 CODEC driver.")
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-3-ee9f9d4655eb@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs35l34.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/cs35l34.c b/sound/soc/codecs/cs35l34.c
+index e5871736fa29..cca59de66b73 100644
+--- a/sound/soc/codecs/cs35l34.c
++++ b/sound/soc/codecs/cs35l34.c
+@@ -20,14 +20,12 @@
+ #include <linux/regulator/machine.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/of.h>
+-#include <linux/of_gpio.h>
+ #include <linux/of_irq.h>
+ #include <sound/core.h>
+ #include <sound/pcm.h>
+ #include <sound/pcm_params.h>
+ #include <sound/soc.h>
+ #include <sound/soc-dapm.h>
+-#include <linux/gpio.h>
+ #include <linux/gpio/consumer.h>
+ #include <sound/initval.h>
+ #include <sound/tlv.h>
+@@ -1061,7 +1059,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client)
+ 		dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret);
+ 
+ 	cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
+-				"reset-gpios", GPIOD_OUT_LOW);
++				"reset", GPIOD_OUT_LOW);
+ 	if (IS_ERR(cs35l34->reset_gpio)) {
+ 		ret = PTR_ERR(cs35l34->reset_gpio);
+ 		goto err_regulator;
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-fsl_rpmsg-update-kconfig-dependencies.patch b/queue-6.7/asoc-fsl_rpmsg-update-kconfig-dependencies.patch
new file mode 100644
index 00000000000..995f209c112
--- /dev/null
+++ b/queue-6.7/asoc-fsl_rpmsg-update-kconfig-dependencies.patch
@@ -0,0 +1,44 @@
+From ff02de6eef7f03e508ced05ddcd6de8a690414a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 12:31:17 +0100
+Subject: ASoC: fsl_rpmsg: update Kconfig dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9cce9c4806a89439ea34aad2e382150d68c7ea95 ]
+
+SND_SOC_IMX_RPMSG gained a new dependency and gets selected by SND_SOC_FSL_RPMSG,
+which as a result needs to have the same dependency, or produce a build failure
+based on that:
+
+WARNING: unmet direct dependencies detected for SND_SOC_IMX_RPMSG
+  Depends on [n]: SOUND [=y] && SND [=y] && SND_SOC [=y] && SND_IMX_SOC [=y] && RPMSG [=y] && OF [=y] && I2C [=n]
+  Selected by [y]:
+  - SND_SOC_FSL_RPMSG [=y] && SOUND [=y] && SND [=y] && SND_SOC [=y] && COMMON_CLK [=y] && RPMSG [=y] && (SND_IMX_SOC [=y] || SND_IMX_SOC [=y]=n) && SND_IMX_SOC [=y]!=n
+x86_64-linux-ld: sound/soc/fsl/imx-rpmsg.o: in function `imx_rpmsg_late_probe':
+imx-rpmsg.c:(.text+0x11e): undefined reference to `i2c_find_device_by_fwnode'
+
+Fixes: f83d38def6b1 ("ASoC: imx-rpmsg: SND_SOC_IMX_RPMSG should depend on OF and I2C")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20231129113204.2869356-1-arnd@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
+index be342ee03fb9..d14061e88e58 100644
+--- a/sound/soc/fsl/Kconfig
++++ b/sound/soc/fsl/Kconfig
+@@ -121,6 +121,7 @@ config SND_SOC_FSL_UTILS
+ config SND_SOC_FSL_RPMSG
+ 	tristate "NXP Audio Base On RPMSG support"
+ 	depends on COMMON_CLK
++	depends on OF && I2C
+ 	depends on RPMSG
+ 	depends on SND_IMX_SOC || SND_IMX_SOC = n
+ 	select SND_SOC_IMX_RPMSG if SND_IMX_SOC != n
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch b/queue-6.7/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
new file mode 100644
index 00000000000..fdddf1158d6
--- /dev/null
+++ b/queue-6.7/asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
@@ -0,0 +1,67 @@
+From e48e51bba281e03bd736e8e7d502422733b685f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:41:58 -0600
+Subject: ASoC: Intel: glk_rt5682_max98357a: fix board id mismatch
+
+From: Brent Lu <brent.lu@intel.com>
+
+[ Upstream commit 486ede0df82dd74472c6f5651e38ff48f7f766c1 ]
+
+The drv_name in enumeration table for ALC5682I-VS codec does not match
+the board id string in machine driver. Modify the entry of "10EC5682"
+to enumerate "RTL5682" as well and remove invalid entry.
+
+Fixes: 88b4d77d6035 ("ASoC: Intel: glk_rt5682_max98357a: support ALC5682I-VS codec")
+Reported-by: Curtis Malainey <cujomalainey@chromium.org>
+Reviewed-by: Curtis Malainey <cujomalainey@chromium.org>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Brent Lu <brent.lu@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20231204214200.203100-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/common/soc-acpi-intel-glk-match.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/intel/common/soc-acpi-intel-glk-match.c b/sound/soc/intel/common/soc-acpi-intel-glk-match.c
+index 387e73100884..8911c90bbaf6 100644
+--- a/sound/soc/intel/common/soc-acpi-intel-glk-match.c
++++ b/sound/soc/intel/common/soc-acpi-intel-glk-match.c
+@@ -19,6 +19,11 @@ static const struct snd_soc_acpi_codecs glk_codecs = {
+ 	.codecs = {"MX98357A"}
+ };
+ 
++static const struct snd_soc_acpi_codecs glk_rt5682_rt5682s_hp = {
++	.num_codecs = 2,
++	.codecs = {"10EC5682", "RTL5682"},
++};
++
+ struct snd_soc_acpi_mach snd_soc_acpi_intel_glk_machines[] = {
+ 	{
+ 		.id = "INT343A",
+@@ -35,20 +40,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_glk_machines[] = {
+ 		.sof_tplg_filename = "sof-glk-da7219.tplg",
+ 	},
+ 	{
+-		.id = "10EC5682",
++		.comp_ids = &glk_rt5682_rt5682s_hp,
+ 		.drv_name = "glk_rt5682_mx98357a",
+ 		.fw_filename = "intel/dsp_fw_glk.bin",
+ 		.machine_quirk = snd_soc_acpi_codec_list,
+ 		.quirk_data = &glk_codecs,
+ 		.sof_tplg_filename = "sof-glk-rt5682.tplg",
+ 	},
+-	{
+-		.id = "RTL5682",
+-		.drv_name = "glk_rt5682_max98357a",
+-		.machine_quirk = snd_soc_acpi_codec_list,
+-		.quirk_data = &glk_codecs,
+-		.sof_tplg_filename = "sof-glk-rt5682.tplg",
+-	},
+ 	{
+ 		.id = "10134242",
+ 		.drv_name = "glk_cs4242_mx98357a",
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch b/queue-6.7/asoc-intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch
new file mode 100644
index 00000000000..c7b2e641086
--- /dev/null
+++ b/queue-6.7/asoc-intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch
@@ -0,0 +1,48 @@
+From 3307c9758926e1b6588c9af5b6fbe5149ed10285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:41:59 -0600
+Subject: ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev =
+ NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit e38e252dbceeef7d2f848017132efd68e9ae1416 ]
+
+sof_sdw_rt_sdca_jack_exit() are used by different codecs, and some of
+them use the same dai name.
+For example, rt712 and rt713 both use "rt712-sdca-aif1" and
+sof_sdw_rt_sdca_jack_exit().
+As a result, sof_sdw_rt_sdca_jack_exit() will be called twice by
+mc_dailink_exit_loop(). Set ctx->headset_codec_dev = NULL; after
+put_device(ctx->headset_codec_dev); to avoid ctx->headset_codec_dev
+being put twice.
+
+Fixes: 5360c6704638 ("ASoC: Intel: sof_sdw: add rt712 support")
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20231204214200.203100-5-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c b/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c
+index 65bbcee88d6d..49a513399dc4 100644
+--- a/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c
++++ b/sound/soc/intel/boards/sof_sdw_rt_sdca_jack_common.c
+@@ -168,6 +168,7 @@ int sof_sdw_rt_sdca_jack_exit(struct snd_soc_card *card, struct snd_soc_dai_link
+ 
+ 	device_remove_software_node(ctx->headset_codec_dev);
+ 	put_device(ctx->headset_codec_dev);
++	ctx->headset_codec_dev = NULL;
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch b/queue-6.7/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
new file mode 100644
index 00000000000..aee77df6c12
--- /dev/null
+++ b/queue-6.7/asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
@@ -0,0 +1,53 @@
+From f9e4895b6c1b3f26e3a1377abdbda77b8711d6fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 22:40:18 +0100
+Subject: ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 51add1687f39292af626ac3c2046f49241713273 ]
+
+dmi_platform_data[] first contains a DMI entry matching:
+
+   DMI_MATCH(DMI_PRODUCT_NAME, "EF20"),
+
+and then contains an identical entry except for the match being:
+
+   DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"),
+
+Since these are partial (non exact) DMI matches the first match
+will also match any board with "EF20EA" in their DMI product-name,
+drop the second, redundant, entry.
+
+Fixes: a4dae468cfdd ("ASoC: rt5645: Add ACPI-defined GPIO for ECS EF20 series")
+Cc: Chris Chiu <chiu@endlessos.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://msgid.link/r/20231126214024.300505-2-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5645.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index a0d01d71d8b5..edcb85bd8ea7 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3854,14 +3854,6 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ 		},
+ 		.driver_data = (void *)&ecs_ef20_platform_data,
+ 	},
+-	{
+-		.ident = "EF20EA",
+-		.callback = cht_rt5645_ef20_quirk_cb,
+-		.matches = {
+-			DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"),
+-		},
+-		.driver_data = (void *)&ecs_ef20_platform_data,
+-	},
+ 	{ }
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch b/queue-6.7/asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch
new file mode 100644
index 00000000000..5e9c60be848
--- /dev/null
+++ b/queue-6.7/asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch
@@ -0,0 +1,129 @@
+From 9b47161088ab9fd9b5c62cf2e57ecf5e6b897979 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:27:09 -0600
+Subject: ASoC: SOF: Intel: pci-mtl: fix ARL-S definitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit a00be6dc9bb80796244196033aa5eb258b6af47a ]
+
+The initial copy/paste from MTL was incorrect, the hardware is
+different and requires different descriptors along with a dedicated
+firmware binary.
+
+Fixes: 3851831f529e ("ASoC: SOF: Intel: pci-mtl: use ARL specific firmware definitions")
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20231204212710.185976-5-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.h     |  1 +
+ sound/soc/sof/intel/mtl.c     | 28 ++++++++++++++++++++++++++++
+ sound/soc/sof/intel/pci-mtl.c | 12 ++++++------
+ 3 files changed, 35 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda.h b/sound/soc/sof/intel/hda.h
+index d628d6a3a7e5..1592e27bc14d 100644
+--- a/sound/soc/sof/intel/hda.h
++++ b/sound/soc/sof/intel/hda.h
+@@ -882,6 +882,7 @@ extern const struct sof_intel_dsp_desc ehl_chip_info;
+ extern const struct sof_intel_dsp_desc jsl_chip_info;
+ extern const struct sof_intel_dsp_desc adls_chip_info;
+ extern const struct sof_intel_dsp_desc mtl_chip_info;
++extern const struct sof_intel_dsp_desc arl_s_chip_info;
+ extern const struct sof_intel_dsp_desc lnl_chip_info;
+ 
+ /* Probes support */
+diff --git a/sound/soc/sof/intel/mtl.c b/sound/soc/sof/intel/mtl.c
+index 254dbbeac1d0..7946110e7adf 100644
+--- a/sound/soc/sof/intel/mtl.c
++++ b/sound/soc/sof/intel/mtl.c
+@@ -746,3 +746,31 @@ const struct sof_intel_dsp_desc mtl_chip_info = {
+ 	.hw_ip_version = SOF_INTEL_ACE_1_0,
+ };
+ EXPORT_SYMBOL_NS(mtl_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON);
++
++const struct sof_intel_dsp_desc arl_s_chip_info = {
++	.cores_num = 2,
++	.init_core_mask = BIT(0),
++	.host_managed_cores_mask = BIT(0),
++	.ipc_req = MTL_DSP_REG_HFIPCXIDR,
++	.ipc_req_mask = MTL_DSP_REG_HFIPCXIDR_BUSY,
++	.ipc_ack = MTL_DSP_REG_HFIPCXIDA,
++	.ipc_ack_mask = MTL_DSP_REG_HFIPCXIDA_DONE,
++	.ipc_ctl = MTL_DSP_REG_HFIPCXCTL,
++	.rom_status_reg = MTL_DSP_ROM_STS,
++	.rom_init_timeout	= 300,
++	.ssp_count = MTL_SSP_COUNT,
++	.ssp_base_offset = CNL_SSP_BASE_OFFSET,
++	.sdw_shim_base = SDW_SHIM_BASE_ACE,
++	.sdw_alh_base = SDW_ALH_BASE_ACE,
++	.d0i3_offset = MTL_HDA_VS_D0I3C,
++	.read_sdw_lcount =  hda_sdw_check_lcount_common,
++	.enable_sdw_irq = mtl_enable_sdw_irq,
++	.check_sdw_irq = mtl_dsp_check_sdw_irq,
++	.check_sdw_wakeen_irq = hda_sdw_check_wakeen_irq_common,
++	.check_ipc_irq = mtl_dsp_check_ipc_irq,
++	.cl_init = mtl_dsp_cl_init,
++	.power_down_dsp = mtl_power_down_dsp,
++	.disable_interrupts = mtl_dsp_disable_interrupts,
++	.hw_ip_version = SOF_INTEL_ACE_1_0,
++};
++EXPORT_SYMBOL_NS(arl_s_chip_info, SND_SOC_SOF_INTEL_HDA_COMMON);
+diff --git a/sound/soc/sof/intel/pci-mtl.c b/sound/soc/sof/intel/pci-mtl.c
+index 0f378f45486d..60d5e73cdad2 100644
+--- a/sound/soc/sof/intel/pci-mtl.c
++++ b/sound/soc/sof/intel/pci-mtl.c
+@@ -50,7 +50,7 @@ static const struct sof_dev_desc mtl_desc = {
+ 	.ops_free = hda_ops_free,
+ };
+ 
+-static const struct sof_dev_desc arl_desc = {
++static const struct sof_dev_desc arl_s_desc = {
+ 	.use_acpi_target_states = true,
+ 	.machines               = snd_soc_acpi_intel_arl_machines,
+ 	.alt_machines           = snd_soc_acpi_intel_arl_sdw_machines,
+@@ -58,21 +58,21 @@ static const struct sof_dev_desc arl_desc = {
+ 	.resindex_pcicfg_base   = -1,
+ 	.resindex_imr_base      = -1,
+ 	.irqindex_host_ipc      = -1,
+-	.chip_info = &mtl_chip_info,
++	.chip_info = &arl_s_chip_info,
+ 	.ipc_supported_mask     = BIT(SOF_IPC_TYPE_4),
+ 	.ipc_default            = SOF_IPC_TYPE_4,
+ 	.dspless_mode_supported = true,         /* Only supported for HDaudio */
+ 	.default_fw_path = {
+-		[SOF_IPC_TYPE_4] = "intel/sof-ipc4/arl",
++		[SOF_IPC_TYPE_4] = "intel/sof-ipc4/arl-s",
+ 	},
+ 	.default_lib_path = {
+-		[SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/arl",
++		[SOF_IPC_TYPE_4] = "intel/sof-ipc4-lib/arl-s",
+ 	},
+ 	.default_tplg_path = {
+ 		[SOF_IPC_TYPE_4] = "intel/sof-ace-tplg",
+ 	},
+ 	.default_fw_filename = {
+-		[SOF_IPC_TYPE_4] = "sof-arl.ri",
++		[SOF_IPC_TYPE_4] = "sof-arl-s.ri",
+ 	},
+ 	.nocodec_tplg_filename = "sof-arl-nocodec.tplg",
+ 	.ops = &sof_mtl_ops,
+@@ -83,7 +83,7 @@ static const struct sof_dev_desc arl_desc = {
+ /* PCI IDs */
+ static const struct pci_device_id sof_pci_ids[] = {
+ 	{ PCI_DEVICE_DATA(INTEL, HDA_MTL, &mtl_desc) },
+-	{ PCI_DEVICE_DATA(INTEL, HDA_ARL_S, &arl_desc) },
++	{ PCI_DEVICE_DATA(INTEL, HDA_ARL_S, &arl_s_desc) },
+ 	{ 0, }
+ };
+ MODULE_DEVICE_TABLE(pci, sof_pci_ids);
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-sof-topology-use-partial-match-for-disconnectin.patch b/queue-6.7/asoc-sof-topology-use-partial-match-for-disconnectin.patch
new file mode 100644
index 00000000000..ca417113b54
--- /dev/null
+++ b/queue-6.7/asoc-sof-topology-use-partial-match-for-disconnectin.patch
@@ -0,0 +1,40 @@
+From 5b6763a53f9cd58e1f643a5db2666821268919d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 15:47:10 -0600
+Subject: ASoC: SOF: topology: Use partial match for disconnecting DAI link and
+ DAI widget
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit 2f03970198d6438d95b96f69041254bd39aafed0 ]
+
+We use partial match for connecting DAI link and DAI widget. We need to
+use partial match for disconnecting, too.
+
+Fixes: fe88788779fc ("ASoC: SOF: topology: Use partial match for connecting DAI link and DAI widget")
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20231204214713.208951-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
+index 37ec671a2d76..7133ec13322b 100644
+--- a/sound/soc/sof/topology.c
++++ b/sound/soc/sof/topology.c
+@@ -1134,7 +1134,7 @@ static void sof_disconnect_dai_widget(struct snd_soc_component *scomp,
+ 	list_for_each_entry(rtd, &card->rtd_list, list) {
+ 		/* does stream match DAI link ? */
+ 		if (!rtd->dai_link->stream_name ||
+-		    strcmp(sname, rtd->dai_link->stream_name))
++		    !strstr(rtd->dai_link->stream_name, sname))
+ 			continue;
+ 
+ 		for_each_rtd_cpu_dais(rtd, i, cpu_dai)
+-- 
+2.43.0
+
diff --git a/queue-6.7/asoc-tas2781-add-support-for-fw-version-0x0503.patch b/queue-6.7/asoc-tas2781-add-support-for-fw-version-0x0503.patch
new file mode 100644
index 00000000000..1d53d7087a2
--- /dev/null
+++ b/queue-6.7/asoc-tas2781-add-support-for-fw-version-0x0503.patch
@@ -0,0 +1,37 @@
+From b6de12cbd2df3a6d3b77a9da1e886303667b6868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 01:25:39 +0100
+Subject: ASoC: tas2781: add support for FW version 0x0503
+
+From: Gergo Koteles <soyer@irl.hu>
+
+[ Upstream commit ee00330a5b78e2acf4b3aac32913da43e2c12a26 ]
+
+Layout of FW version 0x0503 is compatible with 0x0502.
+Already supported by TI's tas2781-linux-driver tree.
+https://git.ti.com/cgit/tas2781-linux-drivers/tas2781-linux-driver/
+
+Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib")
+Signed-off-by: Gergo Koteles <soyer@irl.hu>
+Link: https://msgid.link/r/98d4ee4e01e834af72a1a0bea6736facf43582e0.1702513517.git.soyer@irl.hu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/tas2781-fmwlib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/tas2781-fmwlib.c b/sound/soc/codecs/tas2781-fmwlib.c
+index 5c09e441a936..85e14ff61769 100644
+--- a/sound/soc/codecs/tas2781-fmwlib.c
++++ b/sound/soc/codecs/tas2781-fmwlib.c
+@@ -1982,6 +1982,7 @@ static int tasdevice_dspfw_ready(const struct firmware *fmw,
+ 	case 0x301:
+ 	case 0x302:
+ 	case 0x502:
++	case 0x503:
+ 		tas_priv->fw_parse_variable_header =
+ 			fw_parse_variable_header_kernel;
+ 		tas_priv->fw_parse_program_data =
+-- 
+2.43.0
+
diff --git a/queue-6.7/blk-cgroup-fix-rcu-lockdep-warning-in-blkg_lookup.patch b/queue-6.7/blk-cgroup-fix-rcu-lockdep-warning-in-blkg_lookup.patch
new file mode 100644
index 00000000000..b6d3532812a
--- /dev/null
+++ b/queue-6.7/blk-cgroup-fix-rcu-lockdep-warning-in-blkg_lookup.patch
@@ -0,0 +1,46 @@
+From aef0e9012dca110bdbfacbac5c73858c837f7758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 09:28:33 +0800
+Subject: blk-cgroup: fix rcu lockdep warning in blkg_lookup()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 393cd8ffd832f23eec3a105553eff622e8198918 ]
+
+blkg_lookup() is called with either queue_lock or rcu read lock, so
+use rcu_dereference_check(lockdep_is_held(&q->queue_lock)) for
+retrieving 'blkg', which way models the check exactly for covering
+queue lock or rcu read lock.
+
+Fix lockdep warning of "block/blk-cgroup.h:254 suspicious rcu_dereference_check() usage!"
+from blkg_lookup().
+
+Tested-by: Changhui Zhong <czhong@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Fixes: 83462a6c971c ("blkcg: Drop unnecessary RCU read [un]locks from blkg_conf_prep/finish()")
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20231219012833.2129540-1-ming.lei@redhat.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index fd482439afbc..b927a4a0ad03 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -252,7 +252,8 @@ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg,
+ 	if (blkcg == &blkcg_root)
+ 		return q->root_blkg;
+ 
+-	blkg = rcu_dereference(blkcg->blkg_hint);
++	blkg = rcu_dereference_check(blkcg->blkg_hint,
++			lockdep_is_held(&q->queue_lock));
+ 	if (blkg && blkg->q == q)
+ 		return blkg;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/block-add-check-of-minors-and-first_minor-in-device_.patch b/queue-6.7/block-add-check-of-minors-and-first_minor-in-device_.patch
new file mode 100644
index 00000000000..402fff7ffe5
--- /dev/null
+++ b/queue-6.7/block-add-check-of-minors-and-first_minor-in-device_.patch
@@ -0,0 +1,45 @@
+From 9ed0e620fb8cac81aecf62f2db1650ed81d875d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 15:59:42 +0800
+Subject: block: add check of 'minors' and 'first_minor' in device_add_disk()
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 4c434392c4777881d01beada6701eff8c76b43fe ]
+
+'first_minor' represents the starting minor number of disks, and
+'minors' represents the number of partitions in the device. Neither
+of them can be greater than MINORMASK + 1.
+
+Commit e338924bd05d ("block: check minor range in device_add_disk()")
+only added the check of 'first_minor + minors'. However, their sum might
+be less than MINORMASK but their values are wrong. Complete the checks now.
+
+Fixes: e338924bd05d ("block: check minor range in device_add_disk()")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20231219075942.840255-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index 13db3a7943d8..d74fb5b4ae68 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -432,7 +432,9 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+ 				DISK_MAX_PARTS);
+ 			disk->minors = DISK_MAX_PARTS;
+ 		}
+-		if (disk->first_minor + disk->minors > MINORMASK + 1)
++		if (disk->first_minor > MINORMASK ||
++		    disk->minors > MINORMASK + 1 ||
++		    disk->first_minor + disk->minors > MINORMASK + 1)
+ 			goto out_exit_elevator;
+ 	} else {
+ 		if (WARN_ON(disk->minors))
+-- 
+2.43.0
+
diff --git a/queue-6.7/block-set-memalloc_noio-to-false-on-device_add_disk-.patch b/queue-6.7/block-set-memalloc_noio-to-false-on-device_add_disk-.patch
new file mode 100644
index 00000000000..14f7d019a22
--- /dev/null
+++ b/queue-6.7/block-set-memalloc_noio-to-false-on-device_add_disk-.patch
@@ -0,0 +1,39 @@
+From d8b53fd695d3f89bd2c393367f1eb679dfd68238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 15:53:56 +0800
+Subject: block: Set memalloc_noio to false on device_add_disk() error path
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 5fa3d1a00c2d4ba14f1300371ad39d5456e890d7 ]
+
+On the error path of device_add_disk(), device's memalloc_noio flag was
+set but not cleared. As the comment of pm_runtime_set_memalloc_noio(),
+"The function should be called between device_add() and device_del()".
+Clear this flag before device_del() now.
+
+Fixes: 25e823c8c37d ("block/genhd.c: apply pm_runtime_set_memalloc_noio on block devices")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20231211075356.1839282-1-linan666@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/genhd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/block/genhd.c b/block/genhd.c
+index c9d06f72c587..13db3a7943d8 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -542,6 +542,7 @@ int __must_check device_add_disk(struct device *parent, struct gendisk *disk,
+ 	kobject_put(disk->part0->bd_holder_dir);
+ out_del_block_link:
+ 	sysfs_remove_link(block_depr, dev_name(ddev));
++	pm_runtime_set_memalloc_noio(ddev, false);
+ out_device_del:
+ 	device_del(ddev);
+ out_free_ext_minor:
+-- 
+2.43.0
+
diff --git a/queue-6.7/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch b/queue-6.7/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
new file mode 100644
index 00000000000..75d46ce01ff
--- /dev/null
+++ b/queue-6.7/blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
@@ -0,0 +1,37 @@
+From 5ef6cfc57f7c296e9e545afc2f0c43eb8b15915e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 10:05:01 -0500
+Subject: blocklayoutdriver: Fix reference leak of pnfs_device_node
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit 1530827b90025cdf80c9b0d07a166d045a0a7b81 ]
+
+The error path for blocklayout's device lookup is missing a reference drop
+for the case where a lookup finds the device, but the device is marked with
+NFS_DEVICEID_UNAVAILABLE.
+
+Fixes: b3dce6a2f060 ("pnfs/blocklayout: handle transient devices")
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/blocklayout.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 943aeea1eb16..1d1d7abc3205 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -580,6 +580,8 @@ bl_find_get_deviceid(struct nfs_server *server,
+ 		nfs4_delete_deviceid(node->ld, node->nfs_client, id);
+ 		goto retry;
+ 	}
++
++	nfs4_put_deviceid_node(node);
+ 	return ERR_PTR(-ENODEV);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/bluetooth-btmtkuart-fix-recv_buf-return-value.patch b/queue-6.7/bluetooth-btmtkuart-fix-recv_buf-return-value.patch
new file mode 100644
index 00000000000..f5a6c2b3c9a
--- /dev/null
+++ b/queue-6.7/bluetooth-btmtkuart-fix-recv_buf-return-value.patch
@@ -0,0 +1,68 @@
+From c8aa845732da7b8c20f60139d692673c2fe8dfdd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 17:40:19 +0100
+Subject: Bluetooth: btmtkuart: fix recv_buf() return value
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit 64057f051f20c2a2184b9db7f8037d928d68a4f4 ]
+
+Serdev recv_buf() callback is supposed to return the amount of bytes
+consumed, therefore an int in between 0 and count.
+
+Do not return negative number in case of issue, just print an error and
+return count. This fixes a WARN in ttyport_receive_buf().
+
+Link: https://lore.kernel.org/all/087be419-ec6b-47ad-851a-5e1e3ea5cfcc@kernel.org/
+Fixes: 7237c4c9ec92 ("Bluetooth: mediatek: Add protocol support for MediaTek serial devices")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btmtkuart.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
+index 935feab815d9..203a000a84e3 100644
+--- a/drivers/bluetooth/btmtkuart.c
++++ b/drivers/bluetooth/btmtkuart.c
+@@ -336,7 +336,7 @@ mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count,
+ 	return data;
+ }
+ 
+-static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
++static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
+ {
+ 	struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
+ 	const unsigned char *p_left = data, *p_h4;
+@@ -375,25 +375,20 @@ static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
+ 			bt_dev_err(bdev->hdev,
+ 				   "Frame reassembly failed (%d)", err);
+ 			bdev->rx_skb = NULL;
+-			return err;
++			return;
+ 		}
+ 
+ 		sz_left -= sz_h4;
+ 		p_left += sz_h4;
+ 	}
+-
+-	return 0;
+ }
+ 
+ static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data,
+ 				 size_t count)
+ {
+ 	struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev);
+-	int err;
+ 
+-	err = btmtkuart_recv(bdev->hdev, data, count);
+-	if (err < 0)
+-		return err;
++	btmtkuart_recv(bdev->hdev, data, count);
+ 
+ 	bdev->hdev->stat.byte_rx += count;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/bluetooth-btnxpuart-fix-recv_buf-return-value.patch b/queue-6.7/bluetooth-btnxpuart-fix-recv_buf-return-value.patch
new file mode 100644
index 00000000000..4a53e6e7cdd
--- /dev/null
+++ b/queue-6.7/bluetooth-btnxpuart-fix-recv_buf-return-value.patch
@@ -0,0 +1,69 @@
+From bad56bf7bf5677c63cb9182e5370ab3c54f0779e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 17:40:18 +0100
+Subject: Bluetooth: btnxpuart: fix recv_buf() return value
+
+From: Francesco Dolcini <francesco.dolcini@toradex.com>
+
+[ Upstream commit 94d05394254401e503867c16aff561d3e687dfdc ]
+
+Serdev recv_buf() callback is supposed to return the amount of bytes
+consumed, therefore an int in between 0 and count.
+
+Do not return a negative number in case of issue, just print an error
+and return count. Before this change, in case of error, the returned
+negative number was internally converted to 0 in ttyport_receive_buf,
+now when the receive buffer is corrupted we return the size of the whole
+received data (`count`). This should allow for better recovery in case
+receiver/transmitter get out of sync if some data is lost.
+
+This fixes a WARN in ttyport_receive_buf().
+
+  Bluetooth: hci0: Frame reassembly failed (-84)
+  ------------[ cut here ]------------
+  serial serial0: receive_buf returns -84 (count = 6)
+  WARNING: CPU: 0 PID: 37 at drivers/tty/serdev/serdev-ttyport.c:37 ttyport_receive_buf+0xd8/0xf8
+  Modules linked in: mwifiex_sdio(+) ...
+  CPU: 0 PID: 37 Comm: kworker/u4:2 Not tainted 6.7.0-rc2-00147-gf1a09972a45a #1
+  Hardware name: Toradex Verdin AM62 WB on Verdin Development Board (DT)
+  Workqueue: events_unbound flush_to_ldisc
+  pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+  pc : ttyport_receive_buf+0xd8/0xf8
+  lr : ttyport_receive_buf+0xd8/0xf8
+...
+  Call trace:
+   ttyport_receive_buf+0xd8/0xf8
+   flush_to_ldisc+0xbc/0x1a4
+   process_scheduled_works+0x16c/0x28c
+
+Closes: https://lore.kernel.org/all/ZWEIhcUXfutb5SY6@francesco-nb.int.toradex.com/
+Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets")
+Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btnxpuart.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
+index b7e66b7ac570..951fe3014a3f 100644
+--- a/drivers/bluetooth/btnxpuart.c
++++ b/drivers/bluetooth/btnxpuart.c
+@@ -1276,11 +1276,10 @@ static int btnxpuart_receive_buf(struct serdev_device *serdev, const u8 *data,
+ 	if (IS_ERR(nxpdev->rx_skb)) {
+ 		int err = PTR_ERR(nxpdev->rx_skb);
+ 		/* Safe to ignore out-of-sync bootloader signatures */
+-		if (is_fw_downloading(nxpdev))
+-			return count;
+-		bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err);
++		if (!is_fw_downloading(nxpdev))
++			bt_dev_err(nxpdev->hdev, "Frame reassembly failed (%d)", err);
+ 		nxpdev->rx_skb = NULL;
+-		return err;
++		return count;
+ 	}
+ 	if (!is_fw_downloading(nxpdev))
+ 		nxpdev->hdev->stat.byte_rx += count;
+-- 
+2.43.0
+
diff --git a/queue-6.7/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch b/queue-6.7/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
new file mode 100644
index 00000000000..d2187a8554b
--- /dev/null
+++ b/queue-6.7/bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
@@ -0,0 +1,88 @@
+From fef058f787a1e5cdae0e34dd739b71feaebf6aa1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 14:58:03 +0100
+Subject: Bluetooth: Fix bogus check for re-auth no supported with non-ssp
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+[ Upstream commit d03376c185926098cb4d668d6458801eb785c0a5 ]
+
+This reverts 19f8def031bfa50c579149b200bfeeb919727b27
+"Bluetooth: Fix auth_complete_evt for legacy units" which seems to be
+working around a bug on a broken controller rather then any limitation
+imposed by the Bluetooth spec, in fact if there ws not possible to
+re-auth the command shall fail not succeed.
+
+Fixes: 19f8def031bf ("Bluetooth: Fix auth_complete_evt for legacy units")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/bluetooth/hci_core.h |  1 -
+ net/bluetooth/hci_conn.c         |  8 +++-----
+ net/bluetooth/hci_event.c        | 11 ++---------
+ 3 files changed, 5 insertions(+), 15 deletions(-)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index a3a1ea2696a8..65dd28669352 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -957,7 +957,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev);
+ /* ----- HCI Connections ----- */
+ enum {
+ 	HCI_CONN_AUTH_PEND,
+-	HCI_CONN_REAUTH_PEND,
+ 	HCI_CONN_ENCRYPT_PEND,
+ 	HCI_CONN_RSWITCH_PEND,
+ 	HCI_CONN_MODE_CHANGE_PEND,
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 2cee330188ce..d01db89fcb46 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -2421,12 +2421,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
+ 		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
+ 			     sizeof(cp), &cp);
+ 
+-		/* If we're already encrypted set the REAUTH_PEND flag,
+-		 * otherwise set the ENCRYPT_PEND.
++		/* Set the ENCRYPT_PEND to trigger encryption after
++		 * authentication.
+ 		 */
+-		if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+-			set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
+-		else
++		if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ 			set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+ 	}
+ 
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index ebf17b51072f..ef8c3bed7361 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3500,14 +3500,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
+ 
+ 	if (!ev->status) {
+ 		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
+-
+-		if (!hci_conn_ssp_enabled(conn) &&
+-		    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
+-			bt_dev_info(hdev, "re-auth of legacy device is not possible.");
+-		} else {
+-			set_bit(HCI_CONN_AUTH, &conn->flags);
+-			conn->sec_level = conn->pending_sec_level;
+-		}
++		set_bit(HCI_CONN_AUTH, &conn->flags);
++		conn->sec_level = conn->pending_sec_level;
+ 	} else {
+ 		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
+ 			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
+@@ -3516,7 +3510,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
+ 	}
+ 
+ 	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
+-	clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
+ 
+ 	if (conn->state == BT_CONFIG) {
+ 		if (!ev->status && hci_conn_ssp_enabled(conn)) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-add-crosstask-check-to-__bpf_get_stack.patch b/queue-6.7/bpf-add-crosstask-check-to-__bpf_get_stack.patch
new file mode 100644
index 00000000000..e51daf51dba
--- /dev/null
+++ b/queue-6.7/bpf-add-crosstask-check-to-__bpf_get_stack.patch
@@ -0,0 +1,121 @@
+From 9202009cc89aa25d6a82abc22f391d1e82397061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 03:23:34 -0800
+Subject: bpf: Add crosstask check to __bpf_get_stack
+
+From: Jordan Rome <jordalgo@meta.com>
+
+[ Upstream commit b8e3a87a627b575896e448021e5c2f8a3bc19931 ]
+
+Currently get_perf_callchain only supports user stack walking for
+the current task. Passing the correct *crosstask* param will return
+0 frames if the task passed to __bpf_get_stack isn't the current
+one instead of a single incorrect frame/address. This change
+passes the correct *crosstask* param but also does a preemptive
+check in __bpf_get_stack if the task is current and returns
+-EOPNOTSUPP if it is not.
+
+This issue was found using bpf_get_task_stack inside a BPF
+iterator ("iter/task"), which iterates over all tasks.
+bpf_get_task_stack works fine for fetching kernel stacks
+but because get_perf_callchain relies on the caller to know
+if the requested *task* is the current one (via *crosstask*)
+it was failing in a confusing way.
+
+It might be possible to get user stacks for all tasks utilizing
+something like access_process_vm but that requires the bpf
+program calling bpf_get_task_stack to be sleepable and would
+therefore be a breaking change.
+
+Fixes: fa28dcb82a38 ("bpf: Introduce helper bpf_get_task_stack()")
+Signed-off-by: Jordan Rome <jordalgo@meta.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231108112334.3433136-1-jordalgo@meta.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/bpf.h       |  3 +++
+ kernel/bpf/stackmap.c          | 11 ++++++++++-
+ tools/include/uapi/linux/bpf.h |  3 +++
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
+index 0f6cdf52b1da..bda948a685e5 100644
+--- a/include/uapi/linux/bpf.h
++++ b/include/uapi/linux/bpf.h
+@@ -4517,6 +4517,8 @@ union bpf_attr {
+  * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags)
+  *	Description
+  *		Return a user or a kernel stack in bpf program provided buffer.
++ *		Note: the user stack will only be populated if the *task* is
++ *		the current task; all other tasks will return -EOPNOTSUPP.
+  *		To achieve this, the helper needs *task*, which is a valid
+  *		pointer to **struct task_struct**. To store the stacktrace, the
+  *		bpf program provides *buf* with a nonnegative *size*.
+@@ -4528,6 +4530,7 @@ union bpf_attr {
+  *
+  *		**BPF_F_USER_STACK**
+  *			Collect a user space stack instead of a kernel stack.
++ *			The *task* must be the current task.
+  *		**BPF_F_USER_BUILD_ID**
+  *			Collect buildid+offset instead of ips for user stack,
+  *			only valid if **BPF_F_USER_STACK** is also specified.
+diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
+index d6b277482085..dff7ba539701 100644
+--- a/kernel/bpf/stackmap.c
++++ b/kernel/bpf/stackmap.c
+@@ -388,6 +388,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
+ {
+ 	u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
+ 	bool user_build_id = flags & BPF_F_USER_BUILD_ID;
++	bool crosstask = task && task != current;
+ 	u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
+ 	bool user = flags & BPF_F_USER_STACK;
+ 	struct perf_callchain_entry *trace;
+@@ -410,6 +411,14 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
+ 	if (task && user && !user_mode(regs))
+ 		goto err_fault;
+ 
++	/* get_perf_callchain does not support crosstask user stack walking
++	 * but returns an empty stack instead of NULL.
++	 */
++	if (crosstask && user) {
++		err = -EOPNOTSUPP;
++		goto clear;
++	}
++
+ 	num_elem = size / elem_size;
+ 	max_depth = num_elem + skip;
+ 	if (sysctl_perf_event_max_stack < max_depth)
+@@ -421,7 +430,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
+ 		trace = get_callchain_entry_for_task(task, max_depth);
+ 	else
+ 		trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
+-					   false, false);
++					   crosstask, false);
+ 	if (unlikely(!trace))
+ 		goto err_fault;
+ 
+diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
+index 0f6cdf52b1da..bda948a685e5 100644
+--- a/tools/include/uapi/linux/bpf.h
++++ b/tools/include/uapi/linux/bpf.h
+@@ -4517,6 +4517,8 @@ union bpf_attr {
+  * long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags)
+  *	Description
+  *		Return a user or a kernel stack in bpf program provided buffer.
++ *		Note: the user stack will only be populated if the *task* is
++ *		the current task; all other tasks will return -EOPNOTSUPP.
+  *		To achieve this, the helper needs *task*, which is a valid
+  *		pointer to **struct task_struct**. To store the stacktrace, the
+  *		bpf program provides *buf* with a nonnegative *size*.
+@@ -4528,6 +4530,7 @@ union bpf_attr {
+  *
+  *		**BPF_F_USER_STACK**
+  *			Collect a user space stack instead of a kernel stack.
++ *			The *task* must be the current task.
+  *		**BPF_F_USER_BUILD_ID**
+  *			Collect buildid+offset instead of ips for user stack,
+  *			only valid if **BPF_F_USER_STACK** is also specified.
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-add-kf_rcu-flag-to-bpf_refcount_acquire_impl.patch b/queue-6.7/bpf-add-kf_rcu-flag-to-bpf_refcount_acquire_impl.patch
new file mode 100644
index 00000000000..62b44a21528
--- /dev/null
+++ b/queue-6.7/bpf-add-kf_rcu-flag-to-bpf_refcount_acquire_impl.patch
@@ -0,0 +1,56 @@
+From 471695d031497bd6f13a01ed6a8a70cdda25b714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Nov 2023 00:56:34 -0800
+Subject: bpf: Add KF_RCU flag to bpf_refcount_acquire_impl
+
+From: Dave Marchevsky <davemarchevsky@fb.com>
+
+[ Upstream commit 1500a5d9f49cb66906d3ea1c9158df25cc41dd40 ]
+
+Refcounted local kptrs are kptrs to user-defined types with a
+bpf_refcount field. Recent commits ([0], [1]) modified the lifetime of
+refcounted local kptrs such that the underlying memory is not reused
+until RCU grace period has elapsed.
+
+Separately, verification of bpf_refcount_acquire calls currently
+succeeds for MAYBE_NULL non-owning reference input, which is a problem
+as bpf_refcount_acquire_impl has no handling for this case.
+
+This patch takes advantage of aforementioned lifetime changes to tag
+bpf_refcount_acquire_impl kfunc KF_RCU, thereby preventing MAYBE_NULL
+input to the kfunc. The KF_RCU flag applies to all kfunc params; it's
+fine for it to apply to the void *meta__ign param as that's populated by
+the verifier and is tagged __ign regardless.
+
+  [0]: commit 7e26cd12ad1c ("bpf: Use bpf_mem_free_rcu when
+       bpf_obj_dropping refcounted nodes") is the actual change to
+       allocation behaivor
+  [1]: commit 0816b8c6bf7f ("bpf: Consider non-owning refs to refcounted
+       nodes RCU protected") modified verifier understanding of
+       refcounted local kptrs to match [0]'s changes
+
+Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
+Fixes: 7c50b1cb76ac ("bpf: Add bpf_refcount_acquire kfunc")
+Link: https://lore.kernel.org/r/20231107085639.3016113-2-davemarchevsky@fb.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 56b0c1f678ee..6950f0461634 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -2520,7 +2520,7 @@ BTF_ID_FLAGS(func, bpf_obj_new_impl, KF_ACQUIRE | KF_RET_NULL)
+ BTF_ID_FLAGS(func, bpf_percpu_obj_new_impl, KF_ACQUIRE | KF_RET_NULL)
+ BTF_ID_FLAGS(func, bpf_obj_drop_impl, KF_RELEASE)
+ BTF_ID_FLAGS(func, bpf_percpu_obj_drop_impl, KF_RELEASE)
+-BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL)
++BTF_ID_FLAGS(func, bpf_refcount_acquire_impl, KF_ACQUIRE | KF_RET_NULL | KF_RCU)
+ BTF_ID_FLAGS(func, bpf_list_push_front_impl)
+ BTF_ID_FLAGS(func, bpf_list_push_back_impl)
+ BTF_ID_FLAGS(func, bpf_list_pop_front, KF_ACQUIRE | KF_RET_NULL)
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch b/queue-6.7/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
new file mode 100644
index 00000000000..f2dc1c36aa6
--- /dev/null
+++ b/queue-6.7/bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
@@ -0,0 +1,174 @@
+From a993fc145f6047809d6218e902d217432a6f87ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 22:04:20 +0800
+Subject: bpf: Add map and need_defer parameters to .map_fd_put_ptr()
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 20c20bd11a0702ce4dc9300c3da58acf551d9725 ]
+
+map is the pointer of outer map, and need_defer needs some explanation.
+need_defer tells the implementation to defer the reference release of
+the passed element and ensure that the element is still alive before
+the bpf program, which may manipulate it, exits.
+
+The following three cases will invoke map_fd_put_ptr() and different
+need_defer values will be passed to these callers:
+
+1) release the reference of the old element in the map during map update
+   or map deletion. The release must be deferred, otherwise the bpf
+   program may incur use-after-free problem, so need_defer needs to be
+   true.
+2) release the reference of the to-be-added element in the error path of
+   map update. The to-be-added element is not visible to any bpf
+   program, so it is OK to pass false for need_defer parameter.
+3) release the references of all elements in the map during map release.
+   Any bpf program which has access to the map must have been exited and
+   released, so need_defer=false will be OK.
+
+These two parameters will be used by the following patches to fix the
+potential use-after-free problem for map-in-map.
+
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20231204140425.1480317-3-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Stable-dep-of: 876673364161 ("bpf: Defer the free of inner map when necessary")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h     |  6 +++++-
+ kernel/bpf/arraymap.c   | 12 +++++++-----
+ kernel/bpf/hashtab.c    |  6 +++---
+ kernel/bpf/map_in_map.c |  2 +-
+ kernel/bpf/map_in_map.h |  2 +-
+ 5 files changed, 17 insertions(+), 11 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index cff5bb08820e..741af9e5cb9d 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -106,7 +106,11 @@ struct bpf_map_ops {
+ 	/* funcs called by prog_array and perf_event_array map */
+ 	void *(*map_fd_get_ptr)(struct bpf_map *map, struct file *map_file,
+ 				int fd);
+-	void (*map_fd_put_ptr)(void *ptr);
++	/* If need_defer is true, the implementation should guarantee that
++	 * the to-be-put element is still alive before the bpf program, which
++	 * may manipulate it, exists.
++	 */
++	void (*map_fd_put_ptr)(struct bpf_map *map, void *ptr, bool need_defer);
+ 	int (*map_gen_lookup)(struct bpf_map *map, struct bpf_insn *insn_buf);
+ 	u32 (*map_fd_sys_lookup_elem)(void *ptr);
+ 	void (*map_seq_show_elem)(struct bpf_map *map, void *key,
+diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
+index c85ff9162a5c..9bfad7e96913 100644
+--- a/kernel/bpf/arraymap.c
++++ b/kernel/bpf/arraymap.c
+@@ -867,7 +867,7 @@ int bpf_fd_array_map_update_elem(struct bpf_map *map, struct file *map_file,
+ 	}
+ 
+ 	if (old_ptr)
+-		map->ops->map_fd_put_ptr(old_ptr);
++		map->ops->map_fd_put_ptr(map, old_ptr, true);
+ 	return 0;
+ }
+ 
+@@ -890,7 +890,7 @@ static long fd_array_map_delete_elem(struct bpf_map *map, void *key)
+ 	}
+ 
+ 	if (old_ptr) {
+-		map->ops->map_fd_put_ptr(old_ptr);
++		map->ops->map_fd_put_ptr(map, old_ptr, true);
+ 		return 0;
+ 	} else {
+ 		return -ENOENT;
+@@ -913,8 +913,9 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map,
+ 	return prog;
+ }
+ 
+-static void prog_fd_array_put_ptr(void *ptr)
++static void prog_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
++	/* bpf_prog is freed after one RCU or tasks trace grace period */
+ 	bpf_prog_put(ptr);
+ }
+ 
+@@ -1201,8 +1202,9 @@ static void *perf_event_fd_array_get_ptr(struct bpf_map *map,
+ 	return ee;
+ }
+ 
+-static void perf_event_fd_array_put_ptr(void *ptr)
++static void perf_event_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
++	/* bpf_perf_event is freed after one RCU grace period */
+ 	bpf_event_entry_free_rcu(ptr);
+ }
+ 
+@@ -1256,7 +1258,7 @@ static void *cgroup_fd_array_get_ptr(struct bpf_map *map,
+ 	return cgroup_get_from_fd(fd);
+ }
+ 
+-static void cgroup_fd_array_put_ptr(void *ptr)
++static void cgroup_fd_array_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
+ 	/* cgroup_put free cgrp after a rcu grace period */
+ 	cgroup_put(ptr);
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index fd8d4b0addfc..5b9146fa825f 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -897,7 +897,7 @@ static void htab_put_fd_value(struct bpf_htab *htab, struct htab_elem *l)
+ 
+ 	if (map->ops->map_fd_put_ptr) {
+ 		ptr = fd_htab_map_get_ptr(map, l);
+-		map->ops->map_fd_put_ptr(ptr);
++		map->ops->map_fd_put_ptr(map, ptr, true);
+ 	}
+ }
+ 
+@@ -2484,7 +2484,7 @@ static void fd_htab_map_free(struct bpf_map *map)
+ 		hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
+ 			void *ptr = fd_htab_map_get_ptr(map, l);
+ 
+-			map->ops->map_fd_put_ptr(ptr);
++			map->ops->map_fd_put_ptr(map, ptr, false);
+ 		}
+ 	}
+ 
+@@ -2525,7 +2525,7 @@ int bpf_fd_htab_map_update_elem(struct bpf_map *map, struct file *map_file,
+ 
+ 	ret = htab_map_update_elem(map, key, &ptr, map_flags);
+ 	if (ret)
+-		map->ops->map_fd_put_ptr(ptr);
++		map->ops->map_fd_put_ptr(map, ptr, false);
+ 
+ 	return ret;
+ }
+diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
+index cd5eafaba97e..2dfeb5835e16 100644
+--- a/kernel/bpf/map_in_map.c
++++ b/kernel/bpf/map_in_map.c
+@@ -127,7 +127,7 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map,
+ 	return inner_map;
+ }
+ 
+-void bpf_map_fd_put_ptr(void *ptr)
++void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
+ 	/* ptr->ops->map_free() has to go through one
+ 	 * rcu grace period by itself.
+diff --git a/kernel/bpf/map_in_map.h b/kernel/bpf/map_in_map.h
+index bcb7534afb3c..7d61602354de 100644
+--- a/kernel/bpf/map_in_map.h
++++ b/kernel/bpf/map_in_map.h
+@@ -13,7 +13,7 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd);
+ void bpf_map_meta_free(struct bpf_map *map_meta);
+ void *bpf_map_fd_get_ptr(struct bpf_map *map, struct file *map_file,
+ 			 int ufd);
+-void bpf_map_fd_put_ptr(void *ptr);
++void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer);
+ u32 bpf_map_fd_sys_lookup_elem(void *ptr);
+ 
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-defer-the-free-of-inner-map-when-necessary.patch b/queue-6.7/bpf-defer-the-free-of-inner-map-when-necessary.patch
new file mode 100644
index 00000000000..8d28a26bcb9
--- /dev/null
+++ b/queue-6.7/bpf-defer-the-free-of-inner-map-when-necessary.patch
@@ -0,0 +1,141 @@
+From e613ce91a6ad0a8b9fe435c18e78a602d1585b2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 22:04:22 +0800
+Subject: bpf: Defer the free of inner map when necessary
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 876673364161da50eed6b472d746ef88242b2368 ]
+
+When updating or deleting an inner map in map array or map htab, the map
+may still be accessed by non-sleepable program or sleepable program.
+However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map
+directly through bpf_map_put(), if the ref-counter is the last one
+(which is true for most cases), the inner map will be freed by
+ops->map_free() in a kworker. But for now, most .map_free() callbacks
+don't use synchronize_rcu() or its variants to wait for the elapse of a
+RCU grace period, so after the invocation of ops->map_free completes,
+the bpf program which is accessing the inner map may incur
+use-after-free problem.
+
+Fix the free of inner map by invoking bpf_map_free_deferred() after both
+one RCU grace period and one tasks trace RCU grace period if the inner
+map has been removed from the outer map before. The deferment is
+accomplished by using call_rcu() or call_rcu_tasks_trace() when
+releasing the last ref-counter of bpf map. The newly-added rcu_head
+field in bpf_map shares the same storage space with work field to
+reduce the size of bpf_map.
+
+Fixes: bba1dc0b55ac ("bpf: Remove redundant synchronize_rcu.")
+Fixes: 638e4b825d52 ("bpf: Allows per-cpu maps and map-in-map in sleepable programs")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20231204140425.1480317-5-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h     |  7 ++++++-
+ kernel/bpf/map_in_map.c | 11 ++++++++---
+ kernel/bpf/syscall.c    | 32 +++++++++++++++++++++++++++-----
+ 3 files changed, 41 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 741af9e5cb9d..7a7859a5cce4 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -276,7 +276,11 @@ struct bpf_map {
+ 	 */
+ 	atomic64_t refcnt ____cacheline_aligned;
+ 	atomic64_t usercnt;
+-	struct work_struct work;
++	/* rcu is used before freeing and work is only used during freeing */
++	union {
++		struct work_struct work;
++		struct rcu_head rcu;
++	};
+ 	struct mutex freeze_mutex;
+ 	atomic64_t writecnt;
+ 	/* 'Ownership' of program-containing map is claimed by the first program
+@@ -292,6 +296,7 @@ struct bpf_map {
+ 	} owner;
+ 	bool bypass_spec_v1;
+ 	bool frozen; /* write-once; write-protected by freeze_mutex */
++	bool free_after_mult_rcu_gp;
+ 	s64 __percpu *elem_count;
+ };
+ 
+diff --git a/kernel/bpf/map_in_map.c b/kernel/bpf/map_in_map.c
+index 2dfeb5835e16..3248ff5d8161 100644
+--- a/kernel/bpf/map_in_map.c
++++ b/kernel/bpf/map_in_map.c
+@@ -129,10 +129,15 @@ void *bpf_map_fd_get_ptr(struct bpf_map *map,
+ 
+ void bpf_map_fd_put_ptr(struct bpf_map *map, void *ptr, bool need_defer)
+ {
+-	/* ptr->ops->map_free() has to go through one
+-	 * rcu grace period by itself.
++	struct bpf_map *inner_map = ptr;
++
++	/* The inner map may still be used by both non-sleepable and sleepable
++	 * bpf program, so free it after one RCU grace period and one tasks
++	 * trace RCU grace period.
+ 	 */
+-	bpf_map_put(ptr);
++	if (need_defer)
++		WRITE_ONCE(inner_map->free_after_mult_rcu_gp, true);
++	bpf_map_put(inner_map);
+ }
+ 
+ u32 bpf_map_fd_sys_lookup_elem(void *ptr)
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 0ed286b8a0f0..c6579067eeea 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -719,6 +719,28 @@ static void bpf_map_put_uref(struct bpf_map *map)
+ 	}
+ }
+ 
++static void bpf_map_free_in_work(struct bpf_map *map)
++{
++	INIT_WORK(&map->work, bpf_map_free_deferred);
++	/* Avoid spawning kworkers, since they all might contend
++	 * for the same mutex like slab_mutex.
++	 */
++	queue_work(system_unbound_wq, &map->work);
++}
++
++static void bpf_map_free_rcu_gp(struct rcu_head *rcu)
++{
++	bpf_map_free_in_work(container_of(rcu, struct bpf_map, rcu));
++}
++
++static void bpf_map_free_mult_rcu_gp(struct rcu_head *rcu)
++{
++	if (rcu_trace_implies_rcu_gp())
++		bpf_map_free_rcu_gp(rcu);
++	else
++		call_rcu(rcu, bpf_map_free_rcu_gp);
++}
++
+ /* decrement map refcnt and schedule it for freeing via workqueue
+  * (underlying map implementation ops->map_free() might sleep)
+  */
+@@ -728,11 +750,11 @@ void bpf_map_put(struct bpf_map *map)
+ 		/* bpf_map_free_id() must be called first */
+ 		bpf_map_free_id(map);
+ 		btf_put(map->btf);
+-		INIT_WORK(&map->work, bpf_map_free_deferred);
+-		/* Avoid spawning kworkers, since they all might contend
+-		 * for the same mutex like slab_mutex.
+-		 */
+-		queue_work(system_unbound_wq, &map->work);
++
++		if (READ_ONCE(map->free_after_mult_rcu_gp))
++			call_rcu_tasks_trace(&map->rcu, bpf_map_free_mult_rcu_gp);
++		else
++			bpf_map_free_in_work(map);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(bpf_map_put);
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-enforce-precision-of-r0-on-callback-return.patch b/queue-6.7/bpf-enforce-precision-of-r0-on-callback-return.patch
new file mode 100644
index 00000000000..986d00555f9
--- /dev/null
+++ b/queue-6.7/bpf-enforce-precision-of-r0-on-callback-return.patch
@@ -0,0 +1,46 @@
+From afa32f21c2d00dd6bac0993a250fc1b1fb8a364f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 09:56:57 -0800
+Subject: bpf: enforce precision of R0 on callback return
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit 0acd03a5bd188b0c501d285d938439618bd855c4 ]
+
+Given verifier checks actual value, r0 has to be precise, so we need to
+propagate precision properly. r0 also has to be marked as read,
+otherwise subsequent state comparisons will ignore such register as
+unimportant and precision won't really help here.
+
+Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20231202175705.885270-4-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index af2819d5c8ee..4d59b200e898 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -9829,6 +9829,13 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
+ 			verbose(env, "R0 not a scalar value\n");
+ 			return -EACCES;
+ 		}
++
++		/* we are going to rely on register's precise value */
++		err = mark_reg_read(env, r0, r0->parent, REG_LIVE_READ64);
++		err = err ?: mark_chain_precision(env, BPF_REG_0);
++		if (err)
++			return err;
++
+ 		if (!tnum_in(range, r0->var_off)) {
+ 			verbose_invalid_scalar(env, r0, &range, "callback return", "R0");
+ 			return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-fix-a-race-condition-between-btf_put-and-map_fre.patch b/queue-6.7/bpf-fix-a-race-condition-between-btf_put-and-map_fre.patch
new file mode 100644
index 00000000000..d1c3d4e5dd3
--- /dev/null
+++ b/queue-6.7/bpf-fix-a-race-condition-between-btf_put-and-map_fre.patch
@@ -0,0 +1,211 @@
+From 5da5fd42dafc31b578835cd93e37d17cc2e2951a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 12:38:15 -0800
+Subject: bpf: Fix a race condition between btf_put() and map_free()
+
+From: Yonghong Song <yonghong.song@linux.dev>
+
+[ Upstream commit 59e5791f59dd83e8aa72a4e74217eabb6e8cfd90 ]
+
+When running `./test_progs -j` in my local vm with latest kernel,
+I once hit a kasan error like below:
+
+  [ 1887.184724] BUG: KASAN: slab-use-after-free in bpf_rb_root_free+0x1f8/0x2b0
+  [ 1887.185599] Read of size 4 at addr ffff888106806910 by task kworker/u12:2/2830
+  [ 1887.186498]
+  [ 1887.186712] CPU: 3 PID: 2830 Comm: kworker/u12:2 Tainted: G           OEL     6.7.0-rc3-00699-g90679706d486-dirty #494
+  [ 1887.188034] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+  [ 1887.189618] Workqueue: events_unbound bpf_map_free_deferred
+  [ 1887.190341] Call Trace:
+  [ 1887.190666]  <TASK>
+  [ 1887.190949]  dump_stack_lvl+0xac/0xe0
+  [ 1887.191423]  ? nf_tcp_handle_invalid+0x1b0/0x1b0
+  [ 1887.192019]  ? panic+0x3c0/0x3c0
+  [ 1887.192449]  print_report+0x14f/0x720
+  [ 1887.192930]  ? preempt_count_sub+0x1c/0xd0
+  [ 1887.193459]  ? __virt_addr_valid+0xac/0x120
+  [ 1887.194004]  ? bpf_rb_root_free+0x1f8/0x2b0
+  [ 1887.194572]  kasan_report+0xc3/0x100
+  [ 1887.195085]  ? bpf_rb_root_free+0x1f8/0x2b0
+  [ 1887.195668]  bpf_rb_root_free+0x1f8/0x2b0
+  [ 1887.196183]  ? __bpf_obj_drop_impl+0xb0/0xb0
+  [ 1887.196736]  ? preempt_count_sub+0x1c/0xd0
+  [ 1887.197270]  ? preempt_count_sub+0x1c/0xd0
+  [ 1887.197802]  ? _raw_spin_unlock+0x1f/0x40
+  [ 1887.198319]  bpf_obj_free_fields+0x1d4/0x260
+  [ 1887.198883]  array_map_free+0x1a3/0x260
+  [ 1887.199380]  bpf_map_free_deferred+0x7b/0xe0
+  [ 1887.199943]  process_scheduled_works+0x3a2/0x6c0
+  [ 1887.200549]  worker_thread+0x633/0x890
+  [ 1887.201047]  ? __kthread_parkme+0xd7/0xf0
+  [ 1887.201574]  ? kthread+0x102/0x1d0
+  [ 1887.202020]  kthread+0x1ab/0x1d0
+  [ 1887.202447]  ? pr_cont_work+0x270/0x270
+  [ 1887.202954]  ? kthread_blkcg+0x50/0x50
+  [ 1887.203444]  ret_from_fork+0x34/0x50
+  [ 1887.203914]  ? kthread_blkcg+0x50/0x50
+  [ 1887.204397]  ret_from_fork_asm+0x11/0x20
+  [ 1887.204913]  </TASK>
+  [ 1887.204913]  </TASK>
+  [ 1887.205209]
+  [ 1887.205416] Allocated by task 2197:
+  [ 1887.205881]  kasan_set_track+0x3f/0x60
+  [ 1887.206366]  __kasan_kmalloc+0x6e/0x80
+  [ 1887.206856]  __kmalloc+0xac/0x1a0
+  [ 1887.207293]  btf_parse_fields+0xa15/0x1480
+  [ 1887.207836]  btf_parse_struct_metas+0x566/0x670
+  [ 1887.208387]  btf_new_fd+0x294/0x4d0
+  [ 1887.208851]  __sys_bpf+0x4ba/0x600
+  [ 1887.209292]  __x64_sys_bpf+0x41/0x50
+  [ 1887.209762]  do_syscall_64+0x4c/0xf0
+  [ 1887.210222]  entry_SYSCALL_64_after_hwframe+0x63/0x6b
+  [ 1887.210868]
+  [ 1887.211074] Freed by task 36:
+  [ 1887.211460]  kasan_set_track+0x3f/0x60
+  [ 1887.211951]  kasan_save_free_info+0x28/0x40
+  [ 1887.212485]  ____kasan_slab_free+0x101/0x180
+  [ 1887.213027]  __kmem_cache_free+0xe4/0x210
+  [ 1887.213514]  btf_free+0x5b/0x130
+  [ 1887.213918]  rcu_core+0x638/0xcc0
+  [ 1887.214347]  __do_softirq+0x114/0x37e
+
+The error happens at bpf_rb_root_free+0x1f8/0x2b0:
+
+  00000000000034c0 <bpf_rb_root_free>:
+  ; {
+    34c0: f3 0f 1e fa                   endbr64
+    34c4: e8 00 00 00 00                callq   0x34c9 <bpf_rb_root_free+0x9>
+    34c9: 55                            pushq   %rbp
+    34ca: 48 89 e5                      movq    %rsp, %rbp
+  ...
+  ;       if (rec && rec->refcount_off >= 0 &&
+    36aa: 4d 85 ed                      testq   %r13, %r13
+    36ad: 74 a9                         je      0x3658 <bpf_rb_root_free+0x198>
+    36af: 49 8d 7d 10                   leaq    0x10(%r13), %rdi
+    36b3: e8 00 00 00 00                callq   0x36b8 <bpf_rb_root_free+0x1f8>
+                                        <==== kasan function
+    36b8: 45 8b 7d 10                   movl    0x10(%r13), %r15d
+                                        <==== use-after-free load
+    36bc: 45 85 ff                      testl   %r15d, %r15d
+    36bf: 78 8c                         js      0x364d <bpf_rb_root_free+0x18d>
+
+So the problem is at rec->refcount_off in the above.
+
+I did some source code analysis and find the reason.
+                                  CPU A                        CPU B
+  bpf_map_put:
+    ...
+    btf_put with rcu callback
+    ...
+    bpf_map_free_deferred
+      with system_unbound_wq
+    ...                          ...                           ...
+    ...                          btf_free_rcu:                 ...
+    ...                          ...                           bpf_map_free_deferred:
+    ...                          ...
+    ...         --------->       btf_struct_metas_free()
+    ...         | race condition ...
+    ...         --------->                                     map->ops->map_free()
+    ...
+    ...                          btf->struct_meta_tab = NULL
+
+In the above, map_free() corresponds to array_map_free() and eventually
+calling bpf_rb_root_free() which calls:
+  ...
+  __bpf_obj_drop_impl(obj, field->graph_root.value_rec, false);
+  ...
+
+Here, 'value_rec' is assigned in btf_check_and_fixup_fields() with following code:
+
+  meta = btf_find_struct_meta(btf, btf_id);
+  if (!meta)
+    return -EFAULT;
+  rec->fields[i].graph_root.value_rec = meta->record;
+
+So basically, 'value_rec' is a pointer to the record in struct_metas_tab.
+And it is possible that that particular record has been freed by
+btf_struct_metas_free() and hence we have a kasan error here.
+
+Actually it is very hard to reproduce the failure with current bpf/bpf-next
+code, I only got the above error once. To increase reproducibility, I added
+a delay in bpf_map_free_deferred() to delay map->ops->map_free(), which
+significantly increased reproducibility.
+
+  diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+  index 5e43ddd1b83f..aae5b5213e93 100644
+  --- a/kernel/bpf/syscall.c
+  +++ b/kernel/bpf/syscall.c
+  @@ -695,6 +695,7 @@ static void bpf_map_free_deferred(struct work_struct *work)
+        struct bpf_map *map = container_of(work, struct bpf_map, work);
+        struct btf_record *rec = map->record;
+
+  +     mdelay(100);
+        security_bpf_map_free(map);
+        bpf_map_release_memcg(map);
+        /* implementation dependent freeing */
+
+Hao also provided test cases ([1]) for easily reproducing the above issue.
+
+There are two ways to fix the issue, the v1 of the patch ([2]) moving
+btf_put() after map_free callback, and the v5 of the patch ([3]) using
+a kptr style fix which tries to get a btf reference during
+map_check_btf(). Each approach has its pro and cons. The first approach
+delays freeing btf while the second approach needs to acquire reference
+depending on context which makes logic not very elegant and may
+complicate things with future new data structures. Alexei
+suggested in [4] going back to v1 which is what this patch
+tries to do.
+
+Rerun './test_progs -j' with the above mdelay() hack for a couple
+of times and didn't observe the error for the above rb_root test cases.
+Running Hou's test ([1]) is also successful.
+
+  [1] https://lore.kernel.org/bpf/20231207141500.917136-1-houtao@huaweicloud.com/
+  [2] v1: https://lore.kernel.org/bpf/20231204173946.3066377-1-yonghong.song@linux.dev/
+  [3] v5: https://lore.kernel.org/bpf/20231208041621.2968241-1-yonghong.song@linux.dev/
+  [4] v4: https://lore.kernel.org/bpf/CAADnVQJ3FiXUhZJwX_81sjZvSYYKCFB3BT6P8D59RS2Gu+0Z7g@mail.gmail.com/
+
+Cc: Hou Tao <houtao@huaweicloud.com>
+Fixes: 958cf2e273f0 ("bpf: Introduce bpf_obj_new")
+Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20231214203815.1469107-1-yonghong.song@linux.dev
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index c6579067eeea..6e7e57360b81 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -694,6 +694,7 @@ static void bpf_map_free_deferred(struct work_struct *work)
+ {
+ 	struct bpf_map *map = container_of(work, struct bpf_map, work);
+ 	struct btf_record *rec = map->record;
++	struct btf *btf = map->btf;
+ 
+ 	security_bpf_map_free(map);
+ 	bpf_map_release_memcg(map);
+@@ -709,6 +710,10 @@ static void bpf_map_free_deferred(struct work_struct *work)
+ 	 * template bpf_map struct used during verification.
+ 	 */
+ 	btf_record_free(rec);
++	/* Delay freeing of btf for maps, as map_free callback may need
++	 * struct_meta info which will be freed with btf_put().
++	 */
++	btf_put(btf);
+ }
+ 
+ static void bpf_map_put_uref(struct bpf_map *map)
+@@ -749,7 +754,6 @@ void bpf_map_put(struct bpf_map *map)
+ 	if (atomic64_dec_and_test(&map->refcnt)) {
+ 		/* bpf_map_free_id() must be called first */
+ 		bpf_map_free_id(map);
+-		btf_put(map->btf);
+ 
+ 		if (READ_ONCE(map->free_after_mult_rcu_gp))
+ 			call_rcu_tasks_trace(&map->rcu, bpf_map_free_mult_rcu_gp);
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-fix-accesses-to-uninit-stack-slots.patch b/queue-6.7/bpf-fix-accesses-to-uninit-stack-slots.patch
new file mode 100644
index 00000000000..03228e9b11e
--- /dev/null
+++ b/queue-6.7/bpf-fix-accesses-to-uninit-stack-slots.patch
@@ -0,0 +1,470 @@
+From 7c46217ca064428b4423a3b9a0cb0cf24be1657f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 22:25:18 -0500
+Subject: bpf: Fix accesses to uninit stack slots
+
+From: Andrei Matei <andreimatei1@gmail.com>
+
+[ Upstream commit 6b4a64bafd107e521c01eec3453ce94a3fb38529 ]
+
+Privileged programs are supposed to be able to read uninitialized stack
+memory (ever since 6715df8d5) but, before this patch, these accesses
+were permitted inconsistently. In particular, accesses were permitted
+above state->allocated_stack, but not below it. In other words, if the
+stack was already "large enough", the access was permitted, but
+otherwise the access was rejected instead of being allowed to "grow the
+stack". This undesired rejection was happening in two places:
+- in check_stack_slot_within_bounds()
+- in check_stack_range_initialized()
+This patch arranges for these accesses to be permitted. A bunch of tests
+that were relying on the old rejection had to change; all of them were
+changed to add also run unprivileged, in which case the old behavior
+persists. One tests couldn't be updated - global_func16 - because it
+can't run unprivileged for other reasons.
+
+This patch also fixes the tracking of the stack size for variable-offset
+reads. This second fix is bundled in the same commit as the first one
+because they're inter-related. Before this patch, writes to the stack
+using registers containing a variable offset (as opposed to registers
+with fixed, known values) were not properly contributing to the
+function's needed stack size. As a result, it was possible for a program
+to verify, but then to attempt to read out-of-bounds data at runtime
+because a too small stack had been allocated for it.
+
+Each function tracks the size of the stack it needs in
+bpf_subprog_info.stack_depth, which is maintained by
+update_stack_depth(). For regular memory accesses, check_mem_access()
+was calling update_state_depth() but it was passing in only the fixed
+part of the offset register, ignoring the variable offset. This was
+incorrect; the minimum possible value of that register should be used
+instead.
+
+This tracking is now fixed by centralizing the tracking of stack size in
+grow_stack_state(), and by lifting the calls to grow_stack_state() to
+check_stack_access_within_bounds() as suggested by Andrii. The code is
+now simpler and more convincingly tracks the correct maximum stack size.
+check_stack_range_initialized() can now rely on enough stack having been
+allocated for the access; this helps with the fix for the first issue.
+
+A few tests were changed to also check the stack depth computation. The
+one that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.
+
+Fixes: 01f810ace9ed3 ("bpf: Allow variable-offset stack access")
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231208032519.260451-3-andreimatei1@gmail.com
+
+Closes: https://lore.kernel.org/bpf/CABWLsev9g8UP_c3a=1qbuZUi20tGoUXoU07FPf-5FLvhOKOY+Q@mail.gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c                         | 65 ++++++++-----------
+ tools/testing/selftests/bpf/progs/iters.c     |  2 +-
+ .../selftests/bpf/progs/test_global_func16.c  |  2 +-
+ .../bpf/progs/verifier_basic_stack.c          |  8 +--
+ .../selftests/bpf/progs/verifier_int_ptr.c    |  5 +-
+ .../selftests/bpf/progs/verifier_raw_stack.c  |  5 +-
+ .../selftests/bpf/progs/verifier_var_off.c    | 62 ++++++++++++++----
+ .../selftests/bpf/verifier/atomic_cmpxchg.c   | 11 ----
+ tools/testing/selftests/bpf/verifier/calls.c  |  4 +-
+ 9 files changed, 92 insertions(+), 72 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 4d91df312b99..2b8fbdc1a113 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1685,7 +1685,10 @@ static int resize_reference_state(struct bpf_func_state *state, size_t n)
+ 	return 0;
+ }
+ 
+-static int grow_stack_state(struct bpf_func_state *state, int size)
++/* Possibly update state->allocated_stack to be at least size bytes. Also
++ * possibly update the function's high-water mark in its bpf_subprog_info.
++ */
++static int grow_stack_state(struct bpf_verifier_env *env, struct bpf_func_state *state, int size)
+ {
+ 	size_t old_n = state->allocated_stack / BPF_REG_SIZE, n = size / BPF_REG_SIZE;
+ 
+@@ -1697,6 +1700,11 @@ static int grow_stack_state(struct bpf_func_state *state, int size)
+ 		return -ENOMEM;
+ 
+ 	state->allocated_stack = size;
++
++	/* update known max for given subprogram */
++	if (env->subprog_info[state->subprogno].stack_depth < size)
++		env->subprog_info[state->subprogno].stack_depth = size;
++
+ 	return 0;
+ }
+ 
+@@ -4669,9 +4677,6 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
+ 	struct bpf_reg_state *reg = NULL;
+ 	u32 dst_reg = insn->dst_reg;
+ 
+-	err = grow_stack_state(state, round_up(slot + 1, BPF_REG_SIZE));
+-	if (err)
+-		return err;
+ 	/* caller checked that off % size == 0 and -MAX_BPF_STACK <= off < 0,
+ 	 * so it's aligned access and [off, off + size) are within stack limits
+ 	 */
+@@ -4827,10 +4832,6 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env,
+ 	    (!value_reg && is_bpf_st_mem(insn) && insn->imm == 0))
+ 		writing_zero = true;
+ 
+-	err = grow_stack_state(state, round_up(-min_off, BPF_REG_SIZE));
+-	if (err)
+-		return err;
+-
+ 	for (i = min_off; i < max_off; i++) {
+ 		int spi;
+ 
+@@ -5959,20 +5960,6 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
+ 					   strict);
+ }
+ 
+-static int update_stack_depth(struct bpf_verifier_env *env,
+-			      const struct bpf_func_state *func,
+-			      int off)
+-{
+-	u16 stack = env->subprog_info[func->subprogno].stack_depth;
+-
+-	if (stack >= -off)
+-		return 0;
+-
+-	/* update known max for given subprogram */
+-	env->subprog_info[func->subprogno].stack_depth = -off;
+-	return 0;
+-}
+-
+ /* starting from main bpf function walk all instructions of the function
+  * and recursively walk all callees that given function can call.
+  * Ignore jump and exit insns.
+@@ -6761,13 +6748,14 @@ static int check_ptr_to_map_access(struct bpf_verifier_env *env,
+  * The minimum valid offset is -MAX_BPF_STACK for writes, and
+  * -state->allocated_stack for reads.
+  */
+-static int check_stack_slot_within_bounds(s64 off,
+-					  struct bpf_func_state *state,
+-					  enum bpf_access_type t)
++static int check_stack_slot_within_bounds(struct bpf_verifier_env *env,
++                                          s64 off,
++                                          struct bpf_func_state *state,
++                                          enum bpf_access_type t)
+ {
+ 	int min_valid_off;
+ 
+-	if (t == BPF_WRITE)
++	if (t == BPF_WRITE || env->allow_uninit_stack)
+ 		min_valid_off = -MAX_BPF_STACK;
+ 	else
+ 		min_valid_off = -state->allocated_stack;
+@@ -6816,7 +6804,7 @@ static int check_stack_access_within_bounds(
+ 		max_off = reg->smax_value + off + access_size;
+ 	}
+ 
+-	err = check_stack_slot_within_bounds(min_off, state, type);
++	err = check_stack_slot_within_bounds(env, min_off, state, type);
+ 	if (!err && max_off > 0)
+ 		err = -EINVAL; /* out of stack access into non-negative offsets */
+ 
+@@ -6831,8 +6819,10 @@ static int check_stack_access_within_bounds(
+ 			verbose(env, "invalid variable-offset%s stack R%d var_off=%s size=%d\n",
+ 				err_extra, regno, tn_buf, access_size);
+ 		}
++		return err;
+ 	}
+-	return err;
++
++	return grow_stack_state(env, state, round_up(-min_off, BPF_REG_SIZE));
+ }
+ 
+ /* check whether memory at (regno + off) is accessible for t = (read | write)
+@@ -6847,7 +6837,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
+ {
+ 	struct bpf_reg_state *regs = cur_regs(env);
+ 	struct bpf_reg_state *reg = regs + regno;
+-	struct bpf_func_state *state;
+ 	int size, err = 0;
+ 
+ 	size = bpf_size_to_bytes(bpf_size);
+@@ -6990,11 +6979,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
+ 		if (err)
+ 			return err;
+ 
+-		state = func(env, reg);
+-		err = update_stack_depth(env, state, off);
+-		if (err)
+-			return err;
+-
+ 		if (t == BPF_READ)
+ 			err = check_stack_read(env, regno, off, size,
+ 					       value_regno);
+@@ -7189,7 +7173,8 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
+ 
+ /* When register 'regno' is used to read the stack (either directly or through
+  * a helper function) make sure that it's within stack boundary and, depending
+- * on the access type, that all elements of the stack are initialized.
++ * on the access type and privileges, that all elements of the stack are
++ * initialized.
+  *
+  * 'off' includes 'regno->off', but not its dynamic part (if any).
+  *
+@@ -7297,8 +7282,11 @@ static int check_stack_range_initialized(
+ 
+ 		slot = -i - 1;
+ 		spi = slot / BPF_REG_SIZE;
+-		if (state->allocated_stack <= slot)
+-			goto err;
++		if (state->allocated_stack <= slot) {
++			verbose(env, "verifier bug: allocated_stack too small");
++			return -EFAULT;
++		}
++
+ 		stype = &state->stack[spi].slot_type[slot % BPF_REG_SIZE];
+ 		if (*stype == STACK_MISC)
+ 			goto mark;
+@@ -7322,7 +7310,6 @@ static int check_stack_range_initialized(
+ 			goto mark;
+ 		}
+ 
+-err:
+ 		if (tnum_is_const(reg->var_off)) {
+ 			verbose(env, "invalid%s read from stack R%d off %d+%d size %d\n",
+ 				err_extra, regno, min_off, i - min_off, access_size);
+@@ -7347,7 +7334,7 @@ static int check_stack_range_initialized(
+ 		 * helper may write to the entire memory range.
+ 		 */
+ 	}
+-	return update_stack_depth(env, state, min_off);
++	return 0;
+ }
+ 
+ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
+diff --git a/tools/testing/selftests/bpf/progs/iters.c b/tools/testing/selftests/bpf/progs/iters.c
+index c20c4e38b71c..844d968c27d6 100644
+--- a/tools/testing/selftests/bpf/progs/iters.c
++++ b/tools/testing/selftests/bpf/progs/iters.c
+@@ -846,7 +846,7 @@ __naked int delayed_precision_mark(void)
+ 		"call %[bpf_iter_num_next];"
+ 		"if r0 == 0 goto 2f;"
+ 		"if r6 != 42 goto 3f;"
+-		"r7 = -32;"
++		"r7 = -33;"
+ 		"call %[bpf_get_prandom_u32];"
+ 		"r6 = r0;"
+ 		"goto 1b;\n"
+diff --git a/tools/testing/selftests/bpf/progs/test_global_func16.c b/tools/testing/selftests/bpf/progs/test_global_func16.c
+index e7206304632e..e3e64bc472cd 100644
+--- a/tools/testing/selftests/bpf/progs/test_global_func16.c
++++ b/tools/testing/selftests/bpf/progs/test_global_func16.c
+@@ -13,7 +13,7 @@ __noinline int foo(int (*arr)[10])
+ }
+ 
+ SEC("cgroup_skb/ingress")
+-__failure __msg("invalid indirect read from stack")
++__success
+ int global_func16(struct __sk_buff *skb)
+ {
+ 	int array[10];
+diff --git a/tools/testing/selftests/bpf/progs/verifier_basic_stack.c b/tools/testing/selftests/bpf/progs/verifier_basic_stack.c
+index 359df865a8f3..8d77cc5323d3 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_basic_stack.c
++++ b/tools/testing/selftests/bpf/progs/verifier_basic_stack.c
+@@ -27,8 +27,8 @@ __naked void stack_out_of_bounds(void)
+ 
+ SEC("socket")
+ __description("uninitialized stack1")
+-__failure __msg("invalid indirect read from stack")
+-__failure_unpriv
++__success __log_level(4) __msg("stack depth 8")
++__failure_unpriv __msg_unpriv("invalid indirect read from stack")
+ __naked void uninitialized_stack1(void)
+ {
+ 	asm volatile ("					\
+@@ -45,8 +45,8 @@ __naked void uninitialized_stack1(void)
+ 
+ SEC("socket")
+ __description("uninitialized stack2")
+-__failure __msg("invalid read from stack")
+-__failure_unpriv
++__success __log_level(4) __msg("stack depth 8")
++__failure_unpriv __msg_unpriv("invalid read from stack")
+ __naked void uninitialized_stack2(void)
+ {
+ 	asm volatile ("					\
+diff --git a/tools/testing/selftests/bpf/progs/verifier_int_ptr.c b/tools/testing/selftests/bpf/progs/verifier_int_ptr.c
+index b054f9c48143..589e8270de46 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_int_ptr.c
++++ b/tools/testing/selftests/bpf/progs/verifier_int_ptr.c
+@@ -5,9 +5,10 @@
+ #include <bpf/bpf_helpers.h>
+ #include "bpf_misc.h"
+ 
+-SEC("cgroup/sysctl")
++SEC("socket")
+ __description("ARG_PTR_TO_LONG uninitialized")
+-__failure __msg("invalid indirect read from stack R4 off -16+0 size 8")
++__success
++__failure_unpriv __msg_unpriv("invalid indirect read from stack R4 off -16+0 size 8")
+ __naked void arg_ptr_to_long_uninitialized(void)
+ {
+ 	asm volatile ("					\
+diff --git a/tools/testing/selftests/bpf/progs/verifier_raw_stack.c b/tools/testing/selftests/bpf/progs/verifier_raw_stack.c
+index efbfc3a4ad6a..f67390224a9c 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_raw_stack.c
++++ b/tools/testing/selftests/bpf/progs/verifier_raw_stack.c
+@@ -5,9 +5,10 @@
+ #include <bpf/bpf_helpers.h>
+ #include "bpf_misc.h"
+ 
+-SEC("tc")
++SEC("socket")
+ __description("raw_stack: no skb_load_bytes")
+-__failure __msg("invalid read from stack R6 off=-8 size=8")
++__success
++__failure_unpriv __msg_unpriv("invalid read from stack R6 off=-8 size=8")
+ __naked void stack_no_skb_load_bytes(void)
+ {
+ 	asm volatile ("					\
+diff --git a/tools/testing/selftests/bpf/progs/verifier_var_off.c b/tools/testing/selftests/bpf/progs/verifier_var_off.c
+index 83a90afba785..d1f23c1a7c5b 100644
+--- a/tools/testing/selftests/bpf/progs/verifier_var_off.c
++++ b/tools/testing/selftests/bpf/progs/verifier_var_off.c
+@@ -59,9 +59,10 @@ __naked void stack_read_priv_vs_unpriv(void)
+ "	::: __clobber_all);
+ }
+ 
+-SEC("lwt_in")
++SEC("cgroup/skb")
+ __description("variable-offset stack read, uninitialized")
+-__failure __msg("invalid variable-offset read from stack R2")
++__success
++__failure_unpriv __msg_unpriv("R2 variable stack access prohibited for !root")
+ __naked void variable_offset_stack_read_uninitialized(void)
+ {
+ 	asm volatile ("					\
+@@ -83,12 +84,55 @@ __naked void variable_offset_stack_read_uninitialized(void)
+ 
+ SEC("socket")
+ __description("variable-offset stack write, priv vs unpriv")
+-__success __failure_unpriv
++__success
++/* Check that the maximum stack depth is correctly maintained according to the
++ * maximum possible variable offset.
++ */
++__log_level(4) __msg("stack depth 16")
++__failure_unpriv
+ /* Variable stack access is rejected for unprivileged.
+  */
+ __msg_unpriv("R2 variable stack access prohibited for !root")
+ __retval(0)
+ __naked void stack_write_priv_vs_unpriv(void)
++{
++	asm volatile ("                               \
++	/* Get an unknown value */                    \
++	r2 = *(u32*)(r1 + 0);                         \
++	/* Make it small and 8-byte aligned */        \
++	r2 &= 8;                                      \
++	r2 -= 16;                                     \
++	/* Add it to fp. We now have either fp-8 or   \
++	 * fp-16, but we don't know which             \
++	 */                                           \
++	r2 += r10;                                    \
++	/* Dereference it for a stack write */        \
++	r0 = 0;                                       \
++	*(u64*)(r2 + 0) = r0;                         \
++	exit;                                         \
++"	::: __clobber_all);
++}
++
++/* Similar to the previous test, but this time also perform a read from the
++ * address written to with a variable offset. The read is allowed, showing that,
++ * after a variable-offset write, a priviledged program can read the slots that
++ * were in the range of that write (even if the verifier doesn't actually know if
++ * the slot being read was really written to or not.
++ *
++ * Despite this test being mostly a superset, the previous test is also kept for
++ * the sake of it checking the stack depth in the case where there is no read.
++ */
++SEC("socket")
++__description("variable-offset stack write followed by read")
++__success
++/* Check that the maximum stack depth is correctly maintained according to the
++ * maximum possible variable offset.
++ */
++__log_level(4) __msg("stack depth 16")
++__failure_unpriv
++__msg_unpriv("R2 variable stack access prohibited for !root")
++__retval(0)
++__naked void stack_write_followed_by_read(void)
+ {
+ 	asm volatile ("					\
+ 	/* Get an unknown value */			\
+@@ -103,12 +147,7 @@ __naked void stack_write_priv_vs_unpriv(void)
+ 	/* Dereference it for a stack write */		\
+ 	r0 = 0;						\
+ 	*(u64*)(r2 + 0) = r0;				\
+-	/* Now read from the address we just wrote. This shows\
+-	 * that, after a variable-offset write, a priviledged\
+-	 * program can read the slots that were in the range of\
+-	 * that write (even if the verifier doesn't actually know\
+-	 * if the slot being read was really written to or not.\
+-	 */						\
++	/* Now read from the address we just wrote. */ \
+ 	r3 = *(u64*)(r2 + 0);				\
+ 	r0 = 0;						\
+ 	exit;						\
+@@ -253,9 +292,10 @@ __naked void access_min_out_of_bound(void)
+ 	: __clobber_all);
+ }
+ 
+-SEC("lwt_in")
++SEC("cgroup/skb")
+ __description("indirect variable-offset stack access, min_off < min_initialized")
+-__failure __msg("invalid indirect read from stack R2 var_off")
++__success
++__failure_unpriv __msg_unpriv("R2 variable stack access prohibited for !root")
+ __naked void access_min_off_min_initialized(void)
+ {
+ 	asm volatile ("					\
+diff --git a/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c b/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c
+index 319337bdcfc8..9a7b1106fda8 100644
+--- a/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c
++++ b/tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c
+@@ -83,17 +83,6 @@
+ 	.result = REJECT,
+ 	.errstr = "!read_ok",
+ },
+-{
+-	"Can't use cmpxchg on uninit memory",
+-	.insns = {
+-		BPF_MOV64_IMM(BPF_REG_0, 3),
+-		BPF_MOV64_IMM(BPF_REG_2, 4),
+-		BPF_ATOMIC_OP(BPF_DW, BPF_CMPXCHG, BPF_REG_10, BPF_REG_2, -8),
+-		BPF_EXIT_INSN(),
+-	},
+-	.result = REJECT,
+-	.errstr = "invalid read from stack",
+-},
+ {
+ 	"BPF_W cmpxchg should zero top 32 bits",
+ 	.insns = {
+diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
+index 3d5cd51071f0..ab25a81fd3a1 100644
+--- a/tools/testing/selftests/bpf/verifier/calls.c
++++ b/tools/testing/selftests/bpf/verifier/calls.c
+@@ -1505,7 +1505,9 @@
+ 	.prog_type = BPF_PROG_TYPE_XDP,
+ 	.fixup_map_hash_8b = { 23 },
+ 	.result = REJECT,
+-	.errstr = "invalid read from stack R7 off=-16 size=8",
++	.errstr = "R0 invalid mem access 'scalar'",
++	.result_unpriv = REJECT,
++	.errstr_unpriv = "invalid read from stack R7 off=-16 size=8",
+ },
+ {
+ 	"calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch b/queue-6.7/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
new file mode 100644
index 00000000000..e70667dd201
--- /dev/null
+++ b/queue-6.7/bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
@@ -0,0 +1,42 @@
+From a9538650a754acd07357a8d48e74264f420b77e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 10:42:41 -0800
+Subject: bpf: fix check for attempt to corrupt spilled pointer
+
+From: Andrii Nakryiko <andrii@kernel.org>
+
+[ Upstream commit ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae ]
+
+When register is spilled onto a stack as a 1/2/4-byte register, we set
+slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it,
+depending on actual spill size). So to check if some stack slot has
+spilled register we need to consult slot_type[7], not slot_type[0].
+
+To avoid the need to remember and double-check this in the future, just
+use is_spilled_reg() helper.
+
+Fixes: 27113c59b6d0 ("bpf: Check the other end of slot_type for STACK_SPILL")
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/r/20231205184248.1502704-4-andrii@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 4d59b200e898..c4fbfe499475 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4676,7 +4676,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
+ 	 * so it's aligned access and [off, off + size) are within stack limits
+ 	 */
+ 	if (!env->allow_ptr_leaks &&
+-	    state->stack[spi].slot_type[0] == STACK_SPILL &&
++	    is_spilled_reg(&state->stack[spi]) &&
+ 	    size != BPF_REG_SIZE) {
+ 		verbose(env, "attempt to corrupt spilled pointer on stack\n");
+ 		return -EACCES;
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-fix-verification-of-indirect-var-off-stack-acces.patch b/queue-6.7/bpf-fix-verification-of-indirect-var-off-stack-acces.patch
new file mode 100644
index 00000000000..cbab6933456
--- /dev/null
+++ b/queue-6.7/bpf-fix-verification-of-indirect-var-off-stack-acces.patch
@@ -0,0 +1,83 @@
+From 5149fd1ce8567a0f734bd2eb961442295903d0f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 23:11:48 -0500
+Subject: bpf: Fix verification of indirect var-off stack access
+
+From: Andrei Matei <andreimatei1@gmail.com>
+
+[ Upstream commit a833a17aeac73b33f79433d7cee68d5cafd71e4f ]
+
+This patch fixes a bug around the verification of possibly-zero-sized
+stack accesses. When the access was done through a var-offset stack
+pointer, check_stack_access_within_bounds was incorrectly computing the
+maximum-offset of a zero-sized read to be the same as the register's min
+offset. Instead, we have to take in account the register's maximum
+possible value. The patch also simplifies how the max offset is checked;
+the check is now simpler than for min offset.
+
+The bug was allowing accesses to erroneously pass the
+check_stack_access_within_bounds() checks, only to later crash in
+check_stack_range_initialized() when all the possibly-affected stack
+slots are iterated (this time with a correct max offset).
+check_stack_range_initialized() is relying on
+check_stack_access_within_bounds() for its accesses to the
+stack-tracking vector to be within bounds; in the case of zero-sized
+accesses, we were essentially only verifying that the lowest possible
+slot was within bounds. We would crash when the max-offset of the stack
+pointer was >= 0 (which shouldn't pass verification, and hopefully is
+not something anyone's code attempts to do in practice).
+
+Thanks Hao for reporting!
+
+Fixes: 01f810ace9ed3 ("bpf: Allow variable-offset stack access")
+Reported-by: Hao Sun <sunhao.th@gmail.com>
+Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Eduard Zingerman <eddyz87@gmail.com>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231207041150.229139-2-andreimatei1@gmail.com
+
+Closes: https://lore.kernel.org/bpf/CACkBjsZGEUaRCHsmaX=h-efVogsRfK1FPxmkgb0Os_frnHiNdw@mail.gmail.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index c4fbfe499475..acc1f3b7b183 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6804,10 +6804,7 @@ static int check_stack_access_within_bounds(
+ 
+ 	if (tnum_is_const(reg->var_off)) {
+ 		min_off = reg->var_off.value + off;
+-		if (access_size > 0)
+-			max_off = min_off + access_size - 1;
+-		else
+-			max_off = min_off;
++		max_off = min_off + access_size;
+ 	} else {
+ 		if (reg->smax_value >= BPF_MAX_VAR_OFF ||
+ 		    reg->smin_value <= -BPF_MAX_VAR_OFF) {
+@@ -6816,15 +6813,12 @@ static int check_stack_access_within_bounds(
+ 			return -EACCES;
+ 		}
+ 		min_off = reg->smin_value + off;
+-		if (access_size > 0)
+-			max_off = reg->smax_value + off + access_size - 1;
+-		else
+-			max_off = min_off;
++		max_off = reg->smax_value + off + access_size;
+ 	}
+ 
+ 	err = check_stack_slot_within_bounds(min_off, state, type);
+-	if (!err)
+-		err = check_stack_slot_within_bounds(max_off, state, type);
++	if (!err && max_off > 0)
++		err = -EINVAL; /* out of stack access into non-negative offsets */
+ 
+ 	if (err) {
+ 		if (tnum_is_const(reg->var_off)) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-guard-stack-limits-against-32bit-overflow.patch b/queue-6.7/bpf-guard-stack-limits-against-32bit-overflow.patch
new file mode 100644
index 00000000000..34e708380ab
--- /dev/null
+++ b/queue-6.7/bpf-guard-stack-limits-against-32bit-overflow.patch
@@ -0,0 +1,69 @@
+From 5be67d9932c2ca93d7236b004f8c04306dcb7382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 23:11:50 -0500
+Subject: bpf: Guard stack limits against 32bit overflow
+
+From: Andrei Matei <andreimatei1@gmail.com>
+
+[ Upstream commit 1d38a9ee81570c4bd61f557832dead4d6f816760 ]
+
+This patch promotes the arithmetic around checking stack bounds to be
+done in the 64-bit domain, instead of the current 32bit. The arithmetic
+implies adding together a 64-bit register with a int offset. The
+register was checked to be below 1<<29 when it was variable, but not
+when it was fixed. The offset either comes from an instruction (in which
+case it is 16 bit), from another register (in which case the caller
+checked it to be below 1<<29 [1]), or from the size of an argument to a
+kfunc (in which case it can be a u32 [2]). Between the register being
+inconsistently checked to be below 1<<29, and the offset being up to an
+u32, it appears that we were open to overflowing the `int`s which were
+currently used for arithmetic.
+
+[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498
+[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904
+
+Reported-by: Andrii Nakryiko <andrii.nakryiko@gmail.com>
+Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231207041150.229139-4-andreimatei1@gmail.com
+Stable-dep-of: 6b4a64bafd10 ("bpf: Fix accesses to uninit stack slots")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/verifier.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index acc1f3b7b183..4d91df312b99 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6761,7 +6761,7 @@ static int check_ptr_to_map_access(struct bpf_verifier_env *env,
+  * The minimum valid offset is -MAX_BPF_STACK for writes, and
+  * -state->allocated_stack for reads.
+  */
+-static int check_stack_slot_within_bounds(int off,
++static int check_stack_slot_within_bounds(s64 off,
+ 					  struct bpf_func_state *state,
+ 					  enum bpf_access_type t)
+ {
+@@ -6790,7 +6790,7 @@ static int check_stack_access_within_bounds(
+ 	struct bpf_reg_state *regs = cur_regs(env);
+ 	struct bpf_reg_state *reg = regs + regno;
+ 	struct bpf_func_state *state = func(env, reg);
+-	int min_off, max_off;
++	s64 min_off, max_off;
+ 	int err;
+ 	char *err_extra;
+ 
+@@ -6803,7 +6803,7 @@ static int check_stack_access_within_bounds(
+ 		err_extra = " write to";
+ 
+ 	if (tnum_is_const(reg->var_off)) {
+-		min_off = reg->var_off.value + off;
++		min_off = (s64)reg->var_off.value + off;
+ 		max_off = min_off + access_size;
+ 	} else {
+ 		if (reg->smax_value >= BPF_MAX_VAR_OFF ||
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-limit-the-number-of-kprobes-when-attaching-progr.patch b/queue-6.7/bpf-limit-the-number-of-kprobes-when-attaching-progr.patch
new file mode 100644
index 00000000000..4c0f6ba7e73
--- /dev/null
+++ b/queue-6.7/bpf-limit-the-number-of-kprobes-when-attaching-progr.patch
@@ -0,0 +1,58 @@
+From 0b8f106d824b660e8e373ee6942346b5cff9e846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 18:07:05 +0800
+Subject: bpf: Limit the number of kprobes when attaching program to multiple
+ kprobes
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit d6d1e6c17cab2dcb7b8530c599f00e7de906d380 ]
+
+An abnormally big cnt may also be assigned to kprobe_multi.cnt when
+attaching multiple kprobes. It will trigger the following warning in
+kvmalloc_node():
+
+	if (unlikely(size > INT_MAX)) {
+	    WARN_ON_ONCE(!(flags & __GFP_NOWARN));
+	    return NULL;
+	}
+
+Fix the warning by limiting the maximal number of kprobes in
+bpf_kprobe_multi_link_attach(). If the number of kprobes is greater than
+MAX_KPROBE_MULTI_CNT, the attachment will fail and return -E2BIG.
+
+Fixes: 0dcac2725406 ("bpf: Add multi kprobe link")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231215100708.2265609-3-houtao@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 640b08818afa..652c40a14d0d 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -42,6 +42,7 @@
+ 	rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex))
+ 
+ #define MAX_UPROBE_MULTI_CNT (1U << 20)
++#define MAX_KPROBE_MULTI_CNT (1U << 20)
+ 
+ #ifdef CONFIG_MODULES
+ struct bpf_trace_module {
+@@ -2901,6 +2902,8 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
+ 	cnt = attr->link_create.kprobe_multi.cnt;
+ 	if (!cnt)
+ 		return -EINVAL;
++	if (cnt > MAX_KPROBE_MULTI_CNT)
++		return -E2BIG;
+ 
+ 	size = cnt * sizeof(*addrs);
+ 	addrs = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-limit-the-number-of-uprobes-when-attaching-progr.patch b/queue-6.7/bpf-limit-the-number-of-uprobes-when-attaching-progr.patch
new file mode 100644
index 00000000000..e0b3f904815
--- /dev/null
+++ b/queue-6.7/bpf-limit-the-number-of-uprobes-when-attaching-progr.patch
@@ -0,0 +1,60 @@
+From 713a78dde5041277db8cf3058782f1183d602631 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 18:07:04 +0800
+Subject: bpf: Limit the number of uprobes when attaching program to multiple
+ uprobes
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 8b2efe51ba85ca83460941672afac6fca4199df6 ]
+
+An abnormally big cnt may be passed to link_create.uprobe_multi.cnt,
+and it will trigger the following warning in kvmalloc_node():
+
+	if (unlikely(size > INT_MAX)) {
+		WARN_ON_ONCE(!(flags & __GFP_NOWARN));
+		return NULL;
+	}
+
+Fix the warning by limiting the maximal number of uprobes in
+bpf_uprobe_multi_link_attach(). If the number of uprobes is greater than
+MAX_UPROBE_MULTI_CNT, the attachment will return -E2BIG.
+
+Fixes: 89ae89f53d20 ("bpf: Add multi uprobe link")
+Reported-by: Xingwei Lee <xrivendell7@gmail.com>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Andrii Nakryiko <andrii@kernel.org>
+Closes: https://lore.kernel.org/bpf/CABOYnLwwJY=yFAGie59LFsUsBAgHfroVqbzZ5edAXbFE3YiNVA@mail.gmail.com
+Link: https://lore.kernel.org/bpf/20231215100708.2265609-2-houtao@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 84e8a0f6e4e0..640b08818afa 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -41,6 +41,8 @@
+ #define bpf_event_rcu_dereference(p)					\
+ 	rcu_dereference_protected(p, lockdep_is_held(&bpf_event_mutex))
+ 
++#define MAX_UPROBE_MULTI_CNT (1U << 20)
++
+ #ifdef CONFIG_MODULES
+ struct bpf_trace_module {
+ 	struct module *module;
+@@ -3202,6 +3204,8 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
+ 
+ 	if (!upath || !uoffsets || !cnt)
+ 		return -EINVAL;
++	if (cnt > MAX_UPROBE_MULTI_CNT)
++		return -E2BIG;
+ 
+ 	uref_ctr_offsets = u64_to_user_ptr(attr->link_create.uprobe_multi.ref_ctr_offsets);
+ 	ucookies = u64_to_user_ptr(attr->link_create.uprobe_multi.cookies);
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch b/queue-6.7/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
new file mode 100644
index 00000000000..64fd5fe1df6
--- /dev/null
+++ b/queue-6.7/bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
@@ -0,0 +1,43 @@
+From e16c52ec6d8cdf8be0d5a066fe8313f4ca71ceca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Nov 2023 09:58:01 +0100
+Subject: bpf, lpm: Fix check prefixlen before walking trie
+
+From: Florian Lehner <dev@der-flo.net>
+
+[ Upstream commit 9b75dbeb36fcd9fc7ed51d370310d0518a387769 ]
+
+When looking up an element in LPM trie, the condition 'matchlen ==
+trie->max_prefixlen' will never return true, if key->prefixlen is larger
+than trie->max_prefixlen. Consequently all elements in the LPM trie will
+be visited and no element is returned in the end.
+
+To resolve this, check key->prefixlen first before walking the LPM trie.
+
+Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation")
+Signed-off-by: Florian Lehner <dev@der-flo.net>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231105085801.3742-1-dev@der-flo.net
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/lpm_trie.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
+index 17c7e7782a1f..b32be680da6c 100644
+--- a/kernel/bpf/lpm_trie.c
++++ b/kernel/bpf/lpm_trie.c
+@@ -231,6 +231,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key)
+ 	struct lpm_trie_node *node, *found = NULL;
+ 	struct bpf_lpm_trie_key *key = _key;
+ 
++	if (key->prefixlen > trie->max_prefixlen)
++		return NULL;
++
+ 	/* Start walking the trie from the root node ... */
+ 
+ 	for (node = rcu_dereference_check(trie->root, rcu_read_lock_bh_held());
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch b/queue-6.7/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
new file mode 100644
index 00000000000..0b59a35e735
--- /dev/null
+++ b/queue-6.7/bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
@@ -0,0 +1,81 @@
+From a7ecb3c82627c38caf99f79a7c8ea36bd843bd19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 15:23:23 -0800
+Subject: bpf: sockmap, fix proto update hook to avoid dup calls
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+[ Upstream commit 16b2f264983dc264c1560cc0170e760dec1bf54f ]
+
+When sockets are added to a sockmap or sockhash we allocate and init a
+psock. Then update the proto ops with sock_map_init_proto the flow is
+
+  sock_hash_update_common
+    sock_map_link
+      psock = sock_map_psock_get_checked() <-returns existing psock
+      sock_map_init_proto(sk, psock)       <- updates sk_proto
+
+If the socket is already in a map this results in the sock_map_init_proto
+being called multiple times on the same socket. We do this because when
+a socket is added to multiple maps this might result in a new set of BPF
+programs being attached to the socket requiring an updated ops struct.
+
+This creates a rule where it must be safe to call psock_update_sk_prot
+multiple times. When we added a fix for UAF through unix sockets in patch
+4dd9a38a753fc we broke this rule by adding a sock_hold in that path
+to ensure the sock is not released. The result is if a af_unix stream sock
+is placed in multiple maps it results in a memory leak because we call
+sock_hold multiple times with only a single sock_put on it.
+
+Fixes: 8866730aed51 ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock")
+Reported-by: Xingwei Lee <xrivendell7@gmail.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/r/20231221232327.43678-2-john.fastabend@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/unix/unix_bpf.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+diff --git a/net/unix/unix_bpf.c b/net/unix/unix_bpf.c
+index 7ea7c3a0d0d0..bd84785bf8d6 100644
+--- a/net/unix/unix_bpf.c
++++ b/net/unix/unix_bpf.c
+@@ -161,15 +161,30 @@ int unix_stream_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool r
+ {
+ 	struct sock *sk_pair;
+ 
++	/* Restore does not decrement the sk_pair reference yet because we must
++	 * keep the a reference to the socket until after an RCU grace period
++	 * and any pending sends have completed.
++	 */
+ 	if (restore) {
+ 		sk->sk_write_space = psock->saved_write_space;
+ 		sock_replace_proto(sk, psock->sk_proto);
+ 		return 0;
+ 	}
+ 
+-	sk_pair = unix_peer(sk);
+-	sock_hold(sk_pair);
+-	psock->sk_pair = sk_pair;
++	/* psock_update_sk_prot can be called multiple times if psock is
++	 * added to multiple maps and/or slots in the same map. There is
++	 * also an edge case where replacing a psock with itself can trigger
++	 * an extra psock_update_sk_prot during the insert process. So it
++	 * must be safe to do multiple calls. Here we need to ensure we don't
++	 * increment the refcnt through sock_hold many times. There will only
++	 * be a single matching destroy operation.
++	 */
++	if (!psock->sk_pair) {
++		sk_pair = unix_peer(sk);
++		sock_hold(sk_pair);
++		psock->sk_pair = sk_pair;
++	}
++
+ 	unix_stream_bpf_check_needs_rebuild(psock->sk_proto);
+ 	sock_replace_proto(sk, &unix_stream_bpf_prot);
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/bpf-use-c-unit_size-to-select-target-cache-during-fr.patch b/queue-6.7/bpf-use-c-unit_size-to-select-target-cache-during-fr.patch
new file mode 100644
index 00000000000..d7f375b82fc
--- /dev/null
+++ b/queue-6.7/bpf-use-c-unit_size-to-select-target-cache-during-fr.patch
@@ -0,0 +1,271 @@
+From e186113263b589e9c4e78dd122963e58d2dc26db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Dec 2023 21:10:51 +0800
+Subject: bpf: Use c->unit_size to select target cache during free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hou Tao <houtao1@huawei.com>
+
+[ Upstream commit 7ac5c53e00735d183a0f5e2cfce5eeb6c16319f2 ]
+
+At present, bpf memory allocator uses check_obj_size() to ensure that
+ksize() of allocated pointer is equal with the unit_size of used
+bpf_mem_cache. Its purpose is to prevent bpf_mem_free() from selecting
+a bpf_mem_cache which has different unit_size compared with the
+bpf_mem_cache used for allocation. But as reported by lkp, the return
+value of ksize() or kmalloc_size_roundup() may change due to slab merge
+and it will lead to the warning report in check_obj_size().
+
+The reported warning happened as follows:
+(1) in bpf_mem_cache_adjust_size(), kmalloc_size_roundup(96) returns the
+object_size of kmalloc-96 instead of kmalloc-cg-96. The object_size of
+kmalloc-96 is 96, so size_index for 96 is not adjusted accordingly.
+(2) the object_size of kmalloc-cg-96 is adjust from 96 to 128 due to
+slab merge in __kmem_cache_alias(). For SLAB, SLAB_HWCACHE_ALIGN is
+enabled by default for kmalloc slab, so align is 64 and size is 128 for
+kmalloc-cg-96. SLUB has a similar merge logic, but its object_size will
+not be changed, because its align is 8 under x86-64.
+(3) when unit_alloc() does kmalloc_node(96, __GFP_ACCOUNT, node),
+ksize() returns 128 instead of 96 for the returned pointer.
+(4) the warning in check_obj_size() is triggered.
+
+Considering the slab merge can happen in anytime (e.g, a slab created in
+a new module), the following case is also possible: during the
+initialization of bpf_global_ma, there is no slab merge and ksize() for
+a 96-bytes object returns 96. But after that a new slab created by a
+kernel module is merged to kmalloc-cg-96 and the object_size of
+kmalloc-cg-96 is adjust from 96 to 128 (which is possible for x86-64 +
+CONFIG_SLAB, because its alignment requirement is 64 for 96-bytes slab).
+So soon or later, when bpf_global_ma frees a 96-byte-sized pointer
+which is allocated from bpf_mem_cache with unit_size=96, bpf_mem_free()
+will free the pointer through a bpf_mem_cache in which unit_size is 128,
+because the return value of ksize() changes. The warning for the
+mismatch will be triggered again.
+
+A feasible fix is introducing similar APIs compared with ksize() and
+kmalloc_size_roundup() to return the actually-allocated size instead of
+size which may change due to slab merge, but it will introduce
+unnecessary dependency on the implementation details of mm subsystem.
+
+As for now the pointer of bpf_mem_cache is saved in the 8-bytes area
+(or 4-bytes under 32-bit host) above the returned pointer, using
+unit_size in the saved bpf_mem_cache to select the target cache instead
+of inferring the size from the pointer itself. Beside no extra
+dependency on mm subsystem, the performance for bpf_mem_free_rcu() is
+also improved as shown below.
+
+Before applying the patch, the performances of bpf_mem_alloc() and
+bpf_mem_free_rcu() on 8-CPUs VM with one producer are as follows:
+
+kmalloc : alloc 11.69 ± 0.28M/s free 29.58 ± 0.93M/s
+percpu  : alloc 14.11 ± 0.52M/s free 14.29 ± 0.99M/s
+
+After apply the patch, the performance for bpf_mem_free_rcu() increases
+9% and 146% for kmalloc memory and per-cpu memory respectively:
+
+kmalloc: alloc 11.01 ± 0.03M/s free   32.42 ± 0.48M/s
+percpu:  alloc 12.84 ± 0.12M/s free   35.24 ± 0.23M/s
+
+After the fixes, there is no need to adjust size_index to fix the
+mismatch between allocation and free, so remove it as well. Also return
+NULL instead of ZERO_SIZE_PTR for zero-sized alloc in bpf_mem_alloc(),
+because there is no bpf_mem_cache pointer saved above ZERO_SIZE_PTR.
+
+Fixes: 9077fc228f09 ("bpf: Use kmalloc_size_roundup() to adjust size_index")
+Reported-by: kernel test robot <oliver.sang@intel.com>
+Closes: https://lore.kernel.org/bpf/202310302113.9f8fe705-oliver.sang@intel.com
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Link: https://lore.kernel.org/r/20231216131052.27621-2-houtao@huaweicloud.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/memalloc.c | 105 +++++-------------------------------------
+ 1 file changed, 11 insertions(+), 94 deletions(-)
+
+diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c
+index 6a51cfe4c2d6..aa0fbf000a12 100644
+--- a/kernel/bpf/memalloc.c
++++ b/kernel/bpf/memalloc.c
+@@ -490,27 +490,6 @@ static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu)
+ 	alloc_bulk(c, c->unit_size <= 256 ? 4 : 1, cpu_to_node(cpu), false);
+ }
+ 
+-static int check_obj_size(struct bpf_mem_cache *c, unsigned int idx)
+-{
+-	struct llist_node *first;
+-	unsigned int obj_size;
+-
+-	first = c->free_llist.first;
+-	if (!first)
+-		return 0;
+-
+-	if (c->percpu_size)
+-		obj_size = pcpu_alloc_size(((void **)first)[1]);
+-	else
+-		obj_size = ksize(first);
+-	if (obj_size != c->unit_size) {
+-		WARN_ONCE(1, "bpf_mem_cache[%u]: percpu %d, unexpected object size %u, expect %u\n",
+-			  idx, c->percpu_size, obj_size, c->unit_size);
+-		return -EINVAL;
+-	}
+-	return 0;
+-}
+-
+ /* When size != 0 bpf_mem_cache for each cpu.
+  * This is typical bpf hash map use case when all elements have equal size.
+  *
+@@ -521,10 +500,10 @@ static int check_obj_size(struct bpf_mem_cache *c, unsigned int idx)
+ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ {
+ 	static u16 sizes[NUM_CACHES] = {96, 192, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096};
+-	int cpu, i, err, unit_size, percpu_size = 0;
+ 	struct bpf_mem_caches *cc, __percpu *pcc;
+ 	struct bpf_mem_cache *c, __percpu *pc;
+ 	struct obj_cgroup *objcg = NULL;
++	int cpu, i, unit_size, percpu_size = 0;
+ 
+ 	/* room for llist_node and per-cpu pointer */
+ 	if (percpu)
+@@ -560,7 +539,6 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ 	pcc = __alloc_percpu_gfp(sizeof(*cc), 8, GFP_KERNEL);
+ 	if (!pcc)
+ 		return -ENOMEM;
+-	err = 0;
+ #ifdef CONFIG_MEMCG_KMEM
+ 	objcg = get_obj_cgroup_from_current();
+ #endif
+@@ -574,28 +552,12 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
+ 			c->tgt = c;
+ 
+ 			init_refill_work(c);
+-			/* Another bpf_mem_cache will be used when allocating
+-			 * c->unit_size in bpf_mem_alloc(), so doesn't prefill
+-			 * for the bpf_mem_cache because these free objects will
+-			 * never be used.
+-			 */
+-			if (i != bpf_mem_cache_idx(c->unit_size))
+-				continue;
+ 			prefill_mem_cache(c, cpu);
+-			err = check_obj_size(c, i);
+-			if (err)
+-				goto out;
+ 		}
+ 	}
+ 
+-out:
+ 	ma->caches = pcc;
+-	/* refill_work is either zeroed or initialized, so it is safe to
+-	 * call irq_work_sync().
+-	 */
+-	if (err)
+-		bpf_mem_alloc_destroy(ma);
+-	return err;
++	return 0;
+ }
+ 
+ static void drain_mem_cache(struct bpf_mem_cache *c)
+@@ -869,7 +831,7 @@ void notrace *bpf_mem_alloc(struct bpf_mem_alloc *ma, size_t size)
+ 	void *ret;
+ 
+ 	if (!size)
+-		return ZERO_SIZE_PTR;
++		return NULL;
+ 
+ 	idx = bpf_mem_cache_idx(size + LLIST_NODE_SZ);
+ 	if (idx < 0)
+@@ -879,26 +841,17 @@ void notrace *bpf_mem_alloc(struct bpf_mem_alloc *ma, size_t size)
+ 	return !ret ? NULL : ret + LLIST_NODE_SZ;
+ }
+ 
+-static notrace int bpf_mem_free_idx(void *ptr, bool percpu)
+-{
+-	size_t size;
+-
+-	if (percpu)
+-		size = pcpu_alloc_size(*((void **)ptr));
+-	else
+-		size = ksize(ptr - LLIST_NODE_SZ);
+-	return bpf_mem_cache_idx(size);
+-}
+-
+ void notrace bpf_mem_free(struct bpf_mem_alloc *ma, void *ptr)
+ {
++	struct bpf_mem_cache *c;
+ 	int idx;
+ 
+ 	if (!ptr)
+ 		return;
+ 
+-	idx = bpf_mem_free_idx(ptr, ma->percpu);
+-	if (idx < 0)
++	c = *(void **)(ptr - LLIST_NODE_SZ);
++	idx = bpf_mem_cache_idx(c->unit_size);
++	if (WARN_ON_ONCE(idx < 0))
+ 		return;
+ 
+ 	unit_free(this_cpu_ptr(ma->caches)->cache + idx, ptr);
+@@ -906,13 +859,15 @@ void notrace bpf_mem_free(struct bpf_mem_alloc *ma, void *ptr)
+ 
+ void notrace bpf_mem_free_rcu(struct bpf_mem_alloc *ma, void *ptr)
+ {
++	struct bpf_mem_cache *c;
+ 	int idx;
+ 
+ 	if (!ptr)
+ 		return;
+ 
+-	idx = bpf_mem_free_idx(ptr, ma->percpu);
+-	if (idx < 0)
++	c = *(void **)(ptr - LLIST_NODE_SZ);
++	idx = bpf_mem_cache_idx(c->unit_size);
++	if (WARN_ON_ONCE(idx < 0))
+ 		return;
+ 
+ 	unit_free_rcu(this_cpu_ptr(ma->caches)->cache + idx, ptr);
+@@ -986,41 +941,3 @@ void notrace *bpf_mem_cache_alloc_flags(struct bpf_mem_alloc *ma, gfp_t flags)
+ 
+ 	return !ret ? NULL : ret + LLIST_NODE_SZ;
+ }
+-
+-/* The alignment of dynamic per-cpu area is 8, so c->unit_size and the
+- * actual size of dynamic per-cpu area will always be matched and there is
+- * no need to adjust size_index for per-cpu allocation. However for the
+- * simplicity of the implementation, use an unified size_index for both
+- * kmalloc and per-cpu allocation.
+- */
+-static __init int bpf_mem_cache_adjust_size(void)
+-{
+-	unsigned int size;
+-
+-	/* Adjusting the indexes in size_index() according to the object_size
+-	 * of underlying slab cache, so bpf_mem_alloc() will select a
+-	 * bpf_mem_cache with unit_size equal to the object_size of
+-	 * the underlying slab cache.
+-	 *
+-	 * The maximal value of KMALLOC_MIN_SIZE and __kmalloc_minalign() is
+-	 * 256-bytes, so only do adjustment for [8-bytes, 192-bytes].
+-	 */
+-	for (size = 192; size >= 8; size -= 8) {
+-		unsigned int kmalloc_size, index;
+-
+-		kmalloc_size = kmalloc_size_roundup(size);
+-		if (kmalloc_size == size)
+-			continue;
+-
+-		if (kmalloc_size <= 192)
+-			index = size_index[(kmalloc_size - 1) / 8];
+-		else
+-			index = fls(kmalloc_size - 1) - 1;
+-		/* Only overwrite if necessary */
+-		if (size_index[(size - 1) / 8] != index)
+-			size_index[(size - 1) / 8] = index;
+-	}
+-
+-	return 0;
+-}
+-subsys_initcall(bpf_mem_cache_adjust_size);
+-- 
+2.43.0
+
diff --git a/queue-6.7/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch b/queue-6.7/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
new file mode 100644
index 00000000000..fe7be651ab8
--- /dev/null
+++ b/queue-6.7/calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
@@ -0,0 +1,138 @@
+From 27e11fe8a97a23bbbebaaddf6b8fd0bfeec6e4b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Nov 2023 09:25:54 +0000
+Subject: calipso: fix memory leak in netlbl_calipso_add_pass()
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit ec4e9d630a64df500641892f4e259e8149594a99 ]
+
+If IPv6 support is disabled at boot (ipv6.disable=1),
+the calipso_init() -> netlbl_calipso_ops_register() function isn't called,
+and the netlbl_calipso_ops_get() function always returns NULL.
+In this case, the netlbl_calipso_add_pass() function allocates memory
+for the doi_def variable but doesn't free it with the calipso_doi_free().
+
+BUG: memory leak
+unreferenced object 0xffff888011d68180 (size 64):
+  comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s)
+  hex dump (first 32 bytes):
+    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................
+    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
+  backtrace:
+    [<...>] kmalloc include/linux/slab.h:552 [inline]
+    [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]
+    [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111
+    [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
+    [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
+    [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
+    [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515
+    [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
+    [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
+    [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339
+    [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934
+    [<...>] sock_sendmsg_nosec net/socket.c:651 [inline]
+    [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671
+    [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342
+    [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396
+    [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429
+    [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
+    [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
+
+Found by InfoTeCS on behalf of Linux Verification Center
+(linuxtesting.org) with Syzkaller
+
+Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.")
+Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+[PM: merged via the LSM tree at Jakub Kicinski request]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlabel/netlabel_calipso.c | 49 +++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 23 deletions(-)
+
+diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c
+index f1d5b8465217..a07c2216d28b 100644
+--- a/net/netlabel/netlabel_calipso.c
++++ b/net/netlabel/netlabel_calipso.c
+@@ -54,6 +54,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
+ 	[NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
+ };
+ 
++static const struct netlbl_calipso_ops *calipso_ops;
++
++/**
++ * netlbl_calipso_ops_register - Register the CALIPSO operations
++ * @ops: ops to register
++ *
++ * Description:
++ * Register the CALIPSO packet engine operations.
++ *
++ */
++const struct netlbl_calipso_ops *
++netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
++{
++	return xchg(&calipso_ops, ops);
++}
++EXPORT_SYMBOL(netlbl_calipso_ops_register);
++
++static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
++{
++	return READ_ONCE(calipso_ops);
++}
++
+ /* NetLabel Command Handlers
+  */
+ /**
+@@ -96,15 +118,18 @@ static int netlbl_calipso_add_pass(struct genl_info *info,
+  *
+  */
+ static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
+-
+ {
+ 	int ret_val = -EINVAL;
+ 	struct netlbl_audit audit_info;
++	const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
+ 
+ 	if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
+ 	    !info->attrs[NLBL_CALIPSO_A_MTYPE])
+ 		return -EINVAL;
+ 
++	if (!ops)
++		return -EOPNOTSUPP;
++
+ 	netlbl_netlink_auditinfo(&audit_info);
+ 	switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
+ 	case CALIPSO_MAP_PASS:
+@@ -363,28 +388,6 @@ int __init netlbl_calipso_genl_init(void)
+ 	return genl_register_family(&netlbl_calipso_gnl_family);
+ }
+ 
+-static const struct netlbl_calipso_ops *calipso_ops;
+-
+-/**
+- * netlbl_calipso_ops_register - Register the CALIPSO operations
+- * @ops: ops to register
+- *
+- * Description:
+- * Register the CALIPSO packet engine operations.
+- *
+- */
+-const struct netlbl_calipso_ops *
+-netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
+-{
+-	return xchg(&calipso_ops, ops);
+-}
+-EXPORT_SYMBOL(netlbl_calipso_ops_register);
+-
+-static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
+-{
+-	return READ_ONCE(calipso_ops);
+-}
+-
+ /**
+  * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
+  * @doi_def: the DOI structure
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch b/queue-6.7/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
new file mode 100644
index 00000000000..d1f3da4204b
--- /dev/null
+++ b/queue-6.7/clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
@@ -0,0 +1,43 @@
+From 95edbb98a5104a98a357dba229c3d12ef899087b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 18:14:16 +0100
+Subject: clk: fixed-rate: fix
+ clk_hw_register_fixed_rate_with_accuracy_parent_hw
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Théo Lebrun <theo.lebrun@bootlin.com>
+
+[ Upstream commit ee0cf5e07f44a10fce8f1bfa9db226c0b5ecf880 ]
+
+Add missing comma and remove extraneous NULL argument. The macro is
+currently used by no one which explains why the typo slipped by.
+
+Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers")
+Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
+Link: https://lore.kernel.org/r/20231218-mbly-clk-v1-1-44ce54108f06@bootlin.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/clk-provider.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
+index ace3a4ce2fc9..1293c38ddb7f 100644
+--- a/include/linux/clk-provider.h
++++ b/include/linux/clk-provider.h
+@@ -448,8 +448,8 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
+  */
+ #define clk_hw_register_fixed_rate_with_accuracy_parent_hw(dev, name,	      \
+ 		parent_hw, flags, fixed_rate, fixed_accuracy)		      \
+-	__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw)   \
+-				     NULL, NULL, (flags), (fixed_rate),	      \
++	__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw),  \
++				     NULL, (flags), (fixed_rate),	      \
+ 				     (fixed_accuracy), 0, false)
+ /**
+  * clk_hw_register_fixed_rate_with_accuracy_parent_data - register fixed-rate
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-dispcc-sm8550-update-disp-pll-settings.patch b/queue-6.7/clk-qcom-dispcc-sm8550-update-disp-pll-settings.patch
new file mode 100644
index 00000000000..46921f97a30
--- /dev/null
+++ b/queue-6.7/clk-qcom-dispcc-sm8550-update-disp-pll-settings.patch
@@ -0,0 +1,50 @@
+From ba126b9d9b6c0e1b578a3b264417082788e7e6bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:09 +0100
+Subject: clk: qcom: dispcc-sm8550: Update disp PLL settings
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit febd251d8775c4fb6e4acd6b5d7b0ed707f4611f ]
+
+The settings in the driver seem to have been taken from an older
+release. Update them to match the latest values.
+
+Fixes: 90114ca11476 ("clk: qcom: add SM8550 DISPCC driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-8-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sm8550.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/clk/qcom/dispcc-sm8550.c b/drivers/clk/qcom/dispcc-sm8550.c
+index aefa19f3c2c5..0b8f0904b339 100644
+--- a/drivers/clk/qcom/dispcc-sm8550.c
++++ b/drivers/clk/qcom/dispcc-sm8550.c
+@@ -81,6 +81,10 @@ static const struct alpha_pll_config disp_cc_pll0_config = {
+ 	.config_ctl_val = 0x20485699,
+ 	.config_ctl_hi_val = 0x00182261,
+ 	.config_ctl_hi1_val = 0x82aa299c,
++	.test_ctl_val = 0x00000000,
++	.test_ctl_hi_val = 0x00000003,
++	.test_ctl_hi1_val = 0x00009000,
++	.test_ctl_hi2_val = 0x00000034,
+ 	.user_ctl_val = 0x00000000,
+ 	.user_ctl_hi_val = 0x00000005,
+ };
+@@ -108,6 +112,10 @@ static const struct alpha_pll_config disp_cc_pll1_config = {
+ 	.config_ctl_val = 0x20485699,
+ 	.config_ctl_hi_val = 0x00182261,
+ 	.config_ctl_hi1_val = 0x82aa299c,
++	.test_ctl_val = 0x00000000,
++	.test_ctl_hi_val = 0x00000003,
++	.test_ctl_hi1_val = 0x00009000,
++	.test_ctl_hi2_val = 0x00000034,
+ 	.user_ctl_val = 0x00000000,
+ 	.user_ctl_hi_val = 0x00000005,
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-dispcc-sm8550-use-the-correct-pll-configura.patch b/queue-6.7/clk-qcom-dispcc-sm8550-use-the-correct-pll-configura.patch
new file mode 100644
index 00000000000..5ab5ab5f870
--- /dev/null
+++ b/queue-6.7/clk-qcom-dispcc-sm8550-use-the-correct-pll-configura.patch
@@ -0,0 +1,39 @@
+From 61fdb3f2b316c70bc2523d3ecfca5f0142381ca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:10 +0100
+Subject: clk: qcom: dispcc-sm8550: Use the correct PLL configuration function
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit c559bcb92564cbaedd43c749cf9b6fbb3d53ad5e ]
+
+To ensure that all fields (particularly CAL_L and CAL_L_RINGOSC) are
+filled properly, use the correct prepare function for OLE PLLs.
+
+Fixes: 90114ca11476 ("clk: qcom: add SM8550 DISPCC driver")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-9-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/dispcc-sm8550.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/dispcc-sm8550.c b/drivers/clk/qcom/dispcc-sm8550.c
+index 0b8f0904b339..f96d8b81fd9a 100644
+--- a/drivers/clk/qcom/dispcc-sm8550.c
++++ b/drivers/clk/qcom/dispcc-sm8550.c
+@@ -1774,8 +1774,8 @@ static int disp_cc_sm8550_probe(struct platform_device *pdev)
+ 		goto err_put_rpm;
+ 	}
+ 
+-	clk_lucid_evo_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
+-	clk_lucid_evo_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
++	clk_lucid_ole_pll_configure(&disp_cc_pll0, regmap, &disp_cc_pll0_config);
++	clk_lucid_ole_pll_configure(&disp_cc_pll1, regmap, &disp_cc_pll1_config);
+ 
+ 	/* Enable clock gating for MDP clocks */
+ 	regmap_update_bits(regmap, DISP_CC_MISC_CMD, 0x10, 0x10);
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-gcc-sm8550-add-the-missing-retain_ff_enable.patch b/queue-6.7/clk-qcom-gcc-sm8550-add-the-missing-retain_ff_enable.patch
new file mode 100644
index 00000000000..0dbe8b740f2
--- /dev/null
+++ b/queue-6.7/clk-qcom-gcc-sm8550-add-the-missing-retain_ff_enable.patch
@@ -0,0 +1,100 @@
+From 534a7c5ad19873bc0a021274c8380b2350dfb303 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:04 +0100
+Subject: clk: qcom: gcc-sm8550: Add the missing RETAIN_FF_ENABLE GDSC flag
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1fe8273c8d4088dd68faaab8640ec95f381cbf1e ]
+
+All of the 8550's GCC GDSCs can and should use the retain registers so
+as not to lose their state when entering lower power modes.
+
+Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-3-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8550.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c
+index 586126c4dd90..1c3d78500392 100644
+--- a/drivers/clk/qcom/gcc-sm8550.c
++++ b/drivers/clk/qcom/gcc-sm8550.c
+@@ -3002,7 +3002,7 @@ static struct gdsc pcie_0_gdsc = {
+ 		.name = "pcie_0_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc pcie_0_phy_gdsc = {
+@@ -3011,7 +3011,7 @@ static struct gdsc pcie_0_phy_gdsc = {
+ 		.name = "pcie_0_phy_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc pcie_1_gdsc = {
+@@ -3020,7 +3020,7 @@ static struct gdsc pcie_1_gdsc = {
+ 		.name = "pcie_1_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc pcie_1_phy_gdsc = {
+@@ -3029,7 +3029,7 @@ static struct gdsc pcie_1_phy_gdsc = {
+ 		.name = "pcie_1_phy_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc ufs_phy_gdsc = {
+@@ -3038,7 +3038,7 @@ static struct gdsc ufs_phy_gdsc = {
+ 		.name = "ufs_phy_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc ufs_mem_phy_gdsc = {
+@@ -3047,7 +3047,7 @@ static struct gdsc ufs_mem_phy_gdsc = {
+ 		.name = "ufs_mem_phy_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc usb30_prim_gdsc = {
+@@ -3056,7 +3056,7 @@ static struct gdsc usb30_prim_gdsc = {
+ 		.name = "usb30_prim_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc usb3_phy_gdsc = {
+@@ -3065,7 +3065,7 @@ static struct gdsc usb3_phy_gdsc = {
+ 		.name = "usb3_phy_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR,
++	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct clk_regmap *gcc_sm8550_clocks[] = {
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-gcc-sm8550-mark-rcgs-shared-where-applicabl.patch b/queue-6.7/clk-qcom-gcc-sm8550-mark-rcgs-shared-where-applicabl.patch
new file mode 100644
index 00000000000..3dd9ebece5c
--- /dev/null
+++ b/queue-6.7/clk-qcom-gcc-sm8550-mark-rcgs-shared-where-applicabl.patch
@@ -0,0 +1,414 @@
+From 073f569f7d1cbcfc34a11b5ecaf56133ee7106d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:07 +0100
+Subject: clk: qcom: gcc-sm8550: Mark RCGs shared where applicable
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 929c75d575667af389c8a9e03cebc93d43bb7f31 ]
+
+The vast majority of shared RCGs were not marked as such. Fix it.
+
+Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-6-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8550.c | 86 +++++++++++++++++------------------
+ 1 file changed, 43 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c
+index 73bda0d03aa7..b883dffe5f7a 100644
+--- a/drivers/clk/qcom/gcc-sm8550.c
++++ b/drivers/clk/qcom/gcc-sm8550.c
+@@ -401,7 +401,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = {
+ 		.parent_data = gcc_parent_data_1,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -416,7 +416,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = {
+ 		.parent_data = gcc_parent_data_1,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -431,7 +431,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = {
+ 		.parent_data = gcc_parent_data_1,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_1),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -451,7 +451,7 @@ static struct clk_rcg2 gcc_pcie_0_aux_clk_src = {
+ 		.parent_data = gcc_parent_data_2,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -471,7 +471,7 @@ static struct clk_rcg2 gcc_pcie_0_phy_rchng_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -486,7 +486,7 @@ static struct clk_rcg2 gcc_pcie_1_aux_clk_src = {
+ 		.parent_data = gcc_parent_data_2,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -501,7 +501,7 @@ static struct clk_rcg2 gcc_pcie_1_phy_rchng_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -521,7 +521,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -536,7 +536,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s0_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -551,7 +551,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s1_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -566,7 +566,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s2_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -581,7 +581,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s3_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -596,7 +596,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s4_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -611,7 +611,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s5_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -626,7 +626,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s6_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -641,7 +641,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s7_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -656,7 +656,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s8_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -671,7 +671,7 @@ static struct clk_rcg2 gcc_qupv3_i2c_s9_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -700,7 +700,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
+@@ -717,7 +717,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
+@@ -750,7 +750,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
+@@ -767,7 +767,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
+@@ -784,7 +784,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
+@@ -801,7 +801,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
+@@ -818,7 +818,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s6_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s6_clk_src = {
+@@ -835,7 +835,7 @@ static struct clk_init_data gcc_qupv3_wrap1_s7_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap1_s7_clk_src = {
+@@ -852,7 +852,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s0_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
+@@ -869,7 +869,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s1_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
+@@ -886,7 +886,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s2_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
+@@ -903,7 +903,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s3_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
+@@ -920,7 +920,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s4_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
+@@ -937,7 +937,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s5_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s5_clk_src = {
+@@ -975,7 +975,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s6_clk_src_init = {
+ 	.parent_data = gcc_parent_data_8,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_8),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s6_clk_src = {
+@@ -992,7 +992,7 @@ static struct clk_init_data gcc_qupv3_wrap2_s7_clk_src_init = {
+ 	.parent_data = gcc_parent_data_0,
+ 	.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 	.flags = CLK_SET_RATE_PARENT,
+-	.ops = &clk_rcg2_ops,
++	.ops = &clk_rcg2_shared_ops,
+ };
+ 
+ static struct clk_rcg2 gcc_qupv3_wrap2_s7_clk_src = {
+@@ -1025,7 +1025,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
+ 		.parent_data = gcc_parent_data_9,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_9),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1048,7 +1048,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1071,7 +1071,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1093,7 +1093,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = {
+ 		.parent_data = gcc_parent_data_3,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_3),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1114,7 +1114,7 @@ static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = {
+ 		.parent_data = gcc_parent_data_4,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_4),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1136,7 +1136,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1159,7 +1159,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1174,7 +1174,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
+ 		.parent_data = gcc_parent_data_0,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_0),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+@@ -1189,7 +1189,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
+ 		.parent_data = gcc_parent_data_2,
+ 		.num_parents = ARRAY_SIZE(gcc_parent_data_2),
+ 		.flags = CLK_SET_RATE_PARENT,
+-		.ops = &clk_rcg2_ops,
++		.ops = &clk_rcg2_shared_ops,
+ 	},
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-gcc-sm8550-mark-the-pcie-gdscs-votable.patch b/queue-6.7/clk-qcom-gcc-sm8550-mark-the-pcie-gdscs-votable.patch
new file mode 100644
index 00000000000..d8c60a504d5
--- /dev/null
+++ b/queue-6.7/clk-qcom-gcc-sm8550-mark-the-pcie-gdscs-votable.patch
@@ -0,0 +1,67 @@
+From 3eedede2827b239c30f3fdab6db66d4dff0d9bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:05 +0100
+Subject: clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit e7fe73fc6b68ee97b1e8f124a66a5ee50d8d5e5b ]
+
+The PCIe GDSCs on most Qualcomm platforms expect the OS to always
+consider collapse requests as successful. This also concerns SM8550.
+
+Add the VOTABLE flag to the GDSCs in question to comply with these
+expectations.
+
+Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-4-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8550.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c
+index 1c3d78500392..a16d07426b71 100644
+--- a/drivers/clk/qcom/gcc-sm8550.c
++++ b/drivers/clk/qcom/gcc-sm8550.c
+@@ -3002,7 +3002,7 @@ static struct gdsc pcie_0_gdsc = {
+ 		.name = "pcie_0_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
++	.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc pcie_0_phy_gdsc = {
+@@ -3011,7 +3011,7 @@ static struct gdsc pcie_0_phy_gdsc = {
+ 		.name = "pcie_0_phy_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
++	.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc pcie_1_gdsc = {
+@@ -3020,7 +3020,7 @@ static struct gdsc pcie_1_gdsc = {
+ 		.name = "pcie_1_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
++	.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc pcie_1_phy_gdsc = {
+@@ -3029,7 +3029,7 @@ static struct gdsc pcie_1_phy_gdsc = {
+ 		.name = "pcie_1_phy_gdsc",
+ 	},
+ 	.pwrsts = PWRSTS_OFF_ON,
+-	.flags = POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
++	.flags = VOTABLE | POLL_CFG_GDSCR | RETAIN_FF_ENABLE,
+ };
+ 
+ static struct gdsc ufs_phy_gdsc = {
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-gcc-sm8550-use-collapse-voting-for-pcie-gds.patch b/queue-6.7/clk-qcom-gcc-sm8550-use-collapse-voting-for-pcie-gds.patch
new file mode 100644
index 00000000000..c304d2de1ca
--- /dev/null
+++ b/queue-6.7/clk-qcom-gcc-sm8550-use-collapse-voting-for-pcie-gds.patch
@@ -0,0 +1,70 @@
+From 1de85c5c344e33e7e34f205e8960e59a841d27b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:06 +0100
+Subject: clk: qcom: gcc-sm8550: use collapse-voting for PCIe GDSCs
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 7e77a39265293ea4f05e20fff180755503c49918 ]
+
+The PCIe GDSCs can be shared with other masters and should use the APCS
+collapse-vote register when updating the power state.
+
+This is specifically also needed to be able to disable power domains
+that have been enabled by boot firmware using the vote register.
+
+Following other recent Qualcomm platforms, describe this register and
+the corresponding mask for the PCIe (and _phy) GDSCs.
+
+Fixes: 955f2ea3b9e9 ("clk: qcom: Add GCC driver for SM8550")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-5-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8550.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/clk/qcom/gcc-sm8550.c b/drivers/clk/qcom/gcc-sm8550.c
+index a16d07426b71..73bda0d03aa7 100644
+--- a/drivers/clk/qcom/gcc-sm8550.c
++++ b/drivers/clk/qcom/gcc-sm8550.c
+@@ -2998,6 +2998,8 @@ static struct clk_branch gcc_video_axi1_clk = {
+ 
+ static struct gdsc pcie_0_gdsc = {
+ 	.gdscr = 0x6b004,
++	.collapse_ctrl = 0x52020,
++	.collapse_mask = BIT(0),
+ 	.pd = {
+ 		.name = "pcie_0_gdsc",
+ 	},
+@@ -3007,6 +3009,8 @@ static struct gdsc pcie_0_gdsc = {
+ 
+ static struct gdsc pcie_0_phy_gdsc = {
+ 	.gdscr = 0x6c000,
++	.collapse_ctrl = 0x52020,
++	.collapse_mask = BIT(3),
+ 	.pd = {
+ 		.name = "pcie_0_phy_gdsc",
+ 	},
+@@ -3016,6 +3020,8 @@ static struct gdsc pcie_0_phy_gdsc = {
+ 
+ static struct gdsc pcie_1_gdsc = {
+ 	.gdscr = 0x8d004,
++	.collapse_ctrl = 0x52020,
++	.collapse_mask = BIT(1),
+ 	.pd = {
+ 		.name = "pcie_1_gdsc",
+ 	},
+@@ -3025,6 +3031,8 @@ static struct gdsc pcie_1_gdsc = {
+ 
+ static struct gdsc pcie_1_phy_gdsc = {
+ 	.gdscr = 0x8e000,
++	.collapse_ctrl = 0x52020,
++	.collapse_mask = BIT(4),
+ 	.pd = {
+ 		.name = "pcie_1_phy_gdsc",
+ 	},
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch b/queue-6.7/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
new file mode 100644
index 00000000000..19b64b3f2b2
--- /dev/null
+++ b/queue-6.7/clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
@@ -0,0 +1,40 @@
+From 30cbcfe152d73de80c8cb37d1669ec85ecca3b5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 09:58:14 +0530
+Subject: clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 6ebd9a4f8b8d2b35cf965a04849c4ba763722f13 ]
+
+Update the test_ctl_hi_val and test_ctl_hi1_val of gpu_cc_pll1
+as per latest HW recommendation.
+
+Fixes: 0cef71f2ccc8 ("clk: qcom: Add graphics clock controller driver for SM8150")
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231122042814.4158076-1-quic_skakitap@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gpucc-sm8150.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gpucc-sm8150.c b/drivers/clk/qcom/gpucc-sm8150.c
+index 8422fd047493..c89a5b59ddb7 100644
+--- a/drivers/clk/qcom/gpucc-sm8150.c
++++ b/drivers/clk/qcom/gpucc-sm8150.c
+@@ -37,8 +37,8 @@ static struct alpha_pll_config gpu_cc_pll1_config = {
+ 	.config_ctl_hi_val = 0x00002267,
+ 	.config_ctl_hi1_val = 0x00000024,
+ 	.test_ctl_val = 0x00000000,
+-	.test_ctl_hi_val = 0x00000002,
+-	.test_ctl_hi1_val = 0x00000000,
++	.test_ctl_hi_val = 0x00000000,
++	.test_ctl_hi1_val = 0x00000020,
+ 	.user_ctl_val = 0x00000000,
+ 	.user_ctl_hi_val = 0x00000805,
+ 	.user_ctl_hi1_val = 0x000000d0,
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-gpucc-sm8550-update-gpu-pll-settings.patch b/queue-6.7/clk-qcom-gpucc-sm8550-update-gpu-pll-settings.patch
new file mode 100644
index 00000000000..1adb8301352
--- /dev/null
+++ b/queue-6.7/clk-qcom-gpucc-sm8550-update-gpu-pll-settings.patch
@@ -0,0 +1,44 @@
+From 4d5431df0137750b3d3913930fe38a4bceac7e08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Dec 2023 17:02:08 +0100
+Subject: clk: qcom: gpucc-sm8550: Update GPU PLL settings
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 1d595972da12b5a78748eeb3ba1ff58bb0283b91 ]
+
+The settings in the driver seem to have been taken from an older
+release. Update them to match the latest values.
+
+Fixes: bfae40744b33 ("clk: qcom: gpucc-sm8550: Add support for graphics clock controller")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231218-topic-8550_fixes-v1-7-ce1272d77540@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gpucc-sm8550.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/gpucc-sm8550.c b/drivers/clk/qcom/gpucc-sm8550.c
+index 420dcb27b47d..2fa8673424d7 100644
+--- a/drivers/clk/qcom/gpucc-sm8550.c
++++ b/drivers/clk/qcom/gpucc-sm8550.c
+@@ -35,12 +35,12 @@ enum {
+ };
+ 
+ static const struct pll_vco lucid_ole_vco[] = {
+-	{ 249600000, 2300000000, 0 },
++	{ 249600000, 2000000000, 0 },
+ };
+ 
+ static const struct alpha_pll_config gpu_cc_pll0_config = {
+-	.l = 0x0d,
+-	.alpha = 0x0,
++	.l = 0x1e,
++	.alpha = 0xbaaa,
+ 	.config_ctl_val = 0x20485699,
+ 	.config_ctl_hi_val = 0x00182261,
+ 	.config_ctl_hi1_val = 0x82aa299c,
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch b/queue-6.7/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
new file mode 100644
index 00000000000..32851721cd3
--- /dev/null
+++ b/queue-6.7/clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
@@ -0,0 +1,37 @@
+From 32ea3dda2e291b97ba2ce214bb49c9719fe80f5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 15:20:26 +0530
+Subject: clk: qcom: videocc-sm8150: Add missing PLL config property
+
+From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+
+[ Upstream commit 71f130c9193f613d497f7245365ed05ffdb0a401 ]
+
+When the driver was ported upstream, PLL test_ctl_hi1 register value
+was omitted. Add it to ensure the PLLs are fully configured.
+
+Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150")
+Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-3-56bec3a5e443@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/videocc-sm8150.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c
+index 1afdbe4a249d..5579463f7e46 100644
+--- a/drivers/clk/qcom/videocc-sm8150.c
++++ b/drivers/clk/qcom/videocc-sm8150.c
+@@ -33,6 +33,7 @@ static struct alpha_pll_config video_pll0_config = {
+ 	.config_ctl_val = 0x20485699,
+ 	.config_ctl_hi_val = 0x00002267,
+ 	.config_ctl_hi1_val = 0x00000024,
++	.test_ctl_hi1_val = 0x00000020,
+ 	.user_ctl_val = 0x00000000,
+ 	.user_ctl_hi_val = 0x00000805,
+ 	.user_ctl_hi1_val = 0x000000D0,
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-renesas-rzg2l-check-reset-monitor-registers.patch b/queue-6.7/clk-renesas-rzg2l-check-reset-monitor-registers.patch
new file mode 100644
index 00000000000..6026a659a55
--- /dev/null
+++ b/queue-6.7/clk-renesas-rzg2l-check-reset-monitor-registers.patch
@@ -0,0 +1,138 @@
+From 8bc94d9d151e0ddf2ea30f7447ae15d4c4021c26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 09:06:50 +0200
+Subject: clk: renesas: rzg2l: Check reset monitor registers
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit da235d2fac212d0add570e755feb1167a830bc99 ]
+
+The hardware manual of both RZ/G2L and RZ/G3S specifies that the reset
+monitor registers need to be interrogated when the reset signals are
+toggled (chapters "Procedures for Supplying and Stopping Reset Signals"
+and "Procedure for Activating Modules").  Without this, there is a
+chance that different modules (e.g. Ethernet) are not ready after their
+reset signal is toggled, leading to failures (on probe or resume from
+deep sleep states).
+
+The same indications are available for RZ/V2M for TYPE-B reset controls.
+
+Fixes: ef3c613ccd68 ("clk: renesas: Add CPG core wrapper for RZ/G2L SoC")
+Fixes: 8090bea32484 ("clk: renesas: rzg2l: Add support for RZ/V2M reset monitor reg")
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20231207070700.4156557-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 59 ++++++++++++++++++++++++---------
+ 1 file changed, 44 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 3189c3167ba8..3d2daa4ba2a4 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -1416,12 +1416,27 @@ static int rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ 	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+ 	const struct rzg2l_cpg_info *info = priv->info;
+ 	unsigned int reg = info->resets[id].off;
+-	u32 value = BIT(info->resets[id].bit) << 16;
++	u32 mask = BIT(info->resets[id].bit);
++	s8 monbit = info->resets[id].monbit;
++	u32 value = mask << 16;
+ 
+ 	dev_dbg(rcdev->dev, "assert id:%ld offset:0x%x\n", id, CLK_RST_R(reg));
+ 
+ 	writel(value, priv->base + CLK_RST_R(reg));
+-	return 0;
++
++	if (info->has_clk_mon_regs) {
++		reg = CLK_MRST_R(reg);
++	} else if (monbit >= 0) {
++		reg = CPG_RST_MON;
++		mask = BIT(monbit);
++	} else {
++		/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
++		udelay(35);
++		return 0;
++	}
++
++	return readl_poll_timeout_atomic(priv->base + reg, value,
++					 value & mask, 10, 200);
+ }
+ 
+ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev,
+@@ -1430,14 +1445,28 @@ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev,
+ 	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+ 	const struct rzg2l_cpg_info *info = priv->info;
+ 	unsigned int reg = info->resets[id].off;
+-	u32 dis = BIT(info->resets[id].bit);
+-	u32 value = (dis << 16) | dis;
++	u32 mask = BIT(info->resets[id].bit);
++	s8 monbit = info->resets[id].monbit;
++	u32 value = (mask << 16) | mask;
+ 
+ 	dev_dbg(rcdev->dev, "deassert id:%ld offset:0x%x\n", id,
+ 		CLK_RST_R(reg));
+ 
+ 	writel(value, priv->base + CLK_RST_R(reg));
+-	return 0;
++
++	if (info->has_clk_mon_regs) {
++		reg = CLK_MRST_R(reg);
++	} else if (monbit >= 0) {
++		reg = CPG_RST_MON;
++		mask = BIT(monbit);
++	} else {
++		/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
++		udelay(35);
++		return 0;
++	}
++
++	return readl_poll_timeout_atomic(priv->base + reg, value,
++					 !(value & mask), 10, 200);
+ }
+ 
+ static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
+@@ -1449,9 +1478,6 @@ static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
+ 	if (ret)
+ 		return ret;
+ 
+-	/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
+-	udelay(35);
+-
+ 	return rzg2l_cpg_deassert(rcdev, id);
+ }
+ 
+@@ -1460,18 +1486,21 @@ static int rzg2l_cpg_status(struct reset_controller_dev *rcdev,
+ {
+ 	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+ 	const struct rzg2l_cpg_info *info = priv->info;
+-	unsigned int reg = info->resets[id].off;
+-	u32 bitmask = BIT(info->resets[id].bit);
+ 	s8 monbit = info->resets[id].monbit;
++	unsigned int reg;
++	u32 bitmask;
+ 
+ 	if (info->has_clk_mon_regs) {
+-		return !!(readl(priv->base + CLK_MRST_R(reg)) & bitmask);
++		reg = CLK_MRST_R(info->resets[id].off);
++		bitmask = BIT(info->resets[id].bit);
+ 	} else if (monbit >= 0) {
+-		u32 monbitmask = BIT(monbit);
+-
+-		return !!(readl(priv->base + CPG_RST_MON) & monbitmask);
++		reg = CPG_RST_MON;
++		bitmask = BIT(monbit);
++	} else {
++		return -ENOTSUPP;
+ 	}
+-	return -ENOTSUPP;
++
++	return !!(readl(priv->base + reg) & bitmask);
+ }
+ 
+ static const struct reset_control_ops rzg2l_cpg_reset_ops = {
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch b/queue-6.7/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
new file mode 100644
index 00000000000..a564bfd28f6
--- /dev/null
+++ b/queue-6.7/clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
@@ -0,0 +1,82 @@
+From 12f9d89d50d5ab6cf1eb288e0c0c30b4db08cb33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 09:00:11 +0200
+Subject: clk: renesas: rzg2l-cpg: Reuse code in rzg2l_cpg_reset()
+
+From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+
+[ Upstream commit 5f9e29b9159a41fcf6733c3b59fa46a90ce3ae20 ]
+
+Code in rzg2l_cpg_reset() is equivalent with the combined code of
+rzg2l_cpg_assert() and rzg2l_cpg_deassert(). There is no need to have
+different versions thus re-use rzg2l_cpg_assert() and rzg2l_cpg_deassert().
+
+Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20231120070024.4079344-2-claudiu.beznea.uj@bp.renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Stable-dep-of: da235d2fac21 ("clk: renesas: rzg2l: Check reset monitor registers")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rzg2l-cpg.c | 38 +++++++++++++--------------------
+ 1 file changed, 15 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/clk/renesas/rzg2l-cpg.c b/drivers/clk/renesas/rzg2l-cpg.c
+index 764bd72cf059..3189c3167ba8 100644
+--- a/drivers/clk/renesas/rzg2l-cpg.c
++++ b/drivers/clk/renesas/rzg2l-cpg.c
+@@ -1410,29 +1410,6 @@ rzg2l_cpg_register_mod_clk(const struct rzg2l_mod_clk *mod,
+ 
+ #define rcdev_to_priv(x)	container_of(x, struct rzg2l_cpg_priv, rcdev)
+ 
+-static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
+-			   unsigned long id)
+-{
+-	struct rzg2l_cpg_priv *priv = rcdev_to_priv(rcdev);
+-	const struct rzg2l_cpg_info *info = priv->info;
+-	unsigned int reg = info->resets[id].off;
+-	u32 dis = BIT(info->resets[id].bit);
+-	u32 we = dis << 16;
+-
+-	dev_dbg(rcdev->dev, "reset id:%ld offset:0x%x\n", id, CLK_RST_R(reg));
+-
+-	/* Reset module */
+-	writel(we, priv->base + CLK_RST_R(reg));
+-
+-	/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
+-	udelay(35);
+-
+-	/* Release module from reset state */
+-	writel(we | dis, priv->base + CLK_RST_R(reg));
+-
+-	return 0;
+-}
+-
+ static int rzg2l_cpg_assert(struct reset_controller_dev *rcdev,
+ 			    unsigned long id)
+ {
+@@ -1463,6 +1440,21 @@ static int rzg2l_cpg_deassert(struct reset_controller_dev *rcdev,
+ 	return 0;
+ }
+ 
++static int rzg2l_cpg_reset(struct reset_controller_dev *rcdev,
++			   unsigned long id)
++{
++	int ret;
++
++	ret = rzg2l_cpg_assert(rcdev, id);
++	if (ret)
++		return ret;
++
++	/* Wait for at least one cycle of the RCLK clock (@ ca. 32 kHz) */
++	udelay(35);
++
++	return rzg2l_cpg_deassert(rcdev, id);
++}
++
+ static int rzg2l_cpg_status(struct reset_controller_dev *rcdev,
+ 			    unsigned long id)
+ {
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-rs9-fix-dif-oen-bit-placement-on-9fgv0241.patch b/queue-6.7/clk-rs9-fix-dif-oen-bit-placement-on-9fgv0241.patch
new file mode 100644
index 00000000000..63331aacb6e
--- /dev/null
+++ b/queue-6.7/clk-rs9-fix-dif-oen-bit-placement-on-9fgv0241.patch
@@ -0,0 +1,40 @@
+From ea394ec47097a5f0b9cb738f521641f4a233f7ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Nov 2023 21:06:15 +0100
+Subject: clk: rs9: Fix DIF OEn bit placement on 9FGV0241
+
+From: Marek Vasut <marek.vasut+renesas@mailbox.org>
+
+[ Upstream commit 29d861b5d29b6c80a887e93ad982cbbf4af2a06b ]
+
+On 9FGV0241, the DIF OE0 is BIT(1) and DIF OE1 is BIT(2), on the other
+chips like 9FGV0441 and 9FGV0841 DIF OE0 is BIT(0) and so on. Increment
+the index in BIT() macro instead of the result of BIT() macro to shift
+the bit correctly on 9FGV0241.
+
+Fixes: 603df193ec51 ("clk: rs9: Support device specific dif bit calculation")
+Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
+Link: https://lore.kernel.org/r/20231105200642.62792-1-marek.vasut+renesas@mailbox.org
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-renesas-pcie.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/clk-renesas-pcie.c b/drivers/clk/clk-renesas-pcie.c
+index 380245f635d6..6606aba253c5 100644
+--- a/drivers/clk/clk-renesas-pcie.c
++++ b/drivers/clk/clk-renesas-pcie.c
+@@ -163,7 +163,7 @@ static u8 rs9_calc_dif(const struct rs9_driver_data *rs9, int idx)
+ 	enum rs9_model model = rs9->chip_info->model;
+ 
+ 	if (model == RENESAS_9FGV0241)
+-		return BIT(idx) + 1;
++		return BIT(idx + 1);
+ 	else if (model == RENESAS_9FGV0441)
+ 		return BIT(idx);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch b/queue-6.7/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
new file mode 100644
index 00000000000..940a1882913
--- /dev/null
+++ b/queue-6.7/clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
@@ -0,0 +1,41 @@
+From a97ca8480f38709a0f0625a9c7bf36c4efb9431a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Nov 2023 11:16:36 +0800
+Subject: clk: si5341: fix an error code problem in si5341_output_clk_set_rate
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 5607068ae5ab02c3ac9cabc6859d36e98004c341 ]
+
+regmap_bulk_write() return zero or negative error code, return the value
+of regmap_bulk_write() rather than '0'.
+
+Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver")
+Acked-by: Mike Looijmans <mike.looijmans@topic.nl>
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Link: https://lore.kernel.org/r/20231101031633.996124-1-suhui@nfschina.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-si5341.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
+index 845b451511d2..6e8dd7387cfd 100644
+--- a/drivers/clk/clk-si5341.c
++++ b/drivers/clk/clk-si5341.c
+@@ -895,10 +895,8 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate,
+ 	r[0] = r_div ? (r_div & 0xff) : 1;
+ 	r[1] = (r_div >> 8) & 0xff;
+ 	r[2] = (r_div >> 16) & 0xff;
+-	err = regmap_bulk_write(output->data->regmap,
++	return regmap_bulk_write(output->data->regmap,
+ 			SI5341_OUT_R_REG(output), r, 3);
+-
+-	return 0;
+ }
+ 
+ static int si5341_output_reparent(struct clk_si5341_output *output, u8 index)
+-- 
+2.43.0
+
diff --git a/queue-6.7/clk-sp7021-fix-return-value-check-in-sp7021_clk_prob.patch b/queue-6.7/clk-sp7021-fix-return-value-check-in-sp7021_clk_prob.patch
new file mode 100644
index 00000000000..3cdd5fde9dc
--- /dev/null
+++ b/queue-6.7/clk-sp7021-fix-return-value-check-in-sp7021_clk_prob.patch
@@ -0,0 +1,50 @@
+From 5674e4d2c146e8169bb85858bd5b9f8ae0076d83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 21:30:16 +0800
+Subject: clk: sp7021: fix return value check in sp7021_clk_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 1004c346a2b7393fce37dd1f320555e0a0d71e3f ]
+
+devm_platform_ioremap_resource() never returns NULL pointer,
+it will return ERR_PTR() when it fails, so replace the check
+with IS_ERR().
+
+Fixes: d54c1fd4a51e ("clk: Add Sunplus SP7021 clock driver")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20231128133016.2494699-1-yangyingliang@huawei.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-sp7021.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/clk-sp7021.c b/drivers/clk/clk-sp7021.c
+index 01d3c4c7b0b2..7cb7d501d7a6 100644
+--- a/drivers/clk/clk-sp7021.c
++++ b/drivers/clk/clk-sp7021.c
+@@ -604,14 +604,14 @@ static int sp7021_clk_probe(struct platform_device *pdev)
+ 	int i;
+ 
+ 	clk_base = devm_platform_ioremap_resource(pdev, 0);
+-	if (!clk_base)
+-		return -ENXIO;
++	if (IS_ERR(clk_base))
++		return PTR_ERR(clk_base);
+ 	pll_base = devm_platform_ioremap_resource(pdev, 1);
+-	if (!pll_base)
+-		return -ENXIO;
++	if (IS_ERR(pll_base))
++		return PTR_ERR(pll_base);
+ 	sys_base = devm_platform_ioremap_resource(pdev, 2);
+-	if (!sys_base)
+-		return -ENXIO;
++	if (IS_ERR(sys_base))
++		return PTR_ERR(sys_base);
+ 
+ 	/* enable default clks */
+ 	for (i = 0; i < ARRAY_SIZE(sp_clken); i++)
+-- 
+2.43.0
+
diff --git a/queue-6.7/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch b/queue-6.7/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
new file mode 100644
index 00000000000..f3a3c33ffdb
--- /dev/null
+++ b/queue-6.7/cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
@@ -0,0 +1,43 @@
+From ef750d81a0e730368ec173134f478cabb45f7b6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 18:12:20 +0300
+Subject: cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
+
+From: Alexandra Diupina <adiupina@astralinux.ru>
+
+[ Upstream commit c4a5118a3ae1eadc687d84eef9431f9e13eb015c ]
+
+devm_of_clk_add_hw_provider() may return an errno, so
+add a return value check
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 8410e7f3b31e ("cpufreq: scmi: Fix OPP addition failure with a dummy clock provider")
+Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/scmi-cpufreq.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
+index c8a7ccc42c16..4ee23f4ebf4a 100644
+--- a/drivers/cpufreq/scmi-cpufreq.c
++++ b/drivers/cpufreq/scmi-cpufreq.c
+@@ -334,8 +334,11 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)
+ 
+ #ifdef CONFIG_COMMON_CLK
+ 	/* dummy clock provider as needed by OPP if clocks property is used */
+-	if (of_property_present(dev->of_node, "#clock-cells"))
+-		devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
++	if (of_property_present(dev->of_node, "#clock-cells")) {
++		ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
++		if (ret)
++			return dev_err_probe(dev, ret, "%s: registering clock provider failed\n", __func__);
++	}
+ #endif
+ 
+ 	ret = cpufreq_register_driver(&scmi_cpufreq_driver);
+-- 
+2.43.0
+
diff --git a/queue-6.7/cpuidle-haltpoll-do-not-enable-interrupts-when-enter.patch b/queue-6.7/cpuidle-haltpoll-do-not-enable-interrupts-when-enter.patch
new file mode 100644
index 00000000000..4d6dd1667fc
--- /dev/null
+++ b/queue-6.7/cpuidle-haltpoll-do-not-enable-interrupts-when-enter.patch
@@ -0,0 +1,53 @@
+From 7766cb7b9316e3d678848f6a01ae9d01967bd1b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 18:08:18 +0100
+Subject: cpuidle: haltpoll: Do not enable interrupts when entering idle
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+[ Upstream commit c8f5caec3df84a02b937d6d9cda1f7ffa8dc443f ]
+
+The cpuidle drivers' ->enter() methods are supposed to be IRQ invariant:
+
+  5e26aa933911 ("cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls")
+  bb7b11258561 ("cpuidle: Move IRQ state validation")
+
+Do that in the haltpoll driver too.
+
+Fixes: 5e26aa933911 ("cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls")
+Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218245
+Reported-by: <forza@tnonline.net>
+Tested-by: <forza@tnonline.net>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpuidle/cpuidle-haltpoll.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/cpuidle/cpuidle-haltpoll.c b/drivers/cpuidle/cpuidle-haltpoll.c
+index e66df22f9695..d8515d5c0853 100644
+--- a/drivers/cpuidle/cpuidle-haltpoll.c
++++ b/drivers/cpuidle/cpuidle-haltpoll.c
+@@ -25,13 +25,12 @@ MODULE_PARM_DESC(force, "Load unconditionally");
+ static struct cpuidle_device __percpu *haltpoll_cpuidle_devices;
+ static enum cpuhp_state haltpoll_hp_state;
+ 
+-static int default_enter_idle(struct cpuidle_device *dev,
+-			      struct cpuidle_driver *drv, int index)
++static __cpuidle int default_enter_idle(struct cpuidle_device *dev,
++					struct cpuidle_driver *drv, int index)
+ {
+-	if (current_clr_polling_and_test()) {
+-		local_irq_enable();
++	if (current_clr_polling_and_test())
+ 		return index;
+-	}
++
+ 	arch_cpu_idle();
+ 	return index;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch b/queue-6.7/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
new file mode 100644
index 00000000000..469f3d90106
--- /dev/null
+++ b/queue-6.7/crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
@@ -0,0 +1,85 @@
+From 289b05f39d5d6768d5a1105f59e1c521800a8de2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 16:25:49 +0800
+Subject: crypto: af_alg - Disallow multiple in-flight AIO requests
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 67b164a871af1d736f131fd6fe78a610909f06f3 ]
+
+Having multiple in-flight AIO requests results in unpredictable
+output because they all share the same IV.  Fix this by only allowing
+one request at a time.
+
+Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to algif_aead")
+Fixes: a596999b7ddf ("crypto: algif - change algif_skcipher to be asynchronous")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c         | 14 +++++++++++++-
+ include/crypto/if_alg.h |  3 +++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index ea6fb8e89d06..68cc9290cabe 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -1116,9 +1116,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendmsg);
+ void af_alg_free_resources(struct af_alg_async_req *areq)
+ {
+ 	struct sock *sk = areq->sk;
++	struct af_alg_ctx *ctx;
+ 
+ 	af_alg_free_areq_sgls(areq);
+ 	sock_kfree_s(sk, areq, areq->areqlen);
++
++	ctx = alg_sk(sk)->private;
++	ctx->inflight = false;
+ }
+ EXPORT_SYMBOL_GPL(af_alg_free_resources);
+ 
+@@ -1188,11 +1192,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll);
+ struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
+ 					   unsigned int areqlen)
+ {
+-	struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
++	struct af_alg_ctx *ctx = alg_sk(sk)->private;
++	struct af_alg_async_req *areq;
++
++	/* Only one AIO request can be in flight. */
++	if (ctx->inflight)
++		return ERR_PTR(-EBUSY);
+ 
++	areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
+ 	if (unlikely(!areq))
+ 		return ERR_PTR(-ENOMEM);
+ 
++	ctx->inflight = true;
++
+ 	areq->areqlen = areqlen;
+ 	areq->sk = sk;
+ 	areq->first_rsgl.sgl.sgt.sgl = areq->first_rsgl.sgl.sgl;
+diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
+index ef8ce86b1f78..08b803a4fcde 100644
+--- a/include/crypto/if_alg.h
++++ b/include/crypto/if_alg.h
+@@ -136,6 +136,7 @@ struct af_alg_async_req {
+  *			recvmsg is invoked.
+  * @init:		True if metadata has been sent.
+  * @len:		Length of memory allocated for this data structure.
++ * @inflight:		Non-zero when AIO requests are in flight.
+  */
+ struct af_alg_ctx {
+ 	struct list_head tsgl_list;
+@@ -154,6 +155,8 @@ struct af_alg_ctx {
+ 	bool init;
+ 
+ 	unsigned int len;
++
++	unsigned int inflight;
+ };
+ 
+ int af_alg_register_type(const struct af_alg_type *type);
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch b/queue-6.7/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
new file mode 100644
index 00000000000..9df58f5e1a7
--- /dev/null
+++ b/queue-6.7/crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
@@ -0,0 +1,45 @@
+From 4a52d8e3d0c8668dea7e0902d2df870a58039a0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 11:47:10 +0800
+Subject: crypto: ccp - fix memleak in ccp_init_dm_workarea
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d ]
+
+When dma_map_single() fails, wa->address is supposed to be freed
+by the callers of ccp_init_dm_workarea() through ccp_dm_free().
+However, many of the call spots don't expect to have to call
+ccp_dm_free() on failure of ccp_init_dm_workarea(), which may
+lead to a memleak. Let's free wa->address in ccp_init_dm_workarea()
+when dma_map_single() fails.
+
+Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-ops.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index aa4e1a500691..cb8e99936abb 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa,
+ 
+ 		wa->dma.address = dma_map_single(wa->dev, wa->address, len,
+ 						 dir);
+-		if (dma_mapping_error(wa->dev, wa->dma.address))
++		if (dma_mapping_error(wa->dev, wa->dma.address)) {
++			kfree(wa->address);
++			wa->address = NULL;
+ 			return -ENOMEM;
++		}
+ 
+ 		wa->dma.length = len;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-hisilicon-hpre-save-capability-registers-in-p.patch b/queue-6.7/crypto-hisilicon-hpre-save-capability-registers-in-p.patch
new file mode 100644
index 00000000000..d79ec249a80
--- /dev/null
+++ b/queue-6.7/crypto-hisilicon-hpre-save-capability-registers-in-p.patch
@@ -0,0 +1,211 @@
+From d175d92dff295760e972e406dcf6528776327979 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:20 +0800
+Subject: crypto: hisilicon/hpre - save capability registers in probe process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit cf8b5156bbc8c9376f699e8d35e9464b739e33ff ]
+
+Pre-store the valid value of hpre alg support related capability
+register in hpre_qm_init(), which will be called by hpre_probe().
+It can reduce the number of capability register queries and avoid
+obtaining incorrect values in abnormal scenarios, such as reset
+failed and the memory space disabled.
+
+Fixes: f214d59a0603 ("crypto: hisilicon/hpre - support hpre capability")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 82 ++++++++++++++++++-----
+ 1 file changed, 64 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 84c92d85d23d..3255b2a070c7 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -226,6 +226,20 @@ static const struct hisi_qm_cap_info hpre_basic_info[] = {
+ 	{HPRE_CORE10_ALG_BITMAP_CAP, 0x3170, 0, GENMASK(31, 0), 0x0, 0x10, 0x10}
+ };
+ 
++enum hpre_pre_store_cap_idx {
++	HPRE_CLUSTER_NUM_CAP_IDX = 0x0,
++	HPRE_CORE_ENABLE_BITMAP_CAP_IDX,
++	HPRE_DRV_ALG_BITMAP_CAP_IDX,
++	HPRE_DEV_ALG_BITMAP_CAP_IDX,
++};
++
++static const u32 hpre_pre_store_caps[] = {
++	HPRE_CLUSTER_NUM_CAP,
++	HPRE_CORE_ENABLE_BITMAP_CAP,
++	HPRE_DRV_ALG_BITMAP_CAP,
++	HPRE_DEV_ALG_BITMAP_CAP,
++};
++
+ static const struct hpre_hw_error hpre_hw_errors[] = {
+ 	{
+ 		.int_msk = BIT(0),
+@@ -348,7 +362,7 @@ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg)
+ {
+ 	u32 cap_val;
+ 
+-	cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DRV_ALG_BITMAP_CAP, qm->cap_ver);
++	cap_val = qm->cap_tables.dev_cap_table[HPRE_DRV_ALG_BITMAP_CAP_IDX].cap_val;
+ 	if (alg & cap_val)
+ 		return true;
+ 
+@@ -424,16 +438,6 @@ static u32 vfs_num;
+ module_param_cb(vfs_num, &vfs_num_ops, &vfs_num, 0444);
+ MODULE_PARM_DESC(vfs_num, "Number of VFs to enable(1-63), 0(default)");
+ 
+-static inline int hpre_cluster_num(struct hisi_qm *qm)
+-{
+-	return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CLUSTER_NUM_CAP, qm->cap_ver);
+-}
+-
+-static inline int hpre_cluster_core_mask(struct hisi_qm *qm)
+-{
+-	return hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_CORE_ENABLE_BITMAP_CAP, qm->cap_ver);
+-}
+-
+ struct hisi_qp *hpre_create_qp(u8 type)
+ {
+ 	int node = cpu_to_node(smp_processor_id());
+@@ -500,13 +504,15 @@ static int hpre_cfg_by_dsm(struct hisi_qm *qm)
+ 
+ static int hpre_set_cluster(struct hisi_qm *qm)
+ {
+-	u32 cluster_core_mask = hpre_cluster_core_mask(qm);
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct device *dev = &qm->pdev->dev;
+ 	unsigned long offset;
++	u32 cluster_core_mask;
++	u8 clusters_num;
+ 	u32 val = 0;
+ 	int ret, i;
+ 
++	cluster_core_mask = qm->cap_tables.dev_cap_table[HPRE_CORE_ENABLE_BITMAP_CAP_IDX].cap_val;
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		offset = i * HPRE_CLSTR_ADDR_INTRVL;
+ 
+@@ -701,11 +707,12 @@ static int hpre_set_user_domain_and_cache(struct hisi_qm *qm)
+ 
+ static void hpre_cnt_regs_clear(struct hisi_qm *qm)
+ {
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	unsigned long offset;
++	u8 clusters_num;
+ 	int i;
+ 
+ 	/* clear clusterX/cluster_ctrl */
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		offset = HPRE_CLSTR_BASE + i * HPRE_CLSTR_ADDR_INTRVL;
+ 		writel(0x0, qm->io_base + offset + HPRE_CLUSTER_INQURY);
+@@ -992,13 +999,14 @@ static int hpre_pf_comm_regs_debugfs_init(struct hisi_qm *qm)
+ 
+ static int hpre_cluster_debugfs_init(struct hisi_qm *qm)
+ {
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct device *dev = &qm->pdev->dev;
+ 	char buf[HPRE_DBGFS_VAL_MAX_LEN];
+ 	struct debugfs_regset32 *regset;
+ 	struct dentry *tmp_d;
++	u8 clusters_num;
+ 	int i, ret;
+ 
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		ret = snprintf(buf, HPRE_DBGFS_VAL_MAX_LEN, "cluster%d", i);
+ 		if (ret >= HPRE_DBGFS_VAL_MAX_LEN)
+@@ -1103,6 +1111,34 @@ static void hpre_debugfs_exit(struct hisi_qm *qm)
+ 	debugfs_remove_recursive(qm->debug.debug_root);
+ }
+ 
++static int hpre_pre_store_cap_reg(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *hpre_cap;
++	struct device *dev = &qm->pdev->dev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(hpre_pre_store_caps);
++	hpre_cap = devm_kzalloc(dev, sizeof(*hpre_cap) * size, GFP_KERNEL);
++	if (!hpre_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		hpre_cap[i].type = hpre_pre_store_caps[i];
++		hpre_cap[i].cap_val = hisi_qm_get_hw_info(qm, hpre_basic_info,
++				      hpre_pre_store_caps[i], qm->cap_ver);
++	}
++
++	if (hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val > HPRE_CLUSTERS_NUM_MAX) {
++		dev_err(dev, "Device cluster num %u is out of range for driver supports %d!\n",
++			hpre_cap[HPRE_CLUSTER_NUM_CAP_IDX].cap_val, HPRE_CLUSTERS_NUM_MAX);
++		return -EINVAL;
++	}
++
++	qm->cap_tables.dev_cap_table = hpre_cap;
++
++	return 0;
++}
++
+ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
+ 	u64 alg_msk;
+@@ -1136,7 +1172,15 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver);
++	/* Fetch and save the value of capability registers */
++	ret = hpre_pre_store_cap_reg(qm);
++	if (ret) {
++		pci_err(pdev, "Failed to pre-store capability registers!\n");
++		hisi_qm_uninit(qm);
++		return ret;
++	}
++
++	alg_msk = qm->cap_tables.dev_cap_table[HPRE_DEV_ALG_BITMAP_CAP_IDX].cap_val;
+ 	ret = hisi_qm_set_algs(qm, alg_msk, hpre_dev_algs, ARRAY_SIZE(hpre_dev_algs));
+ 	if (ret) {
+ 		pci_err(pdev, "Failed to set hpre algs!\n");
+@@ -1150,11 +1194,12 @@ static int hpre_show_last_regs_init(struct hisi_qm *qm)
+ {
+ 	int cluster_dfx_regs_num =  ARRAY_SIZE(hpre_cluster_dfx_regs);
+ 	int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs);
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct qm_debug *debug = &qm->debug;
+ 	void __iomem *io_base;
++	u8 clusters_num;
+ 	int i, j, idx;
+ 
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	debug->last_words = kcalloc(cluster_dfx_regs_num * clusters_num +
+ 			com_dfx_regs_num, sizeof(unsigned int), GFP_KERNEL);
+ 	if (!debug->last_words)
+@@ -1191,10 +1236,10 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm)
+ {
+ 	int cluster_dfx_regs_num =  ARRAY_SIZE(hpre_cluster_dfx_regs);
+ 	int com_dfx_regs_num = ARRAY_SIZE(hpre_com_dfx_regs);
+-	u8 clusters_num = hpre_cluster_num(qm);
+ 	struct qm_debug *debug = &qm->debug;
+ 	struct pci_dev *pdev = qm->pdev;
+ 	void __iomem *io_base;
++	u8 clusters_num;
+ 	int i, j, idx;
+ 	u32 val;
+ 
+@@ -1209,6 +1254,7 @@ static void hpre_show_last_dfx_regs(struct hisi_qm *qm)
+ 			  hpre_com_dfx_regs[i].name, debug->last_words[i], val);
+ 	}
+ 
++	clusters_num = qm->cap_tables.dev_cap_table[HPRE_CLUSTER_NUM_CAP_IDX].cap_val;
+ 	for (i = 0; i < clusters_num; i++) {
+ 		io_base = qm->io_base + hpre_cluster_offsets[i];
+ 		for (j = 0; j <  cluster_dfx_regs_num; j++) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch b/queue-6.7/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
new file mode 100644
index 00000000000..01f2882dd31
--- /dev/null
+++ b/queue-6.7/crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
@@ -0,0 +1,385 @@
+From eb9617b29c7a762fc39505e62611c994ba9bd20d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:18 +0800
+Subject: crypto: hisilicon/qm - add a function to set qm algs
+
+From: Wenkai Lin <linwenkai6@hisilicon.com>
+
+[ Upstream commit f76f0d7f20672611974d3cc705996751fc403734 ]
+
+Extract a public function to set qm algs and remove
+the similar code for setting qm algs in each module.
+
+Signed-off-by: Wenkai Lin <linwenkai6@hisilicon.com>
+Signed-off-by: Hao Fang <fanghao11@huawei.com>
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: cf8b5156bbc8 ("crypto: hisilicon/hpre - save capability registers in probe process")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/hpre/hpre_main.c | 42 ++-----------------
+ drivers/crypto/hisilicon/qm.c             | 36 +++++++++++++++++
+ drivers/crypto/hisilicon/sec2/sec_main.c  | 47 ++++------------------
+ drivers/crypto/hisilicon/zip/zip_main.c   | 49 ++++-------------------
+ include/linux/hisi_acc_qm.h               |  8 +++-
+ 5 files changed, 62 insertions(+), 120 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/hpre/hpre_main.c b/drivers/crypto/hisilicon/hpre/hpre_main.c
+index 56777099ef69..84c92d85d23d 100644
+--- a/drivers/crypto/hisilicon/hpre/hpre_main.c
++++ b/drivers/crypto/hisilicon/hpre/hpre_main.c
+@@ -118,8 +118,6 @@
+ #define HPRE_DFX_COMMON2_LEN		0xE
+ #define HPRE_DFX_CORE_LEN		0x43
+ 
+-#define HPRE_DEV_ALG_MAX_LEN	256
+-
+ static const char hpre_name[] = "hisi_hpre";
+ static struct dentry *hpre_debugfs_root;
+ static const struct pci_device_id hpre_dev_ids[] = {
+@@ -135,12 +133,7 @@ struct hpre_hw_error {
+ 	const char *msg;
+ };
+ 
+-struct hpre_dev_alg {
+-	u32 alg_msk;
+-	const char *alg;
+-};
+-
+-static const struct hpre_dev_alg hpre_dev_algs[] = {
++static const struct qm_dev_alg hpre_dev_algs[] = {
+ 	{
+ 		.alg_msk = BIT(0),
+ 		.alg = "rsa\n"
+@@ -362,35 +355,6 @@ bool hpre_check_alg_support(struct hisi_qm *qm, u32 alg)
+ 	return false;
+ }
+ 
+-static int hpre_set_qm_algs(struct hisi_qm *qm)
+-{
+-	struct device *dev = &qm->pdev->dev;
+-	char *algs, *ptr;
+-	u32 alg_msk;
+-	int i;
+-
+-	if (!qm->use_sva)
+-		return 0;
+-
+-	algs = devm_kzalloc(dev, HPRE_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
+-	if (!algs)
+-		return -ENOMEM;
+-
+-	alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver);
+-
+-	for (i = 0; i < ARRAY_SIZE(hpre_dev_algs); i++)
+-		if (alg_msk & hpre_dev_algs[i].alg_msk)
+-			strcat(algs, hpre_dev_algs[i].alg);
+-
+-	ptr = strrchr(algs, '\n');
+-	if (ptr)
+-		*ptr = '\0';
+-
+-	qm->uacce->algs = algs;
+-
+-	return 0;
+-}
+-
+ static int hpre_diff_regs_show(struct seq_file *s, void *unused)
+ {
+ 	struct hisi_qm *qm = s->private;
+@@ -1141,6 +1105,7 @@ static void hpre_debugfs_exit(struct hisi_qm *qm)
+ 
+ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
++	u64 alg_msk;
+ 	int ret;
+ 
+ 	if (pdev->revision == QM_HW_V1) {
+@@ -1171,7 +1136,8 @@ static int hpre_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = hpre_set_qm_algs(qm);
++	alg_msk = hisi_qm_get_hw_info(qm, hpre_basic_info, HPRE_DEV_ALG_BITMAP_CAP, qm->cap_ver);
++	ret = hisi_qm_set_algs(qm, alg_msk, hpre_dev_algs, ARRAY_SIZE(hpre_dev_algs));
+ 	if (ret) {
+ 		pci_err(pdev, "Failed to set hpre algs!\n");
+ 		hisi_qm_uninit(qm);
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 30b43006d1db..40da95dbab25 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -229,6 +229,8 @@
+ #define QM_QOS_MAX_CIR_U		6
+ #define QM_AUTOSUSPEND_DELAY		3000
+ 
++#define QM_DEV_ALG_MAX_LEN		256
++
+ #define QM_MK_CQC_DW3_V1(hop_num, pg_sz, buf_sz, cqe_sz) \
+ 	(((hop_num) << QM_CQ_HOP_NUM_SHIFT) | \
+ 	((pg_sz) << QM_CQ_PAGE_SIZE_SHIFT) | \
+@@ -842,6 +844,40 @@ static void qm_get_xqc_depth(struct hisi_qm *qm, u16 *low_bits,
+ 	*high_bits = (depth >> QM_XQ_DEPTH_SHIFT) & QM_XQ_DEPTH_MASK;
+ }
+ 
++int hisi_qm_set_algs(struct hisi_qm *qm, u64 alg_msk, const struct qm_dev_alg *dev_algs,
++		     u32 dev_algs_size)
++{
++	struct device *dev = &qm->pdev->dev;
++	char *algs, *ptr;
++	int i;
++
++	if (!qm->uacce)
++		return 0;
++
++	if (dev_algs_size >= QM_DEV_ALG_MAX_LEN) {
++		dev_err(dev, "algs size %u is equal or larger than %d.\n",
++			dev_algs_size, QM_DEV_ALG_MAX_LEN);
++		return -EINVAL;
++	}
++
++	algs = devm_kzalloc(dev, QM_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
++	if (!algs)
++		return -ENOMEM;
++
++	for (i = 0; i < dev_algs_size; i++)
++		if (alg_msk & dev_algs[i].alg_msk)
++			strcat(algs, dev_algs[i].alg);
++
++	ptr = strrchr(algs, '\n');
++	if (ptr) {
++		*ptr = '\0';
++		qm->uacce->algs = algs;
++	}
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(hisi_qm_set_algs);
++
+ static u32 qm_get_irq_num(struct hisi_qm *qm)
+ {
+ 	if (qm->fun_type == QM_HW_PF)
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 0e56a47eb862..2eceab7600ca 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -120,7 +120,6 @@
+ 					GENMASK_ULL(42, 25))
+ #define SEC_AEAD_BITMAP			(GENMASK_ULL(7, 6) | GENMASK_ULL(18, 17) | \
+ 					GENMASK_ULL(45, 43))
+-#define SEC_DEV_ALG_MAX_LEN		256
+ 
+ struct sec_hw_error {
+ 	u32 int_msk;
+@@ -132,11 +131,6 @@ struct sec_dfx_item {
+ 	u32 offset;
+ };
+ 
+-struct sec_dev_alg {
+-	u64 alg_msk;
+-	const char *algs;
+-};
+-
+ static const char sec_name[] = "hisi_sec2";
+ static struct dentry *sec_debugfs_root;
+ 
+@@ -173,15 +167,15 @@ static const struct hisi_qm_cap_info sec_basic_info[] = {
+ 	{SEC_CORE4_ALG_BITMAP_HIGH, 0x3170, 0, GENMASK(31, 0), 0x3FFF, 0x3FFF, 0x3FFF},
+ };
+ 
+-static const struct sec_dev_alg sec_dev_algs[] = { {
++static const struct qm_dev_alg sec_dev_algs[] = { {
+ 		.alg_msk = SEC_CIPHER_BITMAP,
+-		.algs = "cipher\n",
++		.alg = "cipher\n",
+ 	}, {
+ 		.alg_msk = SEC_DIGEST_BITMAP,
+-		.algs = "digest\n",
++		.alg = "digest\n",
+ 	}, {
+ 		.alg_msk = SEC_AEAD_BITMAP,
+-		.algs = "aead\n",
++		.alg = "aead\n",
+ 	},
+ };
+ 
+@@ -1077,37 +1071,9 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ 	return ret;
+ }
+ 
+-static int sec_set_qm_algs(struct hisi_qm *qm)
+-{
+-	struct device *dev = &qm->pdev->dev;
+-	char *algs, *ptr;
+-	u64 alg_mask;
+-	int i;
+-
+-	if (!qm->use_sva)
+-		return 0;
+-
+-	algs = devm_kzalloc(dev, SEC_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
+-	if (!algs)
+-		return -ENOMEM;
+-
+-	alg_mask = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW);
+-
+-	for (i = 0; i < ARRAY_SIZE(sec_dev_algs); i++)
+-		if (alg_mask & sec_dev_algs[i].alg_msk)
+-			strcat(algs, sec_dev_algs[i].algs);
+-
+-	ptr = strrchr(algs, '\n');
+-	if (ptr)
+-		*ptr = '\0';
+-
+-	qm->uacce->algs = algs;
+-
+-	return 0;
+-}
+-
+ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
++	u64 alg_msk;
+ 	int ret;
+ 
+ 	qm->pdev = pdev;
+@@ -1142,7 +1108,8 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = sec_set_qm_algs(qm);
++	alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW);
++	ret = hisi_qm_set_algs(qm, alg_msk, sec_dev_algs, ARRAY_SIZE(sec_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set sec algs!\n");
+ 		hisi_qm_uninit(qm);
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index 85576f818278..f7cf54f02dd7 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -74,7 +74,6 @@
+ #define HZIP_AXI_SHUTDOWN_ENABLE	BIT(14)
+ #define HZIP_WR_PORT			BIT(11)
+ 
+-#define HZIP_DEV_ALG_MAX_LEN		256
+ #define HZIP_ALG_ZLIB_BIT		GENMASK(1, 0)
+ #define HZIP_ALG_GZIP_BIT		GENMASK(3, 2)
+ #define HZIP_ALG_DEFLATE_BIT		GENMASK(5, 4)
+@@ -128,23 +127,18 @@ struct zip_dfx_item {
+ 	u32 offset;
+ };
+ 
+-struct zip_dev_alg {
+-	u32 alg_msk;
+-	const char *algs;
+-};
+-
+-static const struct zip_dev_alg zip_dev_algs[] = { {
++static const struct qm_dev_alg zip_dev_algs[] = { {
+ 		.alg_msk = HZIP_ALG_ZLIB_BIT,
+-		.algs = "zlib\n",
++		.alg = "zlib\n",
+ 	}, {
+ 		.alg_msk = HZIP_ALG_GZIP_BIT,
+-		.algs = "gzip\n",
++		.alg = "gzip\n",
+ 	}, {
+ 		.alg_msk = HZIP_ALG_DEFLATE_BIT,
+-		.algs = "deflate\n",
++		.alg = "deflate\n",
+ 	}, {
+ 		.alg_msk = HZIP_ALG_LZ77_BIT,
+-		.algs = "lz77_zstd\n",
++		.alg = "lz77_zstd\n",
+ 	},
+ };
+ 
+@@ -478,35 +472,6 @@ static int hisi_zip_set_high_perf(struct hisi_qm *qm)
+ 	return ret;
+ }
+ 
+-static int hisi_zip_set_qm_algs(struct hisi_qm *qm)
+-{
+-	struct device *dev = &qm->pdev->dev;
+-	char *algs, *ptr;
+-	u32 alg_mask;
+-	int i;
+-
+-	if (!qm->use_sva)
+-		return 0;
+-
+-	algs = devm_kzalloc(dev, HZIP_DEV_ALG_MAX_LEN * sizeof(char), GFP_KERNEL);
+-	if (!algs)
+-		return -ENOMEM;
+-
+-	alg_mask = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver);
+-
+-	for (i = 0; i < ARRAY_SIZE(zip_dev_algs); i++)
+-		if (alg_mask & zip_dev_algs[i].alg_msk)
+-			strcat(algs, zip_dev_algs[i].algs);
+-
+-	ptr = strrchr(algs, '\n');
+-	if (ptr)
+-		*ptr = '\0';
+-
+-	qm->uacce->algs = algs;
+-
+-	return 0;
+-}
+-
+ static void hisi_zip_open_sva_prefetch(struct hisi_qm *qm)
+ {
+ 	u32 val;
+@@ -1193,6 +1158,7 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ 
+ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
++	u64 alg_msk;
+ 	int ret;
+ 
+ 	qm->pdev = pdev;
+@@ -1228,7 +1194,8 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	ret = hisi_zip_set_qm_algs(qm);
++	alg_msk = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver);
++	ret = hisi_qm_set_algs(qm, alg_msk, zip_dev_algs, ARRAY_SIZE(zip_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set zip algs!\n");
+ 		hisi_qm_uninit(qm);
+diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
+index b8da977711a7..4c5611d99c42 100644
+--- a/include/linux/hisi_acc_qm.h
++++ b/include/linux/hisi_acc_qm.h
+@@ -160,6 +160,11 @@ enum qm_cap_bits {
+ 	QM_SUPPORT_RPM,
+ };
+ 
++struct qm_dev_alg {
++	u64 alg_msk;
++	const char *alg;
++};
++
+ struct dfx_diff_registers {
+ 	u32 *regs;
+ 	u32 reg_offset;
+@@ -375,7 +380,6 @@ struct hisi_qm {
+ 	struct work_struct rst_work;
+ 	struct work_struct cmd_process;
+ 
+-	const char *algs;
+ 	bool use_sva;
+ 
+ 	resource_size_t phys_base;
+@@ -575,6 +579,8 @@ void hisi_qm_regs_dump(struct seq_file *s, struct debugfs_regset32 *regset);
+ u32 hisi_qm_get_hw_info(struct hisi_qm *qm,
+ 			const struct hisi_qm_cap_info *info_table,
+ 			u32 index, bool is_read);
++int hisi_qm_set_algs(struct hisi_qm *qm, u64 alg_msk, const struct qm_dev_alg *dev_algs,
++		     u32 dev_algs_size);
+ 
+ /* Used by VFIO ACC live migration driver */
+ struct pci_driver *hisi_sec_get_pf_driver(void);
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch b/queue-6.7/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
new file mode 100644
index 00000000000..275ae9ebfb9
--- /dev/null
+++ b/queue-6.7/crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
@@ -0,0 +1,257 @@
+From 1702fe54719ed53f949cfbf643d982d395ed5f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:19 +0800
+Subject: crypto: hisilicon/qm - save capability registers in qm init process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit cabe13d0bd2efb8dd50ed2310f57b33e1a69a0d4 ]
+
+In previous capability register implementation, qm irq related values
+were read from capability registers dynamically when needed. But in
+abnormal scenario, e.g. the core is timeout and the device needs to
+soft reset and reset failed after disabling the MSE, the device can
+not be removed normally, causing the following call trace:
+
+	| Call trace:
+        |  pci_irq_vector+0xfc/0x140
+        |  hisi_qm_uninit+0x278/0x3b0 [hisi_qm]
+        |  hpre_remove+0x16c/0x1c0 [hisi_hpre]
+        |  pci_device_remove+0x6c/0x264
+        |  device_release_driver_internal+0x1ec/0x3e0
+        |  device_release_driver+0x3c/0x60
+        |  pci_stop_bus_device+0xfc/0x22c
+        |  pci_stop_and_remove_bus_device+0x38/0x70
+        |  pci_iov_remove_virtfn+0x108/0x1c0
+        |  sriov_disable+0x7c/0x1e4
+        |  pci_disable_sriov+0x4c/0x6c
+        |  hisi_qm_sriov_disable+0x90/0x160 [hisi_qm]
+        |  hpre_remove+0x1a8/0x1c0 [hisi_hpre]
+        |  pci_device_remove+0x6c/0x264
+        |  device_release_driver_internal+0x1ec/0x3e0
+        |  driver_detach+0x168/0x2d0
+        |  bus_remove_driver+0xc0/0x230
+        |  driver_unregister+0x58/0xdc
+        |  pci_unregister_driver+0x40/0x220
+        |  hpre_exit+0x34/0x64 [hisi_hpre]
+        |  __arm64_sys_delete_module+0x374/0x620
+        [...]
+
+        | Call trace:
+        |  free_msi_irqs+0x25c/0x300
+        |  pci_disable_msi+0x19c/0x264
+        |  pci_free_irq_vectors+0x4c/0x70
+        |  hisi_qm_pci_uninit+0x44/0x90 [hisi_qm]
+        |  hisi_qm_uninit+0x28c/0x3b0 [hisi_qm]
+        |  hpre_remove+0x16c/0x1c0 [hisi_hpre]
+        |  pci_device_remove+0x6c/0x264
+        [...]
+
+The reason for this call trace is that when the MSE is disabled, the value
+of capability registers in the BAR space become invalid. This will make the
+subsequent unregister process get the wrong irq vector through capability
+registers and get the wrong irq number by pci_irq_vector().
+
+So add a capability table structure to pre-store the valid value of the irq
+information capability register in qm init process, avoid obtaining invalid
+capability register value after the MSE is disabled.
+
+Fixes: 3536cc55cada ("crypto: hisilicon/qm - support get device irq information from hardware registers")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/qm.c | 62 +++++++++++++++++++++++++++++------
+ include/linux/hisi_acc_qm.h   | 12 +++++++
+ 2 files changed, 64 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c
+index 18599f3634c3..30b43006d1db 100644
+--- a/drivers/crypto/hisilicon/qm.c
++++ b/drivers/crypto/hisilicon/qm.c
+@@ -294,6 +294,13 @@ enum qm_basic_type {
+ 	QM_VF_IRQ_NUM_CAP,
+ };
+ 
++enum qm_pre_store_cap_idx {
++	QM_EQ_IRQ_TYPE_CAP_IDX = 0x0,
++	QM_AEQ_IRQ_TYPE_CAP_IDX,
++	QM_ABN_IRQ_TYPE_CAP_IDX,
++	QM_PF2VF_IRQ_TYPE_CAP_IDX,
++};
++
+ static const struct hisi_qm_cap_info qm_cap_info_comm[] = {
+ 	{QM_SUPPORT_DB_ISOLATION, 0x30,   0, BIT(0),  0x0, 0x0, 0x0},
+ 	{QM_SUPPORT_FUNC_QOS,     0x3100, 0, BIT(8),  0x0, 0x0, 0x1},
+@@ -323,6 +330,13 @@ static const struct hisi_qm_cap_info qm_basic_info[] = {
+ 	{QM_VF_IRQ_NUM_CAP,     0x311c,   0,  GENMASK(15, 0), 0x1,       0x2,       0x3},
+ };
+ 
++static const u32 qm_pre_store_caps[] = {
++	QM_EQ_IRQ_TYPE_CAP,
++	QM_AEQ_IRQ_TYPE_CAP,
++	QM_ABN_IRQ_TYPE_CAP,
++	QM_PF2VF_IRQ_TYPE_CAP,
++};
++
+ struct qm_mailbox {
+ 	__le16 w0;
+ 	__le16 queue_num;
+@@ -4816,7 +4830,7 @@ static void qm_unregister_abnormal_irq(struct hisi_qm *qm)
+ 	if (qm->fun_type == QM_HW_VF)
+ 		return;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4833,7 +4847,7 @@ static int qm_register_abnormal_irq(struct hisi_qm *qm)
+ 	if (qm->fun_type == QM_HW_VF)
+ 		return 0;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_ABN_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_ABN_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_ABN_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -4850,7 +4864,7 @@ static void qm_unregister_mb_cmd_irq(struct hisi_qm *qm)
+ 	struct pci_dev *pdev = qm->pdev;
+ 	u32 irq_vector, val;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4864,7 +4878,7 @@ static int qm_register_mb_cmd_irq(struct hisi_qm *qm)
+ 	u32 irq_vector, val;
+ 	int ret;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_PF2VF_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_PF2VF_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -4881,7 +4895,7 @@ static void qm_unregister_aeq_irq(struct hisi_qm *qm)
+ 	struct pci_dev *pdev = qm->pdev;
+ 	u32 irq_vector, val;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4895,7 +4909,7 @@ static int qm_register_aeq_irq(struct hisi_qm *qm)
+ 	u32 irq_vector, val;
+ 	int ret;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_AEQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_AEQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -4913,7 +4927,7 @@ static void qm_unregister_eq_irq(struct hisi_qm *qm)
+ 	struct pci_dev *pdev = qm->pdev;
+ 	u32 irq_vector, val;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return;
+ 
+@@ -4927,7 +4941,7 @@ static int qm_register_eq_irq(struct hisi_qm *qm)
+ 	u32 irq_vector, val;
+ 	int ret;
+ 
+-	val = hisi_qm_get_hw_info(qm, qm_basic_info, QM_EQ_IRQ_TYPE_CAP, qm->cap_ver);
++	val = qm->cap_tables.qm_cap_table[QM_EQ_IRQ_TYPE_CAP_IDX].cap_val;
+ 	if (!((val >> QM_IRQ_TYPE_SHIFT) & QM_IRQ_TYPE_MASK))
+ 		return 0;
+ 
+@@ -5015,7 +5029,29 @@ static int qm_get_qp_num(struct hisi_qm *qm)
+ 	return 0;
+ }
+ 
+-static void qm_get_hw_caps(struct hisi_qm *qm)
++static int qm_pre_store_irq_type_caps(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *qm_cap;
++	struct pci_dev *pdev = qm->pdev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(qm_pre_store_caps);
++	qm_cap = devm_kzalloc(&pdev->dev, sizeof(*qm_cap) * size, GFP_KERNEL);
++	if (!qm_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		qm_cap[i].type = qm_pre_store_caps[i];
++		qm_cap[i].cap_val = hisi_qm_get_hw_info(qm, qm_basic_info,
++							qm_pre_store_caps[i], qm->cap_ver);
++	}
++
++	qm->cap_tables.qm_cap_table = qm_cap;
++
++	return 0;
++}
++
++static int qm_get_hw_caps(struct hisi_qm *qm)
+ {
+ 	const struct hisi_qm_cap_info *cap_info = qm->fun_type == QM_HW_PF ?
+ 						  qm_cap_info_pf : qm_cap_info_vf;
+@@ -5046,6 +5082,9 @@ static void qm_get_hw_caps(struct hisi_qm *qm)
+ 		if (val)
+ 			set_bit(cap_info[i].type, &qm->caps);
+ 	}
++
++	/* Fetch and save the value of irq type related capability registers */
++	return qm_pre_store_irq_type_caps(qm);
+ }
+ 
+ static int qm_get_pci_res(struct hisi_qm *qm)
+@@ -5067,7 +5106,10 @@ static int qm_get_pci_res(struct hisi_qm *qm)
+ 		goto err_request_mem_regions;
+ 	}
+ 
+-	qm_get_hw_caps(qm);
++	ret = qm_get_hw_caps(qm);
++	if (ret)
++		goto err_ioremap;
++
+ 	if (test_bit(QM_SUPPORT_DB_ISOLATION, &qm->caps)) {
+ 		qm->db_interval = QM_QP_DB_INTERVAL;
+ 		qm->db_phys_base = pci_resource_start(pdev, PCI_BAR_4);
+diff --git a/include/linux/hisi_acc_qm.h b/include/linux/hisi_acc_qm.h
+index ddc7ebb70523..b8da977711a7 100644
+--- a/include/linux/hisi_acc_qm.h
++++ b/include/linux/hisi_acc_qm.h
+@@ -265,6 +265,16 @@ struct hisi_qm_cap_info {
+ 	u32 v3_val;
+ };
+ 
++struct hisi_qm_cap_record {
++	u32 type;
++	u32 cap_val;
++};
++
++struct hisi_qm_cap_tables {
++	struct hisi_qm_cap_record *qm_cap_table;
++	struct hisi_qm_cap_record *dev_cap_table;
++};
++
+ struct hisi_qm_list {
+ 	struct mutex lock;
+ 	struct list_head list;
+@@ -376,6 +386,8 @@ struct hisi_qm {
+ 	u32 mb_qos;
+ 	u32 type_rate;
+ 	struct qm_err_isolate isolate_data;
++
++	struct hisi_qm_cap_tables cap_tables;
+ };
+ 
+ struct hisi_qp_status {
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-hisilicon-sec2-save-capability-registers-in-p.patch b/queue-6.7/crypto-hisilicon-sec2-save-capability-registers-in-p.patch
new file mode 100644
index 00000000000..c3f8ca4c8ea
--- /dev/null
+++ b/queue-6.7/crypto-hisilicon-sec2-save-capability-registers-in-p.patch
@@ -0,0 +1,151 @@
+From a514a140866202f4119af7b520387d5496d4704d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:21 +0800
+Subject: crypto: hisilicon/sec2 - save capability registers in probe process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit f1115b0096c3163592e04e74f5a7548c25bda957 ]
+
+Pre-store the valid value of the sec alg support related capability
+register in sec_qm_init(), which will be called by probe process.
+It can reduce the number of capability register queries and avoid
+obtaining incorrect values in abnormal scenarios, such as reset
+failed and the memory space disabled.
+
+Fixes: 921715b6b782 ("crypto: hisilicon/sec - get algorithm bitmap from registers")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/sec2/sec.h        |  7 ++++
+ drivers/crypto/hisilicon/sec2/sec_crypto.c | 10 ++++-
+ drivers/crypto/hisilicon/sec2/sec_main.c   | 43 ++++++++++++++++++++--
+ 3 files changed, 55 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
+index 3e57fc04b377..410c83712e28 100644
+--- a/drivers/crypto/hisilicon/sec2/sec.h
++++ b/drivers/crypto/hisilicon/sec2/sec.h
+@@ -220,6 +220,13 @@ enum sec_cap_type {
+ 	SEC_CORE4_ALG_BITMAP_HIGH,
+ };
+ 
++enum sec_cap_reg_record_idx {
++	SEC_DRV_ALG_BITMAP_LOW_IDX = 0x0,
++	SEC_DRV_ALG_BITMAP_HIGH_IDX,
++	SEC_DEV_ALG_BITMAP_LOW_IDX,
++	SEC_DEV_ALG_BITMAP_HIGH_IDX,
++};
++
+ void sec_destroy_qps(struct hisi_qp **qps, int qp_num);
+ struct hisi_qp **sec_create_qps(void);
+ int sec_register_to_crypto(struct hisi_qm *qm);
+diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+index 6fcabbc87860..ba7f305d43c1 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c
++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c
+@@ -2547,9 +2547,12 @@ static int sec_register_aead(u64 alg_mask)
+ 
+ int sec_register_to_crypto(struct hisi_qm *qm)
+ {
+-	u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW);
++	u64 alg_mask;
+ 	int ret = 0;
+ 
++	alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX,
++				      SEC_DRV_ALG_BITMAP_LOW_IDX);
++
+ 	mutex_lock(&sec_algs_lock);
+ 	if (sec_available_devs) {
+ 		sec_available_devs++;
+@@ -2578,7 +2581,10 @@ int sec_register_to_crypto(struct hisi_qm *qm)
+ 
+ void sec_unregister_from_crypto(struct hisi_qm *qm)
+ {
+-	u64 alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH, SEC_DRV_ALG_BITMAP_LOW);
++	u64 alg_mask;
++
++	alg_mask = sec_get_alg_bitmap(qm, SEC_DRV_ALG_BITMAP_HIGH_IDX,
++				      SEC_DRV_ALG_BITMAP_LOW_IDX);
+ 
+ 	mutex_lock(&sec_algs_lock);
+ 	if (--sec_available_devs)
+diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
+index 2eceab7600ca..878d94ab5d6d 100644
+--- a/drivers/crypto/hisilicon/sec2/sec_main.c
++++ b/drivers/crypto/hisilicon/sec2/sec_main.c
+@@ -167,6 +167,13 @@ static const struct hisi_qm_cap_info sec_basic_info[] = {
+ 	{SEC_CORE4_ALG_BITMAP_HIGH, 0x3170, 0, GENMASK(31, 0), 0x3FFF, 0x3FFF, 0x3FFF},
+ };
+ 
++static const u32 sec_pre_store_caps[] = {
++	SEC_DRV_ALG_BITMAP_LOW,
++	SEC_DRV_ALG_BITMAP_HIGH,
++	SEC_DEV_ALG_BITMAP_LOW,
++	SEC_DEV_ALG_BITMAP_HIGH,
++};
++
+ static const struct qm_dev_alg sec_dev_algs[] = { {
+ 		.alg_msk = SEC_CIPHER_BITMAP,
+ 		.alg = "cipher\n",
+@@ -388,8 +395,8 @@ u64 sec_get_alg_bitmap(struct hisi_qm *qm, u32 high, u32 low)
+ {
+ 	u32 cap_val_h, cap_val_l;
+ 
+-	cap_val_h = hisi_qm_get_hw_info(qm, sec_basic_info, high, qm->cap_ver);
+-	cap_val_l = hisi_qm_get_hw_info(qm, sec_basic_info, low, qm->cap_ver);
++	cap_val_h = qm->cap_tables.dev_cap_table[high].cap_val;
++	cap_val_l = qm->cap_tables.dev_cap_table[low].cap_val;
+ 
+ 	return ((u64)cap_val_h << SEC_ALG_BITMAP_SHIFT) | (u64)cap_val_l;
+ }
+@@ -1071,6 +1078,28 @@ static int sec_pf_probe_init(struct sec_dev *sec)
+ 	return ret;
+ }
+ 
++static int sec_pre_store_cap_reg(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *sec_cap;
++	struct pci_dev *pdev = qm->pdev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(sec_pre_store_caps);
++	sec_cap = devm_kzalloc(&pdev->dev, sizeof(*sec_cap) * size, GFP_KERNEL);
++	if (!sec_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		sec_cap[i].type = sec_pre_store_caps[i];
++		sec_cap[i].cap_val = hisi_qm_get_hw_info(qm, sec_basic_info,
++				     sec_pre_store_caps[i], qm->cap_ver);
++	}
++
++	qm->cap_tables.dev_cap_table = sec_cap;
++
++	return 0;
++}
++
+ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
+ 	u64 alg_msk;
+@@ -1108,7 +1137,15 @@ static int sec_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH, SEC_DEV_ALG_BITMAP_LOW);
++	/* Fetch and save the value of capability registers */
++	ret = sec_pre_store_cap_reg(qm);
++	if (ret) {
++		pci_err(qm->pdev, "Failed to pre-store capability registers!\n");
++		hisi_qm_uninit(qm);
++		return ret;
++	}
++
++	alg_msk = sec_get_alg_bitmap(qm, SEC_DEV_ALG_BITMAP_HIGH_IDX, SEC_DEV_ALG_BITMAP_LOW_IDX);
+ 	ret = hisi_qm_set_algs(qm, alg_msk, sec_dev_algs, ARRAY_SIZE(sec_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set sec algs!\n");
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch b/queue-6.7/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
new file mode 100644
index 00000000000..70de2412d5a
--- /dev/null
+++ b/queue-6.7/crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
@@ -0,0 +1,125 @@
+From 98eff14939a5e9bda6788534a64f0acb80a3ed6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Nov 2023 13:49:24 +0800
+Subject: crypto: hisilicon/zip - add zip comp high perf mode configuration
+
+From: Chenghai Huang <huangchenghai2@huawei.com>
+
+[ Upstream commit a9864bae1806499ebf3757a9e71dddde5b9c48c6 ]
+
+To meet specific application scenarios, the function of switching between
+the high performance mode and the high compression mode is added.
+
+Use the perf_mode=0/1 configuration to set the compression high perf mode,
+0(default, high compression mode), 1(high performance mode). These two
+modes only apply to the compression direction and are compatible with
+software algorithm in both directions.
+
+Signed-off-by: Chenghai Huang <huangchenghai2@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: cf8b5156bbc8 ("crypto: hisilicon/hpre - save capability registers in probe process")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 65 +++++++++++++++++++++++++
+ 1 file changed, 65 insertions(+)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index db4c964cd649..85576f818278 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -107,6 +107,14 @@
+ #define HZIP_CLOCK_GATED_EN		(HZIP_CORE_GATED_EN | \
+ 					 HZIP_CORE_GATED_OOO_EN)
+ 
++/* zip comp high performance */
++#define HZIP_HIGH_PERF_OFFSET		0x301208
++
++enum {
++	HZIP_HIGH_COMP_RATE,
++	HZIP_HIGH_COMP_PERF,
++};
++
+ static const char hisi_zip_name[] = "hisi_zip";
+ static struct dentry *hzip_debugfs_root;
+ 
+@@ -352,6 +360,37 @@ static int hzip_diff_regs_show(struct seq_file *s, void *unused)
+ 	return 0;
+ }
+ DEFINE_SHOW_ATTRIBUTE(hzip_diff_regs);
++
++static int perf_mode_set(const char *val, const struct kernel_param *kp)
++{
++	int ret;
++	u32 n;
++
++	if (!val)
++		return -EINVAL;
++
++	ret = kstrtou32(val, 10, &n);
++	if (ret != 0 || (n != HZIP_HIGH_COMP_PERF &&
++			 n != HZIP_HIGH_COMP_RATE))
++		return -EINVAL;
++
++	return param_set_int(val, kp);
++}
++
++static const struct kernel_param_ops zip_com_perf_ops = {
++	.set = perf_mode_set,
++	.get = param_get_int,
++};
++
++/*
++ * perf_mode = 0 means enable high compression rate mode,
++ * perf_mode = 1 means enable high compression performance mode.
++ * These two modes only apply to the compression direction.
++ */
++static u32 perf_mode = HZIP_HIGH_COMP_RATE;
++module_param_cb(perf_mode, &zip_com_perf_ops, &perf_mode, 0444);
++MODULE_PARM_DESC(perf_mode, "ZIP high perf mode 0(default), 1(enable)");
++
+ static const struct kernel_param_ops zip_uacce_mode_ops = {
+ 	.set = uacce_mode_set,
+ 	.get = param_get_int,
+@@ -417,6 +456,28 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ 	return false;
+ }
+ 
++static int hisi_zip_set_high_perf(struct hisi_qm *qm)
++{
++	u32 val;
++	int ret;
++
++	val = readl_relaxed(qm->io_base + HZIP_HIGH_PERF_OFFSET);
++	if (perf_mode == HZIP_HIGH_COMP_PERF)
++		val |= HZIP_HIGH_COMP_PERF;
++	else
++		val &= ~HZIP_HIGH_COMP_PERF;
++
++	/* Set perf mode */
++	writel(val, qm->io_base + HZIP_HIGH_PERF_OFFSET);
++	ret = readl_relaxed_poll_timeout(qm->io_base + HZIP_HIGH_PERF_OFFSET,
++					 val, val == perf_mode, HZIP_DELAY_1_US,
++					 HZIP_POLL_TIMEOUT_US);
++	if (ret)
++		pci_err(qm->pdev, "failed to set perf mode\n");
++
++	return ret;
++}
++
+ static int hisi_zip_set_qm_algs(struct hisi_qm *qm)
+ {
+ 	struct device *dev = &qm->pdev->dev;
+@@ -1115,6 +1176,10 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ 	if (ret)
+ 		return ret;
+ 
++	ret = hisi_zip_set_high_perf(qm);
++	if (ret)
++		return ret;
++
+ 	hisi_zip_open_sva_prefetch(qm);
+ 	hisi_qm_dev_err_init(qm);
+ 	hisi_zip_debug_regs_clear(qm);
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-hisilicon-zip-save-capability-registers-in-pr.patch b/queue-6.7/crypto-hisilicon-zip-save-capability-registers-in-pr.patch
new file mode 100644
index 00000000000..cd3fa1aa29c
--- /dev/null
+++ b/queue-6.7/crypto-hisilicon-zip-save-capability-registers-in-pr.patch
@@ -0,0 +1,159 @@
+From 3715b4f8f09a0b5fd75898070dec988448cced86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:17:22 +0800
+Subject: crypto: hisilicon/zip - save capability registers in probe process
+
+From: Zhiqi Song <songzhiqi1@huawei.com>
+
+[ Upstream commit 2ff0ad847951d61c2d8b309e1ccefb26c57dcc7b ]
+
+Pre-store the valid value of the zip alg support related capability
+register in hisi_zip_qm_init(), which will be called by hisi_zip_probe().
+It can reduce the number of capability register queries and avoid
+obtaining incorrect values in abnormal scenarios, such as reset failed
+and the memory space disabled.
+
+Fixes: db700974b69d ("crypto: hisilicon/zip - support zip capability")
+Signed-off-by: Zhiqi Song <songzhiqi1@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/hisilicon/zip/zip_main.c | 73 ++++++++++++++++++++-----
+ 1 file changed, 60 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/hisilicon/zip/zip_main.c b/drivers/crypto/hisilicon/zip/zip_main.c
+index f7cf54f02dd7..403b07468841 100644
+--- a/drivers/crypto/hisilicon/zip/zip_main.c
++++ b/drivers/crypto/hisilicon/zip/zip_main.c
+@@ -249,6 +249,26 @@ static struct hisi_qm_cap_info zip_basic_cap_info[] = {
+ 	{ZIP_CAP_MAX, 0x317c, 0, GENMASK(0, 0), 0x0, 0x0, 0x0}
+ };
+ 
++enum zip_pre_store_cap_idx {
++	ZIP_CORE_NUM_CAP_IDX = 0x0,
++	ZIP_CLUSTER_COMP_NUM_CAP_IDX,
++	ZIP_CLUSTER_DECOMP_NUM_CAP_IDX,
++	ZIP_DECOMP_ENABLE_BITMAP_IDX,
++	ZIP_COMP_ENABLE_BITMAP_IDX,
++	ZIP_DRV_ALG_BITMAP_IDX,
++	ZIP_DEV_ALG_BITMAP_IDX,
++};
++
++static const u32 zip_pre_store_caps[] = {
++	ZIP_CORE_NUM_CAP,
++	ZIP_CLUSTER_COMP_NUM_CAP,
++	ZIP_CLUSTER_DECOMP_NUM_CAP,
++	ZIP_DECOMP_ENABLE_BITMAP,
++	ZIP_COMP_ENABLE_BITMAP,
++	ZIP_DRV_ALG_BITMAP,
++	ZIP_DEV_ALG_BITMAP,
++};
++
+ enum {
+ 	HZIP_COMP_CORE0,
+ 	HZIP_COMP_CORE1,
+@@ -443,7 +463,7 @@ bool hisi_zip_alg_support(struct hisi_qm *qm, u32 alg)
+ {
+ 	u32 cap_val;
+ 
+-	cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DRV_ALG_BITMAP, qm->cap_ver);
++	cap_val = qm->cap_tables.dev_cap_table[ZIP_DRV_ALG_BITMAP_IDX].cap_val;
+ 	if ((alg & cap_val) == alg)
+ 		return true;
+ 
+@@ -568,10 +588,8 @@ static int hisi_zip_set_user_domain_and_cache(struct hisi_qm *qm)
+ 	}
+ 
+ 	/* let's open all compression/decompression cores */
+-	dcomp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info,
+-				       ZIP_DECOMP_ENABLE_BITMAP, qm->cap_ver);
+-	comp_bm = hisi_qm_get_hw_info(qm, zip_basic_cap_info,
+-				      ZIP_COMP_ENABLE_BITMAP, qm->cap_ver);
++	dcomp_bm = qm->cap_tables.dev_cap_table[ZIP_DECOMP_ENABLE_BITMAP_IDX].cap_val;
++	comp_bm = qm->cap_tables.dev_cap_table[ZIP_COMP_ENABLE_BITMAP_IDX].cap_val;
+ 	writel(HZIP_DECOMP_CHECK_ENABLE | dcomp_bm | comp_bm, base + HZIP_CLOCK_GATE_CTRL);
+ 
+ 	/* enable sqc,cqc writeback */
+@@ -798,9 +816,8 @@ static int hisi_zip_core_debug_init(struct hisi_qm *qm)
+ 	char buf[HZIP_BUF_SIZE];
+ 	int i;
+ 
+-	zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver);
+-	zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP,
+-						qm->cap_ver);
++	zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val;
++	zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val;
+ 
+ 	for (i = 0; i < zip_core_num; i++) {
+ 		if (i < zip_comp_core_num)
+@@ -942,7 +959,7 @@ static int hisi_zip_show_last_regs_init(struct hisi_qm *qm)
+ 	u32 zip_core_num;
+ 	int i, j, idx;
+ 
+-	zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver);
++	zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val;
+ 
+ 	debug->last_words = kcalloc(core_dfx_regs_num * zip_core_num + com_dfx_regs_num,
+ 				    sizeof(unsigned int), GFP_KERNEL);
+@@ -998,9 +1015,9 @@ static void hisi_zip_show_last_dfx_regs(struct hisi_qm *qm)
+ 				 hzip_com_dfx_regs[i].name, debug->last_words[i], val);
+ 	}
+ 
+-	zip_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CORE_NUM_CAP, qm->cap_ver);
+-	zip_comp_core_num = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_CLUSTER_COMP_NUM_CAP,
+-						qm->cap_ver);
++	zip_core_num = qm->cap_tables.dev_cap_table[ZIP_CORE_NUM_CAP_IDX].cap_val;
++	zip_comp_core_num = qm->cap_tables.dev_cap_table[ZIP_CLUSTER_COMP_NUM_CAP_IDX].cap_val;
++
+ 	for (i = 0; i < zip_core_num; i++) {
+ 		if (i < zip_comp_core_num)
+ 			scnprintf(buf, sizeof(buf), "Comp_core-%d", i);
+@@ -1156,6 +1173,28 @@ static int hisi_zip_pf_probe_init(struct hisi_zip *hisi_zip)
+ 	return ret;
+ }
+ 
++static int zip_pre_store_cap_reg(struct hisi_qm *qm)
++{
++	struct hisi_qm_cap_record *zip_cap;
++	struct pci_dev *pdev = qm->pdev;
++	size_t i, size;
++
++	size = ARRAY_SIZE(zip_pre_store_caps);
++	zip_cap = devm_kzalloc(&pdev->dev, sizeof(*zip_cap) * size, GFP_KERNEL);
++	if (!zip_cap)
++		return -ENOMEM;
++
++	for (i = 0; i < size; i++) {
++		zip_cap[i].type = zip_pre_store_caps[i];
++		zip_cap[i].cap_val = hisi_qm_get_hw_info(qm, zip_basic_cap_info,
++				     zip_pre_store_caps[i], qm->cap_ver);
++	}
++
++	qm->cap_tables.dev_cap_table = zip_cap;
++
++	return 0;
++}
++
+ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ {
+ 	u64 alg_msk;
+@@ -1194,7 +1233,15 @@ static int hisi_zip_qm_init(struct hisi_qm *qm, struct pci_dev *pdev)
+ 		return ret;
+ 	}
+ 
+-	alg_msk = hisi_qm_get_hw_info(qm, zip_basic_cap_info, ZIP_DEV_ALG_BITMAP, qm->cap_ver);
++	/* Fetch and save the value of capability registers */
++	ret = zip_pre_store_cap_reg(qm);
++	if (ret) {
++		pci_err(qm->pdev, "Failed to pre-store capability registers!\n");
++		hisi_qm_uninit(qm);
++		return ret;
++	}
++
++	alg_msk = qm->cap_tables.dev_cap_table[ZIP_DEV_ALG_BITMAP_IDX].cap_val;
+ 	ret = hisi_qm_set_algs(qm, alg_msk, zip_dev_algs, ARRAY_SIZE(zip_dev_algs));
+ 	if (ret) {
+ 		pci_err(qm->pdev, "Failed to set zip algs!\n");
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-jh7110-correct-deferred-probe-return.patch b/queue-6.7/crypto-jh7110-correct-deferred-probe-return.patch
new file mode 100644
index 00000000000..b3491bb1fa4
--- /dev/null
+++ b/queue-6.7/crypto-jh7110-correct-deferred-probe-return.patch
@@ -0,0 +1,54 @@
+From cec92c477ee3b1ab16e6f8bc22993898914e4d13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 15:32:59 +0900
+Subject: crypto: jh7110 - Correct deferred probe return
+
+From: Chanho Park <chanho61.park@samsung.com>
+
+[ Upstream commit d57343022b71b9f41e731282dbe0baf0cff6ada8 ]
+
+This fixes list_add corruption error when the driver is returned
+with -EPROBE_DEFER. It is also required to roll back the previous
+probe sequences in case of deferred_probe. So, this removes
+'err_probe_defer" goto label and just use err_dma_init instead.
+
+Fixes: 42ef0e944b01 ("crypto: starfive - Add crypto engine support")
+Signed-off-by: Chanho Park <chanho61.park@samsung.com>
+Reviewed-by: Jia Jie Ho <jiajie.ho@starfivetech.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/starfive/jh7110-cryp.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/crypto/starfive/jh7110-cryp.c b/drivers/crypto/starfive/jh7110-cryp.c
+index 08e974e0dd12..3a67ddc4d936 100644
+--- a/drivers/crypto/starfive/jh7110-cryp.c
++++ b/drivers/crypto/starfive/jh7110-cryp.c
+@@ -180,12 +180,8 @@ static int starfive_cryp_probe(struct platform_device *pdev)
+ 	spin_unlock(&dev_list.lock);
+ 
+ 	ret = starfive_dma_init(cryp);
+-	if (ret) {
+-		if (ret == -EPROBE_DEFER)
+-			goto err_probe_defer;
+-		else
+-			goto err_dma_init;
+-	}
++	if (ret)
++		goto err_dma_init;
+ 
+ 	/* Initialize crypto engine */
+ 	cryp->engine = crypto_engine_alloc_init(&pdev->dev, 1);
+@@ -233,7 +229,7 @@ static int starfive_cryp_probe(struct platform_device *pdev)
+ 
+ 	tasklet_kill(&cryp->aes_done);
+ 	tasklet_kill(&cryp->hash_done);
+-err_probe_defer:
++
+ 	return ret;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-qat-add-null-pointer-check.patch b/queue-6.7/crypto-qat-add-null-pointer-check.patch
new file mode 100644
index 00000000000..d167fe09a48
--- /dev/null
+++ b/queue-6.7/crypto-qat-add-null-pointer-check.patch
@@ -0,0 +1,40 @@
+From 6a3c9b7c48349f5a7f32b3b46a38c1eca6305b33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 19:17:25 +0000
+Subject: crypto: qat - add NULL pointer check
+
+From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+
+[ Upstream commit a643212c9f28d09225c3792c316bc4aaf6be4a68 ]
+
+There is a possibility that the function adf_devmgr_pci_to_accel_dev()
+might return a NULL pointer.
+Add a NULL pointer check in the function rp2srv_show().
+
+Fixes: dbc8876dd873 ("crypto: qat - add rp2svc sysfs attribute")
+Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
+Reviewed-by: David Guckian <david.guckian@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_sysfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
+index 6f0b3629da13..d450dad32c9e 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
+@@ -215,6 +215,9 @@ static ssize_t rp2srv_show(struct device *dev, struct device_attribute *attr,
+ 	enum adf_cfg_service_type svc;
+ 
+ 	accel_dev = adf_devmgr_pci_to_accel_dev(to_pci_dev(dev));
++	if (!accel_dev)
++		return -EINVAL;
++
+ 	hw_data = GET_HW_DATA(accel_dev);
+ 
+ 	if (accel_dev->sysfs.ring_num == UNSET_RING_NUM)
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-qat-add-sysfs_added-flag-for-ras.patch b/queue-6.7/crypto-qat-add-sysfs_added-flag-for-ras.patch
new file mode 100644
index 00000000000..e0bfacbc4eb
--- /dev/null
+++ b/queue-6.7/crypto-qat-add-sysfs_added-flag-for-ras.patch
@@ -0,0 +1,89 @@
+From 7bcbc82c31ecce1599d08c5d22bc09e701ae6ef1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 17:59:45 +0100
+Subject: crypto: qat - add sysfs_added flag for ras
+
+From: Damian Muszynski <damian.muszynski@intel.com>
+
+[ Upstream commit 65089000ba8c2ae713ccac6603319143f3e1c08b ]
+
+The qat_ras sysfs attribute group is registered within the
+adf_dev_start() function, alongside other driver components.
+If any of the functions preceding the group registration fails,
+the adf_dev_start() function returns, and the caller, to undo the
+operation, invokes adf_dev_stop() followed by adf_dev_shutdown().
+However, the current flow lacks information about whether the
+registration of the qat_ras attribute group was successful or not.
+
+In cases where this condition is encountered, an error similar to
+the following might be reported:
+
+    4xxx 0000:6b:00.0: Starting device qat_dev0
+    4xxx 0000:6b:00.0: qat_dev0 started 9 acceleration engines
+    4xxx 0000:6b:00.0: Failed to send init message
+    4xxx 0000:6b:00.0: Failed to start device qat_dev0
+    sysfs group 'qat_ras' not found for kobject '0000:6b:00.0'
+    ...
+    sysfs_remove_groups+0x29/0x50
+    adf_sysfs_stop_ras+0x4b/0x80 [intel_qat]
+    adf_dev_stop+0x43/0x1d0 [intel_qat]
+    adf_dev_down+0x4b/0x150 [intel_qat]
+    ...
+    4xxx 0000:6b:00.0: qat_dev0 stopped 9 acceleration engines
+    4xxx 0000:6b:00.0: Resetting device qat_dev0
+
+To prevent attempting to remove attributes from a group that has not
+been added yet, a flag named 'sysfs_added' is introduced. This flag
+is set to true upon the successful registration of the attribute group.
+
+Fixes: 532d7f6bc458 ("crypto: qat - add error counters")
+Signed-off-by: Damian Muszynski <damian.muszynski@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_accel_devices.h    | 1 +
+ .../crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c   | 7 ++++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h b/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h
+index 4ff5729a3496..9d5fdd529a2e 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h
++++ b/drivers/crypto/intel/qat/qat_common/adf_accel_devices.h
+@@ -92,6 +92,7 @@ enum ras_errors {
+ 
+ struct adf_error_counters {
+ 	atomic_t counter[ADF_RAS_ERRORS];
++	bool sysfs_added;
+ 	bool enabled;
+ };
+ 
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c
+index cffe2d722995..e97c67c87b3c 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs_ras_counters.c
+@@ -99,6 +99,8 @@ void adf_sysfs_start_ras(struct adf_accel_dev *accel_dev)
+ 	if (device_add_group(&GET_DEV(accel_dev), &qat_ras_group))
+ 		dev_err(&GET_DEV(accel_dev),
+ 			"Failed to create qat_ras attribute group.\n");
++
++	accel_dev->ras_errors.sysfs_added = true;
+ }
+ 
+ void adf_sysfs_stop_ras(struct adf_accel_dev *accel_dev)
+@@ -106,7 +108,10 @@ void adf_sysfs_stop_ras(struct adf_accel_dev *accel_dev)
+ 	if (!accel_dev->ras_errors.enabled)
+ 		return;
+ 
+-	device_remove_group(&GET_DEV(accel_dev), &qat_ras_group);
++	if (accel_dev->ras_errors.sysfs_added) {
++		device_remove_group(&GET_DEV(accel_dev), &qat_ras_group);
++		accel_dev->ras_errors.sysfs_added = false;
++	}
+ 
+ 	ADF_RAS_ERR_CTR_CLEAR(accel_dev->ras_errors);
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-qat-add-sysfs_added-flag-for-rate-limiting.patch b/queue-6.7/crypto-qat-add-sysfs_added-flag-for-rate-limiting.patch
new file mode 100644
index 00000000000..13c2efc7c97
--- /dev/null
+++ b/queue-6.7/crypto-qat-add-sysfs_added-flag-for-rate-limiting.patch
@@ -0,0 +1,89 @@
+From 98ea4356492445865ce63b08cf692800ec45a333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 18:02:23 +0100
+Subject: crypto: qat - add sysfs_added flag for rate limiting
+
+From: Damian Muszynski <damian.muszynski@intel.com>
+
+[ Upstream commit d71fdd0f3c278c7f132c3a522645ebf9157edd6d ]
+
+The qat_rl sysfs attribute group is registered within the adf_dev_start()
+function, alongside other driver components.
+If any of the functions preceding the group registration fails,
+the adf_dev_start() function returns, and the caller, to undo the
+operation, invokes adf_dev_stop() followed by adf_dev_shutdown().
+However, the current flow lacks information about whether the
+registration of the qat_rl attribute group was successful or not.
+
+In cases where this condition is encountered, an error similar to
+the following might be reported:
+
+    4xxx 0000:6b:00.0: Starting device qat_dev0
+    4xxx 0000:6b:00.0: qat_dev0 started 9 acceleration engines
+    4xxx 0000:6b:00.0: Failed to send init message
+    4xxx 0000:6b:00.0: Failed to start device qat_dev0
+    sysfs group 'qat_rl' not found for kobject '0000:6b:00.0'
+    ...
+    sysfs_remove_groups+0x2d/0x50
+    adf_sysfs_rl_rm+0x44/0x70 [intel_qat]
+    adf_rl_stop+0x2d/0xb0 [intel_qat]
+    adf_dev_stop+0x33/0x1d0 [intel_qat]
+    adf_dev_down+0xf1/0x150 [intel_qat]
+    ...
+    4xxx 0000:6b:00.0: qat_dev0 stopped 9 acceleration engines
+    4xxx 0000:6b:00.0: Resetting device qat_dev0
+
+To prevent attempting to remove attributes from a group that has not
+been added yet, a flag named 'sysfs_added' is introduced. This flag
+is set to true upon the successful registration of the attribute group.
+
+Fixes: d9fb8408376e ("crypto: qat - add rate limiting feature to qat_4xxx")
+Signed-off-by: Damian Muszynski <damian.muszynski@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_rl.h       | 1 +
+ drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_rl.h b/drivers/crypto/intel/qat/qat_common/adf_rl.h
+index eb5a330f8543..269c6656fb90 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_rl.h
++++ b/drivers/crypto/intel/qat/qat_common/adf_rl.h
+@@ -79,6 +79,7 @@ struct adf_rl_interface_data {
+ 	struct adf_rl_sla_input_data input;
+ 	enum adf_base_services cap_rem_srv;
+ 	struct rw_semaphore lock;
++	bool sysfs_added;
+ };
+ 
+ struct adf_rl_hw_data {
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c
+index abf9c52474ec..bedb514d4e30 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs_rl.c
+@@ -441,11 +441,19 @@ int adf_sysfs_rl_add(struct adf_accel_dev *accel_dev)
+ 
+ 	data->cap_rem_srv = ADF_SVC_NONE;
+ 	data->input.srv = ADF_SVC_NONE;
++	data->sysfs_added = true;
+ 
+ 	return ret;
+ }
+ 
+ void adf_sysfs_rl_rm(struct adf_accel_dev *accel_dev)
+ {
++	struct adf_rl_interface_data *data;
++
++	data = &GET_RL_STRUCT(accel_dev);
++	if (!data->sysfs_added)
++		return;
++
+ 	device_remove_group(&GET_DEV(accel_dev), &qat_rl_group);
++	data->sysfs_added = false;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-qat-fix-error-path-in-add_update_sla.patch b/queue-6.7/crypto-qat-fix-error-path-in-add_update_sla.patch
new file mode 100644
index 00000000000..76dce6be0bd
--- /dev/null
+++ b/queue-6.7/crypto-qat-fix-error-path-in-add_update_sla.patch
@@ -0,0 +1,58 @@
+From 0fadbb8f9b7dd850c19cd3a20131b9c75a03afb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 18:37:32 +0100
+Subject: crypto: qat - fix error path in add_update_sla()
+
+From: Damian Muszynski <damian.muszynski@intel.com>
+
+[ Upstream commit 6627f03c21cb7001ae4dbbfb7a8514516d02331c ]
+
+The input argument `sla_in` is a pointer to a structure that contains
+the parameters of the SLA which is being added or updated.
+If this pointer is NULL, the function should return an error as
+the data required for the algorithm is not available.
+By mistake, the logic jumps to the error path which dereferences
+the pointer.
+
+This results in a warnings reported by the static analyzer Smatch when
+executed without a database:
+
+    drivers/crypto/intel/qat/qat_common/adf_rl.c:871 add_update_sla()
+    error: we previously assumed 'sla_in' could be null (see line 812)
+
+This issue was not found in internal testing as the pointer cannot be
+NULL. The function add_update_sla() is only called (indirectly) by
+the rate limiting sysfs interface implementation in adf_sysfs_rl.c
+which ensures that the data structure is allocated and valid. This is
+also proven by the fact that Smatch executed with a database does not
+report such error.
+
+Fix it by returning with error if the pointer `sla_in` is NULL.
+
+Fixes: d9fb8408376e ("crypto: qat - add rate limiting feature to qat_4xxx")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Damian Muszynski <damian.muszynski@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_rl.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_rl.c b/drivers/crypto/intel/qat/qat_common/adf_rl.c
+index 86e3e2152b1b..f2de3cd7d05d 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_rl.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_rl.c
+@@ -812,8 +812,7 @@ static int add_update_sla(struct adf_accel_dev *accel_dev,
+ 	if (!sla_in) {
+ 		dev_warn(&GET_DEV(accel_dev),
+ 			 "SLA input data pointer is missing\n");
+-		ret = -EFAULT;
+-		goto ret_err;
++		return -EFAULT;
+ 	}
+ 
+ 	/* Input validation */
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-qat-fix-mutex-ordering-in-adf_rl.patch b/queue-6.7/crypto-qat-fix-mutex-ordering-in-adf_rl.patch
new file mode 100644
index 00000000000..98b9c67b2d8
--- /dev/null
+++ b/queue-6.7/crypto-qat-fix-mutex-ordering-in-adf_rl.patch
@@ -0,0 +1,46 @@
+From 0d05a889cc181f44207cab27bca39ed857fdb11f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 18:39:30 +0100
+Subject: crypto: qat - fix mutex ordering in adf_rl
+
+From: Damian Muszynski <damian.muszynski@intel.com>
+
+[ Upstream commit 487caa8d5ef9a9a27b092c5790d529a7a0c24f8b ]
+
+If the function validate_user_input() returns an error, the error path
+attempts to unlock an unacquired mutex.
+Acquire the mutex before calling validate_user_input(). This is not
+strictly necessary but simplifies the code.
+
+Fixes: d9fb8408376e ("crypto: qat - add rate limiting feature to qat_4xxx")
+Signed-off-by: Damian Muszynski <damian.muszynski@intel.com>
+Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_rl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_rl.c b/drivers/crypto/intel/qat/qat_common/adf_rl.c
+index f2de3cd7d05d..de1b214dba1f 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_rl.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_rl.c
+@@ -815,13 +815,13 @@ static int add_update_sla(struct adf_accel_dev *accel_dev,
+ 		return -EFAULT;
+ 	}
+ 
++	mutex_lock(&rl_data->rl_lock);
++
+ 	/* Input validation */
+ 	ret = validate_user_input(accel_dev, sla_in, is_update);
+ 	if (ret)
+ 		goto ret_err;
+ 
+-	mutex_lock(&rl_data->rl_lock);
+-
+ 	if (is_update) {
+ 		ret = validate_sla_id(accel_dev, sla_in->sla_id);
+ 		if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-qat-prevent-underflow-in-rp2srv_store.patch b/queue-6.7/crypto-qat-prevent-underflow-in-rp2srv_store.patch
new file mode 100644
index 00000000000..8485a39e07b
--- /dev/null
+++ b/queue-6.7/crypto-qat-prevent-underflow-in-rp2srv_store.patch
@@ -0,0 +1,39 @@
+From 35d6df5eabc3bc7c061d4349e3a724f73662385b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 11:58:32 +0300
+Subject: crypto: qat - prevent underflow in rp2srv_store()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit e53c741303a59ee1682e11f61b7772863e02526d ]
+
+The "ring" variable has an upper bounds check but nothing checks for
+negatives.  This code uses kstrtouint() already and it was obviously
+intended to be declared as unsigned int.  Make it so.
+
+Fixes: dbc8876dd873 ("crypto: qat - add rp2svc sysfs attribute")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/intel/qat/qat_common/adf_sysfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
+index ddffc98119c6..6f0b3629da13 100644
+--- a/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
++++ b/drivers/crypto/intel/qat/qat_common/adf_sysfs.c
+@@ -242,7 +242,8 @@ static ssize_t rp2srv_store(struct device *dev, struct device_attribute *attr,
+ 			    const char *buf, size_t count)
+ {
+ 	struct adf_accel_dev *accel_dev;
+-	int ring, num_rings, ret;
++	int num_rings, ret;
++	unsigned int ring;
+ 
+ 	accel_dev = adf_devmgr_pci_to_accel_dev(to_pci_dev(dev));
+ 	if (!accel_dev)
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-rsa-add-a-check-for-allocation-failure.patch b/queue-6.7/crypto-rsa-add-a-check-for-allocation-failure.patch
new file mode 100644
index 00000000000..daf9bbff0f0
--- /dev/null
+++ b/queue-6.7/crypto-rsa-add-a-check-for-allocation-failure.patch
@@ -0,0 +1,38 @@
+From 60dce805e02c466df53513d152c752f31972ef31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 12:02:59 +0300
+Subject: crypto: rsa - add a check for allocation failure
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit d872ca165cb67112f2841ef9c37d51ef7e63d1e4 ]
+
+Static checkers insist that the mpi_alloc() allocation can fail so add
+a check to prevent a NULL dereference.  Small allocations like this
+can't actually fail in current kernels, but adding a check is very
+simple and makes the static checkers happy.
+
+Fixes: 6637e11e4ad2 ("crypto: rsa - allow only odd e and restrict value in FIPS mode")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/rsa.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/crypto/rsa.c b/crypto/rsa.c
+index c79613cdce6e..b9cd11fb7d36 100644
+--- a/crypto/rsa.c
++++ b/crypto/rsa.c
+@@ -220,6 +220,8 @@ static int rsa_check_exponent_fips(MPI e)
+ 	}
+ 
+ 	e_max = mpi_alloc(0);
++	if (!e_max)
++		return -ENOMEM;
+ 	mpi_set_bit(e_max, 256);
+ 
+ 	if (mpi_cmp(e, e_max) >= 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch b/queue-6.7/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
new file mode 100644
index 00000000000..c1e8b75bd90
--- /dev/null
+++ b/queue-6.7/crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
@@ -0,0 +1,38 @@
+From 1e725cd40fba2fece742942c440978f74fb51caa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 02:03:01 +0000
+Subject: crypto: sa2ul - Return crypto_aead_setkey to transfer the error
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit ce852f1308ac738e61c5b2502517deea593a1554 ]
+
+Return crypto_aead_setkey() in order to transfer the error if
+it fails.
+
+Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sa2ul.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
+index 6846a8429574..78a4930c6480 100644
+--- a/drivers/crypto/sa2ul.c
++++ b/drivers/crypto/sa2ul.c
+@@ -1869,9 +1869,8 @@ static int sa_aead_setkey(struct crypto_aead *authenc,
+ 	crypto_aead_set_flags(ctx->fallback.aead,
+ 			      crypto_aead_get_flags(authenc) &
+ 			      CRYPTO_TFM_REQ_MASK);
+-	crypto_aead_setkey(ctx->fallback.aead, key, keylen);
+ 
+-	return 0;
++	return crypto_aead_setkey(ctx->fallback.aead, key, keylen);
+ }
+ 
+ static int sa_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch b/queue-6.7/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
new file mode 100644
index 00000000000..adcb733c084
--- /dev/null
+++ b/queue-6.7/crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
@@ -0,0 +1,72 @@
+From ef559ab3c3178a50f67e292d52b418099760eacd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 04:49:29 -0800
+Subject: crypto: safexcel - Add error handling for dma_map_sg() calls
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 87e02063d07708cac5bfe9fd3a6a242898758ac8 ]
+
+Macro dma_map_sg() may return 0 on error. This patch enables
+checks in case of the macro failure and ensures unmapping of
+previously mapped buffers with dma_unmap_sg().
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 49186a7d9e46 ("crypto: inside_secure - Avoid dma map if size is zero")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Reviewed-by: Antoine Tenart <atenart@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../crypto/inside-secure/safexcel_cipher.c    | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c
+index 272c28b5a088..b83818634ae4 100644
+--- a/drivers/crypto/inside-secure/safexcel_cipher.c
++++ b/drivers/crypto/inside-secure/safexcel_cipher.c
+@@ -742,9 +742,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring,
+ 				max(totlen_src, totlen_dst));
+ 			return -EINVAL;
+ 		}
+-		if (sreq->nr_src > 0)
+-			dma_map_sg(priv->dev, src, sreq->nr_src,
+-				   DMA_BIDIRECTIONAL);
++		if (sreq->nr_src > 0 &&
++		    !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_BIDIRECTIONAL))
++			return -EIO;
+ 	} else {
+ 		if (unlikely(totlen_src && (sreq->nr_src <= 0))) {
+ 			dev_err(priv->dev, "Source buffer not large enough (need %d bytes)!",
+@@ -752,8 +752,9 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring,
+ 			return -EINVAL;
+ 		}
+ 
+-		if (sreq->nr_src > 0)
+-			dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE);
++		if (sreq->nr_src > 0 &&
++		    !dma_map_sg(priv->dev, src, sreq->nr_src, DMA_TO_DEVICE))
++			return -EIO;
+ 
+ 		if (unlikely(totlen_dst && (sreq->nr_dst <= 0))) {
+ 			dev_err(priv->dev, "Dest buffer not large enough (need %d bytes)!",
+@@ -762,9 +763,11 @@ static int safexcel_send_req(struct crypto_async_request *base, int ring,
+ 			goto unmap;
+ 		}
+ 
+-		if (sreq->nr_dst > 0)
+-			dma_map_sg(priv->dev, dst, sreq->nr_dst,
+-				   DMA_FROM_DEVICE);
++		if (sreq->nr_dst > 0 &&
++		    !dma_map_sg(priv->dev, dst, sreq->nr_dst, DMA_FROM_DEVICE)) {
++			ret = -EIO;
++			goto unmap;
++		}
+ 	}
+ 
+ 	memcpy(ctx->base.ctxr->data, ctx->key, ctx->key_len);
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch b/queue-6.7/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
new file mode 100644
index 00000000000..e82ee3f719a
--- /dev/null
+++ b/queue-6.7/crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
@@ -0,0 +1,148 @@
+From cc55b833609f4248514a9552cee5164b4f8fa6dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:25 +0200
+Subject: crypto: sahara - avoid skcipher fallback code duplication
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 01d70a4bbff20ea05cadb4c208841985a7cc6596 ]
+
+Factor out duplicated skcipher fallback handling code to a helper function
+sahara_aes_fallback(). Also, keep a single check if fallback is required in
+sahara_aes_crypt().
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: d1d6351e37aa ("crypto: sahara - handle zero-length aes requests")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 85 ++++++++++++-----------------------------
+ 1 file changed, 25 insertions(+), 60 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index c4eb66d2e08d..0771c7160c47 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -648,12 +648,37 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ 	return crypto_skcipher_setkey(ctx->fallback, key, keylen);
+ }
+ 
++static int sahara_aes_fallback(struct skcipher_request *req, unsigned long mode)
++{
++	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
++	struct sahara_ctx *ctx = crypto_skcipher_ctx(
++		crypto_skcipher_reqtfm(req));
++
++	skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
++	skcipher_request_set_callback(&rctx->fallback_req,
++				      req->base.flags,
++				      req->base.complete,
++				      req->base.data);
++	skcipher_request_set_crypt(&rctx->fallback_req, req->src,
++				   req->dst, req->cryptlen, req->iv);
++
++	if (mode & FLAGS_ENCRYPT)
++		return crypto_skcipher_encrypt(&rctx->fallback_req);
++
++	return crypto_skcipher_decrypt(&rctx->fallback_req);
++}
++
+ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
+ {
+ 	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
++	struct sahara_ctx *ctx = crypto_skcipher_ctx(
++		crypto_skcipher_reqtfm(req));
+ 	struct sahara_dev *dev = dev_ptr;
+ 	int err = 0;
+ 
++	if (unlikely(ctx->keylen != AES_KEYSIZE_128))
++		return sahara_aes_fallback(req, mode);
++
+ 	dev_dbg(dev->device, "nbytes: %d, enc: %d, cbc: %d\n",
+ 		req->cryptlen, !!(mode & FLAGS_ENCRYPT), !!(mode & FLAGS_CBC));
+ 
+@@ -676,81 +701,21 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
+ 
+ static int sahara_aes_ecb_encrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_encrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, FLAGS_ENCRYPT);
+ }
+ 
+ static int sahara_aes_ecb_decrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_decrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, 0);
+ }
+ 
+ static int sahara_aes_cbc_encrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_encrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, FLAGS_ENCRYPT | FLAGS_CBC);
+ }
+ 
+ static int sahara_aes_cbc_decrypt(struct skcipher_request *req)
+ {
+-	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+-	struct sahara_ctx *ctx = crypto_skcipher_ctx(
+-		crypto_skcipher_reqtfm(req));
+-
+-	if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
+-		skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+-		skcipher_request_set_callback(&rctx->fallback_req,
+-					      req->base.flags,
+-					      req->base.complete,
+-					      req->base.data);
+-		skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+-					   req->dst, req->cryptlen, req->iv);
+-		return crypto_skcipher_decrypt(&rctx->fallback_req);
+-	}
+-
+ 	return sahara_aes_crypt(req, FLAGS_CBC);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch b/queue-6.7/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
new file mode 100644
index 00000000000..c2c42e80076
--- /dev/null
+++ b/queue-6.7/crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
@@ -0,0 +1,99 @@
+From 9f654beebf77fe7eed943d1d32a8c9c520829808 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:36 +0200
+Subject: crypto: sahara - do not resize req->src when doing hash operations
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298 ]
+
+When testing sahara sha256 speed performance with tcrypt (mode=404) on
+imx53-qsrb board, multiple "Invalid numbers of src SG." errors are
+reported. This was traced to sahara_walk_and_recalc() resizing req->src
+and causing the subsequent dma_map_sg() call to fail.
+
+Now that the previous commit fixed sahara_sha_hw_links_create() to take
+into account the actual request size, rather than relying on sg->length
+values, the resize operation is no longer necessary.
+
+Therefore, remove sahara_walk_and_recalc() and simplify associated logic.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 38 ++------------------------------------
+ 1 file changed, 2 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index dd8291a4442c..fabe4f381fb6 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -886,24 +886,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev,
+ 	return 0;
+ }
+ 
+-static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes)
+-{
+-	if (!sg || !sg->length)
+-		return nbytes;
+-
+-	while (nbytes && sg) {
+-		if (nbytes <= sg->length) {
+-			sg->length = nbytes;
+-			sg_mark_end(sg);
+-			break;
+-		}
+-		nbytes -= sg->length;
+-		sg = sg_next(sg);
+-	}
+-
+-	return nbytes;
+-}
+-
+ static int sahara_sha_prepare_request(struct ahash_request *req)
+ {
+ 	struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+@@ -940,36 +922,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req)
+ 					hash_later, 0);
+ 	}
+ 
+-	/* nbytes should now be multiple of blocksize */
+-	req->nbytes = req->nbytes - hash_later;
+-
+-	sahara_walk_and_recalc(req->src, req->nbytes);
+-
++	rctx->total = len - hash_later;
+ 	/* have data from previous operation and current */
+ 	if (rctx->buf_cnt && req->nbytes) {
+ 		sg_init_table(rctx->in_sg_chain, 2);
+ 		sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt);
+-
+ 		sg_chain(rctx->in_sg_chain, 2, req->src);
+-
+-		rctx->total = req->nbytes + rctx->buf_cnt;
+ 		rctx->in_sg = rctx->in_sg_chain;
+-
+-		req->src = rctx->in_sg_chain;
+ 	/* only data from previous operation */
+ 	} else if (rctx->buf_cnt) {
+-		if (req->src)
+-			rctx->in_sg = req->src;
+-		else
+-			rctx->in_sg = rctx->in_sg_chain;
+-		/* buf was copied into rembuf above */
++		rctx->in_sg = rctx->in_sg_chain;
+ 		sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt);
+-		rctx->total = rctx->buf_cnt;
+ 	/* no data from previous operation */
+ 	} else {
+ 		rctx->in_sg = req->src;
+-		rctx->total = req->nbytes;
+-		req->src = rctx->in_sg;
+ 	}
+ 
+ 	/* on next call, we only have the remaining data in the buffer */
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-fix-ahash-reqsize.patch b/queue-6.7/crypto-sahara-fix-ahash-reqsize.patch
new file mode 100644
index 00000000000..e1fdba9fbfd
--- /dev/null
+++ b/queue-6.7/crypto-sahara-fix-ahash-reqsize.patch
@@ -0,0 +1,37 @@
+From bca7cda50827eef52d1c7f7111967a0066bffac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:32 +0200
+Subject: crypto: sahara - fix ahash reqsize
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit efcb50f41740ac55e6ccc4986c1a7740e21c62b4 ]
+
+Set the reqsize for sha algorithms to sizeof(struct sahara_sha_reqctx), the
+extra space is not needed.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 78666b82ac80..31973e6ce520 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1162,8 +1162,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in)
+ static int sahara_sha_cra_init(struct crypto_tfm *tfm)
+ {
+ 	crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
+-				 sizeof(struct sahara_sha_reqctx) +
+-				 SHA_BUFFER_LEN + SHA256_BLOCK_SIZE);
++				 sizeof(struct sahara_sha_reqctx));
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-fix-ahash-selftest-failure.patch b/queue-6.7/crypto-sahara-fix-ahash-selftest-failure.patch
new file mode 100644
index 00000000000..d15a18a3a0f
--- /dev/null
+++ b/queue-6.7/crypto-sahara-fix-ahash-selftest-failure.patch
@@ -0,0 +1,41 @@
+From 99ad45eb354d831bea5f440cd76bd4d9998c992d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:21 +0200
+Subject: crypto: sahara - fix ahash selftest failure
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit afffcf3db98b9495114b79d5381f8cc3f69476fb ]
+
+update() calls should not modify the result buffer, so add an additional
+check for "rctx->last" to make sure that only the final hash value is
+copied into the buffer.
+
+Fixes the following selftest failure:
+alg: ahash: sahara-sha256 update() used result buffer on test vector 3,
+cfg="init+update+final aligned buffer"
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 888e5e5157bb..863171b44cda 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -1047,7 +1047,7 @@ static int sahara_sha_process(struct ahash_request *req)
+ 
+ 	memcpy(rctx->context, dev->context_base, rctx->context_size);
+ 
+-	if (req->result)
++	if (req->result && rctx->last)
+ 		memcpy(req->result, rctx->context, rctx->digest_size);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-fix-cbc-selftest-failure.patch b/queue-6.7/crypto-sahara-fix-cbc-selftest-failure.patch
new file mode 100644
index 00000000000..4b74a3fc081
--- /dev/null
+++ b/queue-6.7/crypto-sahara-fix-cbc-selftest-failure.patch
@@ -0,0 +1,94 @@
+From a1aa8df10afa7b16c611457c5c78d5ea39e63878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:20 +0200
+Subject: crypto: sahara - fix cbc selftest failure
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 9f10bc28c0fb676ae58aa3bfa358db8f5de124bb ]
+
+The kernel crypto API requires that all CBC implementations update the IV
+buffer to contain the last ciphertext block.
+
+This fixes the following cbc selftest error:
+alg: skcipher: sahara-cbc-aes encryption test failed (wrong output IV) on
+test vector 0, cfg="in-place (one sglist)"
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 5cc1cd59a384..888e5e5157bb 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -148,6 +148,7 @@ struct sahara_ctx {
+ 
+ struct sahara_aes_reqctx {
+ 	unsigned long mode;
++	u8 iv_out[AES_BLOCK_SIZE];
+ 	struct skcipher_request fallback_req;	// keep at the end
+ };
+ 
+@@ -541,8 +542,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	return -EINVAL;
+ }
+ 
++static void sahara_aes_cbc_update_iv(struct skcipher_request *req)
++{
++	struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
++	struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
++	unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
++
++	/* Update IV buffer to contain the last ciphertext block */
++	if (rctx->mode & FLAGS_ENCRYPT) {
++		sg_pcopy_to_buffer(req->dst, sg_nents(req->dst), req->iv,
++				   ivsize, req->cryptlen - ivsize);
++	} else {
++		memcpy(req->iv, rctx->iv_out, ivsize);
++	}
++}
++
+ static int sahara_aes_process(struct skcipher_request *req)
+ {
++	struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
+ 	struct sahara_dev *dev = dev_ptr;
+ 	struct sahara_ctx *ctx;
+ 	struct sahara_aes_reqctx *rctx;
+@@ -564,8 +581,17 @@ static int sahara_aes_process(struct skcipher_request *req)
+ 	rctx->mode &= FLAGS_MODE_MASK;
+ 	dev->flags = (dev->flags & ~FLAGS_MODE_MASK) | rctx->mode;
+ 
+-	if ((dev->flags & FLAGS_CBC) && req->iv)
+-		memcpy(dev->iv_base, req->iv, AES_KEYSIZE_128);
++	if ((dev->flags & FLAGS_CBC) && req->iv) {
++		unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
++
++		memcpy(dev->iv_base, req->iv, ivsize);
++
++		if (!(dev->flags & FLAGS_ENCRYPT)) {
++			sg_pcopy_to_buffer(req->src, sg_nents(req->src),
++					   rctx->iv_out, ivsize,
++					   req->cryptlen - ivsize);
++		}
++	}
+ 
+ 	/* assign new context to device */
+ 	dev->ctx = ctx;
+@@ -588,6 +614,9 @@ static int sahara_aes_process(struct skcipher_request *req)
+ 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 		DMA_TO_DEVICE);
+ 
++	if ((dev->flags & FLAGS_CBC) && req->iv)
++		sahara_aes_cbc_update_iv(req);
++
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch b/queue-6.7/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
new file mode 100644
index 00000000000..508be244469
--- /dev/null
+++ b/queue-6.7/crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
@@ -0,0 +1,54 @@
+From b5f4a938930eb4443d3b0ba12b14174c6536c83c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:23 +0200
+Subject: crypto: sahara - fix error handling in sahara_hw_descriptor_create()
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7 ]
+
+Do not call dma_unmap_sg() for scatterlists that were not mapped
+successfully.
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index cbb7153e4162..c4eb66d2e08d 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -483,13 +483,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 			 DMA_TO_DEVICE);
+ 	if (!ret) {
+ 		dev_err(dev->device, "couldn't map in sg\n");
+-		goto unmap_in;
++		return -EINVAL;
+ 	}
++
+ 	ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg,
+ 			 DMA_FROM_DEVICE);
+ 	if (!ret) {
+ 		dev_err(dev->device, "couldn't map out sg\n");
+-		goto unmap_out;
++		goto unmap_in;
+ 	}
+ 
+ 	/* Create input links */
+@@ -537,9 +538,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 
+ 	return 0;
+ 
+-unmap_out:
+-	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
+-		DMA_FROM_DEVICE);
+ unmap_in:
+ 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 		DMA_TO_DEVICE);
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-fix-processing-hash-requests-with-req-.patch b/queue-6.7/crypto-sahara-fix-processing-hash-requests-with-req-.patch
new file mode 100644
index 00000000000..b5cfee96b2a
--- /dev/null
+++ b/queue-6.7/crypto-sahara-fix-processing-hash-requests-with-req-.patch
@@ -0,0 +1,56 @@
+From 6cca63b3143f23b5c0597e6c059159909a39ec9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:35 +0200
+Subject: crypto: sahara - fix processing hash requests with req->nbytes <
+ sg->length
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 7bafa74d1ba35dcc173e1ce915e983d65905f77e ]
+
+It's not always the case that the entire sg entry needs to be processed.
+Currently, when nbytes is less than sg->length, "Descriptor length" errors
+are encountered.
+
+To fix this, take the actual request size into account when populating the
+hw links.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index cfb02905c1ab..dd8291a4442c 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -776,6 +776,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
+ 				       int start)
+ {
+ 	struct scatterlist *sg;
++	unsigned int len;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -797,12 +798,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
+ 	if (!ret)
+ 		return -EFAULT;
+ 
++	len = rctx->total;
+ 	for (i = start; i < dev->nb_in_sg + start; i++) {
+-		dev->hw_link[i]->len = sg->length;
++		dev->hw_link[i]->len = min(len, sg->length);
+ 		dev->hw_link[i]->p = sg->dma_address;
+ 		if (i == (dev->nb_in_sg + start - 1)) {
+ 			dev->hw_link[i]->next = 0;
+ 		} else {
++			len -= min(len, sg->length);
+ 			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
+ 			sg = sg_next(sg);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-fix-processing-requests-with-cryptlen-.patch b/queue-6.7/crypto-sahara-fix-processing-requests-with-cryptlen-.patch
new file mode 100644
index 00000000000..7f94f53311f
--- /dev/null
+++ b/queue-6.7/crypto-sahara-fix-processing-requests-with-cryptlen-.patch
@@ -0,0 +1,72 @@
+From 9c5ecf0d96c495e327a1ff2245aa46c4efb9b8f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:22 +0200
+Subject: crypto: sahara - fix processing requests with cryptlen < sg->length
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 5b8668ce3452827d27f8c34ff6ba080a8f983ed0 ]
+
+It's not always the case that the entire sg entry needs to be processed.
+Currently, when cryptlen is less than sg->legth, "Descriptor length" errors
+are encountered.
+
+The error was noticed when testing xts(sahara-ecb-aes) with arbitrary sized
+input data. To fix this, take the actual request size into account when
+populating the hw links.
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 863171b44cda..cbb7153e4162 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -444,6 +444,7 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	int ret;
+ 	int i, j;
+ 	int idx = 0;
++	u32 len;
+ 
+ 	memcpy(dev->key_base, ctx->key, ctx->keylen);
+ 
+@@ -494,12 +495,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	/* Create input links */
+ 	dev->hw_desc[idx]->p1 = dev->hw_phys_link[0];
+ 	sg = dev->in_sg;
++	len = dev->total;
+ 	for (i = 0; i < dev->nb_in_sg; i++) {
+-		dev->hw_link[i]->len = sg->length;
++		dev->hw_link[i]->len = min(len, sg->length);
+ 		dev->hw_link[i]->p = sg->dma_address;
+ 		if (i == (dev->nb_in_sg - 1)) {
+ 			dev->hw_link[i]->next = 0;
+ 		} else {
++			len -= min(len, sg->length);
+ 			dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
+ 			sg = sg_next(sg);
+ 		}
+@@ -508,12 +511,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	/* Create output links */
+ 	dev->hw_desc[idx]->p2 = dev->hw_phys_link[i];
+ 	sg = dev->out_sg;
++	len = dev->total;
+ 	for (j = i; j < dev->nb_out_sg + i; j++) {
+-		dev->hw_link[j]->len = sg->length;
++		dev->hw_link[j]->len = min(len, sg->length);
+ 		dev->hw_link[j]->p = sg->dma_address;
+ 		if (j == (dev->nb_out_sg + i - 1)) {
+ 			dev->hw_link[j]->next = 0;
+ 		} else {
++			len -= min(len, sg->length);
+ 			dev->hw_link[j]->next = dev->hw_phys_link[j + 1];
+ 			sg = sg_next(sg);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-fix-wait_for_completion_timeout-error-.patch b/queue-6.7/crypto-sahara-fix-wait_for_completion_timeout-error-.patch
new file mode 100644
index 00000000000..65a4aa103b1
--- /dev/null
+++ b/queue-6.7/crypto-sahara-fix-wait_for_completion_timeout-error-.patch
@@ -0,0 +1,70 @@
+From ff6fcaec28e2f16e41ca92cd571f483f6124a21c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:33 +0200
+Subject: crypto: sahara - fix wait_for_completion_timeout() error handling
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 2dba8e1d1a7957dcbe7888846268538847b471d1 ]
+
+The sg lists are not unmapped in case of timeout errors. Fix this.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 31973e6ce520..3661f02d131a 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -607,16 +607,17 @@ static int sahara_aes_process(struct skcipher_request *req)
+ 
+ 	timeout = wait_for_completion_timeout(&dev->dma_completion,
+ 				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
+-	if (!timeout) {
+-		dev_err(dev->device, "AES timeout\n");
+-		return -ETIMEDOUT;
+-	}
+ 
+ 	dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
+ 		DMA_FROM_DEVICE);
+ 	dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 		DMA_TO_DEVICE);
+ 
++	if (!timeout) {
++		dev_err(dev->device, "AES timeout\n");
++		return -ETIMEDOUT;
++	}
++
+ 	if ((dev->flags & FLAGS_CBC) && req->iv)
+ 		sahara_aes_cbc_update_iv(req);
+ 
+@@ -1007,15 +1008,16 @@ static int sahara_sha_process(struct ahash_request *req)
+ 
+ 	timeout = wait_for_completion_timeout(&dev->dma_completion,
+ 				msecs_to_jiffies(SAHARA_TIMEOUT_MS));
+-	if (!timeout) {
+-		dev_err(dev->device, "SHA timeout\n");
+-		return -ETIMEDOUT;
+-	}
+ 
+ 	if (rctx->sg_in_idx)
+ 		dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
+ 			     DMA_TO_DEVICE);
+ 
++	if (!timeout) {
++		dev_err(dev->device, "SHA timeout\n");
++		return -ETIMEDOUT;
++	}
++
+ 	memcpy(rctx->context, dev->context_base, rctx->context_size);
+ 
+ 	if (req->result && rctx->last)
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-handle-zero-length-aes-requests.patch b/queue-6.7/crypto-sahara-handle-zero-length-aes-requests.patch
new file mode 100644
index 00000000000..fe42cad582f
--- /dev/null
+++ b/queue-6.7/crypto-sahara-handle-zero-length-aes-requests.patch
@@ -0,0 +1,36 @@
+From 791747a6d387285bdf26dcf0f0c5cdaeb6686987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:31 +0200
+Subject: crypto: sahara - handle zero-length aes requests
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit d1d6351e37aac14b32a291731d0855996c459d11 ]
+
+In case of a zero-length input, exit gracefully from sahara_aes_crypt().
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 0771c7160c47..78666b82ac80 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -676,6 +676,9 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
+ 	struct sahara_dev *dev = dev_ptr;
+ 	int err = 0;
+ 
++	if (!req->cryptlen)
++		return 0;
++
+ 	if (unlikely(ctx->keylen != AES_KEYSIZE_128))
+ 		return sahara_aes_fallback(req, mode);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch b/queue-6.7/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
new file mode 100644
index 00000000000..8098b97531c
--- /dev/null
+++ b/queue-6.7/crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
@@ -0,0 +1,51 @@
+From 7e0094a6d9b846e9818e2f1b71b6bf9298654a18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 10:21:34 +0200
+Subject: crypto: sahara - improve error handling in sahara_sha_process()
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 5deff027fca49a1eb3b20359333cf2ae562a2343 ]
+
+sahara_sha_hw_data_descriptor_create() returns negative error codes on
+failure, so make sure the errors are correctly handled / propagated.
+
+Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 3661f02d131a..cfb02905c1ab 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -987,7 +987,10 @@ static int sahara_sha_process(struct ahash_request *req)
+ 		return ret;
+ 
+ 	if (rctx->first) {
+-		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
++		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
++		if (ret)
++			return ret;
++
+ 		dev->hw_desc[0]->next = 0;
+ 		rctx->first = 0;
+ 	} else {
+@@ -995,7 +998,10 @@ static int sahara_sha_process(struct ahash_request *req)
+ 
+ 		sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0);
+ 		dev->hw_desc[0]->next = dev->hw_phys_desc[1];
+-		sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
++		ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
++		if (ret)
++			return ret;
++
+ 		dev->hw_desc[1]->next = 0;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-sahara-remove-flags_new_key-logic.patch b/queue-6.7/crypto-sahara-remove-flags_new_key-logic.patch
new file mode 100644
index 00000000000..ef3fd7acb72
--- /dev/null
+++ b/queue-6.7/crypto-sahara-remove-flags_new_key-logic.patch
@@ -0,0 +1,105 @@
+From 6571d5ae061bea62c3389f85de9bd9b58e5cf3b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 19:06:19 +0200
+Subject: crypto: sahara - remove FLAGS_NEW_KEY logic
+
+From: Ovidiu Panait <ovidiu.panait@windriver.com>
+
+[ Upstream commit 8fd183435728b139248a77978ea3732039341779 ]
+
+Remove the FLAGS_NEW_KEY logic as it has the following issues:
+- the wrong key may end up being used when there are multiple data streams:
+       t1            t2
+    setkey()
+    encrypt()
+                   setkey()
+                   encrypt()
+
+    encrypt() <--- key from t2 is used
+- switching between encryption and decryption with the same key is not
+  possible, as the hdr flags are only updated when a new setkey() is
+  performed
+
+With this change, the key is always sent along with the cryptdata when
+performing encryption/decryption operations.
+
+Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/sahara.c | 34 +++++++++++++---------------------
+ 1 file changed, 13 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
+index 02065131c300..5cc1cd59a384 100644
+--- a/drivers/crypto/sahara.c
++++ b/drivers/crypto/sahara.c
+@@ -43,7 +43,6 @@
+ #define FLAGS_MODE_MASK		0x000f
+ #define FLAGS_ENCRYPT		BIT(0)
+ #define FLAGS_CBC		BIT(1)
+-#define FLAGS_NEW_KEY		BIT(3)
+ 
+ #define SAHARA_HDR_BASE			0x00800000
+ #define SAHARA_HDR_SKHA_ALG_AES	0
+@@ -141,8 +140,6 @@ struct sahara_hw_link {
+ };
+ 
+ struct sahara_ctx {
+-	unsigned long flags;
+-
+ 	/* AES-specific context */
+ 	int keylen;
+ 	u8 key[AES_KEYSIZE_128];
+@@ -447,26 +444,22 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
+ 	int i, j;
+ 	int idx = 0;
+ 
+-	/* Copy new key if necessary */
+-	if (ctx->flags & FLAGS_NEW_KEY) {
+-		memcpy(dev->key_base, ctx->key, ctx->keylen);
+-		ctx->flags &= ~FLAGS_NEW_KEY;
++	memcpy(dev->key_base, ctx->key, ctx->keylen);
+ 
+-		if (dev->flags & FLAGS_CBC) {
+-			dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
+-			dev->hw_desc[idx]->p1 = dev->iv_phys_base;
+-		} else {
+-			dev->hw_desc[idx]->len1 = 0;
+-			dev->hw_desc[idx]->p1 = 0;
+-		}
+-		dev->hw_desc[idx]->len2 = ctx->keylen;
+-		dev->hw_desc[idx]->p2 = dev->key_phys_base;
+-		dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
++	if (dev->flags & FLAGS_CBC) {
++		dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
++		dev->hw_desc[idx]->p1 = dev->iv_phys_base;
++	} else {
++		dev->hw_desc[idx]->len1 = 0;
++		dev->hw_desc[idx]->p1 = 0;
++	}
++	dev->hw_desc[idx]->len2 = ctx->keylen;
++	dev->hw_desc[idx]->p2 = dev->key_phys_base;
++	dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
++	dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
+ 
+-		dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
++	idx++;
+ 
+-		idx++;
+-	}
+ 
+ 	dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total);
+ 	if (dev->nb_in_sg < 0) {
+@@ -608,7 +601,6 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,
+ 	/* SAHARA only supports 128bit keys */
+ 	if (keylen == AES_KEYSIZE_128) {
+ 		memcpy(ctx->key, key, keylen);
+-		ctx->flags |= FLAGS_NEW_KEY;
+ 		return 0;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-scomp-fix-req-dst-buffer-overflow.patch b/queue-6.7/crypto-scomp-fix-req-dst-buffer-overflow.patch
new file mode 100644
index 00000000000..5298b716329
--- /dev/null
+++ b/queue-6.7/crypto-scomp-fix-req-dst-buffer-overflow.patch
@@ -0,0 +1,57 @@
+From ffa5e50dd5d764cea9130c95bf5f737ec61c4b0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Dec 2023 09:35:23 +0000
+Subject: crypto: scomp - fix req->dst buffer overflow
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+[ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ]
+
+The req->dst buffer size should be checked before copying from the
+scomp_scratch->dst to avoid req->dst buffer overflow problem.
+
+Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface")
+Reported-by: syzbot+3eff5e51bf1db122a16e@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Reviewed-by: Barry Song <v-songbaohua@oppo.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/scompress.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/crypto/scompress.c b/crypto/scompress.c
+index 442a82c9de7d..b108a30a7600 100644
+--- a/crypto/scompress.c
++++ b/crypto/scompress.c
+@@ -117,6 +117,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
+ 	struct crypto_scomp *scomp = *tfm_ctx;
+ 	void **ctx = acomp_request_ctx(req);
+ 	struct scomp_scratch *scratch;
++	unsigned int dlen;
+ 	int ret;
+ 
+ 	if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE)
+@@ -128,6 +129,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
+ 	if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE)
+ 		req->dlen = SCOMP_SCRATCH_SIZE;
+ 
++	dlen = req->dlen;
++
+ 	scratch = raw_cpu_ptr(&scomp_scratch);
+ 	spin_lock(&scratch->lock);
+ 
+@@ -145,6 +148,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
+ 				ret = -ENOMEM;
+ 				goto out;
+ 			}
++		} else if (req->dlen > dlen) {
++			ret = -ENOSPC;
++			goto out;
+ 		}
+ 		scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen,
+ 					 1);
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-virtio-handle-dataq-logic-with-tasklet.patch b/queue-6.7/crypto-virtio-handle-dataq-logic-with-tasklet.patch
new file mode 100644
index 00000000000..1a56ff11411
--- /dev/null
+++ b/queue-6.7/crypto-virtio-handle-dataq-logic-with-tasklet.patch
@@ -0,0 +1,99 @@
+From e73968e572b9e013f7d99a527354d97496b57b63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 11:49:45 +0000
+Subject: crypto: virtio - Handle dataq logic with tasklet
+
+From: Gonglei (Arei) <arei.gonglei@huawei.com>
+
+[ Upstream commit fed93fb62e05c38152b0fc1dc9609639e63eed76 ]
+
+Doing ipsec produces a spinlock recursion warning.
+This is due to crypto_finalize_request() being called in the upper half.
+Move virtual data queue processing of virtio-crypto driver to tasklet.
+
+Fixes: dbaf0624ffa57 ("crypto: add virtio-crypto driver")
+Reported-by: Halil Pasic <pasic@linux.ibm.com>
+Signed-off-by: wangyangxin <wangyangxin1@huawei.com>
+Signed-off-by: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/virtio/virtio_crypto_common.h |  2 ++
+ drivers/crypto/virtio/virtio_crypto_core.c   | 23 +++++++++++---------
+ 2 files changed, 15 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/crypto/virtio/virtio_crypto_common.h b/drivers/crypto/virtio/virtio_crypto_common.h
+index 154590e1f764..7059bbe5a2eb 100644
+--- a/drivers/crypto/virtio/virtio_crypto_common.h
++++ b/drivers/crypto/virtio/virtio_crypto_common.h
+@@ -10,6 +10,7 @@
+ #include <linux/virtio.h>
+ #include <linux/crypto.h>
+ #include <linux/spinlock.h>
++#include <linux/interrupt.h>
+ #include <crypto/aead.h>
+ #include <crypto/aes.h>
+ #include <crypto/engine.h>
+@@ -28,6 +29,7 @@ struct data_queue {
+ 	char name[32];
+ 
+ 	struct crypto_engine *engine;
++	struct tasklet_struct done_task;
+ };
+ 
+ struct virtio_crypto {
+diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c
+index 43a0838d31ff..428d76562447 100644
+--- a/drivers/crypto/virtio/virtio_crypto_core.c
++++ b/drivers/crypto/virtio/virtio_crypto_core.c
+@@ -72,27 +72,28 @@ int virtio_crypto_ctrl_vq_request(struct virtio_crypto *vcrypto, struct scatterl
+ 	return 0;
+ }
+ 
+-static void virtcrypto_dataq_callback(struct virtqueue *vq)
++static void virtcrypto_done_task(unsigned long data)
+ {
+-	struct virtio_crypto *vcrypto = vq->vdev->priv;
++	struct data_queue *data_vq = (struct data_queue *)data;
++	struct virtqueue *vq = data_vq->vq;
+ 	struct virtio_crypto_request *vc_req;
+-	unsigned long flags;
+ 	unsigned int len;
+-	unsigned int qid = vq->index;
+ 
+-	spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags);
+ 	do {
+ 		virtqueue_disable_cb(vq);
+ 		while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) {
+-			spin_unlock_irqrestore(
+-				&vcrypto->data_vq[qid].lock, flags);
+ 			if (vc_req->alg_cb)
+ 				vc_req->alg_cb(vc_req, len);
+-			spin_lock_irqsave(
+-				&vcrypto->data_vq[qid].lock, flags);
+ 		}
+ 	} while (!virtqueue_enable_cb(vq));
+-	spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags);
++}
++
++static void virtcrypto_dataq_callback(struct virtqueue *vq)
++{
++	struct virtio_crypto *vcrypto = vq->vdev->priv;
++	struct data_queue *dq = &vcrypto->data_vq[vq->index];
++
++	tasklet_schedule(&dq->done_task);
+ }
+ 
+ static int virtcrypto_find_vqs(struct virtio_crypto *vi)
+@@ -150,6 +151,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi)
+ 			ret = -ENOMEM;
+ 			goto err_engine;
+ 		}
++		tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task,
++				(unsigned long)&vi->data_vq[i]);
+ 	}
+ 
+ 	kfree(names);
+-- 
+2.43.0
+
diff --git a/queue-6.7/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch b/queue-6.7/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
new file mode 100644
index 00000000000..a67dcf16cff
--- /dev/null
+++ b/queue-6.7/crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
@@ -0,0 +1,43 @@
+From 5efd48c9e78eea51a8ac636b2df25f19be18a5b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Dec 2023 19:42:15 +0800
+Subject: crypto: virtio - Wait for tasklet to complete on device remove
+
+From: wangyangxin <wangyangxin1@huawei.com>
+
+[ Upstream commit 67cc511e8d436456cc98033e6d4ba83ebfc8e672 ]
+
+The scheduled tasklet needs to be executed on device remove.
+
+Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet")
+Signed-off-by: wangyangxin <wangyangxin1@huawei.com>
+Signed-off-by: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/virtio/virtio_crypto_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c
+index 428d76562447..b909c6a2bf1c 100644
+--- a/drivers/crypto/virtio/virtio_crypto_core.c
++++ b/drivers/crypto/virtio/virtio_crypto_core.c
+@@ -500,12 +500,15 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto)
+ static void virtcrypto_remove(struct virtio_device *vdev)
+ {
+ 	struct virtio_crypto *vcrypto = vdev->priv;
++	int i;
+ 
+ 	dev_info(&vdev->dev, "Start virtcrypto_remove.\n");
+ 
+ 	flush_work(&vcrypto->config_work);
+ 	if (virtcrypto_dev_started(vcrypto))
+ 		virtcrypto_dev_stop(vcrypto);
++	for (i = 0; i < vcrypto->max_data_queues; i++)
++		tasklet_kill(&vcrypto->data_vq[i].done_task);
+ 	virtio_reset_device(vdev);
+ 	virtcrypto_free_unused_reqs(vcrypto);
+ 	virtcrypto_clear_crypto_engines(vcrypto);
+-- 
+2.43.0
+
diff --git a/queue-6.7/csky-fix-arch_jump_label_transform_static-override.patch b/queue-6.7/csky-fix-arch_jump_label_transform_static-override.patch
new file mode 100644
index 00000000000..a8bc290134a
--- /dev/null
+++ b/queue-6.7/csky-fix-arch_jump_label_transform_static-override.patch
@@ -0,0 +1,45 @@
+From 170324f1d26ed3d9bfa00aa067ba96c685eff5fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 22:02:59 +0100
+Subject: csky: fix arch_jump_label_transform_static override
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit ca8e45c8048a2c9503c74751d25414601f730580 ]
+
+The arch_jump_label_transform_static() function in csky was originally meant to
+override the generic __weak function, but that got changed to an #ifndef check.
+
+This showed up as a missing-prototype warning:
+arch/csky/kernel/jump_label.c:43:6: error: no previous prototype for 'arch_jump_label_transform_static' [-Werror=missing-prototypes]
+
+Change the method to use the new method of having a #define and a prototype
+for the global function.
+
+Fixes: 7e6b9db27de9 ("jump_label: make initial NOP patching the special case")
+Fixes: 4e8bb4ba5a55 ("csky: Add jump-label implementation")
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/include/asm/jump_label.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/csky/include/asm/jump_label.h b/arch/csky/include/asm/jump_label.h
+index d488ba6084bc..98a3f4b168bd 100644
+--- a/arch/csky/include/asm/jump_label.h
++++ b/arch/csky/include/asm/jump_label.h
+@@ -43,5 +43,10 @@ static __always_inline bool arch_static_branch_jump(struct static_key *key,
+ 	return true;
+ }
+ 
++enum jump_label_type;
++void arch_jump_label_transform_static(struct jump_entry *entry,
++				      enum jump_label_type type);
++#define arch_jump_label_transform_static arch_jump_label_transform_static
++
+ #endif  /* __ASSEMBLY__ */
+ #endif	/* __ASM_CSKY_JUMP_LABEL_H */
+-- 
+2.43.0
+
diff --git a/queue-6.7/dlm-fix-format-seq-ops-type-4.patch b/queue-6.7/dlm-fix-format-seq-ops-type-4.patch
new file mode 100644
index 00000000000..0a711fffd51
--- /dev/null
+++ b/queue-6.7/dlm-fix-format-seq-ops-type-4.patch
@@ -0,0 +1,38 @@
+From 10f3c8e2c373440579dfcb7c7ef592445f500a24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 14:38:58 -0500
+Subject: dlm: fix format seq ops type 4
+
+From: Alexander Aring <aahringo@redhat.com>
+
+[ Upstream commit 367e753d5c54a414d82610eb709fe71fda6cf1c3 ]
+
+This patch fixes to set the type 4 format ops in case of table_open4().
+It got accidentially changed by commit 541adb0d4d10 ("fs: dlm: debugfs
+for queued callbacks") and since them toss debug dumps the same format
+as format 5 that are the queued ast callbacks for lkbs.
+
+Fixes: 541adb0d4d10 ("fs: dlm: debugfs for queued callbacks")
+Signed-off-by: Alexander Aring <aahringo@redhat.com>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/debug_fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
+index 42f332f46359..c587bfadeff4 100644
+--- a/fs/dlm/debug_fs.c
++++ b/fs/dlm/debug_fs.c
+@@ -748,7 +748,7 @@ static int table_open4(struct inode *inode, struct file *file)
+ 	struct seq_file *seq;
+ 	int ret;
+ 
+-	ret = seq_open(file, &format5_seq_ops);
++	ret = seq_open(file, &format4_seq_ops);
+ 	if (ret)
+ 		return ret;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch b/queue-6.7/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
new file mode 100644
index 00000000000..fe48b03a366
--- /dev/null
+++ b/queue-6.7/dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
@@ -0,0 +1,44 @@
+From 184a06fcdb281137d580b7ca03b5e7c5391b1610 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 16:25:26 +0800
+Subject: dma-mapping: clear dev->dma_mem to NULL after freeing it
+
+From: Joakim Zhang <joakim.zhang@cixtech.com>
+
+[ Upstream commit b07bc2347672cc8c7293c64499f1488278c5ca3d ]
+
+Reproduced with below sequence:
+dma_declare_coherent_memory()->dma_release_coherent_memory()
+->dma_declare_coherent_memory()->"return -EBUSY" error
+
+It will return -EBUSY from the dma_assign_coherent_memory()
+in dma_declare_coherent_memory(), the reason is that dev->dma_mem
+pointer has not been set to NULL after it's freed.
+
+Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to kernel/dma")
+Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/coherent.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
+index c21abc77c53e..ff5683a57f77 100644
+--- a/kernel/dma/coherent.c
++++ b/kernel/dma/coherent.c
+@@ -132,8 +132,10 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,
+ 
+ void dma_release_coherent_memory(struct device *dev)
+ {
+-	if (dev)
++	if (dev) {
+ 		_dma_release_coherent_memory(dev->dma_mem);
++		dev->dma_mem = NULL;
++	}
+ }
+ 
+ static void *__dma_alloc_from_coherent(struct device *dev,
+-- 
+2.43.0
+
diff --git a/queue-6.7/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch b/queue-6.7/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
new file mode 100644
index 00000000000..8c694e072dd
--- /dev/null
+++ b/queue-6.7/drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
@@ -0,0 +1,48 @@
+From 704dfc43e5281383264fa73bc84af7075e4e71cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 00:24:58 +0800
+Subject: drivers/amd/pm: fix a use-after-free in kv_parse_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ]
+
+When ps allocated by kzalloc equals to NULL, kv_parse_power_table
+frees adev->pm.dpm.ps that allocated before. However, after the control
+flow goes through the following call chains:
+
+kv_parse_power_table
+  |-> kv_dpm_init
+        |-> kv_dpm_sw_init
+	      |-> kv_dpm_fini
+
+The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
+first free in kv_parse_power_table and causes a use-after-free bug.
+
+Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+index 5d28c951a319..5cb4725c773f 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/kv_dpm.c
+@@ -2735,10 +2735,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
+ 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
+ 		ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
+-		if (ps == NULL) {
+-			kfree(adev->pm.dpm.ps);
++		if (ps == NULL)
+ 			return -ENOMEM;
+-		}
+ 		adev->pm.dpm.ps[i].ps_priv = ps;
+ 		k = 0;
+ 		idx = (u8 *)&power_state->v2.clockInfoIndex[0];
+-- 
+2.43.0
+
diff --git a/queue-6.7/drivers-clk-zynqmp-calculate-closest-mux-rate.patch b/queue-6.7/drivers-clk-zynqmp-calculate-closest-mux-rate.patch
new file mode 100644
index 00000000000..08704e979d9
--- /dev/null
+++ b/queue-6.7/drivers-clk-zynqmp-calculate-closest-mux-rate.patch
@@ -0,0 +1,61 @@
+From 72ac273d3092a91ddc3145d7b3e687987b3d983e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 03:29:15 -0800
+Subject: drivers: clk: zynqmp: calculate closest mux rate
+
+From: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+
+[ Upstream commit b782921ddd7f84f524723090377903f399fdbbcb ]
+
+Currently zynqmp clock driver is not calculating closest mux rate and
+because of that Linux is not setting proper frequency for CPU and
+not able to set given frequency for dynamic frequency scaling.
+
+E.g., In current logic initial acpu clock parent and frequency as below
+apll1                  0    0    0  2199999978    0     0  50000      Y
+    acpu0_mux          0    0    0  2199999978    0     0  50000      Y
+        acpu0_idiv1    0    0    0  2199999978    0     0  50000      Y
+            acpu0      0    0    0  2199999978    0     0  50000      Y
+
+After changing acpu frequency to 549999994 Hz using CPU freq scaling its
+selecting incorrect parent which is not closest frequency.
+rpll_to_xpd            0    0    0  1599999984    0     0  50000      Y
+    acpu0_mux          0    0    0  1599999984    0     0  50000      Y
+        acpu0_div1     0    0    0   533333328    0     0  50000      Y
+            acpu0      0    0    0   533333328    0     0  50000      Y
+
+Parent should remain same since 549999994 = 2199999978 / 4.
+
+So use __clk_mux_determine_rate_closest() generic function to calculate
+closest rate for mux clock. After this change its selecting correct
+parent and correct clock rate.
+apll1                  0    0    0  2199999978    0     0  50000      Y
+    acpu0_mux          0    0    0  2199999978    0     0  50000      Y
+        acpu0_div1     0    0    0   549999995    0     0  50000      Y
+            acpu0      0    0    0   549999995    0     0  50000      Y
+
+Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
+Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+Link: https://lore.kernel.org/r/20231129112916.23125-2-jay.buddhabhatti@amd.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/zynqmp/clk-mux-zynqmp.c b/drivers/clk/zynqmp/clk-mux-zynqmp.c
+index 60359333f26d..9b5d3050b742 100644
+--- a/drivers/clk/zynqmp/clk-mux-zynqmp.c
++++ b/drivers/clk/zynqmp/clk-mux-zynqmp.c
+@@ -89,7 +89,7 @@ static int zynqmp_clk_mux_set_parent(struct clk_hw *hw, u8 index)
+ static const struct clk_ops zynqmp_clk_mux_ops = {
+ 	.get_parent = zynqmp_clk_mux_get_parent,
+ 	.set_parent = zynqmp_clk_mux_set_parent,
+-	.determine_rate = __clk_mux_determine_rate,
++	.determine_rate = __clk_mux_determine_rate_closest,
+ };
+ 
+ static const struct clk_ops zynqmp_clk_mux_ro_ops = {
+-- 
+2.43.0
+
diff --git a/queue-6.7/drivers-clk-zynqmp-update-divider-round-rate-logic.patch b/queue-6.7/drivers-clk-zynqmp-update-divider-round-rate-logic.patch
new file mode 100644
index 00000000000..64ff707d702
--- /dev/null
+++ b/queue-6.7/drivers-clk-zynqmp-update-divider-round-rate-logic.patch
@@ -0,0 +1,121 @@
+From 62be2a80d553dcf481dddc658766021d1f16dcc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 03:29:16 -0800
+Subject: drivers: clk: zynqmp: update divider round rate logic
+
+From: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+
+[ Upstream commit 1fe15be1fb613534ecbac5f8c3f8744f757d237d ]
+
+Currently zynqmp divider round rate is considering single parent and
+calculating rate and parent rate accordingly. But if divider clock flag
+is set to SET_RATE_PARENT then its not trying to traverse through all
+parent rate and not selecting best parent rate from that. So use common
+divider_round_rate() which is traversing through all clock parents and
+its rate and calculating proper parent rate.
+
+Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
+Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
+Link: https://lore.kernel.org/r/20231129112916.23125-3-jay.buddhabhatti@amd.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/zynqmp/divider.c | 66 +++---------------------------------
+ 1 file changed, 5 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c
+index 33a3b2a22659..5a00487ae408 100644
+--- a/drivers/clk/zynqmp/divider.c
++++ b/drivers/clk/zynqmp/divider.c
+@@ -110,52 +110,6 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw,
+ 	return DIV_ROUND_UP_ULL(parent_rate, value);
+ }
+ 
+-static void zynqmp_get_divider2_val(struct clk_hw *hw,
+-				    unsigned long rate,
+-				    struct zynqmp_clk_divider *divider,
+-				    u32 *bestdiv)
+-{
+-	int div1;
+-	int div2;
+-	long error = LONG_MAX;
+-	unsigned long div1_prate;
+-	struct clk_hw *div1_parent_hw;
+-	struct zynqmp_clk_divider *pdivider;
+-	struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw);
+-
+-	if (!div2_parent_hw)
+-		return;
+-
+-	pdivider = to_zynqmp_clk_divider(div2_parent_hw);
+-	if (!pdivider)
+-		return;
+-
+-	div1_parent_hw = clk_hw_get_parent(div2_parent_hw);
+-	if (!div1_parent_hw)
+-		return;
+-
+-	div1_prate = clk_hw_get_rate(div1_parent_hw);
+-	*bestdiv = 1;
+-	for (div1 = 1; div1 <= pdivider->max_div;) {
+-		for (div2 = 1; div2 <= divider->max_div;) {
+-			long new_error = ((div1_prate / div1) / div2) - rate;
+-
+-			if (abs(new_error) < abs(error)) {
+-				*bestdiv = div2;
+-				error = new_error;
+-			}
+-			if (divider->flags & CLK_DIVIDER_POWER_OF_TWO)
+-				div2 = div2 << 1;
+-			else
+-				div2++;
+-		}
+-		if (pdivider->flags & CLK_DIVIDER_POWER_OF_TWO)
+-			div1 = div1 << 1;
+-		else
+-			div1++;
+-	}
+-}
+-
+ /**
+  * zynqmp_clk_divider_round_rate() - Round rate of divider clock
+  * @hw:			handle between common and hardware-specific interfaces
+@@ -174,6 +128,7 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw,
+ 	u32 div_type = divider->div_type;
+ 	u32 bestdiv;
+ 	int ret;
++	u8 width;
+ 
+ 	/* if read only, just return current value */
+ 	if (divider->flags & CLK_DIVIDER_READ_ONLY) {
+@@ -193,23 +148,12 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw,
+ 		return DIV_ROUND_UP_ULL((u64)*prate, bestdiv);
+ 	}
+ 
+-	bestdiv = zynqmp_divider_get_val(*prate, rate, divider->flags);
+-
+-	/*
+-	 * In case of two divisors, compute best divider values and return
+-	 * divider2 value based on compute value. div1 will  be automatically
+-	 * set to optimum based on required total divider value.
+-	 */
+-	if (div_type == TYPE_DIV2 &&
+-	    (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) {
+-		zynqmp_get_divider2_val(hw, rate, divider, &bestdiv);
+-	}
++	width = fls(divider->max_div);
+ 
+-	if ((clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && divider->is_frac)
+-		bestdiv = rate % *prate ? 1 : bestdiv;
++	rate = divider_round_rate(hw, rate, prate, NULL, width, divider->flags);
+ 
+-	bestdiv = min_t(u32, bestdiv, divider->max_div);
+-	*prate = rate * bestdiv;
++	if (divider->is_frac && (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && (rate % *prate))
++		*prate = rate;
+ 
+ 	return rate;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/drivers-perf-hisi-fix-some-event-id-for-hisilicon-uc.patch b/queue-6.7/drivers-perf-hisi-fix-some-event-id-for-hisilicon-uc.patch
new file mode 100644
index 00000000000..c44a34e1a28
--- /dev/null
+++ b/queue-6.7/drivers-perf-hisi-fix-some-event-id-for-hisilicon-uc.patch
@@ -0,0 +1,39 @@
+From 6cea41eec102ec4a1b4e3dc9bc4512135d5667b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 19:04:25 +0800
+Subject: drivers/perf: hisi: Fix some event id for HiSilicon UC pmu
+
+From: Junhao He <hejunhao3@huawei.com>
+
+[ Upstream commit 38bbef7240b8c5f2dc4493eec356e2efbf2da5f4 ]
+
+Some event id of HiSilicon uncore UC PMU driver is incorrect, fix them.
+
+Fixes: 312eca95e28d ("drivers/perf: hisi: Add support for HiSilicon UC PMU driver")
+Signed-off-by: Junhao He <hejunhao3@huawei.com>
+Reviewed-by: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20231204110425.20354-1-hejunhao3@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c
+index 63da05e5831c..636fb79647c8 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c
+@@ -383,8 +383,8 @@ static struct attribute *hisi_uc_pmu_events_attr[] = {
+ 	HISI_PMU_EVENT_ATTR(cpu_rd,		0x10),
+ 	HISI_PMU_EVENT_ATTR(cpu_rd64,		0x17),
+ 	HISI_PMU_EVENT_ATTR(cpu_rs64,		0x19),
+-	HISI_PMU_EVENT_ATTR(cpu_mru,		0x1a),
+-	HISI_PMU_EVENT_ATTR(cycles,		0x9c),
++	HISI_PMU_EVENT_ATTR(cpu_mru,		0x1c),
++	HISI_PMU_EVENT_ATTR(cycles,		0x95),
+ 	HISI_PMU_EVENT_ATTR(spipe_hit,		0xb3),
+ 	HISI_PMU_EVENT_ATTR(hpipe_hit,		0xdb),
+ 	HISI_PMU_EVENT_ATTR(cring_rxdat_cnt,	0xfa),
+-- 
+2.43.0
+
diff --git a/queue-6.7/drivers-thermal-loongson2_thermal-fix-incorrect-ptr_.patch b/queue-6.7/drivers-thermal-loongson2_thermal-fix-incorrect-ptr_.patch
new file mode 100644
index 00000000000..73e2698d541
--- /dev/null
+++ b/queue-6.7/drivers-thermal-loongson2_thermal-fix-incorrect-ptr_.patch
@@ -0,0 +1,94 @@
+From 7c8166c90027da83d649c29c3589fe8597e3b6f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Nov 2023 17:57:45 +0800
+Subject: drivers/thermal/loongson2_thermal: Fix incorrect PTR_ERR() judgment
+
+From: Binbin Zhou <zhoubinbin@loongson.cn>
+
+[ Upstream commit 15ef92e9c41124ee9d88b01208364f3fe1f45f84 ]
+
+PTR_ERR() returns -ENODEV when thermal-zones are undefined, and we need
+-ENODEV as the right value for comparison.
+
+Otherwise, tz->type is NULL when thermal-zones is undefined, resulting
+in the following error:
+
+[   12.290030] CPU 1 Unable to handle kernel paging request at virtual address fffffffffffffff1, era == 900000000355f410, ra == 90000000031579b8
+[   12.302877] Oops[#1]:
+[   12.305190] CPU: 1 PID: 181 Comm: systemd-udevd Not tainted 6.6.0-rc7+ #5385
+[   12.312304] pc 900000000355f410 ra 90000000031579b8 tp 90000001069e8000 sp 90000001069eba10
+[   12.320739] a0 0000000000000000 a1 fffffffffffffff1 a2 0000000000000014 a3 0000000000000001
+[   12.329173] a4 90000001069eb990 a5 0000000000000001 a6 0000000000001001 a7 900000010003431c
+[   12.337606] t0 fffffffffffffff1 t1 54567fd5da9b4fd4 t2 900000010614ec40 t3 00000000000dc901
+[   12.346041] t4 0000000000000000 t5 0000000000000004 t6 900000010614ee20 t7 900000000d00b790
+[   12.354472] t8 00000000000dc901 u0 54567fd5da9b4fd4 s9 900000000402ae10 s0 900000010614ec40
+[   12.362916] s1 90000000039fced0 s2 ffffffffffffffed s3 ffffffffffffffed s4 9000000003acc000
+[   12.362931] s5 0000000000000004 s6 fffffffffffff000 s7 0000000000000490 s8 90000001028b2ec8
+[   12.362938]    ra: 90000000031579b8 thermal_add_hwmon_sysfs+0x258/0x300
+[   12.386411]   ERA: 900000000355f410 strscpy+0xf0/0x160
+[   12.391626]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
+[   12.397898]  PRMD: 00000004 (PPLV0 +PIE -PWE)
+[   12.403678]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
+[   12.409859]  ECFG: 00071c1c (LIE=2-4,10-12 VS=7)
+[   12.415882] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0)
+[   12.415907]  BADV: fffffffffffffff1
+[   12.415911]  PRID: 0014a000 (Loongson-64bit, Loongson-2K1000)
+[   12.415917] Modules linked in: loongson2_thermal(+) vfat fat uio_pdrv_genirq uio fuse zram zsmalloc
+[   12.415950] Process systemd-udevd (pid: 181, threadinfo=00000000358b9718, task=00000000ace72fe3)
+[   12.415961] Stack : 0000000000000dc0 54567fd5da9b4fd4 900000000402ae10 9000000002df9358
+[   12.415982]         ffffffffffffffed 0000000000000004 9000000107a10aa8 90000001002a3410
+[   12.415999]         ffffffffffffffed ffffffffffffffed 9000000107a11268 9000000003157ab0
+[   12.416016]         9000000107a10aa8 ffffff80020fc0c8 90000001002a3410 ffffffffffffffed
+[   12.416032]         0000000000000024 ffffff80020cc1e8 900000000402b2a0 9000000003acc000
+[   12.416048]         90000001002a3410 0000000000000000 ffffff80020f4030 90000001002a3410
+[   12.416065]         0000000000000000 9000000002df6808 90000001002a3410 0000000000000000
+[   12.416081]         ffffff80020f4030 0000000000000000 90000001002a3410 9000000002df2ba8
+[   12.416097]         00000000000000b4 90000001002a34f4 90000001002a3410 0000000000000002
+[   12.416114]         ffffff80020f4030 fffffffffffffff0 90000001002a3410 9000000002df2f30
+[   12.416131]         ...
+[   12.416138] Call Trace:
+[   12.416142] [<900000000355f410>] strscpy+0xf0/0x160
+[   12.416167] [<90000000031579b8>] thermal_add_hwmon_sysfs+0x258/0x300
+[   12.416183] [<9000000003157ab0>] devm_thermal_add_hwmon_sysfs+0x50/0xe0
+[   12.416200] [<ffffff80020cc1e8>] loongson2_thermal_probe+0x128/0x200 [loongson2_thermal]
+[   12.416232] [<9000000002df6808>] platform_probe+0x68/0x140
+[   12.416249] [<9000000002df2ba8>] really_probe+0xc8/0x3c0
+[   12.416269] [<9000000002df2f30>] __driver_probe_device+0x90/0x180
+[   12.416286] [<9000000002df3058>] driver_probe_device+0x38/0x160
+[   12.416302] [<9000000002df33a8>] __driver_attach+0xa8/0x200
+[   12.416314] [<9000000002deffec>] bus_for_each_dev+0x8c/0x120
+[   12.416330] [<9000000002df198c>] bus_add_driver+0x10c/0x2a0
+[   12.416346] [<9000000002df46b4>] driver_register+0x74/0x160
+[   12.416358] [<90000000022201a4>] do_one_initcall+0x84/0x220
+[   12.416372] [<90000000022f3ab8>] do_init_module+0x58/0x2c0
+[   12.416386] [<90000000022f6538>] init_module_from_file+0x98/0x100
+[   12.416399] [<90000000022f67f0>] sys_finit_module+0x230/0x3c0
+[   12.416412] [<900000000358f7c8>] do_syscall+0x88/0xc0
+[   12.416431] [<900000000222137c>] handle_syscall+0xbc/0x158
+
+Fixes: e7e3a7c35791 ("thermal/drivers/loongson-2: Add thermal management support")
+Cc: Yinbo Zhu <zhuyinbo@loongson.cn>
+Signed-off-by: Binbin Zhou <zhoubinbin@loongson.cn>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/343c14de98216636a47b43e8bfd47b70d0a8e068.1700817227.git.zhoubinbin@loongson.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/loongson2_thermal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/loongson2_thermal.c b/drivers/thermal/loongson2_thermal.c
+index 133098dc0854..99ca0c7bc41c 100644
+--- a/drivers/thermal/loongson2_thermal.c
++++ b/drivers/thermal/loongson2_thermal.c
+@@ -127,7 +127,7 @@ static int loongson2_thermal_probe(struct platform_device *pdev)
+ 		if (!IS_ERR(tzd))
+ 			break;
+ 
+-		if (PTR_ERR(tzd) != ENODEV)
++		if (PTR_ERR(tzd) != -ENODEV)
+ 			continue;
+ 
+ 		return dev_err_probe(dev, PTR_ERR(tzd), "failed to register");
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-display-avoid-stringop-overflow-warnings-for.patch b/queue-6.7/drm-amd-display-avoid-stringop-overflow-warnings-for.patch
new file mode 100644
index 00000000000..7ba9a9c19b6
--- /dev/null
+++ b/queue-6.7/drm-amd-display-avoid-stringop-overflow-warnings-for.patch
@@ -0,0 +1,65 @@
+From 1854210da7375bad90d893b6dc4166811b484d85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 23:13:36 +0100
+Subject: drm/amd/display: avoid stringop-overflow warnings for
+ dp_decide_lane_settings()
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c966dc0e9d96dc44423c404a2628236f1200c24e ]
+
+gcc prints a warning about a possible array overflow for a couple of
+callers of dp_decide_lane_settings() after commit 1b56c90018f0 ("Makefile:
+Enable -Wstringop-overflow globally"):
+
+drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c: In function 'dp_perform_fixed_vs_pe_training_sequence_legacy':
+drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c:426:25: error: 'dp_decide_lane_settings' accessing 4 bytes in a region of size 1 [-Werror=stringop-overflow=]
+  426 |                         dp_decide_lane_settings(lt_settings, dpcd_lane_adjust,
+      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+  427 |                                         lt_settings->hw_lane_settings, lt_settings->dpcd_lane_settings);
+      |                                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_dp_training_fixed_vs_pe_retimer.c:426:25: note: referencing argument 4 of type 'union dpcd_training_lane[4]'
+
+I'm not entirely sure what caused this, but changing the prototype to expect
+a pointer instead of an array avoids the warnings.
+
+Fixes: 7727e7b60f82 ("drm/amd/display: Improve robustness of FIXED_VS link training at DP1 rates")
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.c    | 2 +-
+ .../gpu/drm/amd/display/dc/link/protocols/link_dp_training.h    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+index 90339c2dfd84..5a0b04518956 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.c
+@@ -807,7 +807,7 @@ void dp_decide_lane_settings(
+ 		const struct link_training_settings *lt_settings,
+ 		const union lane_adjust ln_adjust[LANE_COUNT_DP_MAX],
+ 		struct dc_lane_settings hw_lane_settings[LANE_COUNT_DP_MAX],
+-		union dpcd_training_lane dpcd_lane_settings[LANE_COUNT_DP_MAX])
++		union dpcd_training_lane *dpcd_lane_settings)
+ {
+ 	uint32_t lane;
+ 
+diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h
+index 7d027bac8255..851bd17317a0 100644
+--- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h
++++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_training.h
+@@ -111,7 +111,7 @@ void dp_decide_lane_settings(
+ 	const struct link_training_settings *lt_settings,
+ 	const union lane_adjust ln_adjust[LANE_COUNT_DP_MAX],
+ 	struct dc_lane_settings hw_lane_settings[LANE_COUNT_DP_MAX],
+-	union dpcd_training_lane dpcd_lane_settings[LANE_COUNT_DP_MAX]);
++	union dpcd_training_lane *dpcd_lane_settings);
+ 
+ enum dc_dp_training_pattern decide_cr_training_pattern(
+ 		const struct dc_link_settings *link_settings);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-display-check-writeback-connectors-in-create.patch b/queue-6.7/drm-amd-display-check-writeback-connectors-in-create.patch
new file mode 100644
index 00000000000..ccf8f2aaad1
--- /dev/null
+++ b/queue-6.7/drm-amd-display-check-writeback-connectors-in-create.patch
@@ -0,0 +1,50 @@
+From eef24a4306587ba5c5a82afc4f371ee99b7fc5f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 06:25:28 -0700
+Subject: drm/amd/display: Check writeback connectors in
+ create_validate_stream_for_sink
+
+From: Alex Hung <alex.hung@amd.com>
+
+[ Upstream commit dbf5d3d02987faa0eec3710dd687cd912362d7b5 ]
+
+[WHY & HOW]
+This is to check connector type to avoid
+unhandled null pointer for writeback connectors.
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Fixes: 60e034f28600 ("drm/amd/display: Revert "drm/amd/display: Use drm_connector in create_validate_stream_for_sink"")
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index beacda24b4ef..a9bd020b165a 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6649,6 +6649,9 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 			break;
+ 		}
+ 
++		if (aconnector->base.connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
++			return stream;
++
+ 		dc_result = dc_validate_stream(adev->dm.dc, stream);
+ 		if (dc_result == DC_OK && stream->signal == SIGNAL_TYPE_DISPLAY_PORT_MST)
+ 			dc_result = dm_dp_mst_is_port_support_mode(aconnector, stream);
+@@ -9373,7 +9376,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 	dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
+ 	acrtc = to_amdgpu_crtc(crtc);
+ 	connector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc);
+-	if (connector && connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK)
++	if (connector)
+ 		aconnector = to_amdgpu_dm_connector(connector);
+ 
+ 	/* TODO This hack should go away */
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-display-fix-null-pointer-dereference-at-hibe.patch b/queue-6.7/drm-amd-display-fix-null-pointer-dereference-at-hibe.patch
new file mode 100644
index 00000000000..acab94ff082
--- /dev/null
+++ b/queue-6.7/drm-amd-display-fix-null-pointer-dereference-at-hibe.patch
@@ -0,0 +1,47 @@
+From 01f6878f0c94e642eb4e03f493fc468ec010d980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 18:35:09 -0600
+Subject: drm/amd/display: Fix NULL pointer dereference at hibernate
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit b719a9c15d52d4f56bdea8241a5d90fd9197ce99 ]
+
+During hibernate sequence the source context might not have a clk_mgr.
+So don't use it to look for DML2 support.
+
+Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2980
+Fixes: 7966f319c66d ("drm/amd/display: Introduce DML2")
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+index a1f1d1003992..e4bb1e25ee3b 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+@@ -4512,7 +4512,7 @@ void dc_resource_state_copy_construct(
+ 	struct dml2_context *dml2 = NULL;
+ 
+ 	// Need to preserve allocated dml2 context
+-	if (src_ctx->clk_mgr->ctx->dc->debug.using_dml2)
++	if (src_ctx->clk_mgr && src_ctx->clk_mgr->ctx->dc->debug.using_dml2)
+ 		dml2 = dst_ctx->bw_ctx.dml2;
+ #endif
+ 
+@@ -4520,7 +4520,7 @@ void dc_resource_state_copy_construct(
+ 
+ #ifdef CONFIG_DRM_AMD_DC_FP
+ 	// Preserve allocated dml2 context
+-	if (src_ctx->clk_mgr->ctx->dc->debug.using_dml2)
++	if (src_ctx->clk_mgr && src_ctx->clk_mgr->ctx->dc->debug.using_dml2)
+ 		dst_ctx->bw_ctx.dml2 = dml2;
+ #endif
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-display-return-drm_connector-from-find_first.patch b/queue-6.7/drm-amd-display-return-drm_connector-from-find_first.patch
new file mode 100644
index 00000000000..b2efdf2ffc0
--- /dev/null
+++ b/queue-6.7/drm-amd-display-return-drm_connector-from-find_first.patch
@@ -0,0 +1,108 @@
+From a03a13b6b1db19244e25caba4cb6d03052d88027 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 06:25:26 -0700
+Subject: drm/amd/display: Return drm_connector from
+ find_first_crtc_matching_connector
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit 748b091d641638e68330b1b24195eaba9aadf997 ]
+
+[WHY]
+We will be dealing with two types of connector: amdgpu_dm_connector
+and drm_writeback_connector.
+
+[HOW]
+We want to find both and then cast to the appriopriate type afterwards.
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: dbf5d3d02987 ("drm/amd/display: Check writeback connectors in create_validate_stream_for_sink")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c         | 8 +++++---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h         | 2 +-
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c   | 4 +++-
+ 3 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index d8c967cee498..5cf919a489a1 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2660,7 +2660,7 @@ static int dm_suspend(void *handle)
+ 	return 0;
+ }
+ 
+-struct amdgpu_dm_connector *
++struct drm_connector *
+ amdgpu_dm_find_first_crtc_matching_connector(struct drm_atomic_state *state,
+ 					     struct drm_crtc *crtc)
+ {
+@@ -2673,7 +2673,7 @@ amdgpu_dm_find_first_crtc_matching_connector(struct drm_atomic_state *state,
+ 		crtc_from_state = new_con_state->crtc;
+ 
+ 		if (crtc_from_state == crtc)
+-			return to_amdgpu_dm_connector(connector);
++			return connector;
+ 	}
+ 
+ 	return NULL;
+@@ -9354,6 +9354,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 	 * update changed items
+ 	 */
+ 	struct amdgpu_crtc *acrtc = NULL;
++	struct drm_connector *connector = NULL;
+ 	struct amdgpu_dm_connector *aconnector = NULL;
+ 	struct drm_connector_state *drm_new_conn_state = NULL, *drm_old_conn_state = NULL;
+ 	struct dm_connector_state *dm_new_conn_state = NULL, *dm_old_conn_state = NULL;
+@@ -9363,7 +9364,8 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 	dm_old_crtc_state = to_dm_crtc_state(old_crtc_state);
+ 	dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
+ 	acrtc = to_amdgpu_crtc(crtc);
+-	aconnector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc);
++	connector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc);
++	aconnector = to_amdgpu_dm_connector(connector);
+ 
+ 	/* TODO This hack should go away */
+ 	if (aconnector && enable) {
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+index 3d480be802cb..3710f4d0f2cb 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+@@ -834,7 +834,7 @@ struct dc_stream_state *
+ int dm_atomic_get_state(struct drm_atomic_state *state,
+ 			struct dm_atomic_state **dm_state);
+ 
+-struct amdgpu_dm_connector *
++struct drm_connector *
+ amdgpu_dm_find_first_crtc_matching_connector(struct drm_atomic_state *state,
+ 					     struct drm_crtc *crtc);
+ 
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 9b71643d8a89..602a2ab98abf 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -1500,14 +1500,16 @@ int pre_validate_dsc(struct drm_atomic_state *state,
+ 		int ind = find_crtc_index_in_state_by_stream(state, stream);
+ 
+ 		if (ind >= 0) {
++			struct drm_connector *connector;
+ 			struct amdgpu_dm_connector *aconnector;
+ 			struct drm_connector_state *drm_new_conn_state;
+ 			struct dm_connector_state *dm_new_conn_state;
+ 			struct dm_crtc_state *dm_old_crtc_state;
+ 
+-			aconnector =
++			connector =
+ 				amdgpu_dm_find_first_crtc_matching_connector(state,
+ 									     state->crtcs[ind].ptr);
++			aconnector = to_amdgpu_dm_connector(connector);
+ 			drm_new_conn_state =
+ 				drm_atomic_get_new_connector_state(state,
+ 								   &aconnector->base);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-display-use-drm_connector-in-create_stream_f.patch b/queue-6.7/drm-amd-display-use-drm_connector-in-create_stream_f.patch
new file mode 100644
index 00000000000..4ce80554fcd
--- /dev/null
+++ b/queue-6.7/drm-amd-display-use-drm_connector-in-create_stream_f.patch
@@ -0,0 +1,211 @@
+From dc2f5ca1e7fd3c09b533b63f05e6007b822388e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 06:25:27 -0700
+Subject: drm/amd/display: Use drm_connector in create_stream_for_sink
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit 3e094a2875260543ca74838decc0c995d3765096 ]
+
+[WHAT]
+We need to use this function for both amdgpu_dm_connectors
+and drm_writeback_connectors. Modify it to operate on
+a drm_connector as a common base.
+
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Reviewed-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Stable-dep-of: dbf5d3d02987 ("drm/amd/display: Check writeback connectors in create_validate_stream_for_sink")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 65 +++++++++++--------
+ 1 file changed, 37 insertions(+), 28 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 5cf919a489a1..beacda24b4ef 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5527,6 +5527,7 @@ static void fill_stream_properties_from_drm_display_mode(
+ 			&& stream->signal == SIGNAL_TYPE_HDMI_TYPE_A)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420;
+ 	else if (drm_mode_is_420_also(info, mode_in)
++			&& aconnector
+ 			&& aconnector->force_yuv420_output)
+ 		timing_out->pixel_encoding = PIXEL_ENCODING_YCBCR420;
+ 	else if ((connector->display_info.color_formats & DRM_COLOR_FORMAT_YCBCR444)
+@@ -5562,7 +5563,7 @@ static void fill_stream_properties_from_drm_display_mode(
+ 		timing_out->hdmi_vic = hv_frame.vic;
+ 	}
+ 
+-	if (is_freesync_video_mode(mode_in, aconnector)) {
++	if (aconnector && is_freesync_video_mode(mode_in, aconnector)) {
+ 		timing_out->h_addressable = mode_in->hdisplay;
+ 		timing_out->h_total = mode_in->htotal;
+ 		timing_out->h_sync_width = mode_in->hsync_end - mode_in->hsync_start;
+@@ -6039,14 +6040,14 @@ static void apply_dsc_policy_for_stream(struct amdgpu_dm_connector *aconnector,
+ }
+ 
+ static struct dc_stream_state *
+-create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
++create_stream_for_sink(struct drm_connector *connector,
+ 		       const struct drm_display_mode *drm_mode,
+ 		       const struct dm_connector_state *dm_state,
+ 		       const struct dc_stream_state *old_stream,
+ 		       int requested_bpc)
+ {
++	struct amdgpu_dm_connector *aconnector = NULL;
+ 	struct drm_display_mode *preferred_mode = NULL;
+-	struct drm_connector *drm_connector;
+ 	const struct drm_connector_state *con_state = &dm_state->base;
+ 	struct dc_stream_state *stream = NULL;
+ 	struct drm_display_mode mode;
+@@ -6065,20 +6066,22 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 	drm_mode_init(&mode, drm_mode);
+ 	memset(&saved_mode, 0, sizeof(saved_mode));
+ 
+-	if (aconnector == NULL) {
+-		DRM_ERROR("aconnector is NULL!\n");
++	if (connector == NULL) {
++		DRM_ERROR("connector is NULL!\n");
+ 		return stream;
+ 	}
+ 
+-	drm_connector = &aconnector->base;
+-
+-	if (!aconnector->dc_sink) {
+-		sink = create_fake_sink(aconnector);
+-		if (!sink)
+-			return stream;
+-	} else {
+-		sink = aconnector->dc_sink;
+-		dc_sink_retain(sink);
++	if (connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK) {
++		aconnector = NULL;
++		aconnector = to_amdgpu_dm_connector(connector);
++		if (!aconnector->dc_sink) {
++			sink = create_fake_sink(aconnector);
++			if (!sink)
++				return stream;
++		} else {
++			sink = aconnector->dc_sink;
++			dc_sink_retain(sink);
++		}
+ 	}
+ 
+ 	stream = dc_create_stream_for_sink(sink);
+@@ -6088,12 +6091,13 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 		goto finish;
+ 	}
+ 
++	/* We leave this NULL for writeback connectors */
+ 	stream->dm_stream_context = aconnector;
+ 
+ 	stream->timing.flags.LTE_340MCSC_SCRAMBLE =
+-		drm_connector->display_info.hdmi.scdc.scrambling.low_rates;
++		connector->display_info.hdmi.scdc.scrambling.low_rates;
+ 
+-	list_for_each_entry(preferred_mode, &aconnector->base.modes, head) {
++	list_for_each_entry(preferred_mode, &connector->modes, head) {
+ 		/* Search for preferred mode */
+ 		if (preferred_mode->type & DRM_MODE_TYPE_PREFERRED) {
+ 			native_mode_found = true;
+@@ -6102,7 +6106,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 	}
+ 	if (!native_mode_found)
+ 		preferred_mode = list_first_entry_or_null(
+-				&aconnector->base.modes,
++				&connector->modes,
+ 				struct drm_display_mode,
+ 				head);
+ 
+@@ -6116,7 +6120,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 		 * and the modelist may not be filled in time.
+ 		 */
+ 		DRM_DEBUG_DRIVER("No preferred mode found\n");
+-	} else {
++	} else if (aconnector) {
+ 		recalculate_timing = is_freesync_video_mode(&mode, aconnector);
+ 		if (recalculate_timing) {
+ 			freesync_mode = get_highest_refresh_rate_mode(aconnector, false);
+@@ -6139,13 +6143,17 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 	 */
+ 	if (!scale || mode_refresh != preferred_refresh)
+ 		fill_stream_properties_from_drm_display_mode(
+-			stream, &mode, &aconnector->base, con_state, NULL,
++			stream, &mode, connector, con_state, NULL,
+ 			requested_bpc);
+ 	else
+ 		fill_stream_properties_from_drm_display_mode(
+-			stream, &mode, &aconnector->base, con_state, old_stream,
++			stream, &mode, connector, con_state, old_stream,
+ 			requested_bpc);
+ 
++	/* The rest isn't needed for writeback connectors */
++	if (!aconnector)
++		goto finish;
++
+ 	if (aconnector->timing_changed) {
+ 		drm_dbg(aconnector->base.dev,
+ 			"overriding timing for automated test, bpc %d, changing to %d\n",
+@@ -6163,7 +6171,7 @@ create_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 
+ 	fill_audio_info(
+ 		&stream->audio_info,
+-		drm_connector,
++		connector,
+ 		sink);
+ 
+ 	update_stream_signal(stream, sink);
+@@ -6633,7 +6641,7 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,
+ 	enum dc_status dc_result = DC_OK;
+ 
+ 	do {
+-		stream = create_stream_for_sink(aconnector, drm_mode,
++		stream = create_stream_for_sink(connector, drm_mode,
+ 						dm_state, old_stream,
+ 						requested_bpc);
+ 		if (stream == NULL) {
+@@ -9365,15 +9373,16 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 	dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
+ 	acrtc = to_amdgpu_crtc(crtc);
+ 	connector = amdgpu_dm_find_first_crtc_matching_connector(state, crtc);
+-	aconnector = to_amdgpu_dm_connector(connector);
++	if (connector && connector->connector_type != DRM_MODE_CONNECTOR_WRITEBACK)
++		aconnector = to_amdgpu_dm_connector(connector);
+ 
+ 	/* TODO This hack should go away */
+-	if (aconnector && enable) {
++	if (connector && enable) {
+ 		/* Make sure fake sink is created in plug-in scenario */
+ 		drm_new_conn_state = drm_atomic_get_new_connector_state(state,
+-							    &aconnector->base);
++									connector);
+ 		drm_old_conn_state = drm_atomic_get_old_connector_state(state,
+-							    &aconnector->base);
++									connector);
+ 
+ 		if (IS_ERR(drm_new_conn_state)) {
+ 			ret = PTR_ERR_OR_ZERO(drm_new_conn_state);
+@@ -9520,7 +9529,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 		 * added MST connectors not found in existing crtc_state in the chained mode
+ 		 * TODO: need to dig out the root cause of that
+ 		 */
+-		if (!aconnector)
++		if (!connector)
+ 			goto skip_modeset;
+ 
+ 		if (modereset_required(new_crtc_state))
+@@ -9563,7 +9572,7 @@ static int dm_update_crtc_state(struct amdgpu_display_manager *dm,
+ 	 * We want to do dc stream updates that do not require a
+ 	 * full modeset below.
+ 	 */
+-	if (!(enable && aconnector && new_crtc_state->active))
++	if (!(enable && connector && new_crtc_state->active))
+ 		return 0;
+ 	/*
+ 	 * Given above conditions, the dc state cannot be NULL because:
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch b/queue-6.7/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
new file mode 100644
index 00000000000..2576512db15
--- /dev/null
+++ b/queue-6.7/drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
@@ -0,0 +1,198 @@
+From d705649444bb1edc55999414de237858552fb06b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 00:59:38 +0800
+Subject: drm/amd/pm: fix a double-free in amdgpu_parse_extended_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit a6582701178a47c4d0cb2188c965c59c0c0647c8 ]
+
+The amdgpu_free_extended_power_table is called in every error-handling
+paths of amdgpu_parse_extended_power_table. However, after the following
+call chain of returning:
+
+amdgpu_parse_extended_power_table
+  |-> kv_dpm_init / si_dpm_init
+      (the only two caller of amdgpu_parse_extended_power_table)
+        |-> kv_dpm_sw_init / si_dpm_sw_init
+            (the only caller of kv_dpm_init / si_dpm_init, accordingly)
+              |-> kv_dpm_fini / si_dpm_fini
+                  (goto dpm_failed in xx_dpm_sw_init)
+                    |-> amdgpu_free_extended_power_table
+
+As above, the amdgpu_free_extended_power_table is called twice in this
+returning chain and thus a double-free is triggered. Similarily, the
+last kfree in amdgpu_parse_extended_power_table also cause a double free
+with amdgpu_free_extended_power_table in kv_dpm_fini.
+
+Fixes: 84176663e70d ("drm/amd/pm: create a new holder for those APIs used only by legacy ASICs(si/kv)")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c    | 52 +++++--------------
+ 1 file changed, 13 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
+index 81fb4e5dd804..60377747bab4 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/legacy_dpm.c
+@@ -272,10 +272,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usVddcDependencyOnSCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_sclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usVddciDependencyOnMCLKOffset) {
+ 			dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *)
+@@ -283,10 +281,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usVddciDependencyOnMCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddci_dependency_on_mclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usVddcDependencyOnMCLKOffset) {
+ 			dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *)
+@@ -294,10 +290,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usVddcDependencyOnMCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.vddc_dependency_on_mclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usMvddDependencyOnMCLKOffset) {
+ 			dep_table = (ATOM_PPLIB_Clock_Voltage_Dependency_Table *)
+@@ -305,10 +299,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(power_info->pplib4.usMvddDependencyOnMCLKOffset));
+ 			ret = amdgpu_parse_clk_voltage_dep_table(&adev->pm.dpm.dyn_state.mvdd_dependency_on_mclk,
+ 								 dep_table);
+-			if (ret) {
+-				amdgpu_free_extended_power_table(adev);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 		if (power_info->pplib4.usMaxClockVoltageOnDCOffset) {
+ 			ATOM_PPLIB_Clock_Voltage_Limit_Table *clk_v =
+@@ -339,10 +331,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				kcalloc(psl->ucNumEntries,
+ 					sizeof(struct amdgpu_phase_shedding_limits_entry),
+ 					GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.phase_shedding_limits_table.entries)
+ 				return -ENOMEM;
+-			}
+ 
+ 			entry = &psl->entries[0];
+ 			for (i = 0; i < psl->ucNumEntries; i++) {
+@@ -383,10 +373,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 			ATOM_PPLIB_CAC_Leakage_Record *entry;
+ 			u32 size = cac_table->ucNumEntries * sizeof(struct amdgpu_cac_leakage_table);
+ 			adev->pm.dpm.dyn_state.cac_leakage_table.entries = kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.cac_leakage_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			entry = &cac_table->entries[0];
+ 			for (i = 0; i < cac_table->ucNumEntries; i++) {
+ 				if (adev->pm.dpm.platform_caps & ATOM_PP_PLATFORM_CAP_EVV) {
+@@ -438,10 +426,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_vce_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -493,10 +479,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_uvd_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.uvd_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -525,10 +509,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.samu_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -548,10 +530,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				 le16_to_cpu(ext_hdr->usPPMTableOffset));
+ 			adev->pm.dpm.dyn_state.ppm_table =
+ 				kzalloc(sizeof(struct amdgpu_ppm_table), GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.ppm_table) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.ppm_table)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.ppm_table->ppm_design = ppm->ucPpmDesign;
+ 			adev->pm.dpm.dyn_state.ppm_table->cpu_core_number =
+ 				le16_to_cpu(ppm->usCpuCoreNumber);
+@@ -583,10 +563,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 				sizeof(struct amdgpu_clock_voltage_dependency_entry);
+ 			adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries =
+ 				kzalloc(size, GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.entries)
+ 				return -ENOMEM;
+-			}
+ 			adev->pm.dpm.dyn_state.acp_clock_voltage_dependency_table.count =
+ 				limits->numEntries;
+ 			entry = &limits->entries[0];
+@@ -606,10 +584,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 			ATOM_PowerTune_Table *pt;
+ 			adev->pm.dpm.dyn_state.cac_tdp_table =
+ 				kzalloc(sizeof(struct amdgpu_cac_tdp_table), GFP_KERNEL);
+-			if (!adev->pm.dpm.dyn_state.cac_tdp_table) {
+-				amdgpu_free_extended_power_table(adev);
++			if (!adev->pm.dpm.dyn_state.cac_tdp_table)
+ 				return -ENOMEM;
+-			}
+ 			if (rev > 0) {
+ 				ATOM_PPLIB_POWERTUNE_Table_V1 *ppt = (ATOM_PPLIB_POWERTUNE_Table_V1 *)
+ 					(mode_info->atom_context->bios + data_offset +
+@@ -645,10 +621,8 @@ int amdgpu_parse_extended_power_table(struct amdgpu_device *adev)
+ 			ret = amdgpu_parse_clk_voltage_dep_table(
+ 					&adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk,
+ 					dep_table);
+-			if (ret) {
+-				kfree(adev->pm.dpm.dyn_state.vddgfx_dependency_on_sclk.entries);
++			if (ret)
+ 				return ret;
+-			}
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch b/queue-6.7/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
new file mode 100644
index 00000000000..14f04a138d0
--- /dev/null
+++ b/queue-6.7/drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
@@ -0,0 +1,45 @@
+From 3f8f12d451ce5021d07f0e3478e17a68ba39f1cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 23:24:11 +0800
+Subject: drm/amd/pm: fix a double-free in si_dpm_init
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ]
+
+When the allocation of
+adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails,
+amdgpu_free_extended_power_table is called to free some fields of adev.
+However, when the control flow returns to si_dpm_sw_init, it goes to
+label dpm_failed and calls si_dpm_fini, which calls
+amdgpu_free_extended_power_table again and free those fields again. Thus
+a double-free is triggered.
+
+Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+index fc8e4ac6c8e7..df4f20293c16 100644
+--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
++++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+@@ -7379,10 +7379,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
+ 		kcalloc(4,
+ 			sizeof(struct amdgpu_clock_voltage_dependency_entry),
+ 			GFP_KERNEL);
+-	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
+-		amdgpu_free_extended_power_table(adev);
++	if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries)
+ 		return -ENOMEM;
+-	}
++
+ 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4;
+ 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0;
+ 	adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch b/queue-6.7/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
new file mode 100644
index 00000000000..6fd1e2910a4
--- /dev/null
+++ b/queue-6.7/drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
@@ -0,0 +1,53 @@
+From c1e8c9bd09849d9ad08fbff7527c595fba9f4eaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Dec 2023 16:22:47 +0800
+Subject: drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 2f3be3ca779b11c332441b10e00443a2510f4d7b ]
+
+The hwmgr->backend, (i.e. data) allocated by kzalloc is not freed in
+the error-handling paths of smu7_get_evv_voltages and
+smu7_update_edc_leakage_table. However, it did be freed in the
+error-handling of phm_initializa_dynamic_state_adjustment_rule_settings,
+by smu7_hwmgr_backend_fini. So the lack of free in smu7_get_evv_voltages
+and smu7_update_edc_leakage_table is considered a memleak in this patch.
+
+Fixes: 599a7e9fe1b6 ("drm/amd/powerplay: implement smu7 hwmgr to manager asics with smu ip version 7.")
+Fixes: 8f0804c6b7d0 ("drm/amd/pm: add edc leakage controller setting")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+index 11372fcc59c8..b1a8799e2dee 100644
+--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+@@ -2974,6 +2974,8 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
+ 		result = smu7_get_evv_voltages(hwmgr);
+ 		if (result) {
+ 			pr_info("Get EVV Voltage Failed.  Abort Driver loading!\n");
++			kfree(hwmgr->backend);
++			hwmgr->backend = NULL;
+ 			return -EINVAL;
+ 		}
+ 	} else {
+@@ -3019,8 +3021,10 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
+ 	}
+ 
+ 	result = smu7_update_edc_leakage_table(hwmgr);
+-	if (result)
++	if (result) {
++		smu7_hwmgr_backend_fini(hwmgr);
+ 		return result;
++	}
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch b/queue-6.7/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
new file mode 100644
index 00000000000..bf290146e29
--- /dev/null
+++ b/queue-6.7/drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
@@ -0,0 +1,48 @@
+From bc4206fcb3f1984d086c80a181c24719c0cb5d52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 17:26:29 -0500
+Subject: drm/amdgpu/debugfs: fix error code when smc register accessors are
+ NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit afe58346d5d3887b3e49ff623d2f2e471f232a8d ]
+
+Should be -EOPNOTSUPP.
+
+Fixes: 5104fdf50d32 ("drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL")
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 0e61ebdb3f3e..8d4a3ff65c18 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -755,7 +755,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
+ 	int r;
+ 
+ 	if (!adev->smc_rreg)
+-		return -EPERM;
++		return -EOPNOTSUPP;
+ 
+ 	if (size & 0x3 || *pos & 0x3)
+ 		return -EINVAL;
+@@ -814,7 +814,7 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user *
+ 	int r;
+ 
+ 	if (!adev->smc_wreg)
+-		return -EPERM;
++		return -EOPNOTSUPP;
+ 
+ 	if (size & 0x3 || *pos & 0x3)
+ 		return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch b/queue-6.7/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
new file mode 100644
index 00000000000..b6a7e0d93ec
--- /dev/null
+++ b/queue-6.7/drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
@@ -0,0 +1,81 @@
+From 84055fe2c5190f85b96bd4fddccd13f5077900c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 07:16:23 +0530
+Subject: drm/amdkfd: Confirm list is non-empty before utilizing
+ list_first_entry in kfd_topology.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 499839eca34ad62d43025ec0b46b80e77065f6d8 ]
+
+Before using list_first_entry, make sure to check that list is not
+empty, if list is empty return -ENODATA.
+
+Fixes the below:
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL?
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL?
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1433 kfd_add_peer_prop() warn: can 'iolink2' even be NULL?
+
+Fixes: 0f28cca87e9a ("drm/amdkfd: Extend KFD device topology to surface peer-to-peer links")
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Suggested-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+index 057284bf50bb..58d775a0668d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -1342,10 +1342,11 @@ static int kfd_create_indirect_link_prop(struct kfd_topology_device *kdev, int g
+ 		num_cpu++;
+ 	}
+ 
++	if (list_empty(&kdev->io_link_props))
++		return -ENODATA;
++
+ 	gpu_link = list_first_entry(&kdev->io_link_props,
+-					struct kfd_iolink_properties, list);
+-	if (!gpu_link)
+-		return -ENOMEM;
++				    struct kfd_iolink_properties, list);
+ 
+ 	for (i = 0; i < num_cpu; i++) {
+ 		/* CPU <--> GPU */
+@@ -1423,15 +1424,17 @@ static int kfd_add_peer_prop(struct kfd_topology_device *kdev,
+ 				peer->gpu->adev))
+ 		return ret;
+ 
++	if (list_empty(&kdev->io_link_props))
++		return -ENODATA;
++
+ 	iolink1 = list_first_entry(&kdev->io_link_props,
+-							struct kfd_iolink_properties, list);
+-	if (!iolink1)
+-		return -ENOMEM;
++				   struct kfd_iolink_properties, list);
++
++	if (list_empty(&peer->io_link_props))
++		return -ENODATA;
+ 
+ 	iolink2 = list_first_entry(&peer->io_link_props,
+-							struct kfd_iolink_properties, list);
+-	if (!iolink2)
+-		return -ENOMEM;
++				   struct kfd_iolink_properties, list);
+ 
+ 	props = kfd_alloc_struct(props);
+ 	if (!props)
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-amdkfd-fix-type-of-dbg_flags-in-struct-kfd_proce.patch b/queue-6.7/drm-amdkfd-fix-type-of-dbg_flags-in-struct-kfd_proce.patch
new file mode 100644
index 00000000000..dea25f56c56
--- /dev/null
+++ b/queue-6.7/drm-amdkfd-fix-type-of-dbg_flags-in-struct-kfd_proce.patch
@@ -0,0 +1,48 @@
+From 5d0d1e45a0aef72e17efc7d113c05de43c89d6f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 08:10:42 +0530
+Subject: drm/amdkfd: Fix type of 'dbg_flags' in 'struct kfd_process'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+
+[ Upstream commit 217e85f97031791fb48a2d374c7bdcf439365b21 ]
+
+dbg_flags looks to be defined with incorrect data type; to process
+multiple debug flag options, and hence defined dbg_flags as u32.
+
+Fixes the below:
+
+drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_packet_manager_v9.c:117 pm_map_process_aldebaran() warn: maybe use && instead of &
+
+Fixes: 0de4ec9a0353 ("drm/amdgpu: prepare map process for multi-process debug devices")
+Suggested-by: Lijo Lazar <lijo.lazar@amd.com>
+Cc: Felix Kuehling <Felix.Kuehling@amd.com>
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+index 4c8e278a0d0c..28162bfbe1b3 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+@@ -971,7 +971,7 @@ struct kfd_process {
+ 	struct work_struct debug_event_workarea;
+ 
+ 	/* Tracks debug per-vmid request for debug flags */
+-	bool dbg_flags;
++	u32 dbg_flags;
+ 
+ 	atomic_t poison;
+ 	/* Queues are in paused stated because we are in the process of doing a CRIU checkpoint */
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch b/queue-6.7/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
new file mode 100644
index 00000000000..134547756d2
--- /dev/null
+++ b/queue-6.7/drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
@@ -0,0 +1,38 @@
+From 43e058e3096f45be6b336844988eef7a7730eebc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 15:14:05 +0200
+Subject: drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 155d6fb61270dd297f128731cd155080deee8f3a ]
+
+'ret' could be uninitialized at the end of the function, although it's
+not clear if that can happen in practice.
+
+Fixes: 6a3608eae6d3 ("drm: bridge: cdns-mhdp8546: Enable HDCP")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-3-c22b2444f5f5@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
+index 946212a95598..5e3b8edcf794 100644
+--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
++++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
+@@ -403,7 +403,8 @@ static int _cdns_mhdp_hdcp_disable(struct cdns_mhdp_device *mhdp)
+ 
+ static int _cdns_mhdp_hdcp_enable(struct cdns_mhdp_device *mhdp, u8 content_type)
+ {
+-	int ret, tries = 3;
++	int ret = -EINVAL;
++	int tries = 3;
+ 	u32 i;
+ 
+ 	for (i = 0; i < tries; i++) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-bridge-fix-typo-in-post_disable-description.patch b/queue-6.7/drm-bridge-fix-typo-in-post_disable-description.patch
new file mode 100644
index 00000000000..dd592b7766c
--- /dev/null
+++ b/queue-6.7/drm-bridge-fix-typo-in-post_disable-description.patch
@@ -0,0 +1,36 @@
+From bef36edbd575b329efde51f9ddc0602f95fa1ab1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Nov 2023 10:42:30 +0100
+Subject: drm/bridge: Fix typo in post_disable() description
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 288b039db225676e0c520c981a1b5a2562d893a3 ]
+
+s/singals/signals/
+
+Fixes: 199e4e967af4 ("drm: Extract drm_bridge.h")
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231124094253.658064-1-dario.binacchi@amarulasolutions.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/drm/drm_bridge.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h
+index cfb7dcdb66c4..9ef461aa9b9e 100644
+--- a/include/drm/drm_bridge.h
++++ b/include/drm/drm_bridge.h
+@@ -194,7 +194,7 @@ struct drm_bridge_funcs {
+ 	 * or &drm_encoder_helper_funcs.dpms hook.
+ 	 *
+ 	 * The bridge must assume that the display pipe (i.e. clocks and timing
+-	 * singals) feeding it is no longer running when this callback is
++	 * signals) feeding it is no longer running when this callback is
+ 	 * called.
+ 	 *
+ 	 * The @post_disable callback is optional.
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-bridge-imx93-mipi-dsi-fix-a-couple-of-building-w.patch b/queue-6.7/drm-bridge-imx93-mipi-dsi-fix-a-couple-of-building-w.patch
new file mode 100644
index 00000000000..512f9e62418
--- /dev/null
+++ b/queue-6.7/drm-bridge-imx93-mipi-dsi-fix-a-couple-of-building-w.patch
@@ -0,0 +1,43 @@
+From 6f00cc9c95f6953a4a4e5d4709cb441102f9f5a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Nov 2023 13:18:07 +0800
+Subject: drm/bridge: imx93-mipi-dsi: Fix a couple of building warnings
+
+From: Liu Ying <victor.liu@nxp.com>
+
+[ Upstream commit 325b71e820b67569048c621227266783442b75ed ]
+
+Fix a couple of building warnings on used uninitialized 'best_m' and
+'best_n' local variables by initializing 'best_m' to zero and 'best_n'
+to UINT_MAX.  This makes compiler happy only.  No functional change.
+
+Fixes: ce62f8ea7e3f ("drm/bridge: imx: Add i.MX93 MIPI DSI support")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202311151746.f7u7dzbZ-lkp@intel.com/
+Signed-off-by: Liu Ying <victor.liu@nxp.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231123051807.3818342-1-victor.liu@nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c b/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c
+index 3ff30ce80c5b..2347f8dd632f 100644
+--- a/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c
++++ b/drivers/gpu/drm/bridge/imx/imx93-mipi-dsi.c
+@@ -226,8 +226,8 @@ dphy_pll_get_configure_from_opts(struct imx93_dsi *dsi,
+ 	unsigned long fout;
+ 	unsigned long best_fout = 0;
+ 	unsigned int fvco_div;
+-	unsigned int min_n, max_n, n, best_n;
+-	unsigned long m, best_m;
++	unsigned int min_n, max_n, n, best_n = UINT_MAX;
++	unsigned long m, best_m = 0;
+ 	unsigned long min_delta = ULONG_MAX;
+ 	unsigned long delta;
+ 	u64 tmp;
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-bridge-tc358767-fix-return-value-on-error-case.patch b/queue-6.7/drm-bridge-tc358767-fix-return-value-on-error-case.patch
new file mode 100644
index 00000000000..f4131c7019b
--- /dev/null
+++ b/queue-6.7/drm-bridge-tc358767-fix-return-value-on-error-case.patch
@@ -0,0 +1,39 @@
+From 6024a80e9161b2e16aa2e95f58c48782d5dfb32e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 15:14:06 +0200
+Subject: drm/bridge: tc358767: Fix return value on error case
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 32bd29b619638256c5b75fb021d6d9f12fc4a984 ]
+
+If the hpd_pin is invalid, the driver returns 'ret'. But 'ret' contains
+0, instead of an error value.
+
+Return -EINVAL instead.
+
+Fixes: f25ee5017e4f ("drm/bridge: tc358767: add IRQ and HPD support")
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-4-c22b2444f5f5@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/tc358767.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
+index ef2e373606ba..615cc8f950d7 100644
+--- a/drivers/gpu/drm/bridge/tc358767.c
++++ b/drivers/gpu/drm/bridge/tc358767.c
+@@ -2273,7 +2273,7 @@ static int tc_probe(struct i2c_client *client)
+ 	} else {
+ 		if (tc->hpd_pin < 0 || tc->hpd_pin > 1) {
+ 			dev_err(dev, "failed to parse HPD number\n");
+-			return ret;
++			return -EINVAL;
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch b/queue-6.7/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
new file mode 100644
index 00000000000..9875c14871c
--- /dev/null
+++ b/queue-6.7/drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
@@ -0,0 +1,52 @@
+From 7d6414f5941a08af5b22179d78ee24cbcd5e6aa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 17:56:42 +0100
+Subject: drm/bridge: tpd12s015: Drop buggy __exit annotation for remove
+ function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit ce3e112e7ae854249d8755906acc5f27e1542114 ]
+
+With tpd12s015_remove() marked with __exit this function is discarded
+when the driver is compiled as a built-in. The result is that when the
+driver unbinds there is no cleanup done which results in resource
+leakage or worse.
+
+Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.kleine-koenig@pengutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c
+index e0e015243a60..b588fea12502 100644
+--- a/drivers/gpu/drm/bridge/ti-tpd12s015.c
++++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c
+@@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev)
+ 	return 0;
+ }
+ 
+-static int __exit tpd12s015_remove(struct platform_device *pdev)
++static int tpd12s015_remove(struct platform_device *pdev)
+ {
+ 	struct tpd12s015_device *tpd = platform_get_drvdata(pdev);
+ 
+@@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match);
+ 
+ static struct platform_driver tpd12s015_driver = {
+ 	.probe	= tpd12s015_probe,
+-	.remove	= __exit_p(tpd12s015_remove),
++	.remove = tpd12s015_remove,
+ 	.driver	= {
+ 		.name	= "tpd12s015",
+ 		.of_match_table = tpd12s015_of_match,
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-dp_mst-fix-fractional-dsc-bpp-handling.patch b/queue-6.7/drm-dp_mst-fix-fractional-dsc-bpp-handling.patch
new file mode 100644
index 00000000000..13045cbd862
--- /dev/null
+++ b/queue-6.7/drm-dp_mst-fix-fractional-dsc-bpp-handling.patch
@@ -0,0 +1,203 @@
+From cb7007d42f829d4631a8e6f3d50583a92f5bddb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Oct 2023 04:08:57 +0300
+Subject: drm/dp_mst: Fix fractional DSC bpp handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 7707dd6022593f3edd8e182e7935870cf326f874 ]
+
+The current code does '(bpp << 4) / 16' in the MST PBN
+calculation, but that is just the same as 'bpp' so the
+DSC codepath achieves absolutely nothing. Fix it up so that
+the fractional part of the bpp value is actually used instead
+of truncated away. 64*1006 has enough zero lsbs that we can
+just shift that down in the dividend and thus still manage
+to stick to a 32bit divisor.
+
+And while touching this, let's just make the whole thing more
+straightforward by making the passed in bpp value .4 binary
+fixed point always, instead of having to pass in different
+things based on whether DSC is enabled or not.
+
+v2:
+- Fix DSC kunit test cases.
+
+Cc: Manasi Navare <manasi.d.navare@intel.com>
+Cc: Lyude Paul <lyude@redhat.com>
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: David Francis <David.Francis@amd.com>
+Cc: Mikita Lipski <mikita.lipski@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Fixes: dc48529fb14e ("drm/dp_mst: Add PBN calculation for DSC modes")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+[Imre: Fix kunit test cases]
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231030155843.2251023-3-imre.deak@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |  2 +-
+ .../display/amdgpu_dm/amdgpu_dm_mst_types.c   |  2 +-
+ drivers/gpu/drm/display/drm_dp_mst_topology.c | 20 +++++--------------
+ drivers/gpu/drm/i915/display/intel_dp_mst.c   |  5 ++---
+ drivers/gpu/drm/nouveau/dispnv50/disp.c       |  3 +--
+ .../gpu/drm/tests/drm_dp_mst_helper_test.c    |  6 +++---
+ include/drm/display/drm_dp_mst_helper.h       |  2 +-
+ 7 files changed, 14 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 4e82ee4d74ac..d8c967cee498 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6928,7 +6928,7 @@ static int dm_encoder_helper_atomic_check(struct drm_encoder *encoder,
+ 								    max_bpc);
+ 		bpp = convert_dc_color_depth_into_bpc(color_depth) * 3;
+ 		clock = adjusted_mode->clock;
+-		dm_new_connector_state->pbn = drm_dp_calc_pbn_mode(clock, bpp, false);
++		dm_new_connector_state->pbn = drm_dp_calc_pbn_mode(clock, bpp << 4);
+ 	}
+ 
+ 	dm_new_connector_state->vcpi_slots =
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 11da0eebee6c..9b71643d8a89 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -1642,7 +1642,7 @@ enum dc_status dm_dp_mst_is_port_support_mode(
+ 	} else {
+ 		/* check if mode could be supported within full_pbn */
+ 		bpp = convert_dc_color_depth_into_bpc(stream->timing.display_color_depth) * 3;
+-		pbn = drm_dp_calc_pbn_mode(stream->timing.pix_clk_100hz / 10, bpp, false);
++		pbn = drm_dp_calc_pbn_mode(stream->timing.pix_clk_100hz / 10, bpp << 4);
+ 		if (pbn > full_pbn)
+ 			return DC_FAIL_BANDWIDTH_VALIDATE;
+ 	}
+diff --git a/drivers/gpu/drm/display/drm_dp_mst_topology.c b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+index 0e0d0e76de06..772b00ebd57b 100644
+--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c
+@@ -4718,13 +4718,12 @@ EXPORT_SYMBOL(drm_dp_check_act_status);
+ 
+ /**
+  * drm_dp_calc_pbn_mode() - Calculate the PBN for a mode.
+- * @clock: dot clock for the mode
+- * @bpp: bpp for the mode.
+- * @dsc: DSC mode. If true, bpp has units of 1/16 of a bit per pixel
++ * @clock: dot clock
++ * @bpp: bpp as .4 binary fixed point
+  *
+  * This uses the formula in the spec to calculate the PBN value for a mode.
+  */
+-int drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc)
++int drm_dp_calc_pbn_mode(int clock, int bpp)
+ {
+ 	/*
+ 	 * margin 5300ppm + 300ppm ~ 0.6% as per spec, factor is 1.006
+@@ -4735,18 +4734,9 @@ int drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc)
+ 	 * peak_kbps *= (1006/1000)
+ 	 * peak_kbps *= (64/54)
+ 	 * peak_kbps *= 8    convert to bytes
+-	 *
+-	 * If the bpp is in units of 1/16, further divide by 16. Put this
+-	 * factor in the numerator rather than the denominator to avoid
+-	 * integer overflow
+ 	 */
+-
+-	if (dsc)
+-		return DIV_ROUND_UP_ULL(mul_u32_u32(clock * (bpp / 16), 64 * 1006),
+-					8 * 54 * 1000 * 1000);
+-
+-	return DIV_ROUND_UP_ULL(mul_u32_u32(clock * bpp, 64 * 1006),
+-				8 * 54 * 1000 * 1000);
++	return DIV_ROUND_UP_ULL(mul_u32_u32(clock * bpp, 64 * 1006 >> 4),
++				1000 * 8 * 54 * 1000);
+ }
+ EXPORT_SYMBOL(drm_dp_calc_pbn_mode);
+ 
+diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c
+index aa1061262613..03ac2817664e 100644
+--- a/drivers/gpu/drm/i915/display/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c
+@@ -106,8 +106,7 @@ static int intel_dp_mst_find_vcpi_slots_for_bpp(struct intel_encoder *encoder,
+ 			continue;
+ 
+ 		crtc_state->pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock,
+-						       dsc ? bpp << 4 : bpp,
+-						       dsc);
++						       bpp << 4);
+ 
+ 		slots = drm_dp_atomic_find_time_slots(state, &intel_dp->mst_mgr,
+ 						      connector->port,
+@@ -979,7 +978,7 @@ intel_dp_mst_mode_valid_ctx(struct drm_connector *connector,
+ 		return ret;
+ 
+ 	if (mode_rate > max_rate || mode->clock > max_dotclk ||
+-	    drm_dp_calc_pbn_mode(mode->clock, min_bpp, false) > port->full_pbn) {
++	    drm_dp_calc_pbn_mode(mode->clock, min_bpp << 4) > port->full_pbn) {
+ 		*status = MODE_CLOCK_HIGH;
+ 		return 0;
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 118807e38422..d093549f6eb7 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -982,8 +982,7 @@ nv50_msto_atomic_check(struct drm_encoder *encoder,
+ 		const int clock = crtc_state->adjusted_mode.clock;
+ 
+ 		asyh->or.bpc = connector->display_info.bpc;
+-		asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, asyh->or.bpc * 3,
+-						    false);
++		asyh->dp.pbn = drm_dp_calc_pbn_mode(clock, asyh->or.bpc * 3 << 4);
+ 	}
+ 
+ 	mst_state = drm_atomic_get_mst_topology_state(state, &mstm->mgr);
+diff --git a/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c b/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c
+index 545beea33e8c..e3c818dfc0e6 100644
+--- a/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c
++++ b/drivers/gpu/drm/tests/drm_dp_mst_helper_test.c
+@@ -42,13 +42,13 @@ static const struct drm_dp_mst_calc_pbn_mode_test drm_dp_mst_calc_pbn_mode_cases
+ 		.clock = 332880,
+ 		.bpp = 24,
+ 		.dsc = true,
+-		.expected = 50
++		.expected = 1191
+ 	},
+ 	{
+ 		.clock = 324540,
+ 		.bpp = 24,
+ 		.dsc = true,
+-		.expected = 49
++		.expected = 1161
+ 	},
+ };
+ 
+@@ -56,7 +56,7 @@ static void drm_test_dp_mst_calc_pbn_mode(struct kunit *test)
+ {
+ 	const struct drm_dp_mst_calc_pbn_mode_test *params = test->param_value;
+ 
+-	KUNIT_EXPECT_EQ(test, drm_dp_calc_pbn_mode(params->clock, params->bpp, params->dsc),
++	KUNIT_EXPECT_EQ(test, drm_dp_calc_pbn_mode(params->clock, params->bpp << 4),
+ 			params->expected);
+ }
+ 
+diff --git a/include/drm/display/drm_dp_mst_helper.h b/include/drm/display/drm_dp_mst_helper.h
+index 4429d3b1745b..655862b3d2a4 100644
+--- a/include/drm/display/drm_dp_mst_helper.h
++++ b/include/drm/display/drm_dp_mst_helper.h
+@@ -842,7 +842,7 @@ struct edid *drm_dp_mst_get_edid(struct drm_connector *connector,
+ int drm_dp_get_vc_payload_bw(const struct drm_dp_mst_topology_mgr *mgr,
+ 			     int link_rate, int link_lane_count);
+ 
+-int drm_dp_calc_pbn_mode(int clock, int bpp, bool dsc);
++int drm_dp_calc_pbn_mode(int clock, int bpp);
+ 
+ void drm_dp_mst_update_slots(struct drm_dp_mst_topology_state *mst_state, uint8_t link_encoding_cap);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-drv-propagate-errors-from-drm_modeset_register_a.patch b/queue-6.7/drm-drv-propagate-errors-from-drm_modeset_register_a.patch
new file mode 100644
index 00000000000..ac8e4dca261
--- /dev/null
+++ b/queue-6.7/drm-drv-propagate-errors-from-drm_modeset_register_a.patch
@@ -0,0 +1,54 @@
+From 0f78cbae33cd11f0cc04fe367b3cc2636916458a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Dec 2023 01:55:52 +0300
+Subject: drm/drv: propagate errors from drm_modeset_register_all()
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 5f8dec200923a76dc57187965fd59c1136f5d085 ]
+
+In case the drm_modeset_register_all() function fails, its error code
+will be ignored. Instead make the drm_dev_register() bail out in case of
+such an error.
+
+Fixes: 79190ea2658a ("drm: Add callbacks for late registering")
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231202225552.1283638-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_drv.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
+index 535f16e7882e..3c835c99daad 100644
+--- a/drivers/gpu/drm/drm_drv.c
++++ b/drivers/gpu/drm/drm_drv.c
+@@ -949,8 +949,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
+ 			goto err_minors;
+ 	}
+ 
+-	if (drm_core_check_feature(dev, DRIVER_MODESET))
+-		drm_modeset_register_all(dev);
++	if (drm_core_check_feature(dev, DRIVER_MODESET)) {
++		ret = drm_modeset_register_all(dev);
++		if (ret)
++			goto err_unload;
++	}
+ 
+ 	DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
+ 		 driver->name, driver->major, driver->minor,
+@@ -960,6 +963,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
+ 
+ 	goto out_unlock;
+ 
++err_unload:
++	if (dev->driver->unload)
++		dev->driver->unload(dev);
+ err_minors:
+ 	remove_compat_control_link(dev);
+ 	drm_minor_unregister(dev, DRM_MINOR_ACCEL);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-i915-display-move-releasing-gem-object-away-from.patch b/queue-6.7/drm-i915-display-move-releasing-gem-object-away-from.patch
new file mode 100644
index 00000000000..2d8150a8f7a
--- /dev/null
+++ b/queue-6.7/drm-i915-display-move-releasing-gem-object-away-from.patch
@@ -0,0 +1,54 @@
+From 4df8d65fcab6f4f044f8841ac095f203d2ef472a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 10:21:57 +0300
+Subject: drm/i915/display: Move releasing gem object away from fb tracking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+[ Upstream commit 501069dad5214fafe1b8ba38fa26a5d07df784c3 ]
+
+As a preparation for Xe we want to remove all i915_gem_object details away
+from frontbuffer tacking code. Due to this move releasing gem object
+reference to i915_gem_object_set_frontbuffer.
+
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Juha-Pekka Heikkila <juhapekka.heikkila@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231012072158.4115795-2-jouni.hogander@intel.com
+Stable-dep-of: 560ea72c76eb ("drm/i915/dp_mst: Fix race between connector registration and setup")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/display/intel_frontbuffer.c       | 2 --
+ drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h | 1 +
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/display/intel_frontbuffer.c b/drivers/gpu/drm/i915/display/intel_frontbuffer.c
+index ec46716b2f49..2ea37c0414a9 100644
+--- a/drivers/gpu/drm/i915/display/intel_frontbuffer.c
++++ b/drivers/gpu/drm/i915/display/intel_frontbuffer.c
+@@ -265,8 +265,6 @@ static void frontbuffer_release(struct kref *ref)
+ 	spin_unlock(&intel_bo_to_i915(obj)->display.fb_tracking.lock);
+ 
+ 	i915_active_fini(&front->write);
+-
+-	i915_gem_object_put(obj);
+ 	kfree_rcu(front, rcu);
+ }
+ 
+diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h
+index e5e870b6f186..9fbf14867a2a 100644
+--- a/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h
++++ b/drivers/gpu/drm/i915/gem/i915_gem_object_frontbuffer.h
+@@ -89,6 +89,7 @@ i915_gem_object_set_frontbuffer(struct drm_i915_gem_object *obj,
+ 
+ 	if (!front) {
+ 		RCU_INIT_POINTER(obj->frontbuffer, NULL);
++		drm_gem_object_put(intel_bo_to_drm_bo(obj));
+ 	} else if (rcu_access_pointer(obj->frontbuffer)) {
+ 		cur = rcu_dereference_protected(obj->frontbuffer, true);
+ 		kref_get(&cur->ref);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-imx-lcdc-fix-double-free-of-driver-data.patch b/queue-6.7/drm-imx-lcdc-fix-double-free-of-driver-data.patch
new file mode 100644
index 00000000000..9359a29745b
--- /dev/null
+++ b/queue-6.7/drm-imx-lcdc-fix-double-free-of-driver-data.patch
@@ -0,0 +1,58 @@
+From 7b5c925faf1a57ef8498ed105c4c9cc7c4e668fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Jul 2023 11:27:31 +0200
+Subject: drm/imx/lcdc: Fix double-free of driver data
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit ff3670877e7c73d06c2a835d9abb62efcae0145c ]
+
+The struct imx_lcdc driver data is allocated using devm_drm_dev_alloc()
+so it must not be explicitly kfree()d.
+
+Also drm_kms_helper_poll_fini() should not be called as there is no
+matching drm_kms_helper_poll_init(). So drop the release function
+completely.
+
+Fixes: c87e859cdeb5 ("drm/imx/lcdc: Implement DRM driver for imx25")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Philipp Zabel <philipp.zabel@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230706092731.2630232-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imx/lcdc/imx-lcdc.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/lcdc/imx-lcdc.c b/drivers/gpu/drm/imx/lcdc/imx-lcdc.c
+index 22b65f4a0e30..4beb3b4bd694 100644
+--- a/drivers/gpu/drm/imx/lcdc/imx-lcdc.c
++++ b/drivers/gpu/drm/imx/lcdc/imx-lcdc.c
+@@ -342,21 +342,12 @@ static const struct drm_mode_config_helper_funcs imx_lcdc_mode_config_helpers =
+ 	.atomic_commit_tail = drm_atomic_helper_commit_tail_rpm,
+ };
+ 
+-static void imx_lcdc_release(struct drm_device *drm)
+-{
+-	struct imx_lcdc *lcdc = imx_lcdc_from_drmdev(drm);
+-
+-	drm_kms_helper_poll_fini(drm);
+-	kfree(lcdc);
+-}
+-
+ DEFINE_DRM_GEM_DMA_FOPS(imx_lcdc_drm_fops);
+ 
+ static struct drm_driver imx_lcdc_drm_driver = {
+ 	.driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC,
+ 	.fops = &imx_lcdc_drm_fops,
+ 	DRM_GEM_DMA_DRIVER_OPS_VMAP,
+-	.release = imx_lcdc_release,
+ 	.name = "imx-lcdc",
+ 	.desc = "i.MX LCDC driver",
+ 	.date = "20200716",
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch b/queue-6.7/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
new file mode 100644
index 00000000000..0de2b23e670
--- /dev/null
+++ b/queue-6.7/drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
@@ -0,0 +1,48 @@
+From 5537d2f89beddebc647f420d4a46f30c1025e5d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 09:29:27 -0500
+Subject: drm/mediatek: dp: Add phy_mtk_dp module as pre-dependency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+
+[ Upstream commit c8048dd0b07df68724805254b9e994d99e9a7af4 ]
+
+The mtk_dp driver registers a phy device which is handled by the
+phy_mtk_dp driver and assumes that the phy probe will complete
+synchronously, proceeding to make use of functionality exposed by that
+driver right away. This assumption however is false when the phy driver
+is built as a module, causing the mtk_dp driver to fail probe in this
+case.
+
+Add the phy_mtk_dp module as a pre-dependency to the mtk_dp module to
+ensure the phy module has been loaded before the dp, so that the phy
+probe happens synchrounously and the mtk_dp driver can probe
+successfully even with the phy driver built as a module.
+
+Suggested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver")
+Signed-off-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Guillaume Ranquet <granquet@baylibre.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20231121142938.460846-1-nfraprado@collabora.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c
+index e4c16ba9902d..2136a596efa1 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dp.c
++++ b/drivers/gpu/drm/mediatek/mtk_dp.c
+@@ -2818,3 +2818,4 @@ MODULE_AUTHOR("Markus Schneider-Pargmann <msp@baylibre.com>");
+ MODULE_AUTHOR("Bo-Chen Chen <rex-bc.chen@mediatek.com>");
+ MODULE_DESCRIPTION("MediaTek DisplayPort Driver");
+ MODULE_LICENSE("GPL");
++MODULE_SOFTDEP("pre: phy_mtk_dp");
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch b/queue-6.7/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
new file mode 100644
index 00000000000..2e59119560d
--- /dev/null
+++ b/queue-6.7/drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
@@ -0,0 +1,41 @@
+From 73d903c6e9ad69578aef98fba1a00d99ad2a46c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 13:58:46 +0800
+Subject: drm/mediatek: Fix underrun in VDO1 when switches off the layer
+
+From: Hsiao Chien Sung <shawn.sung@mediatek.com>
+
+[ Upstream commit 73b5ab27ab2ee616f2709dc212c2b0007894a12e ]
+
+Do not reset Merge while using CMDQ because reset API doesn't
+wait for frame done event as CMDQ does and could lead to
+underrun when the layer is switching off.
+
+Fixes: aaf94f7c3ae6 ("drm/mediatek: Add display merge async reset control")
+
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-23-shawn.sung@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_disp_merge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_disp_merge.c b/drivers/gpu/drm/mediatek/mtk_disp_merge.c
+index e525a6b9e5b0..22f768d923d5 100644
+--- a/drivers/gpu/drm/mediatek/mtk_disp_merge.c
++++ b/drivers/gpu/drm/mediatek/mtk_disp_merge.c
+@@ -103,7 +103,7 @@ void mtk_merge_stop_cmdq(struct device *dev, struct cmdq_pkt *cmdq_pkt)
+ 	mtk_ddp_write(cmdq_pkt, 0, &priv->cmdq_reg, priv->regs,
+ 		      DISP_REG_MERGE_CTRL);
+ 
+-	if (priv->async_clk)
++	if (!cmdq_pkt && priv->async_clk)
+ 		reset_control_reset(priv->reset_ctl);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-mediatek-remove-the-redundant-driver-data-for-dp.patch b/queue-6.7/drm-mediatek-remove-the-redundant-driver-data-for-dp.patch
new file mode 100644
index 00000000000..307fa0192e4
--- /dev/null
+++ b/queue-6.7/drm-mediatek-remove-the-redundant-driver-data-for-dp.patch
@@ -0,0 +1,62 @@
+From 436fc92fce9e20298357e7e5e95cc806f7a937e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 13:58:45 +0800
+Subject: drm/mediatek: Remove the redundant driver data for DPI
+
+From: Hsiao Chien Sung <shawn.sung@mediatek.com>
+
+[ Upstream commit 8ac6935e5689a491f0bec78fec732722b3dad094 ]
+
+DPI input is in 1T2P mode on both MT8195 and MT8188.
+Remove the redundant driver data to align the settings, or
+the screen will glitch.
+
+Fixes: 2847cd7e6403 ("drm/mediatek: Add mt8188 dpi compatibles and platform data")
+
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-22-shawn.sung@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_dpi.c | 16 +---------------
+ 1 file changed, 1 insertion(+), 15 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/mtk_dpi.c
+index 4e3d9f7b4d8c..beb7d9d08e97 100644
+--- a/drivers/gpu/drm/mediatek/mtk_dpi.c
++++ b/drivers/gpu/drm/mediatek/mtk_dpi.c
+@@ -966,20 +966,6 @@ static const struct mtk_dpi_conf mt8186_conf = {
+ 	.csc_enable_bit = CSC_ENABLE,
+ };
+ 
+-static const struct mtk_dpi_conf mt8188_dpintf_conf = {
+-	.cal_factor = mt8195_dpintf_calculate_factor,
+-	.max_clock_khz = 600000,
+-	.output_fmts = mt8195_output_fmts,
+-	.num_output_fmts = ARRAY_SIZE(mt8195_output_fmts),
+-	.pixels_per_iter = 4,
+-	.input_2pixel = false,
+-	.dimension_mask = DPINTF_HPW_MASK,
+-	.hvsize_mask = DPINTF_HSIZE_MASK,
+-	.channel_swap_shift = DPINTF_CH_SWAP,
+-	.yuv422_en_bit = DPINTF_YUV422_EN,
+-	.csc_enable_bit = DPINTF_CSC_ENABLE,
+-};
+-
+ static const struct mtk_dpi_conf mt8192_conf = {
+ 	.cal_factor = mt8183_calculate_factor,
+ 	.reg_h_fre_con = 0xe0,
+@@ -1103,7 +1089,7 @@ static const struct of_device_id mtk_dpi_of_ids[] = {
+ 	{ .compatible = "mediatek,mt8173-dpi", .data = &mt8173_conf },
+ 	{ .compatible = "mediatek,mt8183-dpi", .data = &mt8183_conf },
+ 	{ .compatible = "mediatek,mt8186-dpi", .data = &mt8186_conf },
+-	{ .compatible = "mediatek,mt8188-dp-intf", .data = &mt8188_dpintf_conf },
++	{ .compatible = "mediatek,mt8188-dp-intf", .data = &mt8195_dpintf_conf },
+ 	{ .compatible = "mediatek,mt8192-dpi", .data = &mt8192_conf },
+ 	{ .compatible = "mediatek,mt8195-dp-intf", .data = &mt8195_dpintf_conf },
+ 	{ /* sentinel */ },
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch b/queue-6.7/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
new file mode 100644
index 00000000000..cf1ac75068a
--- /dev/null
+++ b/queue-6.7/drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
@@ -0,0 +1,41 @@
+From db017a563768b3dbea29f00c12b572eee8dd561e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 13:58:44 +0800
+Subject: drm/mediatek: Return error if MDP RDMA failed to enable the clock
+
+From: Hsiao Chien Sung <shawn.sung@mediatek.com>
+
+[ Upstream commit 21b287146adf39304193e4c49198021e06a28ded ]
+
+Return the result of clk_prepare_enable() instead of
+always returns 0.
+
+Fixes: f8946e2b6bb2 ("drm/mediatek: Add display MDP RDMA support for MT8195")
+
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Hsiao Chien Sung <shawn.sung@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20231214055847.4936-21-shawn.sung@mediatek.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_mdp_rdma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
+index c3adaeefd551..c7233d0ac210 100644
+--- a/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
++++ b/drivers/gpu/drm/mediatek/mtk_mdp_rdma.c
+@@ -246,8 +246,7 @@ int mtk_mdp_rdma_clk_enable(struct device *dev)
+ {
+ 	struct mtk_mdp_rdma *rdma = dev_get_drvdata(dev);
+ 
+-	clk_prepare_enable(rdma->clk);
+-	return 0;
++	return clk_prepare_enable(rdma->clk);
+ }
+ 
+ void mtk_mdp_rdma_clk_disable(struct device *dev)
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-a6xx-add-qmp-dependency.patch b/queue-6.7/drm-msm-a6xx-add-qmp-dependency.patch
new file mode 100644
index 00000000000..59195b29b72
--- /dev/null
+++ b/queue-6.7/drm-msm-a6xx-add-qmp-dependency.patch
@@ -0,0 +1,45 @@
+From fc45468f1c8c963b265db0b8993bf4c0c7a71f4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Oct 2023 22:04:03 +0200
+Subject: drm/msm/a6xx: add QMP dependency
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 96ab215b2d5edc39310c00f50b33d8ab72ac3fe3 ]
+
+When QMP is in a loadable module, the A6xx GPU driver fails to link
+as built-in:
+
+x86_64-linux-ld: drivers/gpu/drm/msm/adreno/a6xx_gmu.o: in function `a6xx_gmu_resume':
+a6xx_gmu.c:(.text+0xd62): undefined reference to `qmp_send'
+
+Add the usual dependency that still allows compiling without QMP but
+otherwise avoids the broken combination of options.
+
+Fixes: 88a0997f2f949 ("drm/msm/a6xx: Send ACD state to QMP at GMU resume")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/562945/
+Link: https://lore.kernel.org/r/20231016200415.791090-1-arnd@kernel.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/msm/Kconfig b/drivers/gpu/drm/msm/Kconfig
+index 6309a857ca31..ad70b611b44f 100644
+--- a/drivers/gpu/drm/msm/Kconfig
++++ b/drivers/gpu/drm/msm/Kconfig
+@@ -6,6 +6,7 @@ config DRM_MSM
+ 	depends on ARCH_QCOM || SOC_IMX5 || COMPILE_TEST
+ 	depends on COMMON_CLK
+ 	depends on IOMMU_SUPPORT
++	depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n
+ 	depends on QCOM_OCMEM || QCOM_OCMEM=n
+ 	depends on QCOM_LLCC || QCOM_LLCC=n
+ 	depends on QCOM_COMMAND_DB || QCOM_COMMAND_DB=n
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-adreno-fix-a680-chip-id.patch b/queue-6.7/drm-msm-adreno-fix-a680-chip-id.patch
new file mode 100644
index 00000000000..c7b4472b29b
--- /dev/null
+++ b/queue-6.7/drm-msm-adreno-fix-a680-chip-id.patch
@@ -0,0 +1,40 @@
+From fc512c7200e6280a5fac7762e2a491c2f9ed3cf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 16:26:41 -0800
+Subject: drm/msm/adreno: Fix A680 chip id
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit 3e6688fd96966b6c275e95c39aa367bc0a490ccd ]
+
+The only A680 referenced from DeviceTree is patch level 1, which since
+commit '90b593ce1c9e ("drm/msm/adreno: Switch to chip-id for identifying
+GPU")' isn't a known chip id.
+
+Correct the chip id to allow the A680 to be recognized again.
+
+Fixes: 90b593ce1c9e ("drm/msm/adreno: Switch to chip-id for identifying GPU")
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/569839/
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index 41b13dec9bef..3ee14646ab6b 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -464,7 +464,7 @@ static const struct adreno_info gpulist[] = {
+ 			{ 190, 1 },
+ 		),
+ 	}, {
+-		.chip_ids = ADRENO_CHIP_IDS(0x06080000),
++		.chip_ids = ADRENO_CHIP_IDS(0x06080001),
+ 		.family = ADRENO_6XX_GEN2,
+ 		.revn = 680,
+ 		.fw = {
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-dpu-add-missing-safe_lut_tbl-in-sc8180x-cata.patch b/queue-6.7/drm-msm-dpu-add-missing-safe_lut_tbl-in-sc8180x-cata.patch
new file mode 100644
index 00000000000..e552df1ddbb
--- /dev/null
+++ b/queue-6.7/drm-msm-dpu-add-missing-safe_lut_tbl-in-sc8180x-cata.patch
@@ -0,0 +1,42 @@
+From ce97f2035e4ccf134193febc59d3eb6ac38d5546 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 16:35:01 -0800
+Subject: drm/msm/dpu: Add missing safe_lut_tbl in sc8180x catalog
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit 7cc2621f16b644bb7af37987cb471311641a9e56 ]
+
+Similar to SC8280XP, the misconfigured SAFE logic causes rather
+significant delays in __arm_smmu_tlb_sync(), resulting in poor
+performance for things such as USB.
+
+Introduce appropriate SAFE values for SC8180X to correct this.
+
+Fixes: f3af2d6ee9ab ("drm/msm/dpu: Add SC8180x to hw catalog")
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reported-by: Anton Bambura <jenneron@postmarketos.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/569840/
+Link: https://lore.kernel.org/r/20231130-sc8180x-dpu-safe-lut-v1-1-a8a6bbac36b8@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h
+index e07f4c8c25b9..9ffc8804a6fc 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h
+@@ -367,6 +367,7 @@ static const struct dpu_perf_cfg sc8180x_perf_data = {
+ 	.min_llcc_ib = 800000,
+ 	.min_dram_ib = 800000,
+ 	.danger_lut_tbl = {0xf, 0xffff, 0x0},
++	.safe_lut_tbl = {0xfff0, 0xf000, 0xffff},
+ 	.qos_lut_tbl = {
+ 		{.nentry = ARRAY_SIZE(sc7180_qos_linear),
+ 		.entries = sc7180_qos_linear
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-dpu-correct-clk-bit-for-wb2-block.patch b/queue-6.7/drm-msm-dpu-correct-clk-bit-for-wb2-block.patch
new file mode 100644
index 00000000000..dc8070d20e4
--- /dev/null
+++ b/queue-6.7/drm-msm-dpu-correct-clk-bit-for-wb2-block.patch
@@ -0,0 +1,74 @@
+From 2c49d47592fb9d21081bb5b8b0b6db95716440bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Dec 2023 03:24:37 +0300
+Subject: drm/msm/dpu: correct clk bit for WB2 block
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit e843ca2f30e630675e2d2a75c96f4844f2854430 ]
+
+On sc7280 there are two clk bits for WB2: vbif_cli and clk_ctrl. While
+programming the VBIF params of WB, the driver should be toggling the
+former bit, while the sc7180_mdp, sc7280_mdp and sm8250_mdp structs
+list the latter one.
+
+Correct that to ensure proper programming sequence for WB2 on these
+platforms.
+
+Fixes: 255f056181ac ("drm/msm/dpu: sc7180: add missing WB2 clock control")
+Fixes: 3ce166380567 ("drm/msm/dpu: add writeback support for sc7280")
+Fixes: 53324b99bd7b ("drm/msm/dpu: add writeback blocks to the sm8250 DPU catalog")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Tested-by: Paloma Arellano <quic_parellan@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/570185/
+Link: https://lore.kernel.org/r/20231203002437.1291595-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h | 2 +-
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h | 2 +-
+ drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h
+index 94278a3e3483..9f8068fa0175 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_0_sm8250.h
+@@ -32,7 +32,7 @@ static const struct dpu_mdp_cfg sm8250_mdp = {
+ 		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2bc, .bit_off = 8 },
+ 		[DPU_CLK_CTRL_DMA3] = { .reg_off = 0x2c4, .bit_off = 8 },
+ 		[DPU_CLK_CTRL_REG_DMA] = { .reg_off = 0x2bc, .bit_off = 20 },
+-		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x3b8, .bit_off = 24 },
++		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+ 	},
+ };
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h
+index c0d88ddccb28..9bfa15e4e645 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_6_2_sc7180.h
+@@ -25,7 +25,7 @@ static const struct dpu_mdp_cfg sc7180_mdp = {
+ 		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+ 		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+ 		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 },
+-		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x3b8, .bit_off = 24 },
++		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+ 	},
+ };
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h
+index 15942fa5a8e0..b9c296e51e36 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h
+@@ -25,7 +25,7 @@ static const struct dpu_mdp_cfg sc7280_mdp = {
+ 		[DPU_CLK_CTRL_DMA0] = { .reg_off = 0x2ac, .bit_off = 8 },
+ 		[DPU_CLK_CTRL_DMA1] = { .reg_off = 0x2b4, .bit_off = 8 },
+ 		[DPU_CLK_CTRL_DMA2] = { .reg_off = 0x2c4, .bit_off = 8 },
+-		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x3b8, .bit_off = 24 },
++		[DPU_CLK_CTRL_WB2] = { .reg_off = 0x2bc, .bit_off = 16 },
+ 	},
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch b/queue-6.7/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
new file mode 100644
index 00000000000..06ed0742dc0
--- /dev/null
+++ b/queue-6.7/drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
@@ -0,0 +1,246 @@
+From 55c430757b9bccf3fb60cb0c55b7fd3f352e6f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 13:30:18 -0800
+Subject: drm/msm/dpu: Drop enable and frame_count parameters from
+ dpu_hw_setup_misr()
+
+From: Jessica Zhang <quic_jesszhan@quicinc.com>
+
+[ Upstream commit 3313c23f3eab698bc6b904520ee608fc0f7b03d0 ]
+
+Drop the enable and frame_count parameters from dpu_hw_setup_misr() as they
+are always set to the same values.
+
+In addition, replace MISR_FRAME_COUNT_MASK with MISR_FRAME_COUNT as
+frame_count is always set to the same value.
+
+Fixes: 7b37523fb1d1 ("drm/msm/dpu: Move MISR methods to dpu_hw_util")
+Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/572009/
+Link: https://lore.kernel.org/r/20231213-encoder-fixup-v4-2-6da6cd1bf118@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c    |  4 ++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c |  4 ++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c |  6 +++---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h |  4 ++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c   |  6 +++---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h   |  3 ++-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c | 19 +++++--------------
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h |  9 +++------
+ 8 files changed, 22 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+index 3c475f8042b0..db501ce1d855 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2014-2021 The Linux Foundation. All rights reserved.
+  * Copyright (C) 2013 Red Hat
+  * Author: Rob Clark <robdclark@gmail.com>
+@@ -125,7 +125,7 @@ static void dpu_crtc_setup_lm_misr(struct dpu_crtc_state *crtc_state)
+ 			continue;
+ 
+ 		/* Calculate MISR over 1 frame */
+-		m->hw_lm->ops.setup_misr(m->hw_lm, true, 1);
++		m->hw_lm->ops.setup_misr(m->hw_lm);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+index 1cf7ff6caff4..5dbb5d27bbea 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c
+@@ -2,7 +2,7 @@
+ /*
+  * Copyright (C) 2013 Red Hat
+  * Copyright (c) 2014-2018, 2020-2021 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  *
+  * Author: Rob Clark <robdclark@gmail.com>
+  */
+@@ -255,7 +255,7 @@ void dpu_encoder_setup_misr(const struct drm_encoder *drm_enc)
+ 		if (!phys->hw_intf || !phys->hw_intf->ops.setup_misr)
+ 			continue;
+ 
+-		phys->hw_intf->ops.setup_misr(phys->hw_intf, true, 1);
++		phys->hw_intf->ops.setup_misr(phys->hw_intf);
+ 	}
+ }
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+index 813bfde6832a..27b9373cd784 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -318,9 +318,9 @@ static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf)
+ 	return DPU_REG_READ(c, INTF_LINE_COUNT);
+ }
+ 
+-static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf, bool enable, u32 frame_count)
++static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf)
+ {
+-	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count, 0x1);
++	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, 0x1);
+ }
+ 
+ static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
+index c539025c418b..66a5603dc7ed 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0-only */
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -95,7 +95,7 @@ struct dpu_hw_intf_ops {
+ 
+ 	void (*bind_pingpong_blk)(struct dpu_hw_intf *intf,
+ 			const enum dpu_pingpong pp);
+-	void (*setup_misr)(struct dpu_hw_intf *intf, bool enable, u32 frame_count);
++	void (*setup_misr)(struct dpu_hw_intf *intf);
+ 	int (*collect_misr)(struct dpu_hw_intf *intf, u32 *misr_value);
+ 
+ 	// Tearcheck on INTF since DPU 5.0.0
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+index a34cf8c979cb..a590c1f7465f 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -81,9 +81,9 @@ static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx,
+ 	}
+ }
+ 
+-static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count)
++static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx)
+ {
+-	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count, 0x0);
++	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, 0x0);
+ }
+ 
+ static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h
+index 36992d046a53..98b77cda6547 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.h
+@@ -1,5 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0-only */
+ /*
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -57,7 +58,7 @@ struct dpu_hw_lm_ops {
+ 	/**
+ 	 * setup_misr: Enable/disable MISR
+ 	 */
+-	void (*setup_misr)(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count);
++	void (*setup_misr)(struct dpu_hw_mixer *ctx);
+ 
+ 	/**
+ 	 * collect_misr: Read MISR signature
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+index b328fe22abde..1d4f0b97c3c1 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+  */
+ #define pr_fmt(fmt)	"[drm:%s:%d] " fmt, __func__, __LINE__
+@@ -485,9 +485,7 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset,
+  * note: Aside from encoders, input_sel should be set to 0x0 by default
+  */
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+-		u32 misr_ctrl_offset,
+-		bool enable, u32 frame_count,
+-		u8 input_sel)
++		u32 misr_ctrl_offset, u8 input_sel)
+ {
+ 	u32 config = 0;
+ 
+@@ -496,16 +494,9 @@ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 	/* Clear old MISR value (in case it's read before a new value is calculated)*/
+ 	wmb();
+ 
+-	if (enable) {
+-		config = (frame_count & MISR_FRAME_COUNT_MASK) |
+-			MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK |
+-			((input_sel & 0xF) << 24);
+-
+-		DPU_REG_WRITE(c, misr_ctrl_offset, config);
+-	} else {
+-		DPU_REG_WRITE(c, misr_ctrl_offset, 0);
+-	}
+-
++	config = MISR_FRAME_COUNT | MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK |
++		((input_sel & 0xF) << 24);
++	DPU_REG_WRITE(c, misr_ctrl_offset, config);
+ }
+ 
+ int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+index 3feb6043e251..ec09fc3865ab 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: GPL-2.0-only */
+ /*
+- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Copyright (c) 2015-2021, The Linux Foundation. All rights reserved.
+  */
+ 
+@@ -13,7 +13,7 @@
+ #include "dpu_hw_catalog.h"
+ 
+ #define REG_MASK(n)                     ((BIT(n)) - 1)
+-#define MISR_FRAME_COUNT_MASK           0xFF
++#define MISR_FRAME_COUNT                0x1
+ #define MISR_CTRL_ENABLE                BIT(8)
+ #define MISR_CTRL_STATUS                BIT(9)
+ #define MISR_CTRL_STATUS_CLEAR          BIT(10)
+@@ -358,10 +358,7 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset,
+ 			   const struct dpu_hw_qos_cfg *cfg);
+ 
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+-		u32 misr_ctrl_offset,
+-		bool enable,
+-		u32 frame_count,
+-		u8 input_sel);
++		u32 misr_ctrl_offset, u8 input_sel);
+ 
+ int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-dpu-enable-smartdma-on-sm8450.patch b/queue-6.7/drm-msm-dpu-enable-smartdma-on-sm8450.patch
new file mode 100644
index 00000000000..a509f1531d4
--- /dev/null
+++ b/queue-6.7/drm-msm-dpu-enable-smartdma-on-sm8450.patch
@@ -0,0 +1,101 @@
+From 6e6ec3ed2722f25032a0e22b8e0b5d32a3fd6d81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2023 19:56:27 +0300
+Subject: drm/msm/dpu: enable SmartDMA on SM8450
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a9bd555de5e9042fdf8ab8d6080b86f45c68ddf6 ]
+
+Enable the SmartDMA / multirect support on the SM8450 platform to
+support higher resoltion modes.
+
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/561590/
+Link: https://lore.kernel.org/r/20231009165627.2691015-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Stable-dep-of: 46b1f1b839ca ("drm/msm/dpu: populate SSPP scaler block version")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h   | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h
+index 7742f52be859..d18145c226da 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h
+@@ -75,7 +75,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	{
+ 		.name = "sspp_0", .id = SSPP_VIG0,
+ 		.base = 0x4000, .len = 0x32c,
+-		.features = VIG_SC7180_MASK,
++		.features = VIG_SC7180_MASK_SDMA,
+ 		.sblk = &sm8250_vig_sblk_0,
+ 		.xin_id = 0,
+ 		.type = SSPP_TYPE_VIG,
+@@ -83,7 +83,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	}, {
+ 		.name = "sspp_1", .id = SSPP_VIG1,
+ 		.base = 0x6000, .len = 0x32c,
+-		.features = VIG_SC7180_MASK,
++		.features = VIG_SC7180_MASK_SDMA,
+ 		.sblk = &sm8250_vig_sblk_1,
+ 		.xin_id = 4,
+ 		.type = SSPP_TYPE_VIG,
+@@ -91,7 +91,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	}, {
+ 		.name = "sspp_2", .id = SSPP_VIG2,
+ 		.base = 0x8000, .len = 0x32c,
+-		.features = VIG_SC7180_MASK,
++		.features = VIG_SC7180_MASK_SDMA,
+ 		.sblk = &sm8250_vig_sblk_2,
+ 		.xin_id = 8,
+ 		.type = SSPP_TYPE_VIG,
+@@ -99,7 +99,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	}, {
+ 		.name = "sspp_3", .id = SSPP_VIG3,
+ 		.base = 0xa000, .len = 0x32c,
+-		.features = VIG_SC7180_MASK,
++		.features = VIG_SC7180_MASK_SDMA,
+ 		.sblk = &sm8250_vig_sblk_3,
+ 		.xin_id = 12,
+ 		.type = SSPP_TYPE_VIG,
+@@ -107,7 +107,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	}, {
+ 		.name = "sspp_8", .id = SSPP_DMA0,
+ 		.base = 0x24000, .len = 0x32c,
+-		.features = DMA_SDM845_MASK,
++		.features = DMA_SDM845_MASK_SDMA,
+ 		.sblk = &sdm845_dma_sblk_0,
+ 		.xin_id = 1,
+ 		.type = SSPP_TYPE_DMA,
+@@ -115,7 +115,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	}, {
+ 		.name = "sspp_9", .id = SSPP_DMA1,
+ 		.base = 0x26000, .len = 0x32c,
+-		.features = DMA_SDM845_MASK,
++		.features = DMA_SDM845_MASK_SDMA,
+ 		.sblk = &sdm845_dma_sblk_1,
+ 		.xin_id = 5,
+ 		.type = SSPP_TYPE_DMA,
+@@ -123,7 +123,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	}, {
+ 		.name = "sspp_10", .id = SSPP_DMA2,
+ 		.base = 0x28000, .len = 0x32c,
+-		.features = DMA_CURSOR_SDM845_MASK,
++		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+ 		.sblk = &sdm845_dma_sblk_2,
+ 		.xin_id = 9,
+ 		.type = SSPP_TYPE_DMA,
+@@ -131,7 +131,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 	}, {
+ 		.name = "sspp_11", .id = SSPP_DMA3,
+ 		.base = 0x2a000, .len = 0x32c,
+-		.features = DMA_CURSOR_SDM845_MASK,
++		.features = DMA_CURSOR_SDM845_MASK_SDMA,
+ 		.sblk = &sdm845_dma_sblk_3,
+ 		.xin_id = 13,
+ 		.type = SSPP_TYPE_DMA,
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-dpu-populate-sspp-scaler-block-version.patch b/queue-6.7/drm-msm-dpu-populate-sspp-scaler-block-version.patch
new file mode 100644
index 00000000000..9b98eab0c18
--- /dev/null
+++ b/queue-6.7/drm-msm-dpu-populate-sspp-scaler-block-version.patch
@@ -0,0 +1,349 @@
+From 573531881bf9e7b7d3897bf34af6628affc59c3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 01:40:25 +0200
+Subject: drm/msm/dpu: populate SSPP scaler block version
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit 46b1f1b839cad600de3ad7ed999bd0155c528746 ]
+
+The function _dpu_hw_sspp_setup_scaler3() passes and
+dpu_hw_setup_scaler3() uses scaler_blk.version to determine in which way
+the scaler (QSEED3) block should be programmed. However up to now we
+were not setting this field. Set it now, splitting the vig_sblk data
+which has different version fields.
+
+Reported-by: Marijn Suijten <marijn.suijten@somainline.org>
+Fixes: 9b6f4fedaac2 ("drm/msm/dpu: Add SM6125 support")
+Fixes: 27f0df03f3ff ("drm/msm/dpu: Add SM6375 support")
+Fixes: 3186acba5cdc ("drm/msm/dpu: Add SM6350 support")
+Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550")
+Fixes: 4a352c2fc15a ("drm/msm/dpu: Introduce SC8280XP")
+Fixes: 0e91bcbb0016 ("drm/msm/dpu: Add SM8350 to hw catalog")
+Fixes: 100d7ef6995d ("drm/msm/dpu: add support for SM8450")
+Fixes: 3581b7062cec ("drm/msm/disp/dpu1: add support for display on SM6115")
+Fixes: dabfdd89eaa9 ("drm/msm/disp/dpu1: add inline rotation support for sc7280")
+Fixes: f3af2d6ee9ab ("drm/msm/dpu: Add SC8180x to hw catalog")
+Fixes: 94391a14fc27 ("drm/msm/dpu1: Add MSM8998 to hw catalog")
+Fixes: af776a3e1c30 ("drm/msm/dpu: add SM8250 to hw catalog")
+Fixes: 386fced3f76f ("drm/msm/dpu: add SM8150 to hw catalog")
+Fixes: b75ab05a3479 ("msm:disp:dpu1: add scaler support on SC7180 display")
+Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/570098/
+Link: https://lore.kernel.org/r/20231201234234.2065610-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../msm/disp/dpu1/catalog/dpu_5_0_sm8150.h    |  8 +-
+ .../msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h   |  8 +-
+ .../msm/disp/dpu1/catalog/dpu_8_1_sm8450.h    |  8 +-
+ .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c    | 95 ++++++++++++++-----
+ .../gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h    |  3 +-
+ 5 files changed, 87 insertions(+), 35 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h
+index 9392ad2b4d3f..c022e57864a4 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_0_sm8150.h
+@@ -77,7 +77,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = {
+ 		.name = "sspp_0", .id = SSPP_VIG0,
+ 		.base = 0x4000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_0,
++		.sblk = &sm8150_vig_sblk_0,
+ 		.xin_id = 0,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+@@ -85,7 +85,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = {
+ 		.name = "sspp_1", .id = SSPP_VIG1,
+ 		.base = 0x6000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_1,
++		.sblk = &sm8150_vig_sblk_1,
+ 		.xin_id = 4,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+@@ -93,7 +93,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = {
+ 		.name = "sspp_2", .id = SSPP_VIG2,
+ 		.base = 0x8000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_2,
++		.sblk = &sm8150_vig_sblk_2,
+ 		.xin_id = 8,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+@@ -101,7 +101,7 @@ static const struct dpu_sspp_cfg sm8150_sspp[] = {
+ 		.name = "sspp_3", .id = SSPP_VIG3,
+ 		.base = 0xa000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_3,
++		.sblk = &sm8150_vig_sblk_3,
+ 		.xin_id = 12,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h
+index 9ffc8804a6fc..cb0758f0829d 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_5_1_sc8180x.h
+@@ -76,7 +76,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = {
+ 		.name = "sspp_0", .id = SSPP_VIG0,
+ 		.base = 0x4000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_0,
++		.sblk = &sm8150_vig_sblk_0,
+ 		.xin_id = 0,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+@@ -84,7 +84,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = {
+ 		.name = "sspp_1", .id = SSPP_VIG1,
+ 		.base = 0x6000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_1,
++		.sblk = &sm8150_vig_sblk_1,
+ 		.xin_id = 4,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+@@ -92,7 +92,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = {
+ 		.name = "sspp_2", .id = SSPP_VIG2,
+ 		.base = 0x8000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_2,
++		.sblk = &sm8150_vig_sblk_2,
+ 		.xin_id = 8,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+@@ -100,7 +100,7 @@ static const struct dpu_sspp_cfg sc8180x_sspp[] = {
+ 		.name = "sspp_3", .id = SSPP_VIG3,
+ 		.base = 0xa000, .len = 0x1f0,
+ 		.features = VIG_SDM845_MASK,
+-		.sblk = &sdm845_vig_sblk_3,
++		.sblk = &sm8150_vig_sblk_3,
+ 		.xin_id = 12,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h
+index d18145c226da..72b0f547242f 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_8_1_sm8450.h
+@@ -76,7 +76,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 		.name = "sspp_0", .id = SSPP_VIG0,
+ 		.base = 0x4000, .len = 0x32c,
+ 		.features = VIG_SC7180_MASK_SDMA,
+-		.sblk = &sm8250_vig_sblk_0,
++		.sblk = &sm8450_vig_sblk_0,
+ 		.xin_id = 0,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG0,
+@@ -84,7 +84,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 		.name = "sspp_1", .id = SSPP_VIG1,
+ 		.base = 0x6000, .len = 0x32c,
+ 		.features = VIG_SC7180_MASK_SDMA,
+-		.sblk = &sm8250_vig_sblk_1,
++		.sblk = &sm8450_vig_sblk_1,
+ 		.xin_id = 4,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG1,
+@@ -92,7 +92,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 		.name = "sspp_2", .id = SSPP_VIG2,
+ 		.base = 0x8000, .len = 0x32c,
+ 		.features = VIG_SC7180_MASK_SDMA,
+-		.sblk = &sm8250_vig_sblk_2,
++		.sblk = &sm8450_vig_sblk_2,
+ 		.xin_id = 8,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG2,
+@@ -100,7 +100,7 @@ static const struct dpu_sspp_cfg sm8450_sspp[] = {
+ 		.name = "sspp_3", .id = SSPP_VIG3,
+ 		.base = 0xa000, .len = 0x32c,
+ 		.features = VIG_SC7180_MASK_SDMA,
+-		.sblk = &sm8250_vig_sblk_3,
++		.sblk = &sm8450_vig_sblk_3,
+ 		.xin_id = 12,
+ 		.type = SSPP_TYPE_VIG,
+ 		.clk_ctrl = DPU_CLK_CTRL_VIG3,
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+index a1aada630780..7056c08b9957 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.c
+@@ -249,14 +249,17 @@ static const uint32_t wb2_formats[] = {
+  * SSPP sub blocks config
+  *************************************************************/
+ 
++#define SSPP_SCALER_VER(maj, min) (((maj) << 16) | (min))
++
+ /* SSPP common configuration */
+-#define _VIG_SBLK(sdma_pri, qseed_ver) \
++#define _VIG_SBLK(sdma_pri, qseed_ver, scaler_ver) \
+ 	{ \
+ 	.maxdwnscale = MAX_DOWNSCALE_RATIO, \
+ 	.maxupscale = MAX_UPSCALE_RATIO, \
+ 	.smart_dma_priority = sdma_pri, \
+ 	.scaler_blk = {.name = "scaler", \
+ 		.id = qseed_ver, \
++		.version = scaler_ver, \
+ 		.base = 0xa00, .len = 0xa0,}, \
+ 	.csc_blk = {.name = "csc", \
+ 		.id = DPU_SSPP_CSC_10BIT, \
+@@ -268,13 +271,14 @@ static const uint32_t wb2_formats[] = {
+ 	.rotation_cfg = NULL, \
+ 	}
+ 
+-#define _VIG_SBLK_ROT(sdma_pri, qseed_ver, rot_cfg) \
++#define _VIG_SBLK_ROT(sdma_pri, qseed_ver, scaler_ver, rot_cfg) \
+ 	{ \
+ 	.maxdwnscale = MAX_DOWNSCALE_RATIO, \
+ 	.maxupscale = MAX_UPSCALE_RATIO, \
+ 	.smart_dma_priority = sdma_pri, \
+ 	.scaler_blk = {.name = "scaler", \
+ 		.id = qseed_ver, \
++		.version = scaler_ver, \
+ 		.base = 0xa00, .len = 0xa0,}, \
+ 	.csc_blk = {.name = "csc", \
+ 		.id = DPU_SSPP_CSC_10BIT, \
+@@ -298,13 +302,17 @@ static const uint32_t wb2_formats[] = {
+ 	}
+ 
+ static const struct dpu_sspp_sub_blks msm8998_vig_sblk_0 =
+-				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 2));
+ static const struct dpu_sspp_sub_blks msm8998_vig_sblk_1 =
+-				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 2));
+ static const struct dpu_sspp_sub_blks msm8998_vig_sblk_2 =
+-				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 2));
+ static const struct dpu_sspp_sub_blks msm8998_vig_sblk_3 =
+-				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(0, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 2));
+ 
+ static const struct dpu_rotation_cfg dpu_rot_sc7280_cfg_v2 = {
+ 	.rot_maxheight = 1088,
+@@ -313,13 +321,30 @@ static const struct dpu_rotation_cfg dpu_rot_sc7280_cfg_v2 = {
+ };
+ 
+ static const struct dpu_sspp_sub_blks sdm845_vig_sblk_0 =
+-				_VIG_SBLK(5, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(5, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 3));
+ static const struct dpu_sspp_sub_blks sdm845_vig_sblk_1 =
+-				_VIG_SBLK(6, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(6, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 3));
+ static const struct dpu_sspp_sub_blks sdm845_vig_sblk_2 =
+-				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 3));
+ static const struct dpu_sspp_sub_blks sdm845_vig_sblk_3 =
+-				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED3);
++				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 3));
++
++static const struct dpu_sspp_sub_blks sm8150_vig_sblk_0 =
++				_VIG_SBLK(5, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 4));
++static const struct dpu_sspp_sub_blks sm8150_vig_sblk_1 =
++				_VIG_SBLK(6, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 4));
++static const struct dpu_sspp_sub_blks sm8150_vig_sblk_2 =
++				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 4));
++static const struct dpu_sspp_sub_blks sm8150_vig_sblk_3 =
++				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED3,
++					  SSPP_SCALER_VER(1, 4));
+ 
+ static const struct dpu_sspp_sub_blks sdm845_dma_sblk_0 = _DMA_SBLK(1);
+ static const struct dpu_sspp_sub_blks sdm845_dma_sblk_1 = _DMA_SBLK(2);
+@@ -327,34 +352,60 @@ static const struct dpu_sspp_sub_blks sdm845_dma_sblk_2 = _DMA_SBLK(3);
+ static const struct dpu_sspp_sub_blks sdm845_dma_sblk_3 = _DMA_SBLK(4);
+ 
+ static const struct dpu_sspp_sub_blks sc7180_vig_sblk_0 =
+-				_VIG_SBLK(4, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(4, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 0));
+ 
+ static const struct dpu_sspp_sub_blks sc7280_vig_sblk_0 =
+-			_VIG_SBLK_ROT(4, DPU_SSPP_SCALER_QSEED4, &dpu_rot_sc7280_cfg_v2);
++			_VIG_SBLK_ROT(4, DPU_SSPP_SCALER_QSEED4,
++				      SSPP_SCALER_VER(3, 0),
++				      &dpu_rot_sc7280_cfg_v2);
+ 
+ static const struct dpu_sspp_sub_blks sm6115_vig_sblk_0 =
+-				_VIG_SBLK(2, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(2, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 0));
+ 
+ static const struct dpu_sspp_sub_blks sm6125_vig_sblk_0 =
+-				_VIG_SBLK(3, DPU_SSPP_SCALER_QSEED3LITE);
++				_VIG_SBLK(3, DPU_SSPP_SCALER_QSEED3LITE,
++					  SSPP_SCALER_VER(2, 4));
+ 
+ static const struct dpu_sspp_sub_blks sm8250_vig_sblk_0 =
+-				_VIG_SBLK(5, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(5, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 0));
+ static const struct dpu_sspp_sub_blks sm8250_vig_sblk_1 =
+-				_VIG_SBLK(6, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(6, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 0));
+ static const struct dpu_sspp_sub_blks sm8250_vig_sblk_2 =
+-				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 0));
+ static const struct dpu_sspp_sub_blks sm8250_vig_sblk_3 =
+-				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 0));
++
++static const struct dpu_sspp_sub_blks sm8450_vig_sblk_0 =
++				_VIG_SBLK(5, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 1));
++static const struct dpu_sspp_sub_blks sm8450_vig_sblk_1 =
++				_VIG_SBLK(6, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 1));
++static const struct dpu_sspp_sub_blks sm8450_vig_sblk_2 =
++				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 1));
++static const struct dpu_sspp_sub_blks sm8450_vig_sblk_3 =
++				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 1));
+ 
+ static const struct dpu_sspp_sub_blks sm8550_vig_sblk_0 =
+-				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(7, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 2));
+ static const struct dpu_sspp_sub_blks sm8550_vig_sblk_1 =
+-				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(8, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 2));
+ static const struct dpu_sspp_sub_blks sm8550_vig_sblk_2 =
+-				_VIG_SBLK(9, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(9, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 2));
+ static const struct dpu_sspp_sub_blks sm8550_vig_sblk_3 =
+-				_VIG_SBLK(10, DPU_SSPP_SCALER_QSEED4);
++				_VIG_SBLK(10, DPU_SSPP_SCALER_QSEED4,
++					  SSPP_SCALER_VER(3, 2));
+ static const struct dpu_sspp_sub_blks sm8550_dma_sblk_4 = _DMA_SBLK(5);
+ static const struct dpu_sspp_sub_blks sm8550_dma_sblk_5 = _DMA_SBLK(6);
+ 
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+index df024e10d3a3..62445075306a 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_catalog.h
+@@ -265,7 +265,8 @@ enum {
+ /**
+  * struct dpu_scaler_blk: Scaler information
+  * @info:   HW register and features supported by this sub-blk
+- * @version: qseed block revision
++ * @version: qseed block revision, on QSEED3+ platforms this is the value of
++ *           scaler_blk.base + QSEED3_HW_VERSION registers.
+  */
+ struct dpu_scaler_blk {
+ 	DPU_HW_SUBBLK_INFO;
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-dpu-set-input_sel-bit-for-intf.patch b/queue-6.7/drm-msm-dpu-set-input_sel-bit-for-intf.patch
new file mode 100644
index 00000000000..79926114a39
--- /dev/null
+++ b/queue-6.7/drm-msm-dpu-set-input_sel-bit-for-intf.patch
@@ -0,0 +1,100 @@
+From e9d4b505ec2e9b5a43645be699a5cf3bd4c91e99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 13:30:17 -0800
+Subject: drm/msm/dpu: Set input_sel bit for INTF
+
+From: Jessica Zhang <quic_jesszhan@quicinc.com>
+
+[ Upstream commit 980fffd0c69e5df0f67ee089d405899d532aeeab ]
+
+Set the input_sel bit for encoders as it was missed in the initial
+implementation.
+
+Reported-by: Rob Clark <robdclark@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/39
+Fixes: 91143873a05d ("drm/msm/dpu: Add MISR register support for interface")
+Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/572007/
+Link: https://lore.kernel.org/r/20231213-encoder-fixup-v4-1-6da6cd1bf118@quicinc.com
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 2 +-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c   | 2 +-
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c | 9 +++++++--
+ drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h | 3 ++-
+ 4 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+index e8b8908d3e12..813bfde6832a 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c
+@@ -320,7 +320,7 @@ static u32 dpu_hw_intf_get_line_count(struct dpu_hw_intf *intf)
+ 
+ static void dpu_hw_intf_setup_misr(struct dpu_hw_intf *intf, bool enable, u32 frame_count)
+ {
+-	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count);
++	dpu_hw_setup_misr(&intf->hw, INTF_MISR_CTRL, enable, frame_count, 0x1);
+ }
+ 
+ static int dpu_hw_intf_collect_misr(struct dpu_hw_intf *intf, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+index d1c3bd8379ea..a34cf8c979cb 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_lm.c
+@@ -83,7 +83,7 @@ static void dpu_hw_lm_setup_border_color(struct dpu_hw_mixer *ctx,
+ 
+ static void dpu_hw_lm_setup_misr(struct dpu_hw_mixer *ctx, bool enable, u32 frame_count)
+ {
+-	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count);
++	dpu_hw_setup_misr(&ctx->hw, LM_MISR_CTRL, enable, frame_count, 0x0);
+ }
+ 
+ static int dpu_hw_lm_collect_misr(struct dpu_hw_mixer *ctx, u32 *misr_value)
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+index 18b16b2d2bf5..b328fe22abde 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.c
+@@ -481,9 +481,13 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset,
+ 		      cfg->danger_safe_en ? QOS_QOS_CTRL_DANGER_SAFE_EN : 0);
+ }
+ 
++/*
++ * note: Aside from encoders, input_sel should be set to 0x0 by default
++ */
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+-		bool enable, u32 frame_count)
++		bool enable, u32 frame_count,
++		u8 input_sel)
+ {
+ 	u32 config = 0;
+ 
+@@ -494,7 +498,8 @@ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 
+ 	if (enable) {
+ 		config = (frame_count & MISR_FRAME_COUNT_MASK) |
+-			MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK;
++			MISR_CTRL_ENABLE | MISR_CTRL_FREE_RUN_MASK |
++			((input_sel & 0xF) << 24);
+ 
+ 		DPU_REG_WRITE(c, misr_ctrl_offset, config);
+ 	} else {
+diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+index 4bea139081bc..3feb6043e251 100644
+--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h
+@@ -360,7 +360,8 @@ void _dpu_hw_setup_qos_lut(struct dpu_hw_blk_reg_map *c, u32 offset,
+ void dpu_hw_setup_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+ 		bool enable,
+-		u32 frame_count);
++		u32 frame_count,
++		u8 input_sel);
+ 
+ int dpu_hw_collect_misr(struct dpu_hw_blk_reg_map *c,
+ 		u32 misr_ctrl_offset,
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch b/queue-6.7/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
new file mode 100644
index 00000000000..ef4fc6c00c0
--- /dev/null
+++ b/queue-6.7/drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
@@ -0,0 +1,43 @@
+From 6ef927cb85bb9c780a9013bc963c202bdb063649 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Jun 2023 13:43:20 +0200
+Subject: drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit 3d07a411b4faaf2b498760ccf12888f8de529de0 ]
+
+This helper has been introduced to avoid programmer errors (missing
+_put calls leading to dangling refcnt) when using pm_runtime_get, use it.
+
+While at it, start checking the return value.
+
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Fixes: 5c8290284402 ("drm/msm/dsi: Split PHY drivers to separate files")
+Patchwork: https://patchwork.freedesktop.org/patch/543350/
+Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-1-a11a751f34f0@linaro.org
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+index 05621e5e7d63..b6314bb66d2f 100644
+--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+@@ -516,7 +516,9 @@ static int dsi_phy_enable_resource(struct msm_dsi_phy *phy)
+ 	struct device *dev = &phy->pdev->dev;
+ 	int ret;
+ 
+-	pm_runtime_get_sync(dev);
++	ret = pm_runtime_resume_and_get(dev);
++	if (ret)
++		return ret;
+ 
+ 	ret = clk_prepare_enable(phy->ahb_clk);
+ 	if (ret) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-msm-mdp4-flush-vblank-event-on-disable.patch b/queue-6.7/drm-msm-mdp4-flush-vblank-event-on-disable.patch
new file mode 100644
index 00000000000..c1c6dafc486
--- /dev/null
+++ b/queue-6.7/drm-msm-mdp4-flush-vblank-event-on-disable.patch
@@ -0,0 +1,53 @@
+From 3715ffc938626bea3390d0af6867f0186fd06474 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 00:54:01 +0300
+Subject: drm/msm/mdp4: flush vblank event on disable
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit c6721b3c6423d8a348ae885a0f4c85e14f9bf85c ]
+
+Flush queued events when disabling the crtc. This avoids timeouts when
+we come back and wait for dependencies (like the previous frame's
+flip_done).
+
+Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Patchwork: https://patchwork.freedesktop.org/patch/569127/
+Link: https://lore.kernel.org/r/20231127215401.4064128-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
+index 169f9de4a12a..3100957225a7 100644
+--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
++++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
+@@ -269,6 +269,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
+ {
+ 	struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
+ 	struct mdp4_kms *mdp4_kms = get_kms(crtc);
++	unsigned long flags;
+ 
+ 	DBG("%s", mdp4_crtc->name);
+ 
+@@ -281,6 +282,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
+ 	mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err);
+ 	mdp4_disable(mdp4_kms);
+ 
++	if (crtc->state->event && !crtc->state->active) {
++		WARN_ON(mdp4_crtc->event);
++		spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags);
++		drm_crtc_send_vblank_event(crtc, crtc->state->event);
++		crtc->state->event = NULL;
++		spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags);
++	}
++
+ 	mdp4_crtc->enabled = false;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-nouveau-fence-fix-warning-directly-dereferencing.patch b/queue-6.7/drm-nouveau-fence-fix-warning-directly-dereferencing.patch
new file mode 100644
index 00000000000..ed5897d0fb2
--- /dev/null
+++ b/queue-6.7/drm-nouveau-fence-fix-warning-directly-dereferencing.patch
@@ -0,0 +1,58 @@
+From 7cd9bcba7fd4fabd1fe315b1b8b45b529a065596 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 00:43:03 +0530
+Subject: drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
+
+From: Abhinav Singh <singhabhinav9051571833@gmail.com>
+
+[ Upstream commit 5f35a624c1e30b5bae5023b3c256e94e0ad4f806 ]
+
+Fix a sparse warning with this message
+"warning:dereference of noderef expression". In this context it means we
+are dereferencing a __rcu tagged pointer directly.
+
+We should not be directly dereferencing a rcu pointer. To get a normal
+(non __rcu tagged pointer) from a __rcu tagged pointer we are using the
+function unrcu_pointer(...). The non __rcu tagged pointer then can be
+dereferenced just like a normal pointer.
+
+I tested with qemu with this command
+qemu-system-x86_64 \
+	-m 2G \
+	-smp 2 \
+	-kernel bzImage \
+	-append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
+	-drive file=bullseye.img,format=raw \
+	-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
+	-net nic,model=e1000 \
+	-enable-kvm \
+	-nographic \
+	-pidfile vm.pid \
+	2>&1 | tee vm.log
+with lockdep enabled.
+
+Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu")
+Signed-off-by: Abhinav Singh <singhabhinav9051571833@gmail.com>
+Signed-off-by: Danilo Krummrich <dakr@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231113191303.3277733-1-singhabhinav9051571833@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nv04_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nv04_fence.c b/drivers/gpu/drm/nouveau/nv04_fence.c
+index 5b71a5a5cd85..cdbc75e3d1f6 100644
+--- a/drivers/gpu/drm/nouveau/nv04_fence.c
++++ b/drivers/gpu/drm/nouveau/nv04_fence.c
+@@ -39,7 +39,7 @@ struct nv04_fence_priv {
+ static int
+ nv04_fence_emit(struct nouveau_fence *fence)
+ {
+-	struct nvif_push *push = fence->channel->chan.push;
++	struct nvif_push *push = unrcu_pointer(fence->channel)->chan.push;
+ 	int ret = PUSH_WAIT(push, 2);
+ 	if (ret == 0) {
+ 		PUSH_NVSQ(push, NV_SW, 0x0150, fence->base.seqno);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch b/queue-6.7/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
new file mode 100644
index 00000000000..fc41455c2a4
--- /dev/null
+++ b/queue-6.7/drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
@@ -0,0 +1,42 @@
+From 59def5602e13bd4b33b8330a576df31d9f3aea14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 13:44:02 -0600
+Subject: drm/panel-elida-kd35t133: hold panel in reset for unprepare
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit 03c5b2a5f6c39fe4e090346536cf1c14ee18b61e ]
+
+For devices like the Anbernic RG351M and RG351P the panel is wired to
+an always on regulator. When the device suspends and wakes up, there
+are some slight artifacts on the screen that go away over time. If
+instead we hold the panel in reset status after it is unprepared,
+this does not happen.
+
+Fixes: 5b6603360c12 ("drm/panel: add panel driver for Elida KD35T133 panels")
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Link: https://lore.kernel.org/r/20231117194405.1386265-3-macroalpha82@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231117194405.1386265-3-macroalpha82@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-elida-kd35t133.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-elida-kd35t133.c b/drivers/gpu/drm/panel/panel-elida-kd35t133.c
+index e7be15b68102..6de117232346 100644
+--- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c
++++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c
+@@ -104,6 +104,8 @@ static int kd35t133_unprepare(struct drm_panel *panel)
+ 		return ret;
+ 	}
+ 
++	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
++
+ 	regulator_disable(ctx->iovcc);
+ 	regulator_disable(ctx->vdd);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-panel-nv3051d-hold-panel-in-reset-for-unprepare.patch b/queue-6.7/drm-panel-nv3051d-hold-panel-in-reset-for-unprepare.patch
new file mode 100644
index 00000000000..84cf2daf2e9
--- /dev/null
+++ b/queue-6.7/drm-panel-nv3051d-hold-panel-in-reset-for-unprepare.patch
@@ -0,0 +1,39 @@
+From 3905738c8bb4f31d95849d99f0222347ad3c8f89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 14:25:32 -0600
+Subject: drm/panel: nv3051d: Hold panel in reset for unprepare
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit 697ebc319b942403a6fee894607fd2cd47cca069 ]
+
+Improve the panel's ability to restore from suspend by holding the
+panel in suspend after unprepare.
+
+Fixes: b1d39f0f4264 ("drm/panel: Add NewVision NV3051D MIPI-DSI LCD panel")
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
+Link: https://lore.kernel.org/r/20231117202536.1387815-3-macroalpha82@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231117202536.1387815-3-macroalpha82@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-newvision-nv3051d.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-newvision-nv3051d.c b/drivers/gpu/drm/panel/panel-newvision-nv3051d.c
+index 79de6c886292..c44c6945662f 100644
+--- a/drivers/gpu/drm/panel/panel-newvision-nv3051d.c
++++ b/drivers/gpu/drm/panel/panel-newvision-nv3051d.c
+@@ -261,6 +261,8 @@ static int panel_nv3051d_unprepare(struct drm_panel *panel)
+ 
+ 	usleep_range(10000, 15000);
+ 
++	gpiod_set_value_cansleep(ctx->reset_gpio, 1);
++
+ 	regulator_disable(ctx->vdd);
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-panel-st7701-fix-avcl-calculation.patch b/queue-6.7/drm-panel-st7701-fix-avcl-calculation.patch
new file mode 100644
index 00000000000..0dbb8d71a47
--- /dev/null
+++ b/queue-6.7/drm-panel-st7701-fix-avcl-calculation.patch
@@ -0,0 +1,46 @@
+From 6a920a45bb53ffb93b968108a7682997a1e57587 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 09:48:45 -0600
+Subject: drm/panel: st7701: Fix AVCL calculation
+
+From: Chris Morgan <macromorgan@hotmail.com>
+
+[ Upstream commit 799825aa87200ade1ba21db853d1c2ff720dcfe0 ]
+
+The AVCL register, according to the datasheet, comes in increments
+of -0.2v between -4.4v (represented by 0x0) to -5.0v (represented
+by 0x3). The current calculation is done by adding the defined
+AVCL value in mV to -4400 and then dividing by 200 to get the register
+value. Unfortunately if I subtract -4400 from -4400 I get -8800, which
+divided by 200 gives me -44. If I instead subtract -4400 from -4400
+I get 0, which divided by 200 gives me 0. Based on the datasheet this
+is the expected register value.
+
+Fixes: 83b7a8e7e88e ("drm/panel/panel-sitronix-st7701: Parametrize voltage and timing")
+
+Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20231208154847.130615-2-macroalpha82@gmail.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231208154847.130615-2-macroalpha82@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-sitronix-st7701.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-sitronix-st7701.c b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+index 0459965e1b4f..036ac403ed21 100644
+--- a/drivers/gpu/drm/panel/panel-sitronix-st7701.c
++++ b/drivers/gpu/drm/panel/panel-sitronix-st7701.c
+@@ -288,7 +288,7 @@ static void st7701_init_sequence(struct st7701 *st7701)
+ 		   FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVDD_MASK,
+ 			      DIV_ROUND_CLOSEST(desc->avdd_mv - 6200, 200)) |
+ 		   FIELD_PREP(DSI_CMD2_BK1_PWRCTRL2_AVCL_MASK,
+-			      DIV_ROUND_CLOSEST(-4400 + desc->avcl_mv, 200)));
++			      DIV_ROUND_CLOSEST(-4400 - desc->avcl_mv, 200)));
+ 
+ 	/* T2D = 0.2us * T2D[3:0] */
+ 	ST7701_DSI(st7701, DSI_CMD2_BK1_SPD1,
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch b/queue-6.7/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
new file mode 100644
index 00000000000..13150d05c48
--- /dev/null
+++ b/queue-6.7/drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
@@ -0,0 +1,84 @@
+From 1b78f25b53d86aa454414c38abc053840754dddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 12:42:13 +0100
+Subject: drm/panfrost: Ignore core_mask for poweroff and disable PWRTRANS irq
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit a4f5892914ca7709ea6d191f0edace93a5935966 ]
+
+Some SoCs may be equipped with a GPU containing two core groups
+and this is exactly the case of Samsung's Exynos 5422 featuring
+an ARM Mali-T628 MP6 GPU: the support for this GPU in Panfrost
+is partial, as this driver currently supports using only one
+core group and that's reflected on all parts of it, including
+the power on (and power off, previously to this patch) function.
+
+The issue with this is that even though executing the soft reset
+operation should power off all cores unconditionally, on at least
+one platform we're seeing a crash that seems to be happening due
+to an interrupt firing which may be because we are calling power
+transition only on the first core group, leaving the second one
+unchanged, or because ISR execution was pending before entering
+the panfrost_gpu_power_off() function and executed after powering
+off the GPU cores, or all of the above.
+
+Finally, solve this by:
+ - Avoid to enable the power transition interrupt on reset; and
+ - Ignoring the core_mask and ask the GPU to poweroff both core groups
+
+Fixes: 22aa1a209018 ("drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off()")
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231204114215.54575-2-angelogioacchino.delregno@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_gpu.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+index 97f097ee5c1d..311cf4525e1e 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+@@ -71,7 +71,12 @@ int panfrost_gpu_soft_reset(struct panfrost_device *pfdev)
+ 	}
+ 
+ 	gpu_write(pfdev, GPU_INT_CLEAR, GPU_IRQ_MASK_ALL);
+-	gpu_write(pfdev, GPU_INT_MASK, GPU_IRQ_MASK_ALL);
++
++	/* Only enable the interrupts we care about */
++	gpu_write(pfdev, GPU_INT_MASK,
++		  GPU_IRQ_MASK_ERROR |
++		  GPU_IRQ_PERFCNT_SAMPLE_COMPLETED |
++		  GPU_IRQ_CLEAN_CACHES_COMPLETED);
+ 
+ 	/*
+ 	 * All in-flight jobs should have released their cycle
+@@ -418,11 +423,10 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev)
+ 
+ void panfrost_gpu_power_off(struct panfrost_device *pfdev)
+ {
+-	u64 core_mask = panfrost_get_core_mask(pfdev);
+ 	int ret;
+ 	u32 val;
+ 
+-	gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present & core_mask);
++	gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present);
+ 	ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO,
+ 					 val, !val, 1, 1000);
+ 	if (ret)
+@@ -434,7 +438,7 @@ void panfrost_gpu_power_off(struct panfrost_device *pfdev)
+ 	if (ret)
+ 		dev_err(pfdev->dev, "tiler power transition timeout");
+ 
+-	gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present & core_mask);
++	gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present);
+ 	ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO,
+ 				 val, !val, 0, 1000);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch b/queue-6.7/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
new file mode 100644
index 00000000000..deaf1242e74
--- /dev/null
+++ b/queue-6.7/drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
@@ -0,0 +1,127 @@
+From fd7f832a61bedf42d9ecf58fb0a590f05597179e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 15:15:07 +0100
+Subject: drm/panfrost: Really power off GPU cores in panfrost_gpu_power_off()
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 22aa1a209018dc2eca78745f7666db63637cd5dc ]
+
+The layout of the registers {TILER,SHADER,L2}_PWROFF_LO, used to request
+powering off cores, is the same as the {TILER,SHADER,L2}_PWRON_LO ones:
+this means that in order to request poweroff of cores, we are supposed
+to write a bitmask of cores that should be powered off!
+This means that the panfrost_gpu_power_off() function has always been
+doing nothing.
+
+Fix powering off the GPU by writing a bitmask of the cores to poweroff
+to the relevant PWROFF_LO registers and then check that the transition
+(from ON to OFF) has finished by polling the relevant PWRTRANS_LO
+registers.
+
+While at it, in order to avoid code duplication, move the core mask
+logic from panfrost_gpu_power_on() to a new panfrost_get_core_mask()
+function, used in both poweron and poweroff.
+
+Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231102141507.73481-1-angelogioacchino.delregno@collabora.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_gpu.c | 64 ++++++++++++++++++-------
+ 1 file changed, 46 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+index f0be7e19b13e..97f097ee5c1d 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c
++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c
+@@ -362,28 +362,38 @@ unsigned long long panfrost_cycle_counter_read(struct panfrost_device *pfdev)
+ 	return ((u64)hi << 32) | lo;
+ }
+ 
++static u64 panfrost_get_core_mask(struct panfrost_device *pfdev)
++{
++	u64 core_mask;
++
++	if (pfdev->features.l2_present == 1)
++		return U64_MAX;
++
++	/*
++	 * Only support one core group now.
++	 * ~(l2_present - 1) unsets all bits in l2_present except
++	 * the bottom bit. (l2_present - 2) has all the bits in
++	 * the first core group set. AND them together to generate
++	 * a mask of cores in the first core group.
++	 */
++	core_mask = ~(pfdev->features.l2_present - 1) &
++		     (pfdev->features.l2_present - 2);
++	dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n",
++		      hweight64(core_mask),
++		      hweight64(pfdev->features.shader_present));
++
++	return core_mask;
++}
++
+ void panfrost_gpu_power_on(struct panfrost_device *pfdev)
+ {
+ 	int ret;
+ 	u32 val;
+-	u64 core_mask = U64_MAX;
++	u64 core_mask;
+ 
+ 	panfrost_gpu_init_quirks(pfdev);
++	core_mask = panfrost_get_core_mask(pfdev);
+ 
+-	if (pfdev->features.l2_present != 1) {
+-		/*
+-		 * Only support one core group now.
+-		 * ~(l2_present - 1) unsets all bits in l2_present except
+-		 * the bottom bit. (l2_present - 2) has all the bits in
+-		 * the first core group set. AND them together to generate
+-		 * a mask of cores in the first core group.
+-		 */
+-		core_mask = ~(pfdev->features.l2_present - 1) &
+-			     (pfdev->features.l2_present - 2);
+-		dev_info_once(pfdev->dev, "using only 1st core group (%lu cores from %lu)\n",
+-			      hweight64(core_mask),
+-			      hweight64(pfdev->features.shader_present));
+-	}
+ 	gpu_write(pfdev, L2_PWRON_LO, pfdev->features.l2_present & core_mask);
+ 	ret = readl_relaxed_poll_timeout(pfdev->iomem + L2_READY_LO,
+ 		val, val == (pfdev->features.l2_present & core_mask),
+@@ -408,9 +418,27 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev)
+ 
+ void panfrost_gpu_power_off(struct panfrost_device *pfdev)
+ {
+-	gpu_write(pfdev, TILER_PWROFF_LO, 0);
+-	gpu_write(pfdev, SHADER_PWROFF_LO, 0);
+-	gpu_write(pfdev, L2_PWROFF_LO, 0);
++	u64 core_mask = panfrost_get_core_mask(pfdev);
++	int ret;
++	u32 val;
++
++	gpu_write(pfdev, SHADER_PWROFF_LO, pfdev->features.shader_present & core_mask);
++	ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_PWRTRANS_LO,
++					 val, !val, 1, 1000);
++	if (ret)
++		dev_err(pfdev->dev, "shader power transition timeout");
++
++	gpu_write(pfdev, TILER_PWROFF_LO, pfdev->features.tiler_present);
++	ret = readl_relaxed_poll_timeout(pfdev->iomem + TILER_PWRTRANS_LO,
++					 val, !val, 1, 1000);
++	if (ret)
++		dev_err(pfdev->dev, "tiler power transition timeout");
++
++	gpu_write(pfdev, L2_PWROFF_LO, pfdev->features.l2_present & core_mask);
++	ret = readl_poll_timeout(pfdev->iomem + L2_PWRTRANS_LO,
++				 val, !val, 0, 1000);
++	if (ret)
++		dev_err(pfdev->dev, "l2 power transition timeout");
+ }
+ 
+ int panfrost_gpu_init(struct panfrost_device *pfdev)
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-radeon-check-return-value-of-radeon_ring_lock.patch b/queue-6.7/drm-radeon-check-return-value-of-radeon_ring_lock.patch
new file mode 100644
index 00000000000..499e9ba140d
--- /dev/null
+++ b/queue-6.7/drm-radeon-check-return-value-of-radeon_ring_lock.patch
@@ -0,0 +1,42 @@
+From cf3a01e00b8dcac24c924e679a040e7a331ca4c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Aug 2023 11:04:16 -0700
+Subject: drm/radeon: check return value of radeon_ring_lock()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 71225e1c930942cb1e042fc08c5cc0c4ef30e95e ]
+
+In the unlikely event of radeon_ring_lock() failing, its errno return
+value should be processed. This patch checks said return value and
+prints a debug message in case of an error.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 48c0c902e2e6 ("drm/radeon/kms: add support for CP setup on SI")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/si.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index a91012447b56..85e9cba49cec 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -3611,6 +3611,10 @@ static int si_cp_start(struct radeon_device *rdev)
+ 	for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) {
+ 		ring = &rdev->ring[i];
+ 		r = radeon_ring_lock(rdev, ring, 2);
++		if (r) {
++			DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
++			return r;
++		}
+ 
+ 		/* clear the compute context state */
+ 		radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0));
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-radeon-check-the-alloc_workqueue-return-value-in.patch b/queue-6.7/drm-radeon-check-the-alloc_workqueue-return-value-in.patch
new file mode 100644
index 00000000000..54a1c24113c
--- /dev/null
+++ b/queue-6.7/drm-radeon-check-the-alloc_workqueue-return-value-in.patch
@@ -0,0 +1,46 @@
+From 689587fa470d886300230ea75d521f66b33a109b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 15:50:16 +0800
+Subject: drm/radeon: check the alloc_workqueue return value in
+ radeon_crtc_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 7a2464fac80d42f6f8819fed97a553e9c2f43310 ]
+
+check the alloc_workqueue return value in radeon_crtc_init()
+to avoid null-ptr-deref.
+
+Fixes: fa7f517cb26e ("drm/radeon: rework page flip handling v4")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 901e75ec70ff..efd18c8d84c8 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -687,11 +687,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
+ 	if (radeon_crtc == NULL)
+ 		return;
+ 
++	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
++	if (!radeon_crtc->flip_queue) {
++		kfree(radeon_crtc);
++		return;
++	}
++
+ 	drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs);
+ 
+ 	drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
+ 	radeon_crtc->crtc_id = index;
+-	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
+ 	rdev->mode_info.crtcs[index] = radeon_crtc;
+ 
+ 	if (rdev->family >= CHIP_BONAIRE) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch b/queue-6.7/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
new file mode 100644
index 00000000000..5e0c7452455
--- /dev/null
+++ b/queue-6.7/drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
@@ -0,0 +1,41 @@
+From 3771f119ad69b6729a0381c17b612811b5e7e079 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 16:57:56 +0800
+Subject: drm/radeon/dpm: fix a memleak in sumo_parse_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4 ]
+
+The rdev->pm.dpm.ps allocated by kcalloc should be freed in every
+following error-handling path. However, in the error-handling of
+rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed,
+resulting in a memleak in this function.
+
+Fixes: 80ea2c129c76 ("drm/radeon/kms: add dpm support for sumo asics (v2)")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/sumo_dpm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
+index f74f381af05f..d49c145db437 100644
+--- a/drivers/gpu/drm/radeon/sumo_dpm.c
++++ b/drivers/gpu/drm/radeon/sumo_dpm.c
+@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
+ 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
+ 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
+-		if (!rdev->pm.power_state[i].clock_info)
++		if (!rdev->pm.power_state[i].clock_info) {
++			kfree(rdev->pm.dpm.ps);
+ 			return -EINVAL;
++		}
+ 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
+ 		if (ps == NULL) {
+ 			kfree(rdev->pm.dpm.ps);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch b/queue-6.7/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
new file mode 100644
index 00000000000..0d772cc5267
--- /dev/null
+++ b/queue-6.7/drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
@@ -0,0 +1,52 @@
+From fc3f949dcb4fac6ac9cbb942bf4605bcbfcd758d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 07:22:12 -0800
+Subject: drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit b5c5baa458faa5430c445acd9a17481274d77ccf ]
+
+It may be possible, albeit unlikely, to encounter integer overflow
+during the multiplication of several unsigned int variables, the
+result being assigned to a variable 'size' of wider type.
+
+Prevent this potential behaviour by converting one of the multiples
+to unsigned long.
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 0242f74d29df ("drm/radeon: clean up CS functions in r100.c")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r100.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index affa9e0309b2..cfeca2694d5f 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -2321,7 +2321,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
+ 	switch (prim_walk) {
+ 	case 1:
+ 		for (i = 0; i < track->num_arrays; i++) {
+-			size = track->arrays[i].esize * track->max_indx * 4;
++			size = track->arrays[i].esize * track->max_indx * 4UL;
+ 			if (track->arrays[i].robj == NULL) {
+ 				DRM_ERROR("(PW %u) Vertex array %u no buffer "
+ 					  "bound\n", prim_walk, i);
+@@ -2340,7 +2340,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
+ 		break;
+ 	case 2:
+ 		for (i = 0; i < track->num_arrays; i++) {
+-			size = track->arrays[i].esize * (nverts - 1) * 4;
++			size = track->arrays[i].esize * (nverts - 1) * 4UL;
+ 			if (track->arrays[i].robj == NULL) {
+ 				DRM_ERROR("(PW %u) Vertex array %u no buffer "
+ 					  "bound\n", prim_walk, i);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch b/queue-6.7/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
new file mode 100644
index 00000000000..159acc712a0
--- /dev/null
+++ b/queue-6.7/drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
@@ -0,0 +1,51 @@
+From ce0ec9a29d9a452b5da2d869a4dedf84d1bbb095 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 07:22:30 -0800
+Subject: drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
+
+From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+
+[ Upstream commit 39c960bbf9d9ea862398759e75736cfb68c3446f ]
+
+While improbable, there may be a chance of hitting integer
+overflow when the result of radeon_get_ib_value() gets shifted
+left.
+
+Avoid it by casting one of the operands to larger data type (u64).
+
+Found by Linux Verification Center (linuxtesting.org) with static
+analysis tool SVACE.
+
+Fixes: 1729dd33d20b ("drm/radeon/kms: r600 CS parser fixes")
+Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
+index 638f861af80f..6cf54a747749 100644
+--- a/drivers/gpu/drm/radeon/r600_cs.c
++++ b/drivers/gpu/drm/radeon/r600_cs.c
+@@ -1275,7 +1275,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
+ 			return -EINVAL;
+ 		}
+ 		tmp = (reg - CB_COLOR0_BASE) / 4;
+-		track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
++		track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8;
+ 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
+ 		track->cb_color_base_last[tmp] = ib[idx];
+ 		track->cb_color_bo[tmp] = reloc->robj;
+@@ -1302,7 +1302,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
+ 					"0x%04X\n", reg);
+ 			return -EINVAL;
+ 		}
+-		track->htile_offset = radeon_get_ib_value(p, idx) << 8;
++		track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8;
+ 		ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
+ 		track->htile_bo = reloc->robj;
+ 		track->db_dirty = true;
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch b/queue-6.7/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
new file mode 100644
index 00000000000..eaaaebf92d1
--- /dev/null
+++ b/queue-6.7/drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
@@ -0,0 +1,41 @@
+From 7eb7d655dfab6a6ebab14126381f631c0a5d5cd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 18:21:54 +0800
+Subject: drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b ]
+
+The rdev->pm.dpm.ps allocated by kcalloc should be freed in every
+following error-handling path. However, in the error-handling of
+rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed,
+resulting in a memleak in this function.
+
+Fixes: d70229f70447 ("drm/radeon/kms: add dpm support for trinity asics")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/trinity_dpm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
+index 08ea1c864cb2..ef1cc7bad20a 100644
+--- a/drivers/gpu/drm/radeon/trinity_dpm.c
++++ b/drivers/gpu/drm/radeon/trinity_dpm.c
+@@ -1726,8 +1726,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
+ 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
+ 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
+ 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
+-		if (!rdev->pm.power_state[i].clock_info)
++		if (!rdev->pm.power_state[i].clock_info) {
++			kfree(rdev->pm.dpm.ps);
+ 			return -EINVAL;
++		}
+ 		ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
+ 		if (ps == NULL) {
+ 			kfree(rdev->pm.dpm.ps);
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-sched-fix-bounds-limiting-when-given-a-malformed.patch b/queue-6.7/drm-sched-fix-bounds-limiting-when-given-a-malformed.patch
new file mode 100644
index 00000000000..3bf94d12bf7
--- /dev/null
+++ b/queue-6.7/drm-sched-fix-bounds-limiting-when-given-a-malformed.patch
@@ -0,0 +1,54 @@
+From 5aaefeb586de1c5c5ea57d728db17d758f78d096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 23:58:53 -0500
+Subject: drm/sched: Fix bounds limiting when given a malformed entity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Luben Tuikov <ltuikov89@gmail.com>
+
+[ Upstream commit 2bbe6ab2be53858507f11f99f856846d04765ae3 ]
+
+If we're given a malformed entity in drm_sched_entity_init()--shouldn't
+happen, but we verify--with out-of-bounds priority value, we set it to an
+allowed value. Fix the expression which sets this limit.
+
+Signed-off-by: Luben Tuikov <ltuikov89@gmail.com>
+Fixes: 56e449603f0ac5 ("drm/sched: Convert the GPU scheduler to variable number of run-queues")
+Link: https://patchwork.freedesktop.org/patch/msgid/20231123122422.167832-2-ltuikov89@gmail.com
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Link: https://lore.kernel.org/r/dbb91dbe-ef77-4d79-aaf9-2adb171c1d7a@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/scheduler/sched_entity.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
+index 409e4256f6e7..0a7a7e4ad8d1 100644
+--- a/drivers/gpu/drm/scheduler/sched_entity.c
++++ b/drivers/gpu/drm/scheduler/sched_entity.c
+@@ -81,12 +81,15 @@ int drm_sched_entity_init(struct drm_sched_entity *entity,
+ 		 */
+ 		pr_warn("%s: called with uninitialized scheduler\n", __func__);
+ 	} else if (num_sched_list) {
+-		/* The "priority" of an entity cannot exceed the number
+-		 * of run-queues of a scheduler.
++		/* The "priority" of an entity cannot exceed the number of run-queues of a
++		 * scheduler. Protect against num_rqs being 0, by converting to signed.
+ 		 */
+-		if (entity->priority >= sched_list[0]->num_rqs)
+-			entity->priority = max_t(u32, sched_list[0]->num_rqs,
+-						 DRM_SCHED_PRIORITY_MIN);
++		if (entity->priority >= sched_list[0]->num_rqs) {
++			drm_err(sched_list[0], "entity with out-of-bounds priority:%u num_rqs:%u\n",
++				entity->priority, sched_list[0]->num_rqs);
++			entity->priority = max_t(s32, (s32) sched_list[0]->num_rqs - 1,
++						 (s32) DRM_SCHED_PRIORITY_MIN);
++		}
+ 		entity->rq = sched_list[0]->sched_rq[entity->priority];
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch b/queue-6.7/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
new file mode 100644
index 00000000000..e69f6441106
--- /dev/null
+++ b/queue-6.7/drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
@@ -0,0 +1,57 @@
+From 32be18e7352385916a43cf26b10f3666cde28e19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:37:59 +0200
+Subject: drm/tidss: Check for K2G in in dispc_softreset()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 151825150cf9c2e9fb90763d35b9dff3783628ac ]
+
+K2G doesn't have softreset feature. Instead of having every caller of
+dispc_softreset() check for K2G, move the check into dispc_softreset(),
+and make dispc_softreset() return 0 in case of K2G.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-6-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 9a29f5fa8453..2af623842cfb 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2707,6 +2707,10 @@ static int dispc_softreset(struct dispc_device *dispc)
+ 	u32 val;
+ 	int ret = 0;
+ 
++	/* K2G display controller does not support soft reset */
++	if (dispc->feat->subrev == DISPC_K2G)
++		return 0;
++
+ 	/* Soft reset */
+ 	REG_FLD_MOD(dispc, DSS_SYSCONFIG, 1, 1, 1);
+ 	/* Wait for reset to complete */
+@@ -2829,12 +2833,9 @@ int dispc_init(struct tidss_device *tidss)
+ 	of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth",
+ 			     &dispc->memory_bandwidth_limit);
+ 
+-	/* K2G display controller does not support soft reset */
+-	if (feat->subrev != DISPC_K2G) {
+-		r = dispc_softreset(dispc);
+-		if (r)
+-			return r;
+-	}
++	r = dispc_softreset(dispc);
++	if (r)
++		return r;
+ 
+ 	tidss->dispc = dispc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-tidss-fix-dss-reset.patch b/queue-6.7/drm-tidss-fix-dss-reset.patch
new file mode 100644
index 00000000000..116700a6a7b
--- /dev/null
+++ b/queue-6.7/drm-tidss-fix-dss-reset.patch
@@ -0,0 +1,106 @@
+From 6d8bb1f06cee9f692d3284c9c7d1ffa85eda42a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:38:01 +0200
+Subject: drm/tidss: Fix dss reset
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit bc288a927815efcf9d7f4a54d4d89c5df478c635 ]
+
+The probe function calls dispc_softreset() before runtime PM is enabled
+and without enabling any of the DSS clocks. This happens to work by
+luck, and we need to make sure the DSS HW is active and the fclk is
+enabled.
+
+To fix the above, add a new function, dispc_init_hw(), which does:
+
+- pm_runtime_set_active()
+- clk_prepare_enable(fclk)
+- dispc_softreset().
+
+This ensures that the reset can be successfully accomplished.
+
+Note that we use pm_runtime_set_active(), not the normal
+pm_runtime_get(). The reason for this is that at this point we haven't
+enabled the runtime PM yet and also we don't want the normal resume
+callback to be called: the dispc resume callback does some initial HW
+setup, and it expects that the HW was off (no video ports are
+streaming). If the bootloader has enabled the DSS and has set up a
+boot time splash-screen, the DSS would be enabled and streaming which
+might lead to issues with the normal resume callback.
+
+Fixes: c9b2d923befd ("drm/tidss: Soft Reset DISPC on startup")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-8-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 45 ++++++++++++++++++++++++++++-
+ 1 file changed, 44 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 2af623842cfb..98efbaf3b0c2 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2724,6 +2724,49 @@ static int dispc_softreset(struct dispc_device *dispc)
+ 	return 0;
+ }
+ 
++static int dispc_init_hw(struct dispc_device *dispc)
++{
++	struct device *dev = dispc->dev;
++	int ret;
++
++	ret = pm_runtime_set_active(dev);
++	if (ret) {
++		dev_err(dev, "Failed to set DSS PM to active\n");
++		return ret;
++	}
++
++	ret = clk_prepare_enable(dispc->fclk);
++	if (ret) {
++		dev_err(dev, "Failed to enable DSS fclk\n");
++		goto err_runtime_suspend;
++	}
++
++	ret = dispc_softreset(dispc);
++	if (ret)
++		goto err_clk_disable;
++
++	clk_disable_unprepare(dispc->fclk);
++	ret = pm_runtime_set_suspended(dev);
++	if (ret) {
++		dev_err(dev, "Failed to set DSS PM to suspended\n");
++		return ret;
++	}
++
++	return 0;
++
++err_clk_disable:
++	clk_disable_unprepare(dispc->fclk);
++
++err_runtime_suspend:
++	ret = pm_runtime_set_suspended(dev);
++	if (ret) {
++		dev_err(dev, "Failed to set DSS PM to suspended\n");
++		return ret;
++	}
++
++	return ret;
++}
++
+ int dispc_init(struct tidss_device *tidss)
+ {
+ 	struct device *dev = tidss->dev;
+@@ -2833,7 +2876,7 @@ int dispc_init(struct tidss_device *tidss)
+ 	of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth",
+ 			     &dispc->memory_bandwidth_limit);
+ 
+-	r = dispc_softreset(dispc);
++	r = dispc_init_hw(dispc);
+ 	if (r)
+ 		return r;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-tidss-move-reset-to-the-end-of-dispc_init.patch b/queue-6.7/drm-tidss-move-reset-to-the-end-of-dispc_init.patch
new file mode 100644
index 00000000000..a356973a704
--- /dev/null
+++ b/queue-6.7/drm-tidss-move-reset-to-the-end-of-dispc_init.patch
@@ -0,0 +1,55 @@
+From 590329fe81c8bf87194c7dc10a4c234d9a510ab4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:37:57 +0200
+Subject: drm/tidss: Move reset to the end of dispc_init()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 36d1e0852680aa038e2428d450673390111b165c ]
+
+We do a DSS reset in the middle of the dispc_init(). While that happens
+to work now, we should really make sure that e..g the fclk, which is
+acquired only later in the function, is enabled when doing a reset. This
+will be handled in a later patch, but for now, let's move the
+dispc_softreset() call to the end of dispc_init(), which is a sensible
+place for it anyway.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-4-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 9d9dee7abaef..8d822372bf94 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2777,10 +2777,6 @@ int dispc_init(struct tidss_device *tidss)
+ 			return r;
+ 	}
+ 
+-	/* K2G display controller does not support soft reset */
+-	if (feat->subrev != DISPC_K2G)
+-		dispc_softreset(dispc);
+-
+ 	for (i = 0; i < dispc->feat->num_vps; i++) {
+ 		u32 gamma_size = dispc->feat->vp_feat.color.gamma_size;
+ 		u32 *gamma_table;
+@@ -2829,6 +2825,10 @@ int dispc_init(struct tidss_device *tidss)
+ 	of_property_read_u32(dispc->dev->of_node, "max-memory-bandwidth",
+ 			     &dispc->memory_bandwidth_limit);
+ 
++	/* K2G display controller does not support soft reset */
++	if (feat->subrev != DISPC_K2G)
++		dispc_softreset(dispc);
++
+ 	tidss->dispc = dispc;
+ 
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-tidss-return-error-value-from-from-softreset.patch b/queue-6.7/drm-tidss-return-error-value-from-from-softreset.patch
new file mode 100644
index 00000000000..d49ea94920d
--- /dev/null
+++ b/queue-6.7/drm-tidss-return-error-value-from-from-softreset.patch
@@ -0,0 +1,66 @@
+From 8ff541e00b3b6b4fa2d8d313111b564ee1235f21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 09:37:58 +0200
+Subject: drm/tidss: Return error value from from softreset
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit aceafbb5035c4bfc75a321863ed1e393d644d2d2 ]
+
+Return an error value from dispc_softreset() so that the caller can
+handle the errors.
+
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Link: https://lore.kernel.org/r/20231109-tidss-probe-v2-5-ac91b5ea35c0@ideasonboard.com
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Stable-dep-of: bc288a927815 ("drm/tidss: Fix dss reset")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_dispc.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
+index 8d822372bf94..9a29f5fa8453 100644
+--- a/drivers/gpu/drm/tidss/tidss_dispc.c
++++ b/drivers/gpu/drm/tidss/tidss_dispc.c
+@@ -2702,7 +2702,7 @@ static void dispc_init_errata(struct dispc_device *dispc)
+ 	}
+ }
+ 
+-static void dispc_softreset(struct dispc_device *dispc)
++static int dispc_softreset(struct dispc_device *dispc)
+ {
+ 	u32 val;
+ 	int ret = 0;
+@@ -2712,8 +2712,12 @@ static void dispc_softreset(struct dispc_device *dispc)
+ 	/* Wait for reset to complete */
+ 	ret = readl_poll_timeout(dispc->base_common + DSS_SYSSTATUS,
+ 				 val, val & 1, 100, 5000);
+-	if (ret)
+-		dev_warn(dispc->dev, "failed to reset dispc\n");
++	if (ret) {
++		dev_err(dispc->dev, "failed to reset dispc\n");
++		return ret;
++	}
++
++	return 0;
+ }
+ 
+ int dispc_init(struct tidss_device *tidss)
+@@ -2826,8 +2830,11 @@ int dispc_init(struct tidss_device *tidss)
+ 			     &dispc->memory_bandwidth_limit);
+ 
+ 	/* K2G display controller does not support soft reset */
+-	if (feat->subrev != DISPC_K2G)
+-		dispc_softreset(dispc);
++	if (feat->subrev != DISPC_K2G) {
++		r = dispc_softreset(dispc);
++		if (r)
++			return r;
++	}
+ 
+ 	tidss->dispc = dispc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/drm-tilcdc-fix-irq-free-on-unload.patch b/queue-6.7/drm-tilcdc-fix-irq-free-on-unload.patch
new file mode 100644
index 00000000000..7f47862009e
--- /dev/null
+++ b/queue-6.7/drm-tilcdc-fix-irq-free-on-unload.patch
@@ -0,0 +1,40 @@
+From 104795336ed1674f11e1dbf05d7d261753608c69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Sep 2023 10:12:50 +0300
+Subject: drm/tilcdc: Fix irq free on unload
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 38360bf96d816e175bc602c4ee76953cd303b71d ]
+
+The driver only frees the reserved irq if priv->irq_enabled is set to
+true. However, the driver mistakenly sets priv->irq_enabled to false,
+instead of true, in tilcdc_irq_install(), and thus the driver never
+frees the irq, causing issues on loading the driver a second time.
+
+Fixes: b6366814fa77 ("drm/tilcdc: Convert to Linux IRQ interfaces")
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230919-lcdc-v1-1-ba60da7421e1@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+index 8ebd7134ee21..2f6eaac7f659 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -138,7 +138,7 @@ static int tilcdc_irq_install(struct drm_device *dev, unsigned int irq)
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->irq_enabled = false;
++	priv->irq_enabled = true;
+ 
+ 	return 0;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/dt-bindings-arm-qcom-fix-html-link.patch b/queue-6.7/dt-bindings-arm-qcom-fix-html-link.patch
new file mode 100644
index 00000000000..0742dfd1716
--- /dev/null
+++ b/queue-6.7/dt-bindings-arm-qcom-fix-html-link.patch
@@ -0,0 +1,43 @@
+From e684506613684e6aa0390b3bba6dbc6e60b448f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 19:04:41 -0800
+Subject: dt-bindings: arm: qcom: Fix html link
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 3c3fcac8d3b1b0f242845c3b3c3263bd38b3b92f ]
+
+This link got broken by commit e790a4ce5290 ("arm: docs: Move Arm
+documentation to Documentation/arch/") when the doc moved from arm/ to
+arch/arm/. Fix the link so that it can continue to be followed.
+
+Fixes: e790a4ce5290 ("arm: docs: Move Arm documentation to Documentation/arch/")
+Cc: Alexandre TORGUE <alexandre.torgue@foss.st.com>
+Cc: Yanteng Si <siyanteng@loongson.cn>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20231129030443.2753833-1-swboyd@chromium.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/arm/qcom.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/arm/qcom.yaml b/Documentation/devicetree/bindings/arm/qcom.yaml
+index 7f80f48a0954..8a6466d1fc4e 100644
+--- a/Documentation/devicetree/bindings/arm/qcom.yaml
++++ b/Documentation/devicetree/bindings/arm/qcom.yaml
+@@ -138,7 +138,7 @@ description: |
+   There are many devices in the list below that run the standard ChromeOS
+   bootloader setup and use the open source depthcharge bootloader to boot the
+   OS. These devices do not use the scheme described above. For details, see:
+-  https://docs.kernel.org/arm/google/chromebook-boot-flow.html
++  https://docs.kernel.org/arch/arm/google/chromebook-boot-flow.html
+ 
+ properties:
+   $nodename:
+-- 
+2.43.0
+
diff --git a/queue-6.7/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch b/queue-6.7/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
new file mode 100644
index 00000000000..fd018025221
--- /dev/null
+++ b/queue-6.7/dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
@@ -0,0 +1,125 @@
+From 6740dd5ce1ce64e23a9cd02d4e380bfdfdde94c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 16:33:42 +0800
+Subject: dt-bindings: media: mediatek: mdp3: correct RDMA and WROT node with
+ generic names
+
+From: Moudy Ho <moudy.ho@mediatek.com>
+
+[ Upstream commit f5f185bf7c42f6ca885202fefc40fc871d08a722 ]
+
+The DMA-related nodes RDMA/WROT in MDP3 should be changed to generic names.
+In addition, fix improper space indent in example.
+
+Fixes: 4ad7b39623ab ("media: dt-binding: mediatek: add bindings for MediaTek MDP3 components")
+Signed-off-by: Moudy Ho <moudy.ho@mediatek.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../bindings/media/mediatek,mdp3-rdma.yaml    | 29 +++++++++++--------
+ .../bindings/media/mediatek,mdp3-wrot.yaml    | 23 +++++++++------
+ 2 files changed, 31 insertions(+), 21 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml
+index 7032c7e15039..3e128733ef53 100644
+--- a/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml
++++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-rdma.yaml
+@@ -61,6 +61,9 @@ properties:
+       - description: used for 1st data pipe from RDMA
+       - description: used for 2nd data pipe from RDMA
+ 
++  '#dma-cells':
++    const: 1
++
+ required:
+   - compatible
+   - reg
+@@ -70,6 +73,7 @@ required:
+   - clocks
+   - iommus
+   - mboxes
++  - '#dma-cells'
+ 
+ additionalProperties: false
+ 
+@@ -80,16 +84,17 @@ examples:
+     #include <dt-bindings/power/mt8183-power.h>
+     #include <dt-bindings/memory/mt8183-larb-port.h>
+ 
+-    mdp3_rdma0: mdp3-rdma0@14001000 {
+-      compatible = "mediatek,mt8183-mdp3-rdma";
+-      reg = <0x14001000 0x1000>;
+-      mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>;
+-      mediatek,gce-events = <CMDQ_EVENT_MDP_RDMA0_SOF>,
+-                            <CMDQ_EVENT_MDP_RDMA0_EOF>;
+-      power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+-      clocks = <&mmsys CLK_MM_MDP_RDMA0>,
+-               <&mmsys CLK_MM_MDP_RSZ1>;
+-      iommus = <&iommu>;
+-      mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>,
+-               <&gce 21 CMDQ_THR_PRIO_LOWEST>;
++    dma-controller@14001000 {
++        compatible = "mediatek,mt8183-mdp3-rdma";
++        reg = <0x14001000 0x1000>;
++        mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x1000 0x1000>;
++        mediatek,gce-events = <CMDQ_EVENT_MDP_RDMA0_SOF>,
++                              <CMDQ_EVENT_MDP_RDMA0_EOF>;
++        power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
++        clocks = <&mmsys CLK_MM_MDP_RDMA0>,
++                 <&mmsys CLK_MM_MDP_RSZ1>;
++        iommus = <&iommu>;
++        mboxes = <&gce 20 CMDQ_THR_PRIO_LOWEST>,
++                 <&gce 21 CMDQ_THR_PRIO_LOWEST>;
++        #dma-cells = <1>;
+     };
+diff --git a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml
+index 0baa77198fa2..64ea98aa0592 100644
+--- a/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml
++++ b/Documentation/devicetree/bindings/media/mediatek,mdp3-wrot.yaml
+@@ -50,6 +50,9 @@ properties:
+   iommus:
+     maxItems: 1
+ 
++  '#dma-cells':
++    const: 1
++
+ required:
+   - compatible
+   - reg
+@@ -58,6 +61,7 @@ required:
+   - power-domains
+   - clocks
+   - iommus
++  - '#dma-cells'
+ 
+ additionalProperties: false
+ 
+@@ -68,13 +72,14 @@ examples:
+     #include <dt-bindings/power/mt8183-power.h>
+     #include <dt-bindings/memory/mt8183-larb-port.h>
+ 
+-    mdp3_wrot0: mdp3-wrot0@14005000 {
+-      compatible = "mediatek,mt8183-mdp3-wrot";
+-      reg = <0x14005000 0x1000>;
+-      mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>;
+-      mediatek,gce-events = <CMDQ_EVENT_MDP_WROT0_SOF>,
+-                            <CMDQ_EVENT_MDP_WROT0_EOF>;
+-      power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
+-      clocks = <&mmsys CLK_MM_MDP_WROT0>;
+-      iommus = <&iommu>;
++    dma-controller@14005000 {
++        compatible = "mediatek,mt8183-mdp3-wrot";
++        reg = <0x14005000 0x1000>;
++        mediatek,gce-client-reg = <&gce SUBSYS_1400XXXX 0x5000 0x1000>;
++        mediatek,gce-events = <CMDQ_EVENT_MDP_WROT0_SOF>,
++                              <CMDQ_EVENT_MDP_WROT0_EOF>;
++        power-domains = <&spm MT8183_POWER_DOMAIN_DISP>;
++        clocks = <&mmsys CLK_MM_MDP_WROT0>;
++        iommus = <&iommu>;
++        #dma-cells = <1>;
+     };
+-- 
+2.43.0
+
diff --git a/queue-6.7/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch b/queue-6.7/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
new file mode 100644
index 00000000000..17408f3d836
--- /dev/null
+++ b/queue-6.7/edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
@@ -0,0 +1,91 @@
+From 9169577542066e48cb6c4f6aaf427b4d3face201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 23:19:53 +0100
+Subject: EDAC/thunderx: Fix possible out-of-bounds string access
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ]
+
+Enabling -Wstringop-overflow globally exposes a warning for a common bug
+in the usage of strncat():
+
+  drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':
+  drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]
+   1136 |                 strncat(msg, other, OCX_MESSAGE_SIZE);
+        |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+   ...
+   1145 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);
+   ...
+   1150 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);
+
+   ...
+
+Apparently the author of this driver expected strncat() to behave the
+way that strlcat() does, which uses the size of the destination buffer
+as its third argument rather than the length of the source buffer. The
+result is that there is no check on the size of the allocated buffer.
+
+Change it to strlcat().
+
+  [ bp: Trim compiler output, fixup commit message. ]
+
+Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
+Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/thunderx_edac.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c
+index b9c5772da959..90d46e5c4ff0 100644
+--- a/drivers/edac/thunderx_edac.c
++++ b/drivers/edac/thunderx_edac.c
+@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
+ 		decode_register(other, OCX_OTHER_SIZE,
+ 				ocx_com_errors, ctx->reg_com_int);
+ 
+-		strncat(msg, other, OCX_MESSAGE_SIZE);
++		strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 
+ 		for (lane = 0; lane < OCX_RX_LANES; lane++)
+ 			if (ctx->reg_com_int & BIT(lane)) {
+@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
+ 					 lane, ctx->reg_lane_int[lane],
+ 					 lane, ctx->reg_lane_stat11[lane]);
+ 
+-				strncat(msg, other, OCX_MESSAGE_SIZE);
++				strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 
+ 				decode_register(other, OCX_OTHER_SIZE,
+ 						ocx_lane_errors,
+ 						ctx->reg_lane_int[lane]);
+-				strncat(msg, other, OCX_MESSAGE_SIZE);
++				strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 			}
+ 
+ 		if (ctx->reg_com_int & OCX_COM_INT_CE)
+@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)
+ 		decode_register(other, OCX_OTHER_SIZE,
+ 				ocx_com_link_errors, ctx->reg_com_link_int);
+ 
+-		strncat(msg, other, OCX_MESSAGE_SIZE);
++		strlcat(msg, other, OCX_MESSAGE_SIZE);
+ 
+ 		if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE)
+ 			edac_device_handle_ue(ocx->edac_dev, 0, 0, msg);
+@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
+ 
+ 		decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int);
+ 
+-		strncat(msg, other, L2C_MESSAGE_SIZE);
++		strlcat(msg, other, L2C_MESSAGE_SIZE);
+ 
+ 		if (ctx->reg_int & mask_ue)
+ 			edac_device_handle_ue(l2c->edac_dev, 0, 0, msg);
+-- 
+2.43.0
+
diff --git a/queue-6.7/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch b/queue-6.7/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
new file mode 100644
index 00000000000..e28ed547336
--- /dev/null
+++ b/queue-6.7/efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
@@ -0,0 +1,109 @@
+From 325899b97696736a695e7279f0e661357837c3ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Nov 2023 14:40:56 +0900
+Subject: efivarfs: force RO when remounting if SetVariable is not supported
+
+From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+
+[ Upstream commit 0e8d2444168dd519fea501599d150e62718ed2fe ]
+
+If SetVariable at runtime is not supported by the firmware we never assign
+a callback for that function. At the same time mount the efivarfs as
+RO so no one can call that.  However, we never check the permission flags
+when someone remounts the filesystem as RW. As a result this leads to a
+crash looking like this:
+
+$ mount -o remount,rw /sys/firmware/efi/efivars
+$ efi-updatevar -f PK.auth PK
+
+[  303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+[  303.280482] Mem abort info:
+[  303.280854]   ESR = 0x0000000086000004
+[  303.281338]   EC = 0x21: IABT (current EL), IL = 32 bits
+[  303.282016]   SET = 0, FnV = 0
+[  303.282414]   EA = 0, S1PTW = 0
+[  303.282821]   FSC = 0x04: level 0 translation fault
+[  303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000
+[  303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
+[  303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
+[  303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6
+[  303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1
+[  303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023
+[  303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[  303.292123] pc : 0x0
+[  303.292443] lr : efivar_set_variable_locked+0x74/0xec
+[  303.293156] sp : ffff800008673c10
+[  303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000
+[  303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027
+[  303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000
+[  303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000
+[  303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54
+[  303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4
+[  303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002
+[  303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201
+[  303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc
+[  303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000
+[  303.303341] Call trace:
+[  303.303679]  0x0
+[  303.303938]  efivar_entry_set_get_size+0x98/0x16c
+[  303.304585]  efivarfs_file_write+0xd0/0x1a4
+[  303.305148]  vfs_write+0xc4/0x2e4
+[  303.305601]  ksys_write+0x70/0x104
+[  303.306073]  __arm64_sys_write+0x1c/0x28
+[  303.306622]  invoke_syscall+0x48/0x114
+[  303.307156]  el0_svc_common.constprop.0+0x44/0xec
+[  303.307803]  do_el0_svc+0x38/0x98
+[  303.308268]  el0_svc+0x2c/0x84
+[  303.308702]  el0t_64_sync_handler+0xf4/0x120
+[  303.309293]  el0t_64_sync+0x190/0x194
+[  303.309794] Code: ???????? ???????? ???????? ???????? (????????)
+[  303.310612] ---[ end trace 0000000000000000 ]---
+
+Fix this by adding a .reconfigure() function to the fs operations which
+we can use to check the requested flags and deny anything that's not RO
+if the firmware doesn't implement SetVariable at runtime.
+
+Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction")
+Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/efivarfs/super.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 77240953a92e..869537f1a550 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -15,6 +15,7 @@
+ #include <linux/slab.h>
+ #include <linux/magic.h>
+ #include <linux/statfs.h>
++#include <linux/printk.h>
+ 
+ #include "internal.h"
+ 
+@@ -333,9 +334,20 @@ static int efivarfs_get_tree(struct fs_context *fc)
+ 	return get_tree_single(fc, efivarfs_fill_super);
+ }
+ 
++static int efivarfs_reconfigure(struct fs_context *fc)
++{
++	if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) {
++		pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n");
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
+ static const struct fs_context_operations efivarfs_context_ops = {
+ 	.get_tree	= efivarfs_get_tree,
+ 	.parse_param	= efivarfs_parse_param,
++	.reconfigure	= efivarfs_reconfigure,
+ };
+ 
+ static int efivarfs_init_fs_context(struct fs_context *fc)
+-- 
+2.43.0
+
diff --git a/queue-6.7/efivarfs-free-s_fs_info-on-unmount.patch b/queue-6.7/efivarfs-free-s_fs_info-on-unmount.patch
new file mode 100644
index 00000000000..29cd1a24628
--- /dev/null
+++ b/queue-6.7/efivarfs-free-s_fs_info-on-unmount.patch
@@ -0,0 +1,43 @@
+From f31ab66d48fd65ad7321c36db1c08dcae93a26d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 17:39:28 +0100
+Subject: efivarfs: Free s_fs_info on unmount
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 547713d502f7b4b8efccd409cff84d731a23853b ]
+
+Now that we allocate a s_fs_info struct on fs context creation, we
+should ensure that we free it again when the superblock goes away.
+
+Fixes: 5329aa5101f7 ("efivarfs: Add uid/gid mount options")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/efivarfs/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 869537f1a550..edf29c15db77 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -368,6 +368,8 @@ static int efivarfs_init_fs_context(struct fs_context *fc)
+ 
+ static void efivarfs_kill_sb(struct super_block *sb)
+ {
++	struct efivarfs_fs_info *sfi = sb->s_fs_info;
++
+ 	kill_litter_super(sb);
+ 
+ 	if (!efivar_is_available())
+@@ -375,6 +377,7 @@ static void efivarfs_kill_sb(struct super_block *sb)
+ 
+ 	/* Remove all entries and destroy */
+ 	efivar_entry_iter(efivarfs_destroy, &efivarfs_list, NULL);
++	kfree(sfi);
+ }
+ 
+ static struct file_system_type efivarfs_type = {
+-- 
+2.43.0
+
diff --git a/queue-6.7/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch b/queue-6.7/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
new file mode 100644
index 00000000000..71c23069bcc
--- /dev/null
+++ b/queue-6.7/erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
@@ -0,0 +1,50 @@
+From b246611b226a3c3631e7c9d581fe137fbff55cbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 02:04:31 +0800
+Subject: erofs: fix memory leak on short-lived bounced pages
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit 93d6fda7f926451a0fa1121b9558d75ca47e861e ]
+
+Both MicroLZMA and DEFLATE algorithms can use short-lived pages on
+demand for the overlapped inplace I/O decompression.
+
+However, those short-lived pages are actually added to
+`be->compressed_pages`.  Thus, it should be checked instead of
+`pcl->compressed_bvecs`.
+
+The LZ4 algorithm doesn't work like this, so it won't be impacted.
+
+Fixes: 67139e36d970 ("erofs: introduce `z_erofs_parse_in_bvecs'")
+Reviewed-by: Yue Hu <huyue2@coolpad.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20231128180431.4116991-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zdata.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c
+index a7e6847f6f8f..a33cd6757f98 100644
+--- a/fs/erofs/zdata.c
++++ b/fs/erofs/zdata.c
+@@ -1309,12 +1309,11 @@ static int z_erofs_decompress_pcluster(struct z_erofs_decompress_backend *be,
+ 		put_page(page);
+ 	} else {
+ 		for (i = 0; i < pclusterpages; ++i) {
+-			page = pcl->compressed_bvecs[i].page;
++			/* consider shortlived pages added when decompressing */
++			page = be->compressed_pages[i];
+ 
+ 			if (erofs_page_is_managed(sbi, page))
+ 				continue;
+-
+-			/* recycle all individual short-lived pages */
+ 			(void)z_erofs_put_shortlivedpage(be->pagepool, page);
+ 			WRITE_ONCE(pcl->compressed_bvecs[i].page, NULL);
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.7/f2fs-fix-to-avoid-dirent-corruption.patch b/queue-6.7/f2fs-fix-to-avoid-dirent-corruption.patch
new file mode 100644
index 00000000000..356ced5719c
--- /dev/null
+++ b/queue-6.7/f2fs-fix-to-avoid-dirent-corruption.patch
@@ -0,0 +1,60 @@
+From d214fcd0a21a651805fb8f7d69b04befdf76ee99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 17:25:16 +0800
+Subject: f2fs: fix to avoid dirent corruption
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
+
+As Al reported in link[1]:
+
+f2fs_rename()
+...
+	if (old_dir != new_dir && !whiteout)
+		f2fs_set_link(old_inode, old_dir_entry,
+					old_dir_page, new_dir);
+	else
+		f2fs_put_page(old_dir_page, 0);
+
+You want correct inumber in the ".." link.  And cross-directory
+rename does move the source to new parent, even if you'd been asked
+to leave a whiteout in the old place.
+
+[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
+
+With below testcase, it may cause dirent corruption, due to it missed
+to call f2fs_set_link() to update ".." link to new directory.
+- mkdir -p dir/foo
+- renameat2 -w dir/foo bar
+
+[ASSERT] (__chk_dots_dentries:1421)  --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
+[FSCK] other corrupted bugs                           [Fail]
+
+Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
+Cc: Jan Kara <jack@suse.cz>
+Reported-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/namei.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index d0053b0284d8..7f71bae2c83b 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -1106,7 +1106,7 @@ static int f2fs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
+ 	}
+ 
+ 	if (old_dir_entry) {
+-		if (old_dir != new_dir && !whiteout)
++		if (old_dir != new_dir)
+ 			f2fs_set_link(old_inode, old_dir_entry,
+ 						old_dir_page, new_dir);
+ 		else
+-- 
+2.43.0
+
diff --git a/queue-6.7/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch b/queue-6.7/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
new file mode 100644
index 00000000000..1d69533cccd
--- /dev/null
+++ b/queue-6.7/f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
@@ -0,0 +1,40 @@
+From 059dbfdb79e4b812d2310929ae60caffc3333e64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2023 19:35:44 +0800
+Subject: f2fs: fix to check compress file in f2fs_move_file_range()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit fb9b65340c818875ea86464faf3c744bdce0055c ]
+
+f2fs_move_file_range() doesn't support migrating compressed cluster
+data, let's add the missing check condition and return -EOPNOTSUPP
+for the case until we support it.
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index e50363583f01..37917c634e22 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2818,6 +2818,11 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
+ 			goto out;
+ 	}
+ 
++	if (f2fs_compressed_file(src) || f2fs_compressed_file(dst)) {
++		ret = -EOPNOTSUPP;
++		goto out_unlock;
++	}
++
+ 	ret = -EINVAL;
+ 	if (pos_in + len > src->i_size || pos_in + len < pos_in)
+ 		goto out_unlock;
+-- 
+2.43.0
+
diff --git a/queue-6.7/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch b/queue-6.7/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
new file mode 100644
index 00000000000..e0f15ee4343
--- /dev/null
+++ b/queue-6.7/f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
@@ -0,0 +1,70 @@
+From 0153faa81abd7d592f463b9308ac5ea2a0e02d2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 10:15:27 +0800
+Subject: f2fs: fix to check return value of f2fs_recover_xattr_data
+
+From: Zhiguo Niu <zhiguo.niu@unisoc.com>
+
+[ Upstream commit 86d7d57a3f096c8349b32a0cd5f6f314e4416a6d ]
+
+Should check return value of f2fs_recover_xattr_data in
+__f2fs_setxattr rather than doing invalid retry if error happen.
+
+Also just do set_page_dirty in f2fs_recover_xattr_data when
+page is changed really.
+
+Fixes: 50a472bbc79f ("f2fs: do not return EFSCORRUPTED, but try to run online repair")
+Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c  |  6 +++---
+ fs/f2fs/xattr.c | 11 +++++++----
+ 2 files changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 6c7f6a649d27..9b546fd21010 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2751,11 +2751,11 @@ int f2fs_recover_xattr_data(struct inode *inode, struct page *page)
+ 	f2fs_update_inode_page(inode);
+ 
+ 	/* 3: update and set xattr node page dirty */
+-	if (page)
++	if (page) {
+ 		memcpy(F2FS_NODE(xpage), F2FS_NODE(page),
+ 				VALID_XATTR_BLOCK_SIZE);
+-
+-	set_page_dirty(xpage);
++		set_page_dirty(xpage);
++	}
+ 	f2fs_put_page(xpage, 1);
+ 
+ 	return 0;
+diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
+index a8fc2cac6879..f290fe9327c4 100644
+--- a/fs/f2fs/xattr.c
++++ b/fs/f2fs/xattr.c
+@@ -660,11 +660,14 @@ static int __f2fs_setxattr(struct inode *inode, int index,
+ 	here = __find_xattr(base_addr, last_base_addr, NULL, index, len, name);
+ 	if (!here) {
+ 		if (!F2FS_I(inode)->i_xattr_nid) {
++			error = f2fs_recover_xattr_data(inode, NULL);
+ 			f2fs_notice(F2FS_I_SB(inode),
+-				"recover xattr in inode (%lu)", inode->i_ino);
+-			f2fs_recover_xattr_data(inode, NULL);
+-			kfree(base_addr);
+-			goto retry;
++				"recover xattr in inode (%lu), error(%d)",
++					inode->i_ino, error);
++			if (!error) {
++				kfree(base_addr);
++				goto retry;
++			}
+ 		}
+ 		f2fs_err(F2FS_I_SB(inode), "set inode (%lu) has corrupted xattr",
+ 								inode->i_ino);
+-- 
+2.43.0
+
diff --git a/queue-6.7/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch b/queue-6.7/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
new file mode 100644
index 00000000000..286de1eec6d
--- /dev/null
+++ b/queue-6.7/f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
@@ -0,0 +1,36 @@
+From 0b4d95469ccd93658c8dd05619b3581030b0f53c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2023 19:35:47 +0800
+Subject: f2fs: fix to update iostat correctly in f2fs_filemap_fault()
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit bb34cc6ca87ff78f9fb5913d7619dc1389554da6 ]
+
+In f2fs_filemap_fault(), it fixes to update iostat info only if
+VM_FAULT_LOCKED is tagged in return value of filemap_fault().
+
+Fixes: 8b83ac81f428 ("f2fs: support read iostat")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 37917c634e22..8912511980ae 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -42,7 +42,7 @@ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
+ 	vm_fault_t ret;
+ 
+ 	ret = filemap_fault(vmf);
+-	if (!ret)
++	if (ret & VM_FAULT_LOCKED)
+ 		f2fs_update_iostat(F2FS_I_SB(inode), inode,
+ 					APP_MAPPED_READ_IO, F2FS_BLKSIZE);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch b/queue-6.7/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
new file mode 100644
index 00000000000..9efe4a9f6d1
--- /dev/null
+++ b/queue-6.7/f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
@@ -0,0 +1,69 @@
+From 8b995703018e2639494f2ae345afc25e259dee70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Dec 2023 19:35:43 +0800
+Subject: f2fs: fix to wait on block writeback for post_read case
+
+From: Chao Yu <chao@kernel.org>
+
+[ Upstream commit 55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00 ]
+
+If inode is compressed, but not encrypted, it missed to call
+f2fs_wait_on_block_writeback() to wait for GCed page writeback
+in IPU write path.
+
+Thread A				GC-Thread
+					- f2fs_gc
+					 - do_garbage_collect
+					  - gc_data_segment
+					   - move_data_block
+					    - f2fs_submit_page_write
+					     migrate normal cluster's block via
+					     meta_inode's page cache
+- f2fs_write_single_data_page
+ - f2fs_do_write_data_page
+  - f2fs_inplace_write_data
+   - f2fs_submit_page_bio
+
+IRQ
+- f2fs_read_end_io
+					IRQ
+					old data overrides new data due to
+					out-of-order GC and common IO.
+					- f2fs_read_end_io
+
+Fixes: 4c8ff7095bef ("f2fs: support data compression")
+Signed-off-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 4e42b5f24deb..bc3f05d43b62 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2566,9 +2566,6 @@ int f2fs_encrypt_one_page(struct f2fs_io_info *fio)
+ 
+ 	page = fio->compressed_page ? fio->compressed_page : fio->page;
+ 
+-	/* wait for GCed page writeback via META_MAPPING */
+-	f2fs_wait_on_block_writeback(inode, fio->old_blkaddr);
+-
+ 	if (fscrypt_inode_uses_inline_crypto(inode))
+ 		return 0;
+ 
+@@ -2755,6 +2752,10 @@ int f2fs_do_write_data_page(struct f2fs_io_info *fio)
+ 		goto out_writepage;
+ 	}
+ 
++	/* wait for GCed page writeback via META_MAPPING */
++	if (fio->post_read)
++		f2fs_wait_on_block_writeback(inode, fio->old_blkaddr);
++
+ 	/*
+ 	 * If current allocation needs SSR,
+ 	 * it had better in-place writes for updated data.
+-- 
+2.43.0
+
diff --git a/queue-6.7/f2fs-restrict-max-filesize-for-16k-f2fs.patch b/queue-6.7/f2fs-restrict-max-filesize-for-16k-f2fs.patch
new file mode 100644
index 00000000000..e790eff539a
--- /dev/null
+++ b/queue-6.7/f2fs-restrict-max-filesize-for-16k-f2fs.patch
@@ -0,0 +1,46 @@
+From 04968e4208cf783ddb86f30c8bf56be3088bba20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Dec 2023 18:38:01 -0800
+Subject: f2fs: Restrict max filesize for 16K f2fs
+
+From: Daniel Rosenberg <drosen@google.com>
+
+[ Upstream commit a6a010f5def544af3efcfe21683905a712b60536 ]
+
+Blocks are tracked by u32, so the max permitted filesize is
+(U32_MAX + 1) * BLOCK_SIZE. Additionally, in order to support crypto
+data unit sizes of 4K with a 16K block with IV_INO_LBLK_{32,64}, we must
+further restrict max filesize to (U32_MAX + 1) * 4096. This does not
+affect 4K blocksize f2fs as the natural limit for files are well below
+that.
+
+Fixes: d7e9a9037de2 ("f2fs: Support Block Size == Page Size")
+Signed-off-by: Daniel Rosenberg <drosen@google.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 033af907c3b1..5dfbc6b4c0ac 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -3364,6 +3364,14 @@ loff_t max_file_blocks(struct inode *inode)
+ 	leaf_count *= NIDS_PER_BLOCK;
+ 	result += leaf_count;
+ 
++	/*
++	 * For compatibility with FSCRYPT_POLICY_FLAG_IV_INO_LBLK_{64,32} with
++	 * a 4K crypto data unit, we must restrict the max filesize to what can
++	 * fit within U32_MAX + 1 data units.
++	 */
++
++	result = min(result, (((loff_t)U32_MAX + 1) * 4096) >> F2FS_BLKSIZE_BITS);
++
+ 	return result;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/fbdev-imxfb-fix-left-margin-setting.patch b/queue-6.7/fbdev-imxfb-fix-left-margin-setting.patch
new file mode 100644
index 00000000000..35e483382c9
--- /dev/null
+++ b/queue-6.7/fbdev-imxfb-fix-left-margin-setting.patch
@@ -0,0 +1,121 @@
+From fc1649f7d5c25c262f859529749d0612cdfeac82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Nov 2023 11:41:50 +0100
+Subject: fbdev: imxfb: fix left margin setting
+
+From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+
+[ Upstream commit 5758844105f7dd9a0a04990cd92499a1a593dd36 ]
+
+The previous setting did not take into account the CSTN mode.
+For the H_WAIT_2 bitfield (bits 0-7) of the LCDC Horizontal Configuration
+Register (LCDCR), the IMX25RM manual states that:
+
+In TFT mode, it specifies the number of SCLK periods between the end of
+HSYNC and the beginning of OE signal, and the total delay time equals
+(H_WAIT_2 + 3) of SCLK periods.
+In CSTN mode, it specifies the number of SCLK periods between the end of
+HSYNC and the first display data in each line, and the total delay time
+equals (H_WAIT_2 + 2) of SCLK periods.
+
+The patch handles both cases.
+
+Fixes: 4e47382fbca9 ("fbdev: imxfb: warn about invalid left/right margin")
+Fixes: 7e8549bcee00 ("imxfb: Fix margin settings")
+Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/imxfb.c | 27 +++++++++++++++++++++++++--
+ 1 file changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
+index 84201c9608d3..7042a43b81d8 100644
+--- a/drivers/video/fbdev/imxfb.c
++++ b/drivers/video/fbdev/imxfb.c
+@@ -42,6 +42,7 @@
+ #include <video/videomode.h>
+ 
+ #define PCR_TFT		(1 << 31)
++#define PCR_COLOR	(1 << 30)
+ #define PCR_BPIX_8	(3 << 25)
+ #define PCR_BPIX_12	(4 << 25)
+ #define PCR_BPIX_16	(5 << 25)
+@@ -150,6 +151,12 @@ enum imxfb_type {
+ 	IMX21_FB,
+ };
+ 
++enum imxfb_panel_type {
++	PANEL_TYPE_MONOCHROME,
++	PANEL_TYPE_CSTN,
++	PANEL_TYPE_TFT,
++};
++
+ struct imxfb_info {
+ 	struct platform_device  *pdev;
+ 	void __iomem		*regs;
+@@ -157,6 +164,7 @@ struct imxfb_info {
+ 	struct clk		*clk_ahb;
+ 	struct clk		*clk_per;
+ 	enum imxfb_type		devtype;
++	enum imxfb_panel_type	panel_type;
+ 	bool			enabled;
+ 
+ 	/*
+@@ -444,6 +452,13 @@ static int imxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ 	if (!is_imx1_fb(fbi) && imxfb_mode->aus_mode)
+ 		fbi->lauscr = LAUSCR_AUS_MODE;
+ 
++	if (imxfb_mode->pcr & PCR_TFT)
++		fbi->panel_type = PANEL_TYPE_TFT;
++	else if (imxfb_mode->pcr & PCR_COLOR)
++		fbi->panel_type = PANEL_TYPE_CSTN;
++	else
++		fbi->panel_type = PANEL_TYPE_MONOCHROME;
++
+ 	/*
+ 	 * Copy the RGB parameters for this display
+ 	 * from the machine specific parameters.
+@@ -596,6 +611,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ {
+ 	struct imxfb_info *fbi = info->par;
+ 	u32 ymax_mask = is_imx1_fb(fbi) ? YMAX_MASK_IMX1 : YMAX_MASK_IMX21;
++	u8 left_margin_low;
+ 
+ 	pr_debug("var: xres=%d hslen=%d lm=%d rm=%d\n",
+ 		var->xres, var->hsync_len,
+@@ -604,6 +620,13 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ 		var->yres, var->vsync_len,
+ 		var->upper_margin, var->lower_margin);
+ 
++	if (fbi->panel_type == PANEL_TYPE_TFT)
++		left_margin_low = 3;
++	else if (fbi->panel_type == PANEL_TYPE_CSTN)
++		left_margin_low = 2;
++	else
++		left_margin_low = 0;
++
+ #if DEBUG_VAR
+ 	if (var->xres < 16        || var->xres > 1024)
+ 		printk(KERN_ERR "%s: invalid xres %d\n",
+@@ -611,7 +634,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ 	if (var->hsync_len < 1    || var->hsync_len > 64)
+ 		printk(KERN_ERR "%s: invalid hsync_len %d\n",
+ 			info->fix.id, var->hsync_len);
+-	if (var->left_margin < 3  || var->left_margin > 255)
++	if (var->left_margin < left_margin_low  || var->left_margin > 255)
+ 		printk(KERN_ERR "%s: invalid left_margin %d\n",
+ 			info->fix.id, var->left_margin);
+ 	if (var->right_margin < 1 || var->right_margin > 255)
+@@ -637,7 +660,7 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
+ 
+ 	writel(HCR_H_WIDTH(var->hsync_len - 1) |
+ 		HCR_H_WAIT_1(var->right_margin - 1) |
+-		HCR_H_WAIT_2(var->left_margin - 3),
++		HCR_H_WAIT_2(var->left_margin - left_margin_low),
+ 		fbi->regs + LCDC_HCR);
+ 
+ 	writel(VCR_V_WIDTH(var->vsync_len) |
+-- 
+2.43.0
+
diff --git a/queue-6.7/fbdev-sm712fb-use-correct-initializer-macros-for-str.patch b/queue-6.7/fbdev-sm712fb-use-correct-initializer-macros-for-str.patch
new file mode 100644
index 00000000000..866b2c9f8d1
--- /dev/null
+++ b/queue-6.7/fbdev-sm712fb-use-correct-initializer-macros-for-str.patch
@@ -0,0 +1,77 @@
+From 87c2a2979e69cd2a969be6e4aece5f7559912ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 14:15:31 +0100
+Subject: fbdev/sm712fb: Use correct initializer macros for struct fb_ops
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+[ Upstream commit 12d55c013a09a2d490f004a324c20800e4ff35ec ]
+
+Only initialize mmap and draw helpers with macros; leave read/write
+callbacks to driver implementations. Fixes the following warnings:
+
+  CC [M]  drivers/video/fbdev/sm712fb.o
+  sm712fb.c:1355:25: warning: initialized field overwritten [-Woverride-init]
+  1355 |         .fb_fillrect  = cfb_fillrect,
+       |                         ^~~~~~~~~~~~
+  sm712fb.c:1355:25: note: (near initialization for 'smtcfb_ops.fb_fillrect')
+  sm712fb.c:1356:25: warning: initialized field overwritten [-Woverride-init]
+  1356 |         .fb_imageblit = cfb_imageblit,
+       |                         ^~~~~~~~~~~~~
+  sm712fb.c:1356:25: note: (near initialization for 'smtcfb_ops.fb_imageblit')
+  sm712fb.c:1357:25: warning: initialized field overwritten [-Woverride-init]
+  1357 |         .fb_copyarea  = cfb_copyarea,
+       |                         ^~~~~~~~~~~~
+  sm712fb.c:1357:25: note: (near initialization for 'smtcfb_ops.fb_copyarea')
+  sm712fb.c:1358:25: warning: initialized field overwritten [-Woverride-init]
+  1358 |         .fb_read      = smtcfb_read,
+       |                         ^~~~~~~~~~~
+  sm712fb.c:1358:25: note: (near initialization for 'smtcfb_ops.fb_read')
+  sm712fb.c:1359:25: warning: initialized field overwritten [-Woverride-init]
+  1359 |         .fb_write     = smtcfb_write,
+       |                         ^~~~~~~~~~~~
+  sm712fb.c:1359:25: note: (near initialization for 'smtcfb_ops.fb_write')
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: 586132cf1d38 ("fbdev/sm712fb: Initialize fb_ops to fbdev I/O-memory helpers")
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: linux-fbdev@vger.kernel.org
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231127131655.4020-3-tzimmermann@suse.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/sm712fb.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 3f8ef50e3209..104f122e0f27 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1347,16 +1347,14 @@ static int smtc_set_par(struct fb_info *info)
+ 
+ static const struct fb_ops smtcfb_ops = {
+ 	.owner        = THIS_MODULE,
+-	FB_DEFAULT_IOMEM_OPS,
+ 	.fb_check_var = smtc_check_var,
+ 	.fb_set_par   = smtc_set_par,
+ 	.fb_setcolreg = smtc_setcolreg,
+ 	.fb_blank     = smtc_blank,
+-	.fb_fillrect  = cfb_fillrect,
+-	.fb_imageblit = cfb_imageblit,
+-	.fb_copyarea  = cfb_copyarea,
++	__FB_DEFAULT_IOMEM_OPS_DRAW,
+ 	.fb_read      = smtcfb_read,
+ 	.fb_write     = smtcfb_write,
++	__FB_DEFAULT_IOMEM_OPS_MMAP,
+ };
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.7/firmware-qcom-qseecom-fix-memory-leaks-in-error-path.patch b/queue-6.7/firmware-qcom-qseecom-fix-memory-leaks-in-error-path.patch
new file mode 100644
index 00000000000..d9dbad35e91
--- /dev/null
+++ b/queue-6.7/firmware-qcom-qseecom-fix-memory-leaks-in-error-path.patch
@@ -0,0 +1,82 @@
+From d8cb4498fa2fe54e593bd810711d174fb1947777 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 15:15:48 +0100
+Subject: firmware: qcom: qseecom: fix memory leaks in error paths
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 6c57d7b593c4a4e60db65d5ce0fe1d9f79ccbe9b ]
+
+Fix instances of returning error codes directly instead of jumping to
+the relevant labels where memory allocated for the SCM calls would be
+freed.
+
+Fixes: 759e7a2b62eb ("firmware: Add support for Qualcomm UEFI Secure Application")
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/r/202311270828.k4HGcjiL-lkp@intel.com/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Maximilian Luz <luzmaximilian@gmail.com>
+Tested-by: Deepti Jaggi <quic_djaggi@quicinc.com> #sa8775p-ride
+Link: https://lore.kernel.org/r/20231127141600.20929-2-brgl@bgdev.pl
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../firmware/qcom/qcom_qseecom_uefisecapp.c   | 20 ++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
+index a33acdaf7b78..32188f098ef3 100644
+--- a/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
++++ b/drivers/firmware/qcom/qcom_qseecom_uefisecapp.c
+@@ -325,8 +325,10 @@ static efi_status_t qsee_uefi_get_variable(struct qcuefi_client *qcuefi, const e
+ 	req_data->length = req_size;
+ 
+ 	status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length);
+-	if (status < 0)
+-		return EFI_INVALID_PARAMETER;
++	if (status < 0) {
++		efi_status = EFI_INVALID_PARAMETER;
++		goto out_free;
++	}
+ 
+ 	memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size);
+ 
+@@ -471,8 +473,10 @@ static efi_status_t qsee_uefi_set_variable(struct qcuefi_client *qcuefi, const e
+ 	req_data->length = req_size;
+ 
+ 	status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name, name_length);
+-	if (status < 0)
+-		return EFI_INVALID_PARAMETER;
++	if (status < 0) {
++		efi_status = EFI_INVALID_PARAMETER;
++		goto out_free;
++	}
+ 
+ 	memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size);
+ 
+@@ -563,8 +567,10 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi,
+ 	memcpy(((void *)req_data) + req_data->guid_offset, guid, req_data->guid_size);
+ 	status = ucs2_strscpy(((void *)req_data) + req_data->name_offset, name,
+ 			      *name_size / sizeof(*name));
+-	if (status < 0)
+-		return EFI_INVALID_PARAMETER;
++	if (status < 0) {
++		efi_status = EFI_INVALID_PARAMETER;
++		goto out_free;
++	}
+ 
+ 	status = qcom_qseecom_app_send(qcuefi->client, req_data, req_size, rsp_data, rsp_size);
+ 	if (status) {
+@@ -635,7 +641,7 @@ static efi_status_t qsee_uefi_get_next_variable(struct qcuefi_client *qcuefi,
+ 		 * have already been validated above, causing this function to
+ 		 * bail with EFI_BUFFER_TOO_SMALL.
+ 		 */
+-		return EFI_DEVICE_ERROR;
++		efi_status = EFI_DEVICE_ERROR;
+ 	}
+ 
+ out_free:
+-- 
+2.43.0
+
diff --git a/queue-6.7/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch b/queue-6.7/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
new file mode 100644
index 00000000000..646786b9a82
--- /dev/null
+++ b/queue-6.7/firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
@@ -0,0 +1,55 @@
+From dc1c1ba5d00df38ebbe918cd46015c95a9df504d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 11:12:26 +0100
+Subject: firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 964946b88887089f447a9b6a28c39ee97dc76360 ]
+
+The ending NULL is not taken into account by strncat(), so switch to
+snprintf() to correctly build 'debug_name'.
+
+Using snprintf() also makes the code more readable.
+
+Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/7158db0a4d7b19855ddd542ec61b666973aad8dc.1698660720.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/ti_sci.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
+index 7041befc756a..8b9a2556de16 100644
+--- a/drivers/firmware/ti_sci.c
++++ b/drivers/firmware/ti_sci.c
+@@ -164,7 +164,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
+ {
+ 	struct device *dev = &pdev->dev;
+ 	struct resource *res;
+-	char debug_name[50] = "ti_sci_debug@";
++	char debug_name[50];
+ 
+ 	/* Debug region is optional */
+ 	res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
+@@ -181,10 +181,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
+ 	/* Setup NULL termination */
+ 	info->debug_buffer[info->debug_region_size] = 0;
+ 
+-	info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
+-					      sizeof(debug_name) -
+-					      sizeof("ti_sci_debug@")),
+-				      0444, NULL, info, &ti_sci_debug_fops);
++	snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s",
++		 dev_name(dev));
++	info->d = debugfs_create_file(debug_name, 0444, NULL, info,
++				      &ti_sci_debug_fops);
+ 	if (IS_ERR(info->d))
+ 		return PTR_ERR(info->d);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/fs-indicate-request-originates-from-old-mount-api.patch b/queue-6.7/fs-indicate-request-originates-from-old-mount-api.patch
new file mode 100644
index 00000000000..dde90bfa90f
--- /dev/null
+++ b/queue-6.7/fs-indicate-request-originates-from-old-mount-api.patch
@@ -0,0 +1,61 @@
+From 2756b1489fa0284001c6c417cbb2e31c16b21ab0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 12:17:37 -0500
+Subject: fs: indicate request originates from old mount API
+
+From: Christian Brauner <brauner@kernel.org>
+
+[ Upstream commit f67d922edb4e95a4a56d07d5d40a76dd4f23a85b ]
+
+We already communicate to filesystems when a remount request comes from
+the old mount API as some filesystems choose to implement different
+behavior in the new mount API than the old mount API to e.g., take the
+chance to fix significant API bugs. Allow the same for regular mount
+requests.
+
+Fixes: b330966f79fb ("fuse: reject options on reconfigure via fsconfig(2)")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/namespace.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index fbf0e596fcd3..6c39ec020a5f 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2875,7 +2875,12 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags,
+ 	if (IS_ERR(fc))
+ 		return PTR_ERR(fc);
+ 
++	/*
++	 * Indicate to the filesystem that the remount request is coming
++	 * from the legacy mount system call.
++	 */
+ 	fc->oldapi = true;
++
+ 	err = parse_monolithic_mount_data(fc, data);
+ 	if (!err) {
+ 		down_write(&sb->s_umount);
+@@ -3324,6 +3329,12 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
+ 	if (IS_ERR(fc))
+ 		return PTR_ERR(fc);
+ 
++	/*
++	 * Indicate to the filesystem that the mount request is coming
++	 * from the legacy mount system call.
++	 */
++	fc->oldapi = true;
++
+ 	if (subtype)
+ 		err = vfs_parse_fs_string(fc, "subtype",
+ 					  subtype, strlen(subtype));
+-- 
+2.43.0
+
diff --git a/queue-6.7/fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch b/queue-6.7/fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch
new file mode 100644
index 00000000000..73f60bec4b2
--- /dev/null
+++ b/queue-6.7/fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch
@@ -0,0 +1,74 @@
+From a9197d27406825457a1b2ba3aa0d8c4aed8b2f0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Nov 2023 16:08:22 +0100
+Subject: fs/pipe: Fix lockdep false-positive in watchqueue pipe_write()
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 055ca83559912f2cfd91c9441427bac4caf3c74e ]
+
+When you try to splice between a normal pipe and a notification pipe,
+get_pipe_info(..., true) fails, so splice() falls back to treating the
+notification pipe like a normal pipe - so we end up in
+iter_file_splice_write(), which first locks the input pipe, then calls
+vfs_iter_write(), which locks the output pipe.
+
+Lockdep complains about that, because we're taking a pipe lock while
+already holding another pipe lock.
+
+I think this probably (?) can't actually lead to deadlocks, since you'd
+need another way to nest locking a normal pipe into locking a
+watch_queue pipe, but the lockdep annotations don't make that clear.
+
+Bail out earlier in pipe_write() for notification pipes, before taking
+the pipe lock.
+
+Reported-and-tested-by: <syzbot+011e4ea1da6692cf881c@syzkaller.appspotmail.com>
+Closes: https://syzkaller.appspot.com/bug?extid=011e4ea1da6692cf881c
+Fixes: c73be61cede5 ("pipe: Add general notification queue support")
+Signed-off-by: Jann Horn <jannh@google.com>
+Link: https://lore.kernel.org/r/20231124150822.2121798-1-jannh@google.com
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pipe.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 804a7d789452..226e7f66b590 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -446,6 +446,18 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
+ 	bool was_empty = false;
+ 	bool wake_next_writer = false;
+ 
++	/*
++	 * Reject writing to watch queue pipes before the point where we lock
++	 * the pipe.
++	 * Otherwise, lockdep would be unhappy if the caller already has another
++	 * pipe locked.
++	 * If we had to support locking a normal pipe and a notification pipe at
++	 * the same time, we could set up lockdep annotations for that, but
++	 * since we don't actually need that, it's simpler to just bail here.
++	 */
++	if (pipe_has_watch_queue(pipe))
++		return -EXDEV;
++
+ 	/* Null write succeeds. */
+ 	if (unlikely(total_len == 0))
+ 		return 0;
+@@ -458,11 +470,6 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
+ 		goto out;
+ 	}
+ 
+-	if (pipe_has_watch_queue(pipe)) {
+-		ret = -EXDEV;
+-		goto out;
+-	}
+-
+ 	/*
+ 	 * If it wasn't empty we try to merge new data into
+ 	 * the last buffer.
+-- 
+2.43.0
+
diff --git a/queue-6.7/gfs2-fix-kernel-bug-in-gfs2_quota_cleanup.patch b/queue-6.7/gfs2-fix-kernel-bug-in-gfs2_quota_cleanup.patch
new file mode 100644
index 00000000000..8d6572cf20c
--- /dev/null
+++ b/queue-6.7/gfs2-fix-kernel-bug-in-gfs2_quota_cleanup.patch
@@ -0,0 +1,95 @@
+From 46c96d19673f3d3e7753c0f69a70bb3c7eab8ec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 17:25:49 +0800
+Subject: gfs2: fix kernel BUG in gfs2_quota_cleanup
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+[ Upstream commit 71733b4922007500ae259af9e96017080f5d36d9 ]
+
+[Syz report]
+kernel BUG at fs/gfs2/quota.c:1508!
+invalid opcode: 0000 [#1] PREEMPT SMP KASAN
+CPU: 0 PID: 5060 Comm: syz-executor505 Not tainted 6.7.0-rc3-syzkaller-00134-g994d5c58e50e #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
+RIP: 0010:gfs2_quota_cleanup+0x6b5/0x6c0 fs/gfs2/quota.c:1508
+Code: fe e9 cf fd ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 4c 89 ef e8 b6 19 23 fe e9 20 fe ff ff e8 ec 11 c7 fd 90 <0f> 0b e8 84 9c 4f 07 0f 1f 40 00 66 0f 1f 00 55 41 57 41 56 41 54
+RSP: 0018:ffffc9000409f9e0 EFLAGS: 00010293
+RAX: ffffffff83c76854 RBX: 0000000000000002 RCX: ffff888026001dc0
+RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
+RBP: ffffc9000409fb00 R08: ffffffff83c762b0 R09: 1ffff1100fd38015
+R10: dffffc0000000000 R11: ffffed100fd38016 R12: dffffc0000000000
+R13: ffff88807e9c0828 R14: ffff888014693580 R15: ffff88807e9c0000
+FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f16d1bd70f8 CR3: 0000000027199000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ gfs2_put_super+0x2e1/0x940 fs/gfs2/super.c:611
+ generic_shutdown_super+0x13a/0x2c0 fs/super.c:696
+ kill_block_super+0x44/0x90 fs/super.c:1667
+ deactivate_locked_super+0xc1/0x130 fs/super.c:484
+ cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256
+ task_work_run+0x24a/0x300 kernel/task_work.c:180
+ exit_task_work include/linux/task_work.h:38 [inline]
+ do_exit+0xa34/0x2750 kernel/exit.c:871
+ do_group_exit+0x206/0x2c0 kernel/exit.c:1021
+ __do_sys_exit_group kernel/exit.c:1032 [inline]
+ __se_sys_exit_group kernel/exit.c:1030 [inline]
+ __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1030
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x63/0x6b
+...
+
+[pid  5060] fsconfig(4, FSCONFIG_CMD_RECONFIGURE, NULL, NULL, 0) = 0
+[pid  5060] exit_group(1)               = ?
+...
+
+[Analysis]
+When the task exits, it will execute cleanup_mnt() to recycle the mounted gfs2
+file system, but it performs a system call fsconfig(4, FSCONFIG_CMD_RECONFIGURE,
+NULL, NULL, 0) before executing the task exit operation.
+
+This will execute the following kernel path to complete the setting of
+SDF_JOURNAL_LIVE for sd_flags:
+
+SYSCALL_DEFINE5(fsconfig, ..)->
+	vfs_fsconfig_locked()->
+		vfs_cmd_reconfigure()->
+			gfs2_reconfigure()->
+				gfs2_make_fs_rw()->
+					set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
+
+[Fix]
+Add SDF_NORECOVERY check in gfs2_quota_cleanup() to avoid checking
+SDF_JOURNAL_LIVE on the path where gfs2 is being unmounted.
+
+Reported-and-tested-by: syzbot+3b6e67ac2b646da57862@syzkaller.appspotmail.com
+Fixes: f66af88e3321 ("gfs2: Stop using gfs2_make_fs_ro for withdraw")
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/quota.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
+index 95dae7838b4e..f139ce8cf5ce 100644
+--- a/fs/gfs2/quota.c
++++ b/fs/gfs2/quota.c
+@@ -1505,7 +1505,8 @@ void gfs2_quota_cleanup(struct gfs2_sbd *sdp)
+ 	LIST_HEAD(dispose);
+ 	int count;
+ 
+-	BUG_ON(test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));
++	BUG_ON(!test_bit(SDF_NORECOVERY, &sdp->sd_flags) &&
++		test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags));
+ 
+ 	spin_lock(&qd_lock);
+ 	list_for_each_entry(qd, &sdp->sd_quota_list, qd_list) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch b/queue-6.7/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
new file mode 100644
index 00000000000..9ccf884c83f
--- /dev/null
+++ b/queue-6.7/gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
@@ -0,0 +1,40 @@
+From d190eae01ec458a209664cba8a05e7f62b41dc04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 21:21:29 +0500
+Subject: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
+
+From: Osama Muhammad <osmtendev@gmail.com>
+
+[ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ]
+
+Syzkaller has reported a NULL pointer dereference when accessing
+rgd->rd_rgl in gfs2_rgrp_dump().  This can happen when creating
+rgd->rd_gl fails in read_rindex_entry().  Add a NULL pointer check in
+gfs2_rgrp_dump() to prevent that.
+
+Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d
+Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found")
+Signed-off-by: Osama Muhammad <osmtendev@gmail.com>
+Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/rgrp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index c2060203b98a..396d0f4a259d 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -2306,7 +2306,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd,
+ 		       (unsigned long long)rgd->rd_addr, rgd->rd_flags,
+ 		       rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes,
+ 		       rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt);
+-	if (rgd->rd_sbd->sd_args.ar_rgrplvb) {
++	if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) {
+ 		struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl;
+ 
+ 		gfs2_print_dbg(seq, "%s  L: f:%02x b:%u i:%u\n", fs_id_buf,
+-- 
+2.43.0
+
diff --git a/queue-6.7/gpio-sysfs-fix-forward-declaration-of-struct-gpio_de.patch b/queue-6.7/gpio-sysfs-fix-forward-declaration-of-struct-gpio_de.patch
new file mode 100644
index 00000000000..2a0963a0bf8
--- /dev/null
+++ b/queue-6.7/gpio-sysfs-fix-forward-declaration-of-struct-gpio_de.patch
@@ -0,0 +1,41 @@
+From 1406da1b3e8af22810c1dbd85cb18fc9195e508f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 20:37:15 +0100
+Subject: gpio: sysfs: fix forward declaration of struct gpio_device
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 58bfaaac03284d82a55a724bfe2d97e19f3a11d0 ]
+
+The forward declaration for struct gpio_device should be provided for
+both branches of the #ifdef.
+
+Fixes: 08a149c40bdb ("gpiolib: Clean up headers")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-sysfs.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-sysfs.h b/drivers/gpio/gpiolib-sysfs.h
+index 0f213bdb4732..b794b396d6a5 100644
+--- a/drivers/gpio/gpiolib-sysfs.h
++++ b/drivers/gpio/gpiolib-sysfs.h
+@@ -3,10 +3,10 @@
+ #ifndef GPIOLIB_SYSFS_H
+ #define GPIOLIB_SYSFS_H
+ 
+-#ifdef CONFIG_GPIO_SYSFS
+-
+ struct gpio_device;
+ 
++#ifdef CONFIG_GPIO_SYSFS
++
+ int gpiochip_sysfs_register(struct gpio_device *gdev);
+ void gpiochip_sysfs_unregister(struct gpio_device *gdev);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/gpiolib-remove-the-gpio-device-from-the-list-when-it.patch b/queue-6.7/gpiolib-remove-the-gpio-device-from-the-list-when-it.patch
new file mode 100644
index 00000000000..37b9f34e18f
--- /dev/null
+++ b/queue-6.7/gpiolib-remove-the-gpio-device-from-the-list-when-it.patch
@@ -0,0 +1,53 @@
+From f69f8332c435b5d2f7d3003513501168692e63b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 16:59:47 +0100
+Subject: gpiolib: remove the GPIO device from the list when it's unregistered
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 48e1b4d369cfe2729138a128afa6b8a55d093eaf ]
+
+If we wait until the GPIO device's .release() callback gets invoked
+before we remove it from the global device list, then we risk that
+someone will look it up using gpio_device_find() between where we
+dropped the last reference and before .release() is done taking a
+reference again to an object that's being released.
+
+The device must be removed when it's being unregistered - just like how
+we remove it from the GPIO bus.
+
+Fixes: ff2b13592299 ("gpio: make the gpiochip a real device")
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 3518481c433f..74bcdb50c931 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -650,9 +650,6 @@ static void gpiodev_release(struct device *dev)
+ {
+ 	struct gpio_device *gdev = to_gpio_device(dev);
+ 
+-	scoped_guard(mutex, &gpio_devices_lock)
+-		list_del(&gdev->list);
+-
+ 	ida_free(&gpio_ida, gdev->id);
+ 	kfree_const(gdev->label);
+ 	kfree(gdev->descs);
+@@ -1067,6 +1064,9 @@ void gpiochip_remove(struct gpio_chip *gc)
+ 		dev_crit(&gdev->dev,
+ 			 "REMOVING GPIOCHIP WITH GPIOS STILL REQUESTED\n");
+ 
++	scoped_guard(mutex, &gpio_devices_lock)
++		list_del(&gdev->list);
++
+ 	/*
+ 	 * The gpiochip side puts its use of the device to rest here:
+ 	 * if there are no userspace clients, the chardev and device will
+-- 
+2.43.0
+
diff --git a/queue-6.7/gpiolib-rename-static-functions-that-are-called-with.patch b/queue-6.7/gpiolib-rename-static-functions-that-are-called-with.patch
new file mode 100644
index 00000000000..36aee36e231
--- /dev/null
+++ b/queue-6.7/gpiolib-rename-static-functions-that-are-called-with.patch
@@ -0,0 +1,66 @@
+From 8597c621bc223e1a6eb445549d4f621060fe84cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 16:52:59 +0100
+Subject: gpiolib: rename static functions that are called with the lock taken
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit f95fd4ac155733b5735c84a2e56eee8321232095 ]
+
+Rename two functions that read or modify the global GPIO device list but
+don't take the lock themselves (and need to be called with it already
+acquired). Use the _unlocked() suffix which seems to be used quite
+consistently across the kernel despite there also existing the _locked()
+suffix for the same purpose.
+
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Stable-dep-of: 48e1b4d369cf ("gpiolib: remove the GPIO device from the list when it's unregistered")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 95d2a7b2ea3e..9e69d42ff5af 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -276,7 +276,7 @@ struct gpio_chip *gpio_device_get_chip(struct gpio_device *gdev)
+ EXPORT_SYMBOL_GPL(gpio_device_get_chip);
+ 
+ /* dynamic allocation of GPIOs, e.g. on a hotplugged device */
+-static int gpiochip_find_base(int ngpio)
++static int gpiochip_find_base_unlocked(int ngpio)
+ {
+ 	struct gpio_device *gdev;
+ 	int base = GPIO_DYNAMIC_BASE;
+@@ -349,7 +349,7 @@ EXPORT_SYMBOL_GPL(gpiod_get_direction);
+  * Return -EBUSY if the new chip overlaps with some other chip's integer
+  * space.
+  */
+-static int gpiodev_add_to_list(struct gpio_device *gdev)
++static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev)
+ {
+ 	struct gpio_device *prev, *next;
+ 
+@@ -893,7 +893,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ 	 */
+ 	base = gc->base;
+ 	if (base < 0) {
+-		base = gpiochip_find_base(gc->ngpio);
++		base = gpiochip_find_base_unlocked(gc->ngpio);
+ 		if (base < 0) {
+ 			spin_unlock_irqrestore(&gpio_lock, flags);
+ 			ret = base;
+@@ -913,7 +913,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ 	}
+ 	gdev->base = base;
+ 
+-	ret = gpiodev_add_to_list(gdev);
++	ret = gpiodev_add_to_list_unlocked(gdev);
+ 	if (ret) {
+ 		spin_unlock_irqrestore(&gpio_lock, flags);
+ 		chip_err(gc, "GPIO integer space overlap, cannot add chip\n");
+-- 
+2.43.0
+
diff --git a/queue-6.7/gpiolib-use-a-mutex-to-protect-the-list-of-gpio-devi.patch b/queue-6.7/gpiolib-use-a-mutex-to-protect-the-list-of-gpio-devi.patch
new file mode 100644
index 00000000000..85870d23543
--- /dev/null
+++ b/queue-6.7/gpiolib-use-a-mutex-to-protect-the-list-of-gpio-devi.patch
@@ -0,0 +1,400 @@
+From da7a9adaae4424fca4134f6089a4490e431a4b35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 16:53:00 +0100
+Subject: gpiolib: use a mutex to protect the list of GPIO devices
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit 65a828bab15887b33336d251fd659b2ae86de6d6 ]
+
+The global list of GPIO devices is never modified or accessed from
+atomic context so it's fine to protect it using a mutex. Add a new
+global lock dedicated to the gpio_devices list and use it whenever
+accessing or modifying it.
+
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Stable-dep-of: 48e1b4d369cf ("gpiolib: remove the GPIO device from the list when it's unregistered")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-sysfs.c |  45 ++++++------
+ drivers/gpio/gpiolib-sysfs.h |   6 ++
+ drivers/gpio/gpiolib.c       | 137 ++++++++++++++++-------------------
+ drivers/gpio/gpiolib.h       |   2 +
+ 4 files changed, 90 insertions(+), 100 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib-sysfs.c b/drivers/gpio/gpiolib-sysfs.c
+index 12d853845bb8..1e91e7395d01 100644
+--- a/drivers/gpio/gpiolib-sysfs.c
++++ b/drivers/gpio/gpiolib-sysfs.c
+@@ -769,6 +769,25 @@ int gpiochip_sysfs_register(struct gpio_device *gdev)
+ 	return 0;
+ }
+ 
++int gpiochip_sysfs_register_all(void)
++{
++	struct gpio_device *gdev;
++	int ret;
++
++	guard(mutex)(&gpio_devices_lock);
++
++	list_for_each_entry(gdev, &gpio_devices, list) {
++		if (gdev->mockdev)
++			continue;
++
++		ret = gpiochip_sysfs_register(gdev);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++}
++
+ void gpiochip_sysfs_unregister(struct gpio_device *gdev)
+ {
+ 	struct gpio_desc *desc;
+@@ -793,9 +812,7 @@ void gpiochip_sysfs_unregister(struct gpio_device *gdev)
+ 
+ static int __init gpiolib_sysfs_init(void)
+ {
+-	int		status;
+-	unsigned long	flags;
+-	struct gpio_device *gdev;
++	int status;
+ 
+ 	status = class_register(&gpio_class);
+ 	if (status < 0)
+@@ -807,26 +824,6 @@ static int __init gpiolib_sysfs_init(void)
+ 	 * We run before arch_initcall() so chip->dev nodes can have
+ 	 * registered, and so arch_initcall() can always gpiod_export().
+ 	 */
+-	spin_lock_irqsave(&gpio_lock, flags);
+-	list_for_each_entry(gdev, &gpio_devices, list) {
+-		if (gdev->mockdev)
+-			continue;
+-
+-		/*
+-		 * TODO we yield gpio_lock here because
+-		 * gpiochip_sysfs_register() acquires a mutex. This is unsafe
+-		 * and needs to be fixed.
+-		 *
+-		 * Also it would be nice to use gpio_device_find() here so we
+-		 * can keep gpio_chips local to gpiolib.c, but the yield of
+-		 * gpio_lock prevents us from doing this.
+-		 */
+-		spin_unlock_irqrestore(&gpio_lock, flags);
+-		status = gpiochip_sysfs_register(gdev);
+-		spin_lock_irqsave(&gpio_lock, flags);
+-	}
+-	spin_unlock_irqrestore(&gpio_lock, flags);
+-
+-	return status;
++	return gpiochip_sysfs_register_all();
+ }
+ postcore_initcall(gpiolib_sysfs_init);
+diff --git a/drivers/gpio/gpiolib-sysfs.h b/drivers/gpio/gpiolib-sysfs.h
+index b794b396d6a5..ab157cec0b4b 100644
+--- a/drivers/gpio/gpiolib-sysfs.h
++++ b/drivers/gpio/gpiolib-sysfs.h
+@@ -8,6 +8,7 @@ struct gpio_device;
+ #ifdef CONFIG_GPIO_SYSFS
+ 
+ int gpiochip_sysfs_register(struct gpio_device *gdev);
++int gpiochip_sysfs_register_all(void);
+ void gpiochip_sysfs_unregister(struct gpio_device *gdev);
+ 
+ #else
+@@ -17,6 +18,11 @@ static inline int gpiochip_sysfs_register(struct gpio_device *gdev)
+ 	return 0;
+ }
+ 
++static inline int gpiochip_sysfs_register_all(void)
++{
++	return 0;
++}
++
+ static inline void gpiochip_sysfs_unregister(struct gpio_device *gdev)
+ {
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 9e69d42ff5af..3518481c433f 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -2,6 +2,7 @@
+ 
+ #include <linux/acpi.h>
+ #include <linux/bitmap.h>
++#include <linux/cleanup.h>
+ #include <linux/compat.h>
+ #include <linux/debugfs.h>
+ #include <linux/device.h>
+@@ -15,6 +16,7 @@
+ #include <linux/kernel.h>
+ #include <linux/list.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/of.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/seq_file.h>
+@@ -94,7 +96,9 @@ DEFINE_SPINLOCK(gpio_lock);
+ 
+ static DEFINE_MUTEX(gpio_lookup_lock);
+ static LIST_HEAD(gpio_lookup_list);
++
+ LIST_HEAD(gpio_devices);
++DEFINE_MUTEX(gpio_devices_lock);
+ 
+ static DEFINE_MUTEX(gpio_machine_hogs_mutex);
+ static LIST_HEAD(gpio_machine_hogs);
+@@ -126,20 +130,15 @@ static inline void desc_set_label(struct gpio_desc *d, const char *label)
+ struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+ 	struct gpio_device *gdev;
+-	unsigned long flags;
+-
+-	spin_lock_irqsave(&gpio_lock, flags);
+ 
+-	list_for_each_entry(gdev, &gpio_devices, list) {
+-		if (gdev->base <= gpio &&
+-		    gdev->base + gdev->ngpio > gpio) {
+-			spin_unlock_irqrestore(&gpio_lock, flags);
+-			return &gdev->descs[gpio - gdev->base];
++	scoped_guard(mutex, &gpio_devices_lock) {
++		list_for_each_entry(gdev, &gpio_devices, list) {
++			if (gdev->base <= gpio &&
++			    gdev->base + gdev->ngpio > gpio)
++				return &gdev->descs[gpio - gdev->base];
+ 		}
+ 	}
+ 
+-	spin_unlock_irqrestore(&gpio_lock, flags);
+-
+ 	if (!gpio_is_valid(gpio))
+ 		pr_warn("invalid GPIO %d\n", gpio);
+ 
+@@ -398,26 +397,21 @@ static int gpiodev_add_to_list_unlocked(struct gpio_device *gdev)
+ static struct gpio_desc *gpio_name_to_desc(const char * const name)
+ {
+ 	struct gpio_device *gdev;
+-	unsigned long flags;
+ 
+ 	if (!name)
+ 		return NULL;
+ 
+-	spin_lock_irqsave(&gpio_lock, flags);
++	guard(mutex)(&gpio_devices_lock);
+ 
+ 	list_for_each_entry(gdev, &gpio_devices, list) {
+ 		struct gpio_desc *desc;
+ 
+ 		for_each_gpio_desc(gdev->chip, desc) {
+-			if (desc->name && !strcmp(desc->name, name)) {
+-				spin_unlock_irqrestore(&gpio_lock, flags);
++			if (desc->name && !strcmp(desc->name, name))
+ 				return desc;
+-			}
+ 		}
+ 	}
+ 
+-	spin_unlock_irqrestore(&gpio_lock, flags);
+-
+ 	return NULL;
+ }
+ 
+@@ -655,11 +649,9 @@ EXPORT_SYMBOL_GPL(gpiochip_line_is_valid);
+ static void gpiodev_release(struct device *dev)
+ {
+ 	struct gpio_device *gdev = to_gpio_device(dev);
+-	unsigned long flags;
+ 
+-	spin_lock_irqsave(&gpio_lock, flags);
+-	list_del(&gdev->list);
+-	spin_unlock_irqrestore(&gpio_lock, flags);
++	scoped_guard(mutex, &gpio_devices_lock)
++		list_del(&gdev->list);
+ 
+ 	ida_free(&gpio_ida, gdev->id);
+ 	kfree_const(gdev->label);
+@@ -817,7 +809,6 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ 			       struct lock_class_key *request_key)
+ {
+ 	struct gpio_device *gdev;
+-	unsigned long flags;
+ 	unsigned int i;
+ 	int base = 0;
+ 	int ret = 0;
+@@ -882,49 +873,46 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ 
+ 	gdev->ngpio = gc->ngpio;
+ 
+-	spin_lock_irqsave(&gpio_lock, flags);
++	scoped_guard(mutex, &gpio_devices_lock) {
++		/*
++		 * TODO: this allocates a Linux GPIO number base in the global
++		 * GPIO numberspace for this chip. In the long run we want to
++		 * get *rid* of this numberspace and use only descriptors, but
++		 * it may be a pipe dream. It will not happen before we get rid
++		 * of the sysfs interface anyways.
++		 */
++		base = gc->base;
+ 
+-	/*
+-	 * TODO: this allocates a Linux GPIO number base in the global
+-	 * GPIO numberspace for this chip. In the long run we want to
+-	 * get *rid* of this numberspace and use only descriptors, but
+-	 * it may be a pipe dream. It will not happen before we get rid
+-	 * of the sysfs interface anyways.
+-	 */
+-	base = gc->base;
+-	if (base < 0) {
+-		base = gpiochip_find_base_unlocked(gc->ngpio);
+ 		if (base < 0) {
+-			spin_unlock_irqrestore(&gpio_lock, flags);
+-			ret = base;
+-			base = 0;
++			base = gpiochip_find_base_unlocked(gc->ngpio);
++			if (base < 0) {
++				ret = base;
++				base = 0;
++				goto err_free_label;
++			}
++			/*
++			 * TODO: it should not be necessary to reflect the assigned
++			 * base outside of the GPIO subsystem. Go over drivers and
++			 * see if anyone makes use of this, else drop this and assign
++			 * a poison instead.
++			 */
++			gc->base = base;
++		} else {
++			dev_warn(&gdev->dev,
++				 "Static allocation of GPIO base is deprecated, use dynamic allocation.\n");
++		}
++		gdev->base = base;
++
++		ret = gpiodev_add_to_list_unlocked(gdev);
++		if (ret) {
++			chip_err(gc, "GPIO integer space overlap, cannot add chip\n");
+ 			goto err_free_label;
+ 		}
+-		/*
+-		 * TODO: it should not be necessary to reflect the assigned
+-		 * base outside of the GPIO subsystem. Go over drivers and
+-		 * see if anyone makes use of this, else drop this and assign
+-		 * a poison instead.
+-		 */
+-		gc->base = base;
+-	} else {
+-		dev_warn(&gdev->dev,
+-			 "Static allocation of GPIO base is deprecated, use dynamic allocation.\n");
+-	}
+-	gdev->base = base;
+ 
+-	ret = gpiodev_add_to_list_unlocked(gdev);
+-	if (ret) {
+-		spin_unlock_irqrestore(&gpio_lock, flags);
+-		chip_err(gc, "GPIO integer space overlap, cannot add chip\n");
+-		goto err_free_label;
++		for (i = 0; i < gc->ngpio; i++)
++			gdev->descs[i].gdev = gdev;
+ 	}
+ 
+-	for (i = 0; i < gc->ngpio; i++)
+-		gdev->descs[i].gdev = gdev;
+-
+-	spin_unlock_irqrestore(&gpio_lock, flags);
+-
+ 	BLOCKING_INIT_NOTIFIER_HEAD(&gdev->line_state_notifier);
+ 	BLOCKING_INIT_NOTIFIER_HEAD(&gdev->device_notifier);
+ 	init_rwsem(&gdev->sem);
+@@ -1015,9 +1003,8 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
+ 		goto err_print_message;
+ 	}
+ err_remove_from_list:
+-	spin_lock_irqsave(&gpio_lock, flags);
+-	list_del(&gdev->list);
+-	spin_unlock_irqrestore(&gpio_lock, flags);
++	scoped_guard(mutex, &gpio_devices_lock)
++		list_del(&gdev->list);
+ err_free_label:
+ 	kfree_const(gdev->label);
+ err_free_descs:
+@@ -1126,7 +1113,7 @@ struct gpio_device *gpio_device_find(void *data,
+ 	 */
+ 	might_sleep();
+ 
+-	guard(spinlock_irqsave)(&gpio_lock);
++	guard(mutex)(&gpio_devices_lock);
+ 
+ 	list_for_each_entry(gdev, &gpio_devices, list) {
+ 		if (gdev->chip && match(gdev->chip, data))
+@@ -4727,35 +4714,33 @@ static void gpiolib_dbg_show(struct seq_file *s, struct gpio_device *gdev)
+ 
+ static void *gpiolib_seq_start(struct seq_file *s, loff_t *pos)
+ {
+-	unsigned long flags;
+ 	struct gpio_device *gdev = NULL;
+ 	loff_t index = *pos;
+ 
+ 	s->private = "";
+ 
+-	spin_lock_irqsave(&gpio_lock, flags);
+-	list_for_each_entry(gdev, &gpio_devices, list)
+-		if (index-- == 0) {
+-			spin_unlock_irqrestore(&gpio_lock, flags);
++	guard(mutex)(&gpio_devices_lock);
++
++	list_for_each_entry(gdev, &gpio_devices, list) {
++		if (index-- == 0)
+ 			return gdev;
+-		}
+-	spin_unlock_irqrestore(&gpio_lock, flags);
++	}
+ 
+ 	return NULL;
+ }
+ 
+ static void *gpiolib_seq_next(struct seq_file *s, void *v, loff_t *pos)
+ {
+-	unsigned long flags;
+ 	struct gpio_device *gdev = v;
+ 	void *ret = NULL;
+ 
+-	spin_lock_irqsave(&gpio_lock, flags);
+-	if (list_is_last(&gdev->list, &gpio_devices))
+-		ret = NULL;
+-	else
+-		ret = list_first_entry(&gdev->list, struct gpio_device, list);
+-	spin_unlock_irqrestore(&gpio_lock, flags);
++	scoped_guard(mutex, &gpio_devices_lock) {
++		if (list_is_last(&gdev->list, &gpio_devices))
++			ret = NULL;
++		else
++			ret = list_first_entry(&gdev->list, struct gpio_device,
++					       list);
++	}
+ 
+ 	s->private = "\n";
+ 	++*pos;
+diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h
+index 3ccacf3c1288..8142b5cbc395 100644
+--- a/drivers/gpio/gpiolib.h
++++ b/drivers/gpio/gpiolib.h
+@@ -15,6 +15,7 @@
+ #include <linux/gpio/consumer.h> /* for enum gpiod_flags */
+ #include <linux/gpio/driver.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/notifier.h>
+ #include <linux/rwsem.h>
+ 
+@@ -136,6 +137,7 @@ int gpiod_set_transitory(struct gpio_desc *desc, bool transitory);
+ 
+ extern spinlock_t gpio_lock;
+ extern struct list_head gpio_devices;
++extern struct mutex gpio_devices_lock;
+ 
+ void gpiod_line_state_notify(struct gpio_desc *desc, unsigned long action);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch b/queue-6.7/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
new file mode 100644
index 00000000000..7bb4d6c8415
--- /dev/null
+++ b/queue-6.7/gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
@@ -0,0 +1,48 @@
+From 7f721af86b614840db1522035b9efe7593da0850 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Dec 2023 00:58:42 +0800
+Subject: gpu/drm/radeon: fix two memleaks in radeon_vm_init
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d ]
+
+When radeon_bo_create and radeon_vm_clear_bo fail, the vm->page_tables
+allocated before need to be freed. However, neither radeon_vm_init
+itself nor its caller have done such deallocation.
+
+Fixes: 6d2f2944e95e ("drm/radeon: use normal BOs for the page tables v4")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_vm.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
+index 987cabbf1318..c38b4d5d6a14 100644
+--- a/drivers/gpu/drm/radeon/radeon_vm.c
++++ b/drivers/gpu/drm/radeon/radeon_vm.c
+@@ -1204,13 +1204,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
+ 	r = radeon_bo_create(rdev, pd_size, align, true,
+ 			     RADEON_GEM_DOMAIN_VRAM, 0, NULL,
+ 			     NULL, &vm->page_directory);
+-	if (r)
++	if (r) {
++		kfree(vm->page_tables);
++		vm->page_tables = NULL;
+ 		return r;
+-
++	}
+ 	r = radeon_vm_clear_bo(rdev, vm->page_directory);
+ 	if (r) {
+ 		radeon_bo_unref(&vm->page_directory);
+ 		vm->page_directory = NULL;
++		kfree(vm->page_tables);
++		vm->page_tables = NULL;
+ 		return r;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/hwrng-stm32-add-missing-clk_disable_unprepare-in-stm.patch b/queue-6.7/hwrng-stm32-add-missing-clk_disable_unprepare-in-stm.patch
new file mode 100644
index 00000000000..a7275645384
--- /dev/null
+++ b/queue-6.7/hwrng-stm32-add-missing-clk_disable_unprepare-in-stm.patch
@@ -0,0 +1,36 @@
+From c001d097b5eca1accc1c1b479719303b20ceecf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 16:20:48 +0800
+Subject: hwrng: stm32 - add missing clk_disable_unprepare() in
+ stm32_rng_init()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 429fec81d12266e6402868672de8c68bf4d8db13 ]
+
+Add clk_disable_unprepare() in the error path in stm32_rng_init().
+
+Fixes: 6b85a7e141cb ("hwrng: stm32 - implement STM32MP13x support")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Reviewed-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hw_random/stm32-rng.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c
+index 41e1dbea5d2e..efd6edcd7066 100644
+--- a/drivers/char/hw_random/stm32-rng.c
++++ b/drivers/char/hw_random/stm32-rng.c
+@@ -325,6 +325,7 @@ static int stm32_rng_init(struct hwrng *rng)
+ 							(!(reg & RNG_CR_CONDRST)),
+ 							10, 50000);
+ 		if (err) {
++			clk_disable_unprepare(priv->clk);
+ 			dev_err((struct device *)priv->rng.priv,
+ 				"%s: timeout %x!\n", __func__, reg);
+ 			return -EINVAL;
+-- 
+2.43.0
+
diff --git a/queue-6.7/ib-iser-prevent-invalidating-wrong-mr.patch b/queue-6.7/ib-iser-prevent-invalidating-wrong-mr.patch
new file mode 100644
index 00000000000..1cb6030c5b7
--- /dev/null
+++ b/queue-6.7/ib-iser-prevent-invalidating-wrong-mr.patch
@@ -0,0 +1,133 @@
+From 2f0f84921c7710eb5951b6748936610830cf36fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 09:23:11 +0200
+Subject: IB/iser: Prevent invalidating wrong MR
+
+From: Sergey Gorenko <sergeygo@nvidia.com>
+
+[ Upstream commit 2f1888281e67205bd80d3e8f54dbd519a9653f26 ]
+
+The iser_reg_resources structure has two pointers to MR but only one
+mr_valid field. The implementation assumes that we use only *sig_mr when
+pi_enable is true. Otherwise, we use only *mr. However, it is only
+sometimes correct. Read commands without protection information occur even
+when pi_enble is true. For example, the following SCSI commands have a
+Data-In buffer but never have protection information: READ CAPACITY (16),
+INQUIRY, MODE SENSE(6), MAINTENANCE IN. So, we use
+*sig_mr for some SCSI commands and *mr for the other SCSI commands.
+
+In most cases, it works fine because the remote invalidation is applied.
+However, there are two cases when the remote invalidation is not
+applicable.
+ 1. Small write commands when all data is sent as an immediate.
+ 2. The target does not support the remote invalidation feature.
+
+The lazy invalidation is used if the remote invalidation is impossible.
+Since, at the lazy invalidation, we always invalidate the MR we want to
+use, the wrong MR may be invalidated.
+
+To fix the issue, we need a field per MR that indicates the MR needs
+invalidation. Since the ib_mr structure already has such a field, let's
+use ib_mr.need_inval instead of iser_reg_resources.mr_valid.
+
+Fixes: b76a439982f8 ("IB/iser: Use IB_WR_REG_MR_INTEGRITY for PI handover")
+Link: https://lore.kernel.org/r/20231219072311.40989-1-sergeygo@nvidia.com
+Acked-by: Max Gurtovoy <mgurtovoy@nvidia.com>
+Signed-off-by: Sergey Gorenko <sergeygo@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iscsi_iser.h     | 2 --
+ drivers/infiniband/ulp/iser/iser_initiator.c | 5 ++++-
+ drivers/infiniband/ulp/iser/iser_memory.c    | 8 ++++----
+ drivers/infiniband/ulp/iser/iser_verbs.c     | 1 -
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index dee8c97ff056..d967d5532459 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -317,12 +317,10 @@ struct iser_device {
+  *
+  * @mr:         memory region
+  * @sig_mr:     signature memory region
+- * @mr_valid:   is mr valid indicator
+  */
+ struct iser_reg_resources {
+ 	struct ib_mr                     *mr;
+ 	struct ib_mr                     *sig_mr;
+-	u8				  mr_valid:1;
+ };
+ 
+ /**
+diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
+index 39ea73f69016..f5f090dc4f1e 100644
+--- a/drivers/infiniband/ulp/iser/iser_initiator.c
++++ b/drivers/infiniband/ulp/iser/iser_initiator.c
+@@ -581,7 +581,10 @@ static inline int iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
+ 		return -EINVAL;
+ 	}
+ 
+-	desc->rsc.mr_valid = 0;
++	if (desc->sig_protected)
++		desc->rsc.sig_mr->need_inval = false;
++	else
++		desc->rsc.mr->need_inval = false;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
+index 29ae2c6a250a..6efcb79c8efe 100644
+--- a/drivers/infiniband/ulp/iser/iser_memory.c
++++ b/drivers/infiniband/ulp/iser/iser_memory.c
+@@ -264,7 +264,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task,
+ 
+ 	iser_set_prot_checks(iser_task->sc, &sig_attrs->check_mask);
+ 
+-	if (rsc->mr_valid)
++	if (rsc->sig_mr->need_inval)
+ 		iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr);
+ 
+ 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+@@ -288,7 +288,7 @@ static int iser_reg_sig_mr(struct iscsi_iser_task *iser_task,
+ 	wr->access = IB_ACCESS_LOCAL_WRITE |
+ 		     IB_ACCESS_REMOTE_READ |
+ 		     IB_ACCESS_REMOTE_WRITE;
+-	rsc->mr_valid = 1;
++	rsc->sig_mr->need_inval = true;
+ 
+ 	sig_reg->sge.lkey = mr->lkey;
+ 	sig_reg->rkey = mr->rkey;
+@@ -313,7 +313,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+ 	struct ib_reg_wr *wr = &tx_desc->reg_wr;
+ 	int n;
+ 
+-	if (rsc->mr_valid)
++	if (rsc->mr->need_inval)
+ 		iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr);
+ 
+ 	ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+@@ -336,7 +336,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+ 		     IB_ACCESS_REMOTE_WRITE |
+ 		     IB_ACCESS_REMOTE_READ;
+ 
+-	rsc->mr_valid = 1;
++	rsc->mr->need_inval = true;
+ 
+ 	reg->sge.lkey = mr->lkey;
+ 	reg->rkey = mr->rkey;
+diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
+index 95b8eebf7e04..6801b70dc9e0 100644
+--- a/drivers/infiniband/ulp/iser/iser_verbs.c
++++ b/drivers/infiniband/ulp/iser/iser_verbs.c
+@@ -129,7 +129,6 @@ iser_create_fastreg_desc(struct iser_device *device,
+ 			goto err_alloc_mr_integrity;
+ 		}
+ 	}
+-	desc->rsc.mr_valid = 0;
+ 
+ 	return desc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/ice-fix-some-null-pointer-dereference-issues-in-ice_.patch b/queue-6.7/ice-fix-some-null-pointer-dereference-issues-in-ice_.patch
new file mode 100644
index 00000000000..4f815c03848
--- /dev/null
+++ b/queue-6.7/ice-fix-some-null-pointer-dereference-issues-in-ice_.patch
@@ -0,0 +1,50 @@
+From 23acbce06c73d37dd6e32302e555a995beeeeaf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 10:40:15 +0800
+Subject: ice: Fix some null pointer dereference issues in ice_ptp.c
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit 3027e7b15b02d2d37e3f82d6b8404f6d37e3b8cf ]
+
+devm_kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+
+Fixes: d938a8cca88a ("ice: Auxbus devices & driver for E822 TS")
+Cc: Kunwu Chan <kunwu.chan@hotmail.com>
+Suggested-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_ptp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
+index 71f405f8a6fe..e6b1ce76ca8a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
++++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
+@@ -2692,6 +2692,8 @@ static int ice_ptp_register_auxbus_driver(struct ice_pf *pf)
+ 	name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
+ 			      pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
+ 			      ice_get_ptp_src_clock_index(&pf->hw));
++	if (!name)
++		return -ENOMEM;
+ 
+ 	aux_driver->name = name;
+ 	aux_driver->shutdown = ice_ptp_auxbus_shutdown;
+@@ -2938,6 +2940,8 @@ static int ice_ptp_create_auxbus_device(struct ice_pf *pf)
+ 	name = devm_kasprintf(dev, GFP_KERNEL, "ptp_aux_dev_%u_%u_clk%u",
+ 			      pf->pdev->bus->number, PCI_SLOT(pf->pdev->devfn),
+ 			      ice_get_ptp_src_clock_index(&pf->hw));
++	if (!name)
++		return -ENOMEM;
+ 
+ 	aux_dev->name = name;
+ 	aux_dev->id = id;
+-- 
+2.43.0
+
diff --git a/queue-6.7/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch b/queue-6.7/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
new file mode 100644
index 00000000000..46c19169367
--- /dev/null
+++ b/queue-6.7/ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
@@ -0,0 +1,173 @@
+From e9841100f2cb229fa4c8ef853ad97e97e706d1bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 17:03:13 +0000
+Subject: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in
+ ip6_tnl_parse_tlv_enc_lim()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit d375b98e0248980681e5e56b712026174d617198 ]
+
+syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.
+
+Reading frag_off can only be done if we pulled enough bytes
+to skb->head. Currently we might access garbage.
+
+[1]
+BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0
+ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0
+ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]
+ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432
+__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
+netdev_start_xmit include/linux/netdevice.h:4954 [inline]
+xmit_one net/core/dev.c:3548 [inline]
+dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564
+__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349
+dev_queue_xmit include/linux/netdevice.h:3134 [inline]
+neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592
+neigh_output include/net/neighbour.h:542 [inline]
+ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137
+ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222
+NF_HOOK_COND include/linux/netfilter.h:303 [inline]
+ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243
+dst_output include/net/dst.h:451 [inline]
+ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155
+ip6_send_skb net/ipv6/ip6_output.c:1952 [inline]
+ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972
+rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582
+rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920
+inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847
+sock_sendmsg_nosec net/socket.c:730 [inline]
+__sock_sendmsg net/socket.c:745 [inline]
+____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
+___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
+__sys_sendmsg net/socket.c:2667 [inline]
+__do_sys_sendmsg net/socket.c:2676 [inline]
+__se_sys_sendmsg net/socket.c:2674 [inline]
+__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
+do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
+entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+Uninit was created at:
+slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
+slab_alloc_node mm/slub.c:3478 [inline]
+__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517
+__do_kmalloc_node mm/slab_common.c:1006 [inline]
+__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027
+kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582
+pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098
+__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655
+pskb_may_pull_reason include/linux/skbuff.h:2673 [inline]
+pskb_may_pull include/linux/skbuff.h:2681 [inline]
+ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408
+ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]
+ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432
+__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
+netdev_start_xmit include/linux/netdevice.h:4954 [inline]
+xmit_one net/core/dev.c:3548 [inline]
+dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564
+__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349
+dev_queue_xmit include/linux/netdevice.h:3134 [inline]
+neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592
+neigh_output include/net/neighbour.h:542 [inline]
+ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137
+ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222
+NF_HOOK_COND include/linux/netfilter.h:303 [inline]
+ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243
+dst_output include/net/dst.h:451 [inline]
+ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155
+ip6_send_skb net/ipv6/ip6_output.c:1952 [inline]
+ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972
+rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582
+rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920
+inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847
+sock_sendmsg_nosec net/socket.c:730 [inline]
+__sock_sendmsg net/socket.c:745 [inline]
+____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
+___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
+__sys_sendmsg net/socket.c:2667 [inline]
+__do_sys_sendmsg net/socket.c:2676 [inline]
+__se_sys_sendmsg net/socket.c:2674 [inline]
+__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
+do_syscall_x64 arch/x86/entry/common.c:52 [inline]
+do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
+entry_SYSCALL_64_after_hwframe+0x63/0x6b
+
+CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
+
+Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_tunnel.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 5e80e517f071..46c19bd48990 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -399,7 +399,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ 	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
+ 	unsigned int nhoff = raw - skb->data;
+ 	unsigned int off = nhoff + sizeof(*ipv6h);
+-	u8 next, nexthdr = ipv6h->nexthdr;
++	u8 nexthdr = ipv6h->nexthdr;
+ 
+ 	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
+ 		struct ipv6_opt_hdr *hdr;
+@@ -410,25 +410,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ 
+ 		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
+ 		if (nexthdr == NEXTHDR_FRAGMENT) {
+-			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
+-			if (frag_hdr->frag_off)
+-				break;
+ 			optlen = 8;
+ 		} else if (nexthdr == NEXTHDR_AUTH) {
+ 			optlen = ipv6_authlen(hdr);
+ 		} else {
+ 			optlen = ipv6_optlen(hdr);
+ 		}
+-		/* cache hdr->nexthdr, since pskb_may_pull() might
+-		 * invalidate hdr
+-		 */
+-		next = hdr->nexthdr;
+-		if (nexthdr == NEXTHDR_DEST) {
+-			u16 i = 2;
+ 
+-			/* Remember : hdr is no longer valid at this point. */
+-			if (!pskb_may_pull(skb, off + optlen))
++		if (!pskb_may_pull(skb, off + optlen))
++			break;
++
++		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
++		if (nexthdr == NEXTHDR_FRAGMENT) {
++			struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;
++
++			if (frag_hdr->frag_off)
+ 				break;
++		}
++		if (nexthdr == NEXTHDR_DEST) {
++			u16 i = 2;
+ 
+ 			while (1) {
+ 				struct ipv6_tlv_tnl_enc_lim *tel;
+@@ -449,7 +449,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+ 					i++;
+ 			}
+ 		}
+-		nexthdr = next;
++		nexthdr = hdr->nexthdr;
+ 		off += optlen;
+ 	}
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch b/queue-6.7/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
new file mode 100644
index 00000000000..5082edc66d8
--- /dev/null
+++ b/queue-6.7/ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
@@ -0,0 +1,72 @@
+From 32a9c2edf5b034d100112e98fa7ab244e40a1e86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 17:19:35 +0100
+Subject: ipmr: support IP_PKTINFO on cache report IGMP msg
+
+From: Leone Fernando <leone4fernando@gmail.com>
+
+[ Upstream commit bb7403655b3c3eb245d0ee330047cd3e20b3c4af ]
+
+In order to support IP_PKTINFO on those packets, we need to call
+ipv4_pktinfo_prepare.
+
+When sending mrouted/pimd daemons a cache report IGMP msg, it is
+unnecessary to set dst on the newly created skb.
+It used to be necessary on older versions until
+commit d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference") which
+changed the way IP_PKTINFO struct is been retrieved.
+
+Changes from v1:
+1. Undo changes in ipv4_pktinfo_prepare function. use it directly
+   and copy the control block.
+
+Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference")
+Signed-off-by: Leone Fernando <leone4fernando@gmail.com>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ipmr.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 9e222a57bc2b..0063a237253b 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1025,6 +1025,10 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+ 	struct sk_buff *skb;
+ 	int ret;
+ 
++	mroute_sk = rcu_dereference(mrt->mroute_sk);
++	if (!mroute_sk)
++		return -EINVAL;
++
+ 	if (assert == IGMPMSG_WHOLEPKT || assert == IGMPMSG_WRVIFWHOLE)
+ 		skb = skb_realloc_headroom(pkt, sizeof(struct iphdr));
+ 	else
+@@ -1069,7 +1073,8 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+ 		msg = (struct igmpmsg *)skb_network_header(skb);
+ 		msg->im_vif = vifi;
+ 		msg->im_vif_hi = vifi >> 8;
+-		skb_dst_set(skb, dst_clone(skb_dst(pkt)));
++		ipv4_pktinfo_prepare(mroute_sk, pkt);
++		memcpy(skb->cb, pkt->cb, sizeof(skb->cb));
+ 		/* Add our header */
+ 		igmp = skb_put(skb, sizeof(struct igmphdr));
+ 		igmp->type = assert;
+@@ -1079,12 +1084,6 @@ static int ipmr_cache_report(const struct mr_table *mrt,
+ 		skb->transport_header = skb->network_header;
+ 	}
+ 
+-	mroute_sk = rcu_dereference(mrt->mroute_sk);
+-	if (!mroute_sk) {
+-		kfree_skb(skb);
+-		return -EINVAL;
+-	}
+-
+ 	igmpmsg_netlink_event(mrt, skb);
+ 
+ 	/* Deliver to mrouted */
+-- 
+2.43.0
+
diff --git a/queue-6.7/keys-dns-fix-size-check-of-v1-server-list-header.patch b/queue-6.7/keys-dns-fix-size-check-of-v1-server-list-header.patch
new file mode 100644
index 00000000000..ed7b1c191e1
--- /dev/null
+++ b/queue-6.7/keys-dns-fix-size-check-of-v1-server-list-header.patch
@@ -0,0 +1,45 @@
+From 8e7f0000c31db9e8ea09c1e0ed1b1239765205b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 10 Jan 2024 21:11:40 +0000
+Subject: keys, dns: Fix size check of V1 server-list header
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit acc657692aed438e9931438f8c923b2b107aebf9 ]
+
+Fix the size check added to dns_resolver_preparse() for the V1 server-list
+header so that it doesn't give EINVAL if the size supplied is the same as
+the size of the header struct (which should be valid).
+
+This can be tested with:
+
+        echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p
+
+which will give "add_key: Invalid argument" without this fix.
+
+Fixes: 1997b3cb4217 ("keys, dns: Fix missing size check of V1 server-list header")
+Reported-by: Pengfei Xu <pengfei.xu@intel.com>
+Link: https://lore.kernel.org/r/ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com/
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/dns_resolver/dns_key.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
+index f18ca02aa95a..c42ddd85ff1f 100644
+--- a/net/dns_resolver/dns_key.c
++++ b/net/dns_resolver/dns_key.c
+@@ -104,7 +104,7 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
+ 		const struct dns_server_list_v1_header *v1;
+ 
+ 		/* It may be a server list. */
+-		if (datalen <= sizeof(*v1))
++		if (datalen < sizeof(*v1))
+ 			return -EINVAL;
+ 
+ 		v1 = (const struct dns_server_list_v1_header *)data;
+-- 
+2.43.0
+
diff --git a/queue-6.7/keys-encrypted-add-check-for-strsep.patch b/queue-6.7/keys-encrypted-add-check-for-strsep.patch
new file mode 100644
index 00000000000..bd146421e59
--- /dev/null
+++ b/queue-6.7/keys-encrypted-add-check-for-strsep.patch
@@ -0,0 +1,37 @@
+From 2f847e1f37f817057e8f333ebf66f37c6e682902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 07:36:27 +0000
+Subject: KEYS: encrypted: Add check for strsep
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit b4af096b5df5dd131ab796c79cedc7069d8f4882 ]
+
+Add check for strsep() in order to transfer the error.
+
+Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided decrypted data")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/encrypted-keys/encrypted.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 8af2136069d2..76f55dd13cb8 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -237,6 +237,10 @@ static int datablob_parse(char *datablob, const char **format,
+ 			break;
+ 		}
+ 		*decrypted_data = strsep(&datablob, " \t");
++		if (!*decrypted_data) {
++			pr_info("encrypted_key: decrypted_data is missing\n");
++			break;
++		}
+ 		ret = 0;
+ 		break;
+ 	case Opt_load:
+-- 
+2.43.0
+
diff --git a/queue-6.7/kselftest-alsa-conf-stringify-the-printed-errno-in-s.patch b/queue-6.7/kselftest-alsa-conf-stringify-the-printed-errno-in-s.patch
new file mode 100644
index 00000000000..55a37974cb6
--- /dev/null
+++ b/queue-6.7/kselftest-alsa-conf-stringify-the-printed-errno-in-s.patch
@@ -0,0 +1,59 @@
+From da955920302afca887ecdddf28de82d80315f2ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 18:37:08 +0100
+Subject: kselftest/alsa - conf: Stringify the printed errno in sysfs_get()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+
+[ Upstream commit fd38dd6abda589a8771e7872e4dea28c99c6a6ef ]
+
+GCC 13.2.0 reported the warning of the print format specifier:
+
+conf.c: In function ‘sysfs_get’:
+conf.c:181:72: warning: format ‘%s’ expects argument of type ‘char *’, \
+			but argument 3 has type ‘int’ [-Wformat=]
+  181 |                 ksft_exit_fail_msg("sysfs: unable to read value '%s': %s\n",
+      |                                                                       ~^
+      |                                                                        |
+      |                                                                        char *
+      |                                                                       %d
+
+The fix passes strerror(errno) as it was intended, like in the sibling error
+exit message.
+
+Fixes: aba51cd0949ae ("selftests: alsa - add PCM test")
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: linux-sound@vger.kernel.org
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240107173704.937824-5-mirsad.todorovac@alu.unizg.hr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/alsa/conf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/alsa/conf.c b/tools/testing/selftests/alsa/conf.c
+index 00925eb8d9f4..89e3656a042d 100644
+--- a/tools/testing/selftests/alsa/conf.c
++++ b/tools/testing/selftests/alsa/conf.c
+@@ -179,7 +179,7 @@ static char *sysfs_get(const char *sysfs_root, const char *id)
+ 	close(fd);
+ 	if (len < 0)
+ 		ksft_exit_fail_msg("sysfs: unable to read value '%s': %s\n",
+-				   path, errno);
++				   path, strerror(errno));
+ 	while (len > 0 && path[len-1] == '\n')
+ 		len--;
+ 	path[len] = '\0';
+-- 
+2.43.0
+
diff --git a/queue-6.7/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch b/queue-6.7/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
new file mode 100644
index 00000000000..1e5aff3c82b
--- /dev/null
+++ b/queue-6.7/kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
@@ -0,0 +1,58 @@
+From 522aeca7d6b86fb0b2cb81678da4f1a7bee4666d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 18:37:02 +0100
+Subject: kselftest/alsa - mixer-test: fix the number of parameters to
+ ksft_exit_fail_msg()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+
+[ Upstream commit 8c51c13dc63d46e754c44215eabc0890a8bd9bfb ]
+
+Minor fix in the number of arguments to error reporting function in the
+test program as reported by GCC 13.2.0 warning.
+
+mixer-test.c: In function ‘find_controls’:
+mixer-test.c:169:44: warning: too many arguments for format [-Wformat-extra-args]
+  169 |                         ksft_exit_fail_msg("snd_ctl_poll_descriptors() failed for %d\n",
+      |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The number of arguments in call to ksft_exit_fail_msg() doesn't correspond
+to the format specifiers, so this is adjusted resembling the sibling calls
+to the error function.
+
+Fixes: b1446bda56456 ("kselftest: alsa: Check for event generation when we write to controls")
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: linux-sound@vger.kernel.org
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240107173704.937824-2-mirsad.todorovac@alu.unizg.hr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/alsa/mixer-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c
+index 23df154fcdd7..208c2170c074 100644
+--- a/tools/testing/selftests/alsa/mixer-test.c
++++ b/tools/testing/selftests/alsa/mixer-test.c
+@@ -166,7 +166,7 @@ static void find_controls(void)
+ 		err = snd_ctl_poll_descriptors(card_data->handle,
+ 					       &card_data->pollfd, 1);
+ 		if (err != 1) {
+-			ksft_exit_fail_msg("snd_ctl_poll_descriptors() failed for %d\n",
++			ksft_exit_fail_msg("snd_ctl_poll_descriptors() failed for card %d: %d\n",
+ 				       card, err);
+ 		}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch b/queue-6.7/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
new file mode 100644
index 00000000000..96a14541f33
--- /dev/null
+++ b/queue-6.7/kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
@@ -0,0 +1,64 @@
+From f8c856e85ce2513968020a6b8b0dd170fff0f517 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jan 2024 18:37:04 +0100
+Subject: kselftest/alsa - mixer-test: Fix the print format specifier warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+
+[ Upstream commit 3f47c1ebe5ca9c5883e596c7888dec4bec0176d8 ]
+
+The GCC 13.2.0 compiler issued the following warning:
+
+mixer-test.c: In function ‘ctl_value_index_valid’:
+mixer-test.c:322:79: warning: format ‘%lld’ expects argument of type ‘long long int’, \
+			      but argument 5 has type ‘long int’ [-Wformat=]
+  322 |                         ksft_print_msg("%s.%d value %lld more than maximum %lld\n",
+      |                                                                            ~~~^
+      |                                                                               |
+      |                                                                               long long int
+      |                                                                            %ld
+  323 |                                        ctl->name, index, int64_val,
+  324 |                                        snd_ctl_elem_info_get_max(ctl->info));
+      |                                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+      |                                        |
+      |                                        long int
+
+Fixing the format specifier as advised by the compiler suggestion removes the
+warning.
+
+Fixes: 3f48b137d88e7 ("kselftest: alsa: Factor out check that values meet constraints")
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: linux-sound@vger.kernel.org
+Cc: linux-kselftest@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Mirsad Todorovac <mirsad.todorovac@alu.unizg.hr>
+Acked-by: Mark Brown <broonie@kernel.org>
+Link: https://lore.kernel.org/r/20240107173704.937824-3-mirsad.todorovac@alu.unizg.hr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/alsa/mixer-test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/alsa/mixer-test.c b/tools/testing/selftests/alsa/mixer-test.c
+index 208c2170c074..df942149c6f6 100644
+--- a/tools/testing/selftests/alsa/mixer-test.c
++++ b/tools/testing/selftests/alsa/mixer-test.c
+@@ -319,7 +319,7 @@ static bool ctl_value_index_valid(struct ctl_data *ctl,
+ 		}
+ 
+ 		if (int64_val > snd_ctl_elem_info_get_max64(ctl->info)) {
+-			ksft_print_msg("%s.%d value %lld more than maximum %lld\n",
++			ksft_print_msg("%s.%d value %lld more than maximum %ld\n",
+ 				       ctl->name, index, int64_val,
+ 				       snd_ctl_elem_info_get_max(ctl->info));
+ 			return false;
+-- 
+2.43.0
+
diff --git a/queue-6.7/ksmbd-validate-the-zero-field-of-packet-header.patch b/queue-6.7/ksmbd-validate-the-zero-field-of-packet-header.patch
new file mode 100644
index 00000000000..26c50f686f0
--- /dev/null
+++ b/queue-6.7/ksmbd-validate-the-zero-field-of-packet-header.patch
@@ -0,0 +1,48 @@
+From fec258a3fb75ba808c7ddb3889556e171f0c1a72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 14:56:47 +0800
+Subject: ksmbd: validate the zero field of packet header
+
+From: Li Nan <linan122@huawei.com>
+
+[ Upstream commit 516b3eb8c8065f7465f87608d37a7ed08298c7a5 ]
+
+The SMB2 Protocol requires that "The first byte of the Direct TCP
+transport packet header MUST be zero (0x00)"[1]. Commit 1c1bcf2d3ea0
+("ksmbd: validate smb request protocol id") removed the validation of
+this 1-byte zero. Add the validation back now.
+
+[1]: [MS-SMB2] - v20230227, page 30.
+https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SMB2/%5bMS-SMB2%5d-230227.pdf
+
+Fixes: 1c1bcf2d3ea0 ("ksmbd: validate smb request protocol id")
+Signed-off-by: Li Nan <linan122@huawei.com>
+Acked-by: Tom Talpey <tom@talpey.com>
+Acked-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/smb_common.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/smb/server/smb_common.c b/fs/smb/server/smb_common.c
+index 6691ae68af0c..7c98bf699772 100644
+--- a/fs/smb/server/smb_common.c
++++ b/fs/smb/server/smb_common.c
+@@ -158,8 +158,12 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work)
+  */
+ bool ksmbd_smb_request(struct ksmbd_conn *conn)
+ {
+-	__le32 *proto = (__le32 *)smb2_get_msg(conn->request_buf);
++	__le32 *proto;
+ 
++	if (conn->request_buf[0] != 0)
++		return false;
++
++	proto = (__le32 *)smb2_get_msg(conn->request_buf);
+ 	if (*proto == SMB2_COMPRESSION_TRANSFORM_ID) {
+ 		pr_err_ratelimited("smb2 compression not support yet");
+ 		return false;
+-- 
+2.43.0
+
diff --git a/queue-6.7/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch b/queue-6.7/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
new file mode 100644
index 00000000000..7fcdbc2493f
--- /dev/null
+++ b/queue-6.7/kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
@@ -0,0 +1,50 @@
+From 950cf510ea43ae158e8c127e5b202616244eddb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 10:47:58 +0000
+Subject: kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ]
+
+Move the call to kunit_suite_has_succeeded() after the check that
+the kunit_suite pointer is valid.
+
+This was found by smatch:
+
+ lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable
+ dereferenced before check 'suite' (see line 63)
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Fixes: 38289a26e1b8 ("kunit: fix debugfs code to use enum kunit_status, not bool")
+Reviewed-by: Rae Moar <rmoar@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/debugfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c
+index 270d185737e6..5bfc18ad5fff 100644
+--- a/lib/kunit/debugfs.c
++++ b/lib/kunit/debugfs.c
+@@ -60,12 +60,14 @@ static void debugfs_print_result(struct seq_file *seq, struct string_stream *log
+ static int debugfs_print_results(struct seq_file *seq, void *v)
+ {
+ 	struct kunit_suite *suite = (struct kunit_suite *)seq->private;
+-	enum kunit_status success = kunit_suite_has_succeeded(suite);
++	enum kunit_status success;
+ 	struct kunit_case *test_case;
+ 
+ 	if (!suite)
+ 		return 0;
+ 
++	success = kunit_suite_has_succeeded(suite);
++
+ 	/* Print KTAP header so the debugfs log can be parsed as valid KTAP. */
+ 	seq_puts(seq, "KTAP version 1\n");
+ 	seq_puts(seq, "1..1\n");
+-- 
+2.43.0
+
diff --git a/queue-6.7/kunit-debugfs-handle-errors-from-alloc_string_stream.patch b/queue-6.7/kunit-debugfs-handle-errors-from-alloc_string_stream.patch
new file mode 100644
index 00000000000..8e6482264c2
--- /dev/null
+++ b/queue-6.7/kunit-debugfs-handle-errors-from-alloc_string_stream.patch
@@ -0,0 +1,86 @@
+From f0d35796996a5be90f3b6dae9f43ed89d1ecc617 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 10:47:32 +0000
+Subject: kunit: debugfs: Handle errors from alloc_string_stream()
+
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+
+[ Upstream commit 1557e89d3af51a4f1bd6870b3117bed651de5dbf ]
+
+In kunit_debugfs_create_suite() give up and skip creating the debugfs
+file if any of the alloc_string_stream() calls return an error or NULL.
+Only put a value in the log pointer of kunit_suite and kunit_test if it
+is a valid pointer to a log.
+
+This prevents the potential invalid dereference reported by smatch:
+
+ lib/kunit/debugfs.c:115 kunit_debugfs_create_suite() error: 'suite->log'
+	dereferencing possible ERR_PTR()
+ lib/kunit/debugfs.c:119 kunit_debugfs_create_suite() error: 'test_case->log'
+	dereferencing possible ERR_PTR()
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Fixes: 05e2006ce493 ("kunit: Use string_stream for test log")
+Reviewed-by: Rae Moar <rmoar@google.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kunit/debugfs.c | 30 +++++++++++++++++++++++++-----
+ 1 file changed, 25 insertions(+), 5 deletions(-)
+
+diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c
+index 5bfc18ad5fff..382706dfb47d 100644
+--- a/lib/kunit/debugfs.c
++++ b/lib/kunit/debugfs.c
+@@ -111,14 +111,28 @@ static const struct file_operations debugfs_results_fops = {
+ void kunit_debugfs_create_suite(struct kunit_suite *suite)
+ {
+ 	struct kunit_case *test_case;
++	struct string_stream *stream;
+ 
+-	/* Allocate logs before creating debugfs representation. */
+-	suite->log = alloc_string_stream(GFP_KERNEL);
+-	string_stream_set_append_newlines(suite->log, true);
++	/*
++	 * Allocate logs before creating debugfs representation.
++	 * The suite->log and test_case->log pointer are expected to be NULL
++	 * if there isn't a log, so only set it if the log stream was created
++	 * successfully.
++	 */
++	stream = alloc_string_stream(GFP_KERNEL);
++	if (IS_ERR_OR_NULL(stream))
++		return;
++
++	string_stream_set_append_newlines(stream, true);
++	suite->log = stream;
+ 
+ 	kunit_suite_for_each_test_case(suite, test_case) {
+-		test_case->log = alloc_string_stream(GFP_KERNEL);
+-		string_stream_set_append_newlines(test_case->log, true);
++		stream = alloc_string_stream(GFP_KERNEL);
++		if (IS_ERR_OR_NULL(stream))
++			goto err;
++
++		string_stream_set_append_newlines(stream, true);
++		test_case->log = stream;
+ 	}
+ 
+ 	suite->debugfs = debugfs_create_dir(suite->name, debugfs_rootdir);
+@@ -126,6 +140,12 @@ void kunit_debugfs_create_suite(struct kunit_suite *suite)
+ 	debugfs_create_file(KUNIT_DEBUGFS_RESULTS, S_IFREG | 0444,
+ 			    suite->debugfs,
+ 			    suite, &debugfs_results_fops);
++	return;
++
++err:
++	string_stream_destroy(suite->log);
++	kunit_suite_for_each_test_case(suite, test_case)
++		string_stream_destroy(test_case->log);
+ }
+ 
+ void kunit_debugfs_destroy_suite(struct kunit_suite *suite)
+-- 
+2.43.0
+
diff --git a/queue-6.7/kvm-ppc-book3s-hv-handle-pending-exceptions-on-guest.patch b/queue-6.7/kvm-ppc-book3s-hv-handle-pending-exceptions-on-guest.patch
new file mode 100644
index 00000000000..4b56853bf2f
--- /dev/null
+++ b/queue-6.7/kvm-ppc-book3s-hv-handle-pending-exceptions-on-guest.patch
@@ -0,0 +1,62 @@
+From 85acd8612e4ffb406153eaf2e5013025f29ed00f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 18:56:11 +0530
+Subject: KVM: PPC: Book3S HV: Handle pending exceptions on guest entry with
+ MSR_EE
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit ecd10702baae5c16a91d139bde7eff84ce55daee ]
+
+Commit 026728dc5d41 ("KVM: PPC: Book3S HV P9: Inject pending xive
+interrupts at guest entry") changed guest entry so that if external
+interrupts are enabled, BOOK3S_IRQPRIO_EXTERNAL is not tested for. Test
+for this regardless of MSR_EE.
+
+For an L1 host, do not inject an interrupt, but always
+use LPCR_MER. If the L0 desires it can inject an interrupt.
+
+Fixes: 026728dc5d41 ("KVM: PPC: Book3S HV P9: Inject pending xive interrupts at guest entry")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+[jpn: use kvmpcc_get_msr(), write commit message]
+Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231201132618.555031-7-vaibhav@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
+index 1ed6ec140701..002a7573a5d4 100644
+--- a/arch/powerpc/kvm/book3s_hv.c
++++ b/arch/powerpc/kvm/book3s_hv.c
+@@ -4736,13 +4736,19 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit,
+ 
+ 	if (!nested) {
+ 		kvmppc_core_prepare_to_enter(vcpu);
+-		if (__kvmppc_get_msr_hv(vcpu) & MSR_EE) {
+-			if (xive_interrupt_pending(vcpu))
++		if (test_bit(BOOK3S_IRQPRIO_EXTERNAL,
++			     &vcpu->arch.pending_exceptions) ||
++		    xive_interrupt_pending(vcpu)) {
++			/*
++			 * For nested HV, don't synthesize but always pass MER,
++			 * the L0 will be able to optimise that more
++			 * effectively than manipulating registers directly.
++			 */
++			if (!kvmhv_on_pseries() && (__kvmppc_get_msr_hv(vcpu) & MSR_EE))
+ 				kvmppc_inject_interrupt_hv(vcpu,
+-						BOOK3S_INTERRUPT_EXTERNAL, 0);
+-		} else if (test_bit(BOOK3S_IRQPRIO_EXTERNAL,
+-			     &vcpu->arch.pending_exceptions)) {
+-			lpcr |= LPCR_MER;
++							   BOOK3S_INTERRUPT_EXTERNAL, 0);
++			else
++				lpcr |= LPCR_MER;
+ 		}
+ 	} else if (vcpu->arch.pending_exceptions ||
+ 		   vcpu->arch.doorbell_request ||
+-- 
+2.43.0
+
diff --git a/queue-6.7/loongarch-signal.c-add-header-file-to-fix-build-erro.patch b/queue-6.7/loongarch-signal.c-add-header-file-to-fix-build-erro.patch
new file mode 100644
index 00000000000..580e87305af
--- /dev/null
+++ b/queue-6.7/loongarch-signal.c-add-header-file-to-fix-build-erro.patch
@@ -0,0 +1,44 @@
+From bfd5cedadc2427268ee7b39829c347c5e4418947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Dec 2023 20:58:25 -0800
+Subject: LoongArch: signal.c: add header file to fix build error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit c968b99f868dd82ebcafec9788ce18334da177b6 ]
+
+loongarch's signal.c uses rseq_signal_deliver() so it should
+pull in the appropriate header to prevent a build error:
+
+../arch/loongarch/kernel/signal.c: In function 'handle_signal':
+../arch/loongarch/kernel/signal.c:1034:9: error: implicit declaration of function 'rseq_signal_deliver' [-Werror=implicit-function-declaration]
+ 1034 |         rseq_signal_deliver(ksig, regs);
+      |         ^~~~~~~~~~~~~~~~~~~
+
+Fixes: b74baf4ad05b ("LoongArch: Add signal handling support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Huacai Chen <chenhuacai@kernel.org>
+Cc: WANG Xuerui <kernel@xen0n.name>
+Cc: loongarch@lists.linux.dev
+Cc: Kent Overstreet <kent.overstreet@linux.dev>
+Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/loongarch/kernel/signal.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/loongarch/kernel/signal.c b/arch/loongarch/kernel/signal.c
+index 4a3686d13349..7a555b600171 100644
+--- a/arch/loongarch/kernel/signal.c
++++ b/arch/loongarch/kernel/signal.c
+@@ -15,6 +15,7 @@
+ #include <linux/context_tracking.h>
+ #include <linux/entry-common.h>
+ #include <linux/irqflags.h>
++#include <linux/rseq.h>
+ #include <linux/sched.h>
+ #include <linux/mm.h>
+ #include <linux/personality.h>
+-- 
+2.43.0
+
diff --git a/queue-6.7/md-synchronize-flush-io-with-array-reconfiguration.patch b/queue-6.7/md-synchronize-flush-io-with-array-reconfiguration.patch
new file mode 100644
index 00000000000..67321ef775d
--- /dev/null
+++ b/queue-6.7/md-synchronize-flush-io-with-array-reconfiguration.patch
@@ -0,0 +1,96 @@
+From 0f5de9729b68cec902c03327399b83d9bf9ef33a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 10:02:34 +0800
+Subject: md: synchronize flush io with array reconfiguration
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit fa2bbff7b0b4e211fec5e5686ef96350690597b5 ]
+
+Currently rcu is used to protect iterating rdev from submit_flushes():
+
+submit_flushes			remove_and_add_spares
+				synchronize_rcu
+				pers->hot_remove_disk()
+ rcu_read_lock()
+ rdev_for_each_rcu
+  if (rdev->raid_disk >= 0)
+				rdev->radi_disk = -1;
+   atomic_inc(&rdev->nr_pending)
+   rcu_read_unlock()
+   bi = bio_alloc_bioset()
+   bi->bi_end_io = md_end_flush
+   bi->private = rdev
+   submit_bio
+   // issue io for removed rdev
+
+Fix this problem by grabbing 'acive_io' before iterating rdev, make sure
+that remove_and_add_spares() won't concurrent with submit_flushes().
+
+Fixes: a2826aa92e2e ("md: support barrier requests on all personalities.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20231129020234.1586910-1-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 9bdd57324c37..f246bb0932b0 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -543,6 +543,9 @@ static void md_end_flush(struct bio *bio)
+ 	rdev_dec_pending(rdev, mddev);
+ 
+ 	if (atomic_dec_and_test(&mddev->flush_pending)) {
++		/* The pair is percpu_ref_get() from md_flush_request() */
++		percpu_ref_put(&mddev->active_io);
++
+ 		/* The pre-request flush has finished */
+ 		queue_work(md_wq, &mddev->flush_work);
+ 	}
+@@ -562,12 +565,8 @@ static void submit_flushes(struct work_struct *ws)
+ 	rdev_for_each_rcu(rdev, mddev)
+ 		if (rdev->raid_disk >= 0 &&
+ 		    !test_bit(Faulty, &rdev->flags)) {
+-			/* Take two references, one is dropped
+-			 * when request finishes, one after
+-			 * we reclaim rcu_read_lock
+-			 */
+ 			struct bio *bi;
+-			atomic_inc(&rdev->nr_pending);
++
+ 			atomic_inc(&rdev->nr_pending);
+ 			rcu_read_unlock();
+ 			bi = bio_alloc_bioset(rdev->bdev, 0,
+@@ -578,7 +577,6 @@ static void submit_flushes(struct work_struct *ws)
+ 			atomic_inc(&mddev->flush_pending);
+ 			submit_bio(bi);
+ 			rcu_read_lock();
+-			rdev_dec_pending(rdev, mddev);
+ 		}
+ 	rcu_read_unlock();
+ 	if (atomic_dec_and_test(&mddev->flush_pending))
+@@ -631,6 +629,18 @@ bool md_flush_request(struct mddev *mddev, struct bio *bio)
+ 	/* new request after previous flush is completed */
+ 	if (ktime_after(req_start, mddev->prev_flush_start)) {
+ 		WARN_ON(mddev->flush_bio);
++		/*
++		 * Grab a reference to make sure mddev_suspend() will wait for
++		 * this flush to be done.
++		 *
++		 * md_flush_reqeust() is called under md_handle_request() and
++		 * 'active_io' is already grabbed, hence percpu_ref_is_zero()
++		 * won't pass, percpu_ref_tryget_live() can't be used because
++		 * percpu_ref_kill() can be called by mddev_suspend()
++		 * concurrently.
++		 */
++		WARN_ON(percpu_ref_is_zero(&mddev->active_io));
++		percpu_ref_get(&mddev->active_io);
+ 		mddev->flush_bio = bio;
+ 		bio = NULL;
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-amphion-fix-vpu-core-alias-name.patch b/queue-6.7/media-amphion-fix-vpu-core-alias-name.patch
new file mode 100644
index 00000000000..02ec93b0e6a
--- /dev/null
+++ b/queue-6.7/media-amphion-fix-vpu-core-alias-name.patch
@@ -0,0 +1,41 @@
+From 3a57f9210535d96031a3bcbdf76877724d98ee42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Nov 2023 08:15:21 +0100
+Subject: media: amphion: Fix VPU core alias name
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+[ Upstream commit f033c87fda47e272bb4f75dc7b03677261d91158 ]
+
+Starting with commit f6038de293f2 ("arm64: dts: imx8qm: Fix VPU core
+alias name") the alias for VPU cores uses dashes instead of underscores.
+Adjust the alias stem accordingly. Fixes the errors:
+amphion-vpu-core 2d040000.vpu-core: can't get vpu core id
+amphion-vpu-core 2d050000.vpu-core: can't get vpu core id
+
+Fixes: f6038de293f2 ("arm64: dts: imx8qm: Fix VPU core alias name")
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Reviewed-by: Ming Qian <ming.qian@nxp.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/amphion/vpu_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/amphion/vpu_core.c b/drivers/media/platform/amphion/vpu_core.c
+index 1af6fc9460d4..3a2030d02e45 100644
+--- a/drivers/media/platform/amphion/vpu_core.c
++++ b/drivers/media/platform/amphion/vpu_core.c
+@@ -642,7 +642,7 @@ static int vpu_core_probe(struct platform_device *pdev)
+ 		return -ENODEV;
+ 
+ 	core->type = core->res->type;
+-	core->id = of_alias_get_id(dev->of_node, "vpu_core");
++	core->id = of_alias_get_id(dev->of_node, "vpu-core");
+ 	if (core->id < 0) {
+ 		dev_err(dev, "can't get vpu core id\n");
+ 		return core->id;
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-bttv-add-back-vbi-hack.patch b/queue-6.7/media-bttv-add-back-vbi-hack.patch
new file mode 100644
index 00000000000..17c01abdbdb
--- /dev/null
+++ b/queue-6.7/media-bttv-add-back-vbi-hack.patch
@@ -0,0 +1,66 @@
+From 12d6082a04aa15657ca236e37b873fb17b7531b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 13:58:11 +0100
+Subject: media: bttv: add back vbi hack
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 3f1faa154a4316b1b585a25394697504b3c24e98 ]
+
+The old (now removed) videobuf framework had an optional vbi hack where
+the sequence number of the frame counter was copied in the last 4 bytes
+of the buffer. This hack was active only for the read() interface
+(so not for streaming I/O), and it was enabled by bttv. This allowed
+applications that used read() for the VBI data to match it with the
+corresponding video frame.
+
+When bttv was converted to vb2 this hack was forgotten, but some old
+applications rely on this.
+
+So add this back, but this time in the bttv driver rather than in the
+vb2 framework.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: b7ec3212a73a ("media: bttv: convert to vb2")
+Tested-by: Dr. David Alan Gilbert <dave@treblig.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/bt8xx/bttv-driver.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index 8e8c9dada67a..49a3dd70ec0f 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -2772,6 +2772,27 @@ bttv_irq_wakeup_vbi(struct bttv *btv, struct bttv_buffer *wakeup,
+ 		return;
+ 	wakeup->vbuf.vb2_buf.timestamp = ktime_get_ns();
+ 	wakeup->vbuf.sequence = btv->field_count >> 1;
++
++	/*
++	 * Ugly hack for backwards compatibility.
++	 * Some applications expect that the last 4 bytes of
++	 * the VBI data contains the sequence number.
++	 *
++	 * This makes it possible to associate the VBI data
++	 * with the video frame if you use read() to get the
++	 * VBI data.
++	 */
++	if (vb2_fileio_is_active(wakeup->vbuf.vb2_buf.vb2_queue)) {
++		u32 *vaddr = vb2_plane_vaddr(&wakeup->vbuf.vb2_buf, 0);
++		unsigned long size =
++			vb2_get_plane_payload(&wakeup->vbuf.vb2_buf, 0) / 4;
++
++		if (vaddr && size) {
++			vaddr += size - 1;
++			*vaddr = wakeup->vbuf.sequence;
++		}
++	}
++
+ 	vb2_buffer_done(&wakeup->vbuf.vb2_buf, state);
+ 	if (btv->field_count == 0)
+ 		btor(BT848_INT_VSYNC, BT848_INT_MASK);
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-bttv-start_streaming-should-return-a-proper-er.patch b/queue-6.7/media-bttv-start_streaming-should-return-a-proper-er.patch
new file mode 100644
index 00000000000..daa24369ad6
--- /dev/null
+++ b/queue-6.7/media-bttv-start_streaming-should-return-a-proper-er.patch
@@ -0,0 +1,88 @@
+From 43b3a9b7bcce236b56b6904b0b4456ded1dfce80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 13:58:10 +0100
+Subject: media: bttv: start_streaming should return a proper error code
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 0d75bb6ae127f5e3fd0e2239714908fd2038193d ]
+
+The start_streaming callback returned 0 or 1 instead of a
+proper error code. Fix that.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: b7ec3212a73a ("media: bttv: convert to vb2")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/bt8xx/bttv-driver.c | 6 ++----
+ drivers/media/pci/bt8xx/bttv-vbi.c    | 8 +++-----
+ 2 files changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
+index 09a193bb87df..8e8c9dada67a 100644
+--- a/drivers/media/pci/bt8xx/bttv-driver.c
++++ b/drivers/media/pci/bt8xx/bttv-driver.c
+@@ -1536,13 +1536,11 @@ static void buf_cleanup(struct vb2_buffer *vb)
+ 
+ static int start_streaming(struct vb2_queue *q, unsigned int count)
+ {
+-	int ret = 1;
+ 	int seqnr = 0;
+ 	struct bttv_buffer *buf;
+ 	struct bttv *btv = vb2_get_drv_priv(q);
+ 
+-	ret = check_alloc_btres_lock(btv, RESOURCE_VIDEO_STREAM);
+-	if (ret == 0) {
++	if (!check_alloc_btres_lock(btv, RESOURCE_VIDEO_STREAM)) {
+ 		if (btv->field_count)
+ 			seqnr++;
+ 		while (!list_empty(&btv->capture)) {
+@@ -1553,7 +1551,7 @@ static int start_streaming(struct vb2_queue *q, unsigned int count)
+ 			vb2_buffer_done(&buf->vbuf.vb2_buf,
+ 					VB2_BUF_STATE_QUEUED);
+ 		}
+-		return !ret;
++		return -EBUSY;
+ 	}
+ 	if (!vb2_is_streaming(&btv->vbiq)) {
+ 		init_irqreg(btv);
+diff --git a/drivers/media/pci/bt8xx/bttv-vbi.c b/drivers/media/pci/bt8xx/bttv-vbi.c
+index ab213e51ec95..e489a3acb4b9 100644
+--- a/drivers/media/pci/bt8xx/bttv-vbi.c
++++ b/drivers/media/pci/bt8xx/bttv-vbi.c
+@@ -123,14 +123,12 @@ static void buf_cleanup_vbi(struct vb2_buffer *vb)
+ 
+ static int start_streaming_vbi(struct vb2_queue *q, unsigned int count)
+ {
+-	int ret;
+ 	int seqnr = 0;
+ 	struct bttv_buffer *buf;
+ 	struct bttv *btv = vb2_get_drv_priv(q);
+ 
+ 	btv->framedrop = 0;
+-	ret = check_alloc_btres_lock(btv, RESOURCE_VBI);
+-	if (ret == 0) {
++	if (!check_alloc_btres_lock(btv, RESOURCE_VBI)) {
+ 		if (btv->field_count)
+ 			seqnr++;
+ 		while (!list_empty(&btv->vcapture)) {
+@@ -141,13 +139,13 @@ static int start_streaming_vbi(struct vb2_queue *q, unsigned int count)
+ 			vb2_buffer_done(&buf->vbuf.vb2_buf,
+ 					VB2_BUF_STATE_QUEUED);
+ 		}
+-		return !ret;
++		return -EBUSY;
+ 	}
+ 	if (!vb2_is_streaming(&btv->capq)) {
+ 		init_irqreg(btv);
+ 		btv->field_count = 0;
+ 	}
+-	return !ret;
++	return 0;
+ }
+ 
+ static void stop_streaming_vbi(struct vb2_queue *q)
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch b/queue-6.7/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
new file mode 100644
index 00000000000..ca6e4448aa3
--- /dev/null
+++ b/queue-6.7/media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
@@ -0,0 +1,51 @@
+From a1896234598fdcae9ad1279716b78b00a981f4b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 21:22:55 +0800
+Subject: media: cx231xx: fix a memleak in cx231xx_init_isoc
+
+From: Zhipeng Lu <alexious@zju.edu.cn>
+
+[ Upstream commit 5d3c8990e2bbf929cb211563dadd70708f42e4e6 ]
+
+The dma_q->p_left_data alloced by kzalloc should be freed in all the
+following error handling paths. However, it hasn't been freed in the
+allocation error paths of dev->video_mode.isoc_ctl.urb and
+dev->video_mode.isoc_ctl.transfer_buffer.
+
+On the other hand, the dma_q->p_left_data did be freed in the
+error-handling paths after that of dev->video_mode.isoc_ctl.urb and
+dev->video_mode.isoc_ctl.transfer_buffer, by calling
+cx231xx_uninit_isoc(dev). So the same free operation should be done in
+error-handling paths of those two allocation.
+
+Fixes: 64fbf4445526 ("[media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER")
+Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/cx231xx/cx231xx-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c
+index 7b7e2a26ef93..d8312201694f 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-core.c
++++ b/drivers/media/usb/cx231xx/cx231xx-core.c
+@@ -1023,6 +1023,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
+ 	if (!dev->video_mode.isoc_ctl.urb) {
+ 		dev_err(dev->dev,
+ 			"cannot alloc memory for usb buffers\n");
++		kfree(dma_q->p_left_data);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -1032,6 +1033,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
+ 		dev_err(dev->dev,
+ 			"cannot allocate memory for usbtransfer\n");
+ 		kfree(dev->video_mode.isoc_ctl.urb);
++		kfree(dma_q->p_left_data);
+ 		return -ENOMEM;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch b/queue-6.7/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
new file mode 100644
index 00000000000..7b7767409f3
--- /dev/null
+++ b/queue-6.7/media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
@@ -0,0 +1,54 @@
+From d72cc59c2930079aeec6c9f13df1a77a7068bbfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 17:44:07 +0100
+Subject: media: dt-bindings: media: rkisp1: Fix the port description for the
+ parallel interface
+
+From: Mehdi Djait <mehdi.djait@bootlin.com>
+
+[ Upstream commit 25bf28b25a2afa1864b7143259443160d9163ea0 ]
+
+The bus-type belongs to the endpoint's properties and should therefore
+be moved.
+
+Link: https://lore.kernel.org/r/20231115164407.99876-1-mehdi.djait@bootlin.com
+
+Fixes: 6a0eaa25bf36 ("media: dt-bindings: media: rkisp1: Add port for parallel interface")
+Signed-off-by: Mehdi Djait <mehdi.djait@bootlin.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/media/rockchip-isp1.yaml      | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml
+index e466dff8286d..afcaa427d48b 100644
+--- a/Documentation/devicetree/bindings/media/rockchip-isp1.yaml
++++ b/Documentation/devicetree/bindings/media/rockchip-isp1.yaml
+@@ -90,15 +90,16 @@ properties:
+         description: connection point for input on the parallel interface
+ 
+         properties:
+-          bus-type:
+-            enum: [5, 6]
+-
+           endpoint:
+             $ref: video-interfaces.yaml#
+             unevaluatedProperties: false
+ 
+-        required:
+-          - bus-type
++            properties:
++              bus-type:
++                enum: [5, 6]
++
++            required:
++              - bus-type
+ 
+     anyOf:
+       - required:
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch b/queue-6.7/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
new file mode 100644
index 00000000000..b796451a025
--- /dev/null
+++ b/queue-6.7/media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
@@ -0,0 +1,54 @@
+From 1feb5858625f23f55174b8b65c1074c2da34a222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 08:20:26 +0100
+Subject: media: dvb-frontends: m88ds3103: Fix a memory leak in an error
+ handling path of m88ds3103_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 5b2f885e2f6f482d05c23f04c8240f7b4fc5bdb5 ]
+
+If an error occurs after a successful i2c_mux_add_adapter(), then
+i2c_mux_del_adapters() should be called to free some resources, as
+already done in the remove function.
+
+Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-frontends/m88ds3103.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
+index 26c67ef05d13..e0272054fca5 100644
+--- a/drivers/media/dvb-frontends/m88ds3103.c
++++ b/drivers/media/dvb-frontends/m88ds3103.c
+@@ -1894,7 +1894,7 @@ static int m88ds3103_probe(struct i2c_client *client)
+ 		/* get frontend address */
+ 		ret = regmap_read(dev->regmap, 0x29, &utmp);
+ 		if (ret)
+-			goto err_kfree;
++			goto err_del_adapters;
+ 		dev->dt_addr = ((utmp & 0x80) == 0) ? 0x42 >> 1 : 0x40 >> 1;
+ 		dev_dbg(&client->dev, "dt addr is 0x%02x\n", dev->dt_addr);
+ 
+@@ -1902,11 +1902,14 @@ static int m88ds3103_probe(struct i2c_client *client)
+ 						      dev->dt_addr);
+ 		if (IS_ERR(dev->dt_client)) {
+ 			ret = PTR_ERR(dev->dt_client);
+-			goto err_kfree;
++			goto err_del_adapters;
+ 		}
+ 	}
+ 
+ 	return 0;
++
++err_del_adapters:
++	i2c_mux_del_adapters(dev->muxc);
+ err_kfree:
+ 	kfree(dev);
+ err:
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch b/queue-6.7/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
new file mode 100644
index 00000000000..e2c9e440335
--- /dev/null
+++ b/queue-6.7/media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
@@ -0,0 +1,35 @@
+From 2d4b3cc6819bb6982db1ebf9f4d6ff1d1205f9e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 12:53:33 +0300
+Subject: media: dvbdev: drop refcount on error path in dvb_device_open()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ]
+
+If call to file->f_op->open() fails, then call dvb_device_put(dvbdev).
+
+Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/dvb-core/dvbdev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
+index 305bb21d843c..49f0eb7d0b9d 100644
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -104,6 +104,8 @@ static int dvb_device_open(struct inode *inode, struct file *file)
+ 			err = file->f_op->open(inode, file);
+ 		up_read(&minor_rwsem);
+ 		mutex_unlock(&dvbdev_mutex);
++		if (err)
++			dvb_device_put(dvbdev);
+ 		return err;
+ 	}
+ fail:
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-i2c-mt9m114-use-fsleep-in-place-of-udelay.patch b/queue-6.7/media-i2c-mt9m114-use-fsleep-in-place-of-udelay.patch
new file mode 100644
index 00000000000..c37a2f3d379
--- /dev/null
+++ b/queue-6.7/media-i2c-mt9m114-use-fsleep-in-place-of-udelay.patch
@@ -0,0 +1,53 @@
+From bed804cafd03066cf36a4f7e7356bde73730e114 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 12:23:07 +0100
+Subject: media: i2c: mt9m114: use fsleep() in place of udelay()
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 02d4e62ae2452c83e4a3e279b8e4cb4dcbad4b31 ]
+
+With clang-16, building without COMMON_CLK triggers a range check on
+udelay() because of a constant division-by-zero calculation:
+
+ld.lld: error: undefined symbol: __bad_udelay
+>>> referenced by mt9m114.c
+>>>               drivers/media/i2c/mt9m114.o:(mt9m114_power_on) in archive vmlinux.a
+
+In this configuration, the driver already fails to probe, before
+this function gets called, so it's enough to suppress the assertion.
+
+Do this by using fsleep(), which turns long delays into sleep() calls
+in place of the link failure.
+
+This is probably a good idea regardless to avoid overly long dynamic
+udelay() calls on a slow clock.
+
+Cc: Sakari Ailus <sakari.ailus@linux.intel.com>
+Fixes: 24d756e914fc ("media: i2c: Add driver for onsemi MT9M114 camera sensor")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9m114.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/mt9m114.c b/drivers/media/i2c/mt9m114.c
+index ac19078ceda3..1a535c098ded 100644
+--- a/drivers/media/i2c/mt9m114.c
++++ b/drivers/media/i2c/mt9m114.c
+@@ -2112,7 +2112,7 @@ static int mt9m114_power_on(struct mt9m114 *sensor)
+ 		duration = DIV_ROUND_UP(2 * 50 * 1000000, freq);
+ 
+ 		gpiod_set_value(sensor->reset, 1);
+-		udelay(duration);
++		fsleep(duration);
+ 		gpiod_set_value(sensor->reset, 0);
+ 	} else {
+ 		/*
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-imx-mipi-csis-drop-extra-clock-enable-at-probe.patch b/queue-6.7/media-imx-mipi-csis-drop-extra-clock-enable-at-probe.patch
new file mode 100644
index 00000000000..ec381741ec3
--- /dev/null
+++ b/queue-6.7/media-imx-mipi-csis-drop-extra-clock-enable-at-probe.patch
@@ -0,0 +1,81 @@
+From e77005b6d934bf99b897518f8edd841184efa710 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 16:21:35 +0100
+Subject: media: imx-mipi-csis: Drop extra clock enable at probe()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit fb387fcb5cdd0384ba04a5d15a3605e2dccdab2a ]
+
+The driver always enables the clocks at probe() and disables them only
+at remove(). It is not clear why the driver does this, as it supports
+runtime PM, and enables and disables the clocks in the runtime resume
+and suspend callbacks. Also, in the case runtime PM is not available,
+the driver calls the resume and suspend callbacks manually from probe()
+and remove().
+
+Drop the unnecessary clock enable, thus enabling the clocks only when
+actually needed.
+
+Link: https://lore.kernel.org/r/20231122-imx-csis-v2-2-e44b8dc4cb66@ideasonboard.com
+
+Fixes: 7807063b862b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for i.MX7")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/nxp/imx-mipi-csis.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c
+index b39d7aeba750..b08f6d2e7516 100644
+--- a/drivers/media/platform/nxp/imx-mipi-csis.c
++++ b/drivers/media/platform/nxp/imx-mipi-csis.c
+@@ -1435,24 +1435,18 @@ static int mipi_csis_probe(struct platform_device *pdev)
+ 	/* Reset PHY and enable the clocks. */
+ 	mipi_csis_phy_reset(csis);
+ 
+-	ret = mipi_csis_clk_enable(csis);
+-	if (ret < 0) {
+-		dev_err(csis->dev, "failed to enable clocks: %d\n", ret);
+-		return ret;
+-	}
+-
+ 	/* Now that the hardware is initialized, request the interrupt. */
+ 	ret = devm_request_irq(dev, irq, mipi_csis_irq_handler, 0,
+ 			       dev_name(dev), csis);
+ 	if (ret) {
+ 		dev_err(dev, "Interrupt request failed\n");
+-		goto err_disable_clock;
++		return ret;
+ 	}
+ 
+ 	/* Initialize and register the subdev. */
+ 	ret = mipi_csis_subdev_init(csis);
+ 	if (ret < 0)
+-		goto err_disable_clock;
++		return ret;
+ 
+ 	platform_set_drvdata(pdev, &csis->sd);
+ 
+@@ -1486,8 +1480,6 @@ static int mipi_csis_probe(struct platform_device *pdev)
+ 	v4l2_async_nf_unregister(&csis->notifier);
+ 	v4l2_async_nf_cleanup(&csis->notifier);
+ 	v4l2_async_unregister_subdev(&csis->sd);
+-err_disable_clock:
+-	mipi_csis_clk_disable(csis);
+ 
+ 	return ret;
+ }
+@@ -1506,7 +1498,6 @@ static void mipi_csis_remove(struct platform_device *pdev)
+ 		mipi_csis_runtime_suspend(&pdev->dev);
+ 
+ 	pm_runtime_disable(&pdev->dev);
+-	mipi_csis_clk_disable(csis);
+ 	v4l2_subdev_cleanup(&csis->sd);
+ 	media_entity_cleanup(&csis->sd.entity);
+ 	pm_runtime_set_suspended(&pdev->dev);
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-imx-mipi-csis-fix-clock-handling-in-remove.patch b/queue-6.7/media-imx-mipi-csis-fix-clock-handling-in-remove.patch
new file mode 100644
index 00000000000..64ca17a9468
--- /dev/null
+++ b/queue-6.7/media-imx-mipi-csis-fix-clock-handling-in-remove.patch
@@ -0,0 +1,46 @@
+From b5a04e5f15cee29a807cb35dfc8228e1a2539bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 16:21:34 +0100
+Subject: media: imx-mipi-csis: Fix clock handling in remove()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 5705b0e0eb550ff834125a46a4ef99b62093d83d ]
+
+The driver always calls mipi_csis_runtime_suspend() and
+mipi_csis_clk_disable() in remove(). This causes multiple WARNs from the
+kernel, as the clocks get disabled too many times.
+
+Fix the remove() to call mipi_csis_runtime_suspend() and
+mipi_csis_clk_disable() in a way that reverses what is done in probe().
+
+Link: https://lore.kernel.org/r/20231122-imx-csis-v2-1-e44b8dc4cb66@ideasonboard.com
+
+Fixes: 7807063b862b ("media: staging/imx7: add MIPI CSI-2 receiver subdev for i.MX7")
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/nxp/imx-mipi-csis.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/nxp/imx-mipi-csis.c b/drivers/media/platform/nxp/imx-mipi-csis.c
+index 6cb20b45e0a1..b39d7aeba750 100644
+--- a/drivers/media/platform/nxp/imx-mipi-csis.c
++++ b/drivers/media/platform/nxp/imx-mipi-csis.c
+@@ -1502,8 +1502,10 @@ static void mipi_csis_remove(struct platform_device *pdev)
+ 	v4l2_async_nf_cleanup(&csis->notifier);
+ 	v4l2_async_unregister_subdev(&csis->sd);
+ 
++	if (!pm_runtime_enabled(&pdev->dev))
++		mipi_csis_runtime_suspend(&pdev->dev);
++
+ 	pm_runtime_disable(&pdev->dev);
+-	mipi_csis_runtime_suspend(&pdev->dev);
+ 	mipi_csis_clk_disable(csis);
+ 	v4l2_subdev_cleanup(&csis->sd);
+ 	media_entity_cleanup(&csis->sd.entity);
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch b/queue-6.7/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
new file mode 100644
index 00000000000..7ec81a97dc1
--- /dev/null
+++ b/queue-6.7/media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
@@ -0,0 +1,43 @@
+From 5b9aea42a146a984a38a8322148a5980d1daa2f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 15:48:09 +0100
+Subject: media: mtk-jpeg: Remove cancel worker in mtk_jpeg_remove to avoid the
+ crash of multi-core JPEG devices
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit d8212c5c87c143ca01b78f6bf61244af07e0058e ]
+
+This patch reverts commit c677d7ae8314
+("media: mtk-jpeg: Fix use after free bug due to uncanceled work").
+The job_timeout_work is initialized only for
+the single-core JPEG device so it will cause the crash for multi-core
+JPEG devices.
+
+Fix it by removing the cancel_delayed_work_sync function.
+
+Fixes: c677d7ae8314 ("media: mtk-jpeg: Fix use after free bug due to uncanceled work")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+index 7194f88edc0f..60425c99a2b8 100644
+--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
++++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+@@ -1403,7 +1403,6 @@ static void mtk_jpeg_remove(struct platform_device *pdev)
+ {
+ 	struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev);
+ 
+-	cancel_delayed_work_sync(&jpeg->job_timeout_work);
+ 	pm_runtime_disable(&pdev->dev);
+ 	video_unregister_device(jpeg->vdev);
+ 	v4l2_m2m_release(jpeg->m2m_dev);
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-pvrusb2-fix-use-after-free-on-context-disconne.patch b/queue-6.7/media-pvrusb2-fix-use-after-free-on-context-disconne.patch
new file mode 100644
index 00000000000..6e601be1e86
--- /dev/null
+++ b/queue-6.7/media-pvrusb2-fix-use-after-free-on-context-disconne.patch
@@ -0,0 +1,46 @@
+From dff0ccac2f0cc41741a85c13f78406c40fdf5db8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Oct 2023 01:09:12 +0200
+Subject: media: pvrusb2: fix use after free on context disconnection
+
+From: Ricardo B. Marliere <ricardo@marliere.net>
+
+[ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ]
+
+Upon module load, a kthread is created targeting the
+pvr2_context_thread_func function, which may call pvr2_context_destroy
+and thus call kfree() on the context object. However, that might happen
+before the usb hub_event handler is able to notify the driver. This
+patch adds a sanity check before the invalid read reported by syzbot,
+within the context disconnection call stack.
+
+Reported-and-tested-by: syzbot+621409285c4156a009b3@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/
+
+Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload")
+Signed-off-by: Ricardo B. Marliere <ricardo@marliere.net>
+Acked-by: Mike Isely <isely@pobox.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+index 14170a5d72b3..1764674de98b 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c
+@@ -268,7 +268,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp)
+ {
+ 	pvr2_hdw_disconnect(mp->hdw);
+ 	mp->disconnect_flag = !0;
+-	pvr2_context_notify(mp);
++	if (!pvr2_context_shutok())
++		pvr2_context_notify(mp);
+ }
+ 
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-rkisp1-fix-media-device-memory-leak.patch b/queue-6.7/media-rkisp1-fix-media-device-memory-leak.patch
new file mode 100644
index 00000000000..5f2be3c3b21
--- /dev/null
+++ b/queue-6.7/media-rkisp1-fix-media-device-memory-leak.patch
@@ -0,0 +1,57 @@
+From 77ef053412635f5ebda4aa3d7b23dfbce0f53510 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 16:50:07 +0100
+Subject: media: rkisp1: Fix media device memory leak
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 452f604a4683654f4d9472b3126d8da61d748443 ]
+
+Add missing calls to media_device_cleanup() to fix memory leak.
+
+Link: https://lore.kernel.org/r/20231122-rkisp-fixes-v2-1-78bfb63cdcf8@ideasonboard.com
+
+Fixes: d65dd85281fb ("media: staging: rkisp1: add Rockchip ISP1 base driver")
+Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+index c41abd2833f1..894d5afaff4e 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+@@ -582,7 +582,7 @@ static int rkisp1_probe(struct platform_device *pdev)
+ 
+ 	ret = v4l2_device_register(rkisp1->dev, &rkisp1->v4l2_dev);
+ 	if (ret)
+-		goto err_pm_runtime_disable;
++		goto err_media_dev_cleanup;
+ 
+ 	ret = media_device_register(&rkisp1->media_dev);
+ 	if (ret) {
+@@ -617,6 +617,8 @@ static int rkisp1_probe(struct platform_device *pdev)
+ 	media_device_unregister(&rkisp1->media_dev);
+ err_unreg_v4l2_dev:
+ 	v4l2_device_unregister(&rkisp1->v4l2_dev);
++err_media_dev_cleanup:
++	media_device_cleanup(&rkisp1->media_dev);
+ err_pm_runtime_disable:
+ 	pm_runtime_disable(&pdev->dev);
+ 	return ret;
+@@ -637,6 +639,8 @@ static void rkisp1_remove(struct platform_device *pdev)
+ 	media_device_unregister(&rkisp1->media_dev);
+ 	v4l2_device_unregister(&rkisp1->v4l2_dev);
+ 
++	media_device_cleanup(&rkisp1->media_dev);
++
+ 	pm_runtime_disable(&pdev->dev);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-rkisp1-fix-memory-leaks-in-rkisp1_isp_unregist.patch b/queue-6.7/media-rkisp1-fix-memory-leaks-in-rkisp1_isp_unregist.patch
new file mode 100644
index 00000000000..e995b41b0c3
--- /dev/null
+++ b/queue-6.7/media-rkisp1-fix-memory-leaks-in-rkisp1_isp_unregist.patch
@@ -0,0 +1,38 @@
+From fd27db6a6940074ccfa61d8011d464c51c7e7f37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 16:50:08 +0100
+Subject: media: rkisp1: Fix memory leaks in rkisp1_isp_unregister()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 688f3af3c354adc19b78d352c8c7b2006f993f2d ]
+
+Add missing call to v4l2_subdev_cleanup() to fix memory leak.
+
+Link: https://lore.kernel.org/r/20231122-rkisp-fixes-v2-2-78bfb63cdcf8@ideasonboard.com
+
+Fixes: 2cce0a369dbd ("media: rkisp1: isp: Use V4L2 subdev active state")
+Reviewed-by: Tommaso Merciai <tomm.merciai@gmail.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
+index 88ca8b2283b7..45d1ab96fc6e 100644
+--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
++++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-isp.c
+@@ -933,6 +933,7 @@ void rkisp1_isp_unregister(struct rkisp1_device *rkisp1)
+ 		return;
+ 
+ 	v4l2_device_unregister_subdev(&isp->sd);
++	v4l2_subdev_cleanup(&isp->sd);
+ 	media_entity_cleanup(&isp->sd.entity);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch b/queue-6.7/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
new file mode 100644
index 00000000000..9814da455ae
--- /dev/null
+++ b/queue-6.7/media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
@@ -0,0 +1,42 @@
+From 5a348934100f75654c6ceec40cfb6dba1de137e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 21:16:40 +0100
+Subject: media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 1fb7b5ab62113b29ce331464048d8c39e58fd08a ]
+
+The (TRY_)DECODER_CMD ioctls are used to support flushing when holding
+capture buffers is supported. This is the case of this driver but the
+ioctls were never hooked to the ioctl ops.
+
+Add them to correctly support flushing.
+
+Fixes: ed7bb87d3d03 ("media: rkvdec: Enable capture buffer holding for H264")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/rkvdec/rkvdec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
+index 84a41792cb4b..ac398b5a9736 100644
+--- a/drivers/staging/media/rkvdec/rkvdec.c
++++ b/drivers/staging/media/rkvdec/rkvdec.c
+@@ -461,6 +461,9 @@ static const struct v4l2_ioctl_ops rkvdec_ioctl_ops = {
+ 
+ 	.vidioc_streamon = v4l2_m2m_ioctl_streamon,
+ 	.vidioc_streamoff = v4l2_m2m_ioctl_streamoff,
++
++	.vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd,
++	.vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd,
+ };
+ 
+ static int rkvdec_queue_setup(struct vb2_queue *vq, unsigned int *num_buffers,
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-v4l-async-fix-duplicated-list-deletion.patch b/queue-6.7/media-v4l-async-fix-duplicated-list-deletion.patch
new file mode 100644
index 00000000000..cb219268ac4
--- /dev/null
+++ b/queue-6.7/media-v4l-async-fix-duplicated-list-deletion.patch
@@ -0,0 +1,42 @@
+From 244397d8b0d51a76c452c765518ea124298bb486 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Nov 2023 23:57:23 +0100
+Subject: media: v4l: async: Fix duplicated list deletion
+
+From: Sebastian Reichel <sre@kernel.org>
+
+[ Upstream commit 3de6ee94aae701fa949cd3b5df6b6a440ddfb8f2 ]
+
+The list deletion call dropped here is already called from the
+helper function in the line before. Having a second list_del()
+call results in either a warning (with CONFIG_DEBUG_LIST=y):
+
+list_del corruption, c46c8198->next is LIST_POISON1 (00000100)
+
+If CONFIG_DEBUG_LIST is disabled the operation results in a
+kernel error due to NULL pointer dereference.
+
+Fixes: 28a1295795d8 ("media: v4l: async: Allow multiple connections between entities")
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/v4l2-core/v4l2-async.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-async.c b/drivers/media/v4l2-core/v4l2-async.c
+index 091e8cf4114b..8cfd593d293d 100644
+--- a/drivers/media/v4l2-core/v4l2-async.c
++++ b/drivers/media/v4l2-core/v4l2-async.c
+@@ -880,7 +880,6 @@ void v4l2_async_unregister_subdev(struct v4l2_subdev *sd)
+ 				  &asc->notifier->waiting_list);
+ 
+ 			v4l2_async_unbind_subdev_one(asc->notifier, asc);
+-			list_del(&asc->asc_subdev_entry);
+ 		}
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch b/queue-6.7/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
new file mode 100644
index 00000000000..6dc3d336f7e
--- /dev/null
+++ b/queue-6.7/media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
@@ -0,0 +1,56 @@
+From d0750f64c6c2b311088d1dd6a921c28f21491f9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 21:16:39 +0100
+Subject: media: verisilicon: Hook the (TRY_)DECODER_CMD stateless ioctls
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 6c0d9e12b1d12bbd95484e4b99f63feeb423765f ]
+
+The (TRY_)DECODER_CMD ioctls are used to support flushing when holding
+capture buffers is supported. This is the case of this driver but the
+ioctls were never hooked to the ioctl ops.
+
+Add them to correctly support flushing.
+
+Fixes: 340ce50f75a6 ("media: hantro: Enable HOLD_CAPTURE_BUF for H.264")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/verisilicon/hantro_drv.c  | 2 ++
+ drivers/media/platform/verisilicon/hantro_v4l2.c | 3 +++
+ 2 files changed, 5 insertions(+)
+
+diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
+index a9fa05ac56a9..3a2a0f28cbfe 100644
+--- a/drivers/media/platform/verisilicon/hantro_drv.c
++++ b/drivers/media/platform/verisilicon/hantro_drv.c
+@@ -905,6 +905,8 @@ static int hantro_add_func(struct hantro_dev *vpu, unsigned int funcid)
+ 
+ 	if (funcid == MEDIA_ENT_F_PROC_VIDEO_ENCODER) {
+ 		vpu->encoder = func;
++		v4l2_disable_ioctl(vfd, VIDIOC_TRY_DECODER_CMD);
++		v4l2_disable_ioctl(vfd, VIDIOC_DECODER_CMD);
+ 	} else {
+ 		vpu->decoder = func;
+ 		v4l2_disable_ioctl(vfd, VIDIOC_TRY_ENCODER_CMD);
+diff --git a/drivers/media/platform/verisilicon/hantro_v4l2.c b/drivers/media/platform/verisilicon/hantro_v4l2.c
+index b3ae037a50f6..db145519fc5d 100644
+--- a/drivers/media/platform/verisilicon/hantro_v4l2.c
++++ b/drivers/media/platform/verisilicon/hantro_v4l2.c
+@@ -785,6 +785,9 @@ const struct v4l2_ioctl_ops hantro_ioctl_ops = {
+ 	.vidioc_g_selection = vidioc_g_selection,
+ 	.vidioc_s_selection = vidioc_s_selection,
+ 
++	.vidioc_decoder_cmd = v4l2_m2m_ioctl_stateless_decoder_cmd,
++	.vidioc_try_decoder_cmd = v4l2_m2m_ioctl_stateless_try_decoder_cmd,
++
+ 	.vidioc_try_encoder_cmd = v4l2_m2m_ioctl_try_encoder_cmd,
+ 	.vidioc_encoder_cmd = vidioc_encoder_cmd,
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-videobuf2-request-more-buffers-for-vb2_read.patch b/queue-6.7/media-videobuf2-request-more-buffers-for-vb2_read.patch
new file mode 100644
index 00000000000..63fdb94f960
--- /dev/null
+++ b/queue-6.7/media-videobuf2-request-more-buffers-for-vb2_read.patch
@@ -0,0 +1,65 @@
+From 1f59c21221f1172c99b27c1d63cade05cf143520 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 13:58:12 +0100
+Subject: media: videobuf2: request more buffers for vb2_read
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 350ab13e1382f2afcc2285041a1e75b80d771c2c ]
+
+The vb2 read support requests 1 buffer, leaving it to the driver
+to increase this number to something that works.
+
+Unfortunately, drivers do not deal with this reliably, and in fact
+this caused problems for the bttv driver and reading from /dev/vbiX,
+causing every other VBI frame to be all 0.
+
+Instead, request as the number of buffers whatever is the maximum of
+2 and q->min_buffers_needed+1.
+
+In order to start streaming you need at least q->min_buffers_needed
+queued buffers, so add 1 buffer for processing. And if that field
+is 0, then choose 2 (again, one buffer is being filled while the
+other one is being processed).
+
+This certainly makes more sense than requesting just 1 buffer, and
+the VBI bttv support is now working again.
+
+It turns out that the old videobuf1 behavior of bttv was to allocate
+8 (video) and 4 (vbi) buffers when used with read(). After the vb2
+conversion that changed to 2 for both. With this patch it is 3, which
+is really all you need.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Fixes: b7ec3212a73a ("media: bttv: convert to vb2")
+Tested-by: Dr. David Alan Gilbert <dave@treblig.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/common/videobuf2/videobuf2-core.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c
+index 27aee92f3eea..19f80ff497b7 100644
+--- a/drivers/media/common/videobuf2/videobuf2-core.c
++++ b/drivers/media/common/videobuf2/videobuf2-core.c
+@@ -2648,9 +2648,14 @@ static int __vb2_init_fileio(struct vb2_queue *q, int read)
+ 		return -EBUSY;
+ 
+ 	/*
+-	 * Start with count 1, driver can increase it in queue_setup()
++	 * Start with q->min_buffers_needed + 1, driver can increase it in
++	 * queue_setup()
++	 *
++	 * 'min_buffers_needed' buffers need to be queued up before you
++	 * can start streaming, plus 1 for userspace (or in this case,
++	 * kernelspace) processing.
+ 	 */
+-	count = 1;
++	count = max(2, q->min_buffers_needed + 1);
+ 
+ 	dprintk(q, 3, "setting up file io: mode %s, count %d, read_once %d, write_immediately %d\n",
+ 		(read) ? "read" : "write", count, q->fileio_read_once,
+-- 
+2.43.0
+
diff --git a/queue-6.7/media-visl-hook-the-try_-decoder_cmd-stateless-ioctl.patch b/queue-6.7/media-visl-hook-the-try_-decoder_cmd-stateless-ioctl.patch
new file mode 100644
index 00000000000..7b8ea720b91
--- /dev/null
+++ b/queue-6.7/media-visl-hook-the-try_-decoder_cmd-stateless-ioctl.patch
@@ -0,0 +1,42 @@
+From ca04d0b436122074b4030146859e38587e2bc000 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Nov 2023 21:16:38 +0100
+Subject: media: visl: Hook the (TRY_)DECODER_CMD stateless ioctls
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 3907f6ef8e0d55a88cdb0f7238363d24e26790ca ]
+
+The (TRY_)DECODER_CMD ioctls are used to support flushing when holding
+capture buffers is supported. This is the case of this driver but the
+ioctls were never hooked to the ioctl ops.
+
+Add them to correctly support flushing.
+
+Fixes: 0c078e310b6d ("media: visl: add virtual stateless decoder driver")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/test-drivers/visl/visl-video.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/test-drivers/visl/visl-video.c b/drivers/media/test-drivers/visl/visl-video.c
+index 7cac6a6456eb..9303a3e118d7 100644
+--- a/drivers/media/test-drivers/visl/visl-video.c
++++ b/drivers/media/test-drivers/visl/visl-video.c
+@@ -525,6 +525,9 @@ const struct v4l2_ioctl_ops visl_ioctl_ops = {
+ 	.vidioc_streamon		= v4l2_m2m_ioctl_streamon,
+ 	.vidioc_streamoff		= v4l2_m2m_ioctl_streamoff,
+ 
++	.vidioc_decoder_cmd		= v4l2_m2m_ioctl_stateless_decoder_cmd,
++	.vidioc_try_decoder_cmd		= v4l2_m2m_ioctl_stateless_try_decoder_cmd,
++
+ 	.vidioc_subscribe_event		= v4l2_ctrl_subscribe_event,
+ 	.vidioc_unsubscribe_event	= v4l2_event_unsubscribe,
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.7/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch b/queue-6.7/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
new file mode 100644
index 00000000000..d4451eb72b6
--- /dev/null
+++ b/queue-6.7/mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
@@ -0,0 +1,68 @@
+From 766887c9f0592c7d2502793e3ecc12c96f31e45a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 11:00:14 -0500
+Subject: mlxbf_gige: Enable the GigE port in mlxbf_gige_open
+
+From: Asmaa Mnebhi <asmaa@nvidia.com>
+
+[ Upstream commit a460f4a684511e007bbf1700758a41f05d9981e6 ]
+
+At the moment, the GigE port is enabled in the mlxbf_gige_probe
+function. If the mlxbf_gige_open is not executed, this could cause
+pause frames to increase in the case where there is high backgroud
+traffic. This results in clogging the port.
+So move enabling the OOB port to mlxbf_gige_open.
+
+Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c   | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+index ac7f0128619c..3d09fa54598f 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+@@ -130,9 +130,15 @@ static int mlxbf_gige_open(struct net_device *netdev)
+ {
+ 	struct mlxbf_gige *priv = netdev_priv(netdev);
+ 	struct phy_device *phydev = netdev->phydev;
++	u64 control;
+ 	u64 int_en;
+ 	int err;
+ 
++	/* Perform general init of GigE block */
++	control = readq(priv->base + MLXBF_GIGE_CONTROL);
++	control |= MLXBF_GIGE_CONTROL_PORT_EN;
++	writeq(control, priv->base + MLXBF_GIGE_CONTROL);
++
+ 	err = mlxbf_gige_request_irqs(priv);
+ 	if (err)
+ 		return err;
+@@ -365,7 +371,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
+ 	void __iomem *plu_base;
+ 	void __iomem *base;
+ 	int addr, phy_irq;
+-	u64 control;
+ 	int err;
+ 
+ 	base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC);
+@@ -380,11 +385,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
+ 	if (IS_ERR(plu_base))
+ 		return PTR_ERR(plu_base);
+ 
+-	/* Perform general init of GigE block */
+-	control = readq(base + MLXBF_GIGE_CONTROL);
+-	control |= MLXBF_GIGE_CONTROL_PORT_EN;
+-	writeq(control, base + MLXBF_GIGE_CONTROL);
+-
+ 	netdev = devm_alloc_etherdev(&pdev->dev, sizeof(*priv));
+ 	if (!netdev)
+ 		return -ENOMEM;
+-- 
+2.43.0
+
diff --git a/queue-6.7/mlxbf_gige-fix-intermittent-no-ip-issue.patch b/queue-6.7/mlxbf_gige-fix-intermittent-no-ip-issue.patch
new file mode 100644
index 00000000000..cd928ff743c
--- /dev/null
+++ b/queue-6.7/mlxbf_gige-fix-intermittent-no-ip-issue.patch
@@ -0,0 +1,92 @@
+From 5025e0382edd8bec53a76571135921f57aebbe65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 10:59:46 -0500
+Subject: mlxbf_gige: Fix intermittent no ip issue
+
+From: Asmaa Mnebhi <asmaa@nvidia.com>
+
+[ Upstream commit ef210ef85d5cb543ce34a57803ed856d0c8c08c2 ]
+
+Although the link is up, there is no ip assigned on setups with high background
+traffic. Nothing is transmitted nor received. The RX error count keeps on
+increasing. After several minutes, the RX error count stagnates and the
+GigE interface finally gets an ip.
+
+The issue is that mlxbf_gige_rx_init() is called before phy_start().
+As soon as the RX DMA is enabled in mlxbf_gige_rx_init(), the RX CI reaches the max
+of 128, and becomes equal to RX PI. RX CI doesn't decrease since the code hasn't
+ran phy_start yet.
+Bring the PHY up before starting the RX.
+
+Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
+Reviewed-by: David Thompson <davthompson@nvidia.com>
+Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 14 +++++++-------
+ .../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c   |  6 +++---
+ 2 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+index 954ba0826c61..ac7f0128619c 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+@@ -147,14 +147,14 @@ static int mlxbf_gige_open(struct net_device *netdev)
+ 	 */
+ 	priv->valid_polarity = 0;
+ 
+-	err = mlxbf_gige_rx_init(priv);
++	phy_start(phydev);
++
++	err = mlxbf_gige_tx_init(priv);
+ 	if (err)
+ 		goto free_irqs;
+-	err = mlxbf_gige_tx_init(priv);
++	err = mlxbf_gige_rx_init(priv);
+ 	if (err)
+-		goto rx_deinit;
+-
+-	phy_start(phydev);
++		goto tx_deinit;
+ 
+ 	netif_napi_add(netdev, &priv->napi, mlxbf_gige_poll);
+ 	napi_enable(&priv->napi);
+@@ -176,8 +176,8 @@ static int mlxbf_gige_open(struct net_device *netdev)
+ 
+ 	return 0;
+ 
+-rx_deinit:
+-	mlxbf_gige_rx_deinit(priv);
++tx_deinit:
++	mlxbf_gige_tx_deinit(priv);
+ 
+ free_irqs:
+ 	mlxbf_gige_free_irqs(priv);
+diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
+index 227d01cace3f..699984358493 100644
+--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
++++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
+@@ -142,6 +142,9 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv)
+ 	writeq(MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS_EN,
+ 	       priv->base + MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS);
+ 
++	writeq(ilog2(priv->rx_q_entries),
++	       priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2);
++
+ 	/* Clear MLXBF_GIGE_INT_MASK 'receive pkt' bit to
+ 	 * indicate readiness to receive interrupts
+ 	 */
+@@ -154,9 +157,6 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv)
+ 	data |= MLXBF_GIGE_RX_DMA_EN;
+ 	writeq(data, priv->base + MLXBF_GIGE_RX_DMA);
+ 
+-	writeq(ilog2(priv->rx_q_entries),
+-	       priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2);
+-
+ 	return 0;
+ 
+ free_wqe_and_skb:
+-- 
+2.43.0
+
diff --git a/queue-6.7/mmc-sdhci_am654-fix-ti-soc-dependencies.patch b/queue-6.7/mmc-sdhci_am654-fix-ti-soc-dependencies.patch
new file mode 100644
index 00000000000..86a4ae524b7
--- /dev/null
+++ b/queue-6.7/mmc-sdhci_am654-fix-ti-soc-dependencies.patch
@@ -0,0 +1,48 @@
+From 5bad011c3596382cc4723e88fc2c4b5035bb313e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 13:59:46 +0000
+Subject: mmc: sdhci_am654: Fix TI SoC dependencies
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit cb052da7f031b0d2309a4895ca236afb3b4bbf50 ]
+
+The sdhci_am654 is specific to recent TI SoCs, update the
+dependencies for those SoCs and compile testing. While we're
+at it update the text to reflect the wider range of
+supported TI SoCS the driver now supports.
+
+Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Link: https://lore.kernel.org/r/20231220135950.433588-1-pbrobinson@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 58bd5fe4cd25..24ce5576b61a 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -1041,14 +1041,15 @@ config MMC_SDHCI_OMAP
+ 
+ config MMC_SDHCI_AM654
+ 	tristate "Support for the SDHCI Controller in TI's AM654 SOCs"
++	depends on ARCH_K3 || COMPILE_TEST
+ 	depends on MMC_SDHCI_PLTFM && OF
+ 	select MMC_SDHCI_IO_ACCESSORS
+ 	select MMC_CQHCI
+ 	select REGMAP_MMIO
+ 	help
+ 	  This selects the Secure Digital Host Controller Interface (SDHCI)
+-	  support present in TI's AM654 SOCs. The controller supports
+-	  SD/MMC/SDIO devices.
++	  support present in TI's AM65x/AM64x/AM62x/J721E SOCs. The controller
++	  supports SD/MMC/SDIO devices.
+ 
+ 	  If you have a controller with this interface, say Y or M here.
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/mmc-sdhci_omap-fix-ti-soc-dependencies.patch b/queue-6.7/mmc-sdhci_omap-fix-ti-soc-dependencies.patch
new file mode 100644
index 00000000000..cc938033a51
--- /dev/null
+++ b/queue-6.7/mmc-sdhci_omap-fix-ti-soc-dependencies.patch
@@ -0,0 +1,48 @@
+From 024307fdcee60cc025cfc595aa70a874e4055c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 13:59:47 +0000
+Subject: mmc: sdhci_omap: Fix TI SoC dependencies
+
+From: Peter Robinson <pbrobinson@gmail.com>
+
+[ Upstream commit 09f164d393a6671e5ff8342ba6b3cb7fe3f20208 ]
+
+The sdhci_omap is specific to  older TI SoCs, update the
+dependencies for those SoCs and compile testing. While we're
+at it update the text to reflect the wider range of
+supported TI SoCS the driver now supports.
+
+Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver")
+Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
+Link: https://lore.kernel.org/r/20231220135950.433588-2-pbrobinson@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 24ce5576b61a..81f2c4e05287 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -1026,14 +1026,15 @@ config MMC_SDHCI_XENON
+ 
+ config MMC_SDHCI_OMAP
+ 	tristate "TI SDHCI Controller Support"
++	depends on ARCH_OMAP2PLUS || ARCH_KEYSTONE || COMPILE_TEST
+ 	depends on MMC_SDHCI_PLTFM && OF
+ 	select THERMAL
+ 	imply TI_SOC_THERMAL
+ 	select MMC_SDHCI_EXTERNAL_DMA if DMA_ENGINE
+ 	help
+ 	  This selects the Secure Digital Host Controller Interface (SDHCI)
+-	  support present in TI's DRA7 SOCs. The controller supports
+-	  SD/MMC/SDIO devices.
++	  support present in TI's Keystone/OMAP2+/DRA7 SOCs. The controller
++	  supports SD/MMC/SDIO devices.
+ 
+ 	  If you have a controller with this interface, say Y or M here.
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch b/queue-6.7/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
new file mode 100644
index 00000000000..886436cde1a
--- /dev/null
+++ b/queue-6.7/mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
@@ -0,0 +1,85 @@
+From 062232b142d71dbb67ce1b9bb26454f45b70a7e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 10:46:19 +0800
+Subject: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: ZhaoLong Wang <wangzhaolong1@huawei.com>
+
+[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ]
+
+If both ftl.ko and gluebi.ko are loaded, the notifier of ftl
+triggers NULL pointer dereference when trying to access
+‘gluebi->desc’ in gluebi_read().
+
+ubi_gluebi_init
+  ubi_register_volume_notifier
+    ubi_enumerate_volumes
+      ubi_notify_all
+        gluebi_notify    nb->notifier_call()
+          gluebi_create
+            mtd_device_register
+              mtd_device_parse_register
+                add_mtd_device
+                  blktrans_notify_add   not->add()
+                    ftl_add_mtd         tr->add_mtd()
+                      scan_header
+                        mtd_read
+                          mtd_read_oob
+                            mtd_read_oob_std
+                              gluebi_read   mtd->read()
+                                gluebi->desc - NULL
+
+Detailed reproduction information available at the Link [1],
+
+In the normal case, obtain gluebi->desc in the gluebi_get_device(),
+and access gluebi->desc in the gluebi_read(). However,
+gluebi_get_device() is not executed in advance in the
+ftl_add_mtd() process, which leads to NULL pointer dereference.
+
+The solution for the gluebi module is to run jffs2 on the UBI
+volume without considering working with ftl or mtdblock [2].
+Therefore, this problem can be avoided by preventing gluebi from
+creating the mtdblock device after creating mtd partition of the
+type MTD_UBIVOLUME.
+
+Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1]
+Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2]
+Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>
+Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Acked-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtd_blkdevs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index ff18636e0889..5bc32108ca03 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -463,7 +463,7 @@ static void blktrans_notify_add(struct mtd_info *mtd)
+ {
+ 	struct mtd_blktrans_ops *tr;
+ 
+-	if (mtd->type == MTD_ABSENT)
++	if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME)
+ 		return;
+ 
+ 	list_for_each_entry(tr, &blktrans_majors, list)
+@@ -503,7 +503,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
+ 	mutex_lock(&mtd_table_mutex);
+ 	list_add(&tr->list, &blktrans_majors);
+ 	mtd_for_each_device(mtd)
+-		if (mtd->type != MTD_ABSENT)
++		if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME)
+ 			tr->add_mtd(tr, mtd);
+ 	mutex_unlock(&mtd_table_mutex);
+ 	return 0;
+-- 
+2.43.0
+
diff --git a/queue-6.7/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch b/queue-6.7/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
new file mode 100644
index 00000000000..055bc6f7aa8
--- /dev/null
+++ b/queue-6.7/mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
@@ -0,0 +1,49 @@
+From e281ed67fd132daa6ecff4b769ef3ff875aa063f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Nov 2023 18:31:51 +1000
+Subject: mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller
+ response
+
+From: Ronald Monthero <debug.penguin32@gmail.com>
+
+[ Upstream commit 923fb6238cb3ac529aa2bf13b3b1e53762186a8b ]
+
+Under heavy load it is likely that the controller is done
+with its own task but the thread unlocking the wait is not
+scheduled in time. Increasing IFC_TIMEOUT_MSECS allows the
+controller to respond within allowable timeslice of 1 sec.
+
+fsl,ifc-nand 7e800000.nand: Controller is not responding
+
+[<804b2047>] (nand_get_device) from [<804b5335>] (nand_write_oob+0x1b/0x4a)
+[<804b5335>] (nand_write_oob) from [<804a3585>] (mtd_write+0x41/0x5c)
+[<804a3585>] (mtd_write) from [<804c1d47>] (ubi_io_write+0x17f/0x22c)
+[<804c1d47>] (ubi_io_write) from [<804c047b>] (ubi_eba_write_leb+0x5b/0x1d0)
+
+Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller")
+Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Ronald Monthero <debug.penguin32@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20231118083156.776887-1-debug.penguin32@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+index 20bb1e0cb5eb..f0e2318ce088 100644
+--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
+@@ -21,7 +21,7 @@
+ 
+ #define ERR_BYTE		0xFF /* Value returned for read
+ 					bytes when read failed	*/
+-#define IFC_TIMEOUT_MSECS	500  /* Maximum number of mSecs to wait
++#define IFC_TIMEOUT_MSECS	1000 /* Maximum timeout to wait
+ 					for IFC NAND Machine	*/
+ 
+ struct fsl_ifc_ctrl;
+-- 
+2.43.0
+
diff --git a/queue-6.7/net-ncsi-fix-netlink-major-minor-version-numbers.patch b/queue-6.7/net-ncsi-fix-netlink-major-minor-version-numbers.patch
new file mode 100644
index 00000000000..5fe0c51e665
--- /dev/null
+++ b/queue-6.7/net-ncsi-fix-netlink-major-minor-version-numbers.patch
@@ -0,0 +1,202 @@
+From cad99861f9315613c398fb4899c525b056cf1ad4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 10:07:34 -0600
+Subject: net/ncsi: Fix netlink major/minor version numbers
+
+From: Peter Delevoryas <peter@pjd.dev>
+
+[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ]
+
+The netlink interface for major and minor version numbers doesn't actually
+return the major and minor version numbers.
+
+It reports a u32 that contains the (major, minor, update, alpha1)
+components as the major version number, and then alpha2 as the minor
+version number.
+
+For whatever reason, the u32 byte order was reversed (ntohl): maybe it was
+assumed that the encoded value was a single big-endian u32, and alpha2 was
+the minor version.
+
+The correct way to get the supported NC-SI version from the network
+controller is to parse the Get Version ID response as described in 8.4.44
+of the NC-SI spec[1].
+
+    Get Version ID Response Packet Format
+
+              Bits
+            +--------+--------+--------+--------+
+     Bytes  | 31..24 | 23..16 | 15..8  | 7..0   |
+    +-------+--------+--------+--------+--------+
+    | 0..15 | NC-SI Header                      |
+    +-------+--------+--------+--------+--------+
+    | 16..19| Response code   | Reason code     |
+    +-------+--------+--------+--------+--------+
+    |20..23 | Major  | Minor  | Update | Alpha1 |
+    +-------+--------+--------+--------+--------+
+    |24..27 |         reserved         | Alpha2 |
+    +-------+--------+--------+--------+--------+
+    |            .... other stuff ....          |
+
+The major, minor, and update fields are all binary-coded decimal (BCD)
+encoded [2]. The spec provides examples below the Get Version ID response
+format in section 8.4.44.1, but for practical purposes, this is an example
+from a live network card:
+
+    root@bmc:~# ncsi-util 0x15
+    NC-SI Command Response:
+    cmd: GET_VERSION_ID(0x15)
+    Response: COMMAND_COMPLETED(0x0000)  Reason: NO_ERROR(0x0000)
+    Payload length = 40
+
+    20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1)
+    24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2)
+
+    28: 0x6d 0x6c 0x78 0x30
+    32: 0x2e 0x31 0x00 0x00
+    36: 0x00 0x00 0x00 0x00
+    40: 0x16 0x1d 0x07 0xd2
+    44: 0x10 0x1d 0x15 0xb3
+    48: 0x00 0x17 0x15 0xb3
+    52: 0x00 0x00 0x81 0x19
+
+This should be parsed as "1.1.0".
+
+"f" in the upper-nibble means to ignore it, contributing zero.
+
+If both nibbles are "f", I think the whole field is supposed to be ignored.
+Major and minor are "required", meaning they're not supposed to be "ff",
+but the update field is "optional" so I think it can be ff. I think the
+simplest thing to do is just set the major and minor to zero instead of
+juggling some conditional logic or something.
+
+bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9,
+so I've provided a custom BCD decoding function.
+
+Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII
+characters as far as I can tell, although the full encoding table for
+non-alphabetic characters is slightly different (I think).
+
+I imagine the alpha fields are just supposed to be alphabetic characters,
+but I haven't seen any network cards actually report a non-zero value for
+either.
+
+If people wrote software against this netlink behavior, and were parsing
+the major and minor versions themselves from the u32, then this would
+definitely break their code.
+
+[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf
+[2] https://en.wikipedia.org/wiki/Binary-coded_decimal
+[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1
+
+Signed-off-by: Peter Delevoryas <peter@pjd.dev>
+Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/internal.h     |  7 +++++--
+ net/ncsi/ncsi-netlink.c |  4 ++--
+ net/ncsi/ncsi-pkt.h     |  7 +++++--
+ net/ncsi/ncsi-rsp.c     | 26 ++++++++++++++++++++++++--
+ 4 files changed, 36 insertions(+), 8 deletions(-)
+
+diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
+index 03757e76bb6b..374412ed780b 100644
+--- a/net/ncsi/internal.h
++++ b/net/ncsi/internal.h
+@@ -105,8 +105,11 @@ enum {
+ 
+ 
+ struct ncsi_channel_version {
+-	u32 version;		/* Supported BCD encoded NCSI version */
+-	u32 alpha2;		/* Supported BCD encoded NCSI version */
++	u8   major;		/* NCSI version major */
++	u8   minor;		/* NCSI version minor */
++	u8   update;		/* NCSI version update */
++	char alpha1;		/* NCSI version alpha1 */
++	char alpha2;		/* NCSI version alpha2 */
+ 	u8  fw_name[12];	/* Firmware name string                */
+ 	u32 fw_version;		/* Firmware version                   */
+ 	u16 pci_ids[4];		/* PCI identification                 */
+diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
+index a3a6753a1db7..2f872d064396 100644
+--- a/net/ncsi/ncsi-netlink.c
++++ b/net/ncsi/ncsi-netlink.c
+@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb,
+ 	if (nc == nc->package->preferred_channel)
+ 		nla_put_flag(skb, NCSI_CHANNEL_ATTR_FORCED);
+ 
+-	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.version);
+-	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.alpha2);
++	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.major);
++	nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.minor);
+ 	nla_put_string(skb, NCSI_CHANNEL_ATTR_VERSION_STR, nc->version.fw_name);
+ 
+ 	vid_nest = nla_nest_start_noflag(skb, NCSI_CHANNEL_ATTR_VLAN_LIST);
+diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h
+index ba66c7dc3a21..c9d1da34dc4d 100644
+--- a/net/ncsi/ncsi-pkt.h
++++ b/net/ncsi/ncsi-pkt.h
+@@ -197,9 +197,12 @@ struct ncsi_rsp_gls_pkt {
+ /* Get Version ID */
+ struct ncsi_rsp_gvi_pkt {
+ 	struct ncsi_rsp_pkt_hdr rsp;          /* Response header */
+-	__be32                  ncsi_version; /* NCSI version    */
++	unsigned char           major;        /* NCSI version major */
++	unsigned char           minor;        /* NCSI version minor */
++	unsigned char           update;       /* NCSI version update */
++	unsigned char           alpha1;       /* NCSI version alpha1 */
+ 	unsigned char           reserved[3];  /* Reserved        */
+-	unsigned char           alpha2;       /* NCSI version    */
++	unsigned char           alpha2;       /* NCSI version alpha2 */
+ 	unsigned char           fw_name[12];  /* f/w name string */
+ 	__be32                  fw_version;   /* f/w version     */
+ 	__be16                  pci_ids[4];   /* PCI IDs         */
+diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
+index 069c2659074b..480e80e3c283 100644
+--- a/net/ncsi/ncsi-rsp.c
++++ b/net/ncsi/ncsi-rsp.c
+@@ -19,6 +19,19 @@
+ #include "ncsi-pkt.h"
+ #include "ncsi-netlink.h"
+ 
++/* Nibbles within [0xA, 0xF] add zero "0" to the returned value.
++ * Optional fields (encoded as 0xFF) will default to zero.
++ */
++static u8 decode_bcd_u8(u8 x)
++{
++	int lo = x & 0xF;
++	int hi = x >> 4;
++
++	lo = lo < 0xA ? lo : 0;
++	hi = hi < 0xA ? hi : 0;
++	return lo + hi * 10;
++}
++
+ static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
+ 				 unsigned short payload)
+ {
+@@ -755,9 +768,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)
+ 	if (!nc)
+ 		return -ENODEV;
+ 
+-	/* Update to channel's version info */
++	/* Update channel's version info
++	 *
++	 * Major, minor, and update fields are supposed to be
++	 * unsigned integers encoded as packed BCD.
++	 *
++	 * Alpha1 and alpha2 are ISO/IEC 8859-1 characters.
++	 */
+ 	ncv = &nc->version;
+-	ncv->version = ntohl(rsp->ncsi_version);
++	ncv->major = decode_bcd_u8(rsp->major);
++	ncv->minor = decode_bcd_u8(rsp->minor);
++	ncv->update = decode_bcd_u8(rsp->update);
++	ncv->alpha1 = rsp->alpha1;
+ 	ncv->alpha2 = rsp->alpha2;
+ 	memcpy(ncv->fw_name, rsp->fw_name, 12);
+ 	ncv->fw_version = ntohl(rsp->fw_version);
+-- 
+2.43.0
+
diff --git a/queue-6.7/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch b/queue-6.7/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
new file mode 100644
index 00000000000..0744c787b65
--- /dev/null
+++ b/queue-6.7/net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
@@ -0,0 +1,149 @@
+From 166b050c68263983269ec7f9574fede3262f0553 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Dec 2023 16:14:57 +0800
+Subject: net/sched: act_ct: fix skb leak and crash on ooo frags
+
+From: Tao Liu <taoliu828@163.com>
+
+[ Upstream commit 3f14b377d01d8357eba032b4cabc8c1149b458b6 ]
+
+act_ct adds skb->users before defragmentation. If frags arrive in order,
+the last frag's reference is reset in:
+
+  inet_frag_reasm_prepare
+    skb_morph
+
+which is not straightforward.
+
+However when frags arrive out of order, nobody unref the last frag, and
+all frags are leaked. The situation is even worse, as initiating packet
+capture can lead to a crash[0] when skb has been cloned and shared at the
+same time.
+
+Fix the issue by removing skb_get() before defragmentation. act_ct
+returns TC_ACT_CONSUMED when defrag failed or in progress.
+
+[0]:
+[  843.804823] ------------[ cut here ]------------
+[  843.809659] kernel BUG at net/core/skbuff.c:2091!
+[  843.814516] invalid opcode: 0000 [#1] PREEMPT SMP
+[  843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2
+[  843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022
+[  843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300
+[  843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89
+[  843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202
+[  843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820
+[  843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00
+[  843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000
+[  843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880
+[  843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900
+[  843.871680] FS:  0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000
+[  843.876242] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0
+[  843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  843.894229] PKRU: 55555554
+[  843.898539] Call Trace:
+[  843.902772]  <IRQ>
+[  843.906922]  ? __die_body+0x1e/0x60
+[  843.911032]  ? die+0x3c/0x60
+[  843.915037]  ? do_trap+0xe2/0x110
+[  843.918911]  ? pskb_expand_head+0x2ac/0x300
+[  843.922687]  ? do_error_trap+0x65/0x80
+[  843.926342]  ? pskb_expand_head+0x2ac/0x300
+[  843.929905]  ? exc_invalid_op+0x50/0x60
+[  843.933398]  ? pskb_expand_head+0x2ac/0x300
+[  843.936835]  ? asm_exc_invalid_op+0x1a/0x20
+[  843.940226]  ? pskb_expand_head+0x2ac/0x300
+[  843.943580]  inet_frag_reasm_prepare+0xd1/0x240
+[  843.946904]  ip_defrag+0x5d4/0x870
+[  843.950132]  nf_ct_handle_fragments+0xec/0x130 [nf_conntrack]
+[  843.953334]  tcf_ct_act+0x252/0xd90 [act_ct]
+[  843.956473]  ? tcf_mirred_act+0x516/0x5a0 [act_mirred]
+[  843.959657]  tcf_action_exec+0xa1/0x160
+[  843.962823]  fl_classify+0x1db/0x1f0 [cls_flower]
+[  843.966010]  ? skb_clone+0x53/0xc0
+[  843.969173]  tcf_classify+0x24d/0x420
+[  843.972333]  tc_run+0x8f/0xf0
+[  843.975465]  __netif_receive_skb_core+0x67a/0x1080
+[  843.978634]  ? dev_gro_receive+0x249/0x730
+[  843.981759]  __netif_receive_skb_list_core+0x12d/0x260
+[  843.984869]  netif_receive_skb_list_internal+0x1cb/0x2f0
+[  843.987957]  ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core]
+[  843.991170]  napi_complete_done+0x72/0x1a0
+[  843.994305]  mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core]
+[  843.997501]  __napi_poll+0x25/0x1b0
+[  844.000627]  net_rx_action+0x256/0x330
+[  844.003705]  __do_softirq+0xb3/0x29b
+[  844.006718]  irq_exit_rcu+0x9e/0xc0
+[  844.009672]  common_interrupt+0x86/0xa0
+[  844.012537]  </IRQ>
+[  844.015285]  <TASK>
+[  844.017937]  asm_common_interrupt+0x26/0x40
+[  844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20
+[  844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb f4 <fa> c3 0f 1f 00 89 fa ec 48 8b 05 ee 88 ed 00 a9 00 00 00 80 75 11
+[  844.028900] RSP: 0018:ffffc90000533e70 EFLAGS: 00000246
+[  844.031725] RAX: 0000000000004000 RBX: 0000000000000001 RCX: 0000000000000000
+[  844.034553] RDX: ffff889ffffc0000 RSI: ffffffff828b7f20 RDI: ffff88a090f45c64
+[  844.037368] RBP: ffff88a0901a2800 R08: ffff88a090f45c00 R09: 00000000000317c0
+[  844.040155] R10: 00ec812281150475 R11: ffff889fffff0e04 R12: ffffffff828b7fa0
+[  844.042962] R13: ffffffff828b7f20 R14: 0000000000000001 R15: 0000000000000000
+[  844.045819]  acpi_idle_enter+0x7b/0xc0
+[  844.048621]  cpuidle_enter_state+0x7f/0x430
+[  844.051451]  cpuidle_enter+0x2d/0x40
+[  844.054279]  do_idle+0x1d4/0x240
+[  844.057096]  cpu_startup_entry+0x2a/0x30
+[  844.059934]  start_secondary+0x104/0x130
+[  844.062787]  secondary_startup_64_no_verify+0x16b/0x16b
+[  844.065674]  </TASK>
+
+Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
+Signed-off-by: Tao Liu <taoliu828@163.com>
+Link: https://lore.kernel.org/r/20231228081457.936732-1-taoliu828@163.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_ct.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index f69c47945175..3d50215985d5 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -850,7 +850,6 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,
+ 	if (err || !frag)
+ 		return err;
+ 
+-	skb_get(skb);
+ 	err = nf_ct_handle_fragments(net, skb, zone, family, &proto, &mru);
+ 	if (err)
+ 		return err;
+@@ -999,12 +998,8 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+ 	nh_ofs = skb_network_offset(skb);
+ 	skb_pull_rcsum(skb, nh_ofs);
+ 	err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);
+-	if (err == -EINPROGRESS) {
+-		retval = TC_ACT_STOLEN;
+-		goto out_clear;
+-	}
+ 	if (err)
+-		goto drop;
++		goto out_frag;
+ 
+ 	err = nf_ct_skb_network_trim(skb, family);
+ 	if (err)
+@@ -1091,6 +1086,11 @@ TC_INDIRECT_SCOPE int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
+ 		qdisc_skb_cb(skb)->pkt_len = skb->len;
+ 	return retval;
+ 
++out_frag:
++	if (err != -EINPROGRESS)
++		tcf_action_inc_drop_qstats(&c->common);
++	return TC_ACT_CONSUMED;
++
+ drop:
+ 	tcf_action_inc_drop_qstats(&c->common);
+ 	return TC_ACT_SHOT;
+-- 
+2.43.0
+
diff --git a/queue-6.7/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch b/queue-6.7/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
new file mode 100644
index 00000000000..91e8be54423
--- /dev/null
+++ b/queue-6.7/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
@@ -0,0 +1,50 @@
+From 0d5aae4661f49f580bd54c95c1add1d78f5e539c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 11:00:37 +0100
+Subject: netfilter: nf_tables: mark newset as dead on transaction abort
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 08e4c8c5919fd405a4d709b4ba43d836894a26eb ]
+
+If a transaction is aborted, we should mark the to-be-released NEWSET dead,
+just like commit path does for DEL and DESTROYSET commands.
+
+In both cases all remaining elements will be released via
+set->ops->destroy().
+
+The existing abort code does NOT post the actual release to the work queue.
+Also the entire __nf_tables_abort() function is wrapped in gc_seq
+begin/end pair.
+
+Therefore, async gc worker will never try to release the pending set
+elements, as gc sequence is always stale.
+
+It might be possible to speed up transaction aborts via work queue too,
+this would result in a race and a possible use-after-free.
+
+So fix this before it becomes an issue.
+
+Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index be04af433988..bbb8d8533f77 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -10383,6 +10383,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
+ 				nft_trans_destroy(trans);
+ 				break;
+ 			}
++			nft_trans_set(trans)->dead = 1;
+ 			list_del_rcu(&nft_trans_set(trans)->list);
+ 			break;
+ 		case NFT_MSG_DELSET:
+-- 
+2.43.0
+
diff --git a/queue-6.7/netfilter-nf_tables-validate-chain-type-update-if-av.patch b/queue-6.7/netfilter-nf_tables-validate-chain-type-update-if-av.patch
new file mode 100644
index 00000000000..82669420dca
--- /dev/null
+++ b/queue-6.7/netfilter-nf_tables-validate-chain-type-update-if-av.patch
@@ -0,0 +1,47 @@
+From 5baa07a2e244f10ca49db30e6d2621d865694aa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 22:43:22 +0100
+Subject: netfilter: nf_tables: validate chain type update if available
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit aaba7ddc8507f4ad5bbd07988573967632bc2385 ]
+
+Parse netlink attribute containing the chain type in this update, to
+bail out if this is different from the existing type.
+
+Otherwise, it is possible to define a chain with the same name, hook and
+priority but different type, which is silently ignored.
+
+Fixes: 96518518cc41 ("netfilter: add nftables")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index bbb8d8533f77..d5f76e26ae03 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2261,7 +2261,16 @@ static int nft_chain_parse_hook(struct net *net,
+ 				return -EOPNOTSUPP;
+ 		}
+ 
+-		type = basechain->type;
++		if (nla[NFTA_CHAIN_TYPE]) {
++			type = __nf_tables_chain_type_lookup(nla[NFTA_CHAIN_TYPE],
++							     family);
++			if (!type) {
++				NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_TYPE]);
++				return -ENOENT;
++			}
++		} else {
++			type = basechain->type;
++		}
+ 	}
+ 
+ 	if (!try_module_get(type->owner)) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/nfs-use-parent-s-objective-cred-in-nfs_access_login_.patch b/queue-6.7/nfs-use-parent-s-objective-cred-in-nfs_access_login_.patch
new file mode 100644
index 00000000000..f698a2e31e4
--- /dev/null
+++ b/queue-6.7/nfs-use-parent-s-objective-cred-in-nfs_access_login_.patch
@@ -0,0 +1,40 @@
+From 53a1df19d770bae26e8bc9031864b2cf53f1e883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 09:10:54 -0500
+Subject: NFS: Use parent's objective cred in nfs_access_login_time()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit a10a9233073d984b239e22358ba21825e27e2e88 ]
+
+The subjective cred (task->cred) can potentially be overridden and
+subsquently freed in non-RCU context, which could lead to a panic if we
+try to use it in cred_fscmp().  Use __task_cred(), which returns the
+objective cred (task->real_cred) instead.
+
+Fixes: 0eb43812c027 ("NFS: Clear the file access cache upon login")
+Fixes: 5e9a7b9c2ea1 ("NFS: Fix up a sparse warning")
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/dir.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 13dffe4201e6..273c0b68abf4 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -2963,7 +2963,7 @@ static u64 nfs_access_login_time(const struct task_struct *task,
+ 	rcu_read_lock();
+ 	for (;;) {
+ 		parent = rcu_dereference(task->real_parent);
+-		pcred = rcu_dereference(parent->cred);
++		pcred = __task_cred(parent);
+ 		if (parent == task || cred_fscmp(pcred, cred) != 0)
+ 			break;
+ 		task = parent;
+-- 
+2.43.0
+
diff --git a/queue-6.7/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch b/queue-6.7/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
new file mode 100644
index 00000000000..e469e8f2040
--- /dev/null
+++ b/queue-6.7/nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
@@ -0,0 +1,53 @@
+From b5c400d74c27297cb0d8b2d1b853c87c7dfe9b58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 13:55:29 -0500
+Subject: NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90 ]
+
+Once the client has processed the CB_LAYOUTRECALL, but has not yet
+successfully returned the layout, the server is supposed to switch to
+returning NFS4ERR_RETURNCONFLICT. This patch ensures that we handle
+that return value correctly.
+
+Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 8a943fffaad5..23819a756508 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -170,6 +170,7 @@ static int nfs4_map_errors(int err)
+ 	case -NFS4ERR_RESOURCE:
+ 	case -NFS4ERR_LAYOUTTRYLATER:
+ 	case -NFS4ERR_RECALLCONFLICT:
++	case -NFS4ERR_RETURNCONFLICT:
+ 		return -EREMOTEIO;
+ 	case -NFS4ERR_WRONGSEC:
+ 	case -NFS4ERR_WRONG_CRED:
+@@ -558,6 +559,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,
+ 		case -NFS4ERR_GRACE:
+ 		case -NFS4ERR_LAYOUTTRYLATER:
+ 		case -NFS4ERR_RECALLCONFLICT:
++		case -NFS4ERR_RETURNCONFLICT:
+ 			exception->delay = 1;
+ 			return 0;
+ 
+@@ -9691,6 +9693,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
+ 		status = -EBUSY;
+ 		break;
+ 	case -NFS4ERR_RECALLCONFLICT:
++	case -NFS4ERR_RETURNCONFLICT:
+ 		status = -ERECALLCONFLICT;
+ 		break;
+ 	case -NFS4ERR_DELEG_REVOKED:
+-- 
+2.43.0
+
diff --git a/queue-6.7/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch b/queue-6.7/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
new file mode 100644
index 00000000000..a1c05d7ccdf
--- /dev/null
+++ b/queue-6.7/null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
@@ -0,0 +1,59 @@
+From f86d48bdcb61d4ec1616bb8b5f5512fa10da62df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Dec 2023 09:23:02 +0000
+Subject: null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 9a9525de865410047fa962867b4fcd33943b206f ]
+
+null_blk has some rather odd capping of the max_hw_sectors value to
+BLK_DEF_MAX_SECTORS, which doesn't make sense - max_hw_sector is the
+hardware limit, and BLK_DEF_MAX_SECTORS despite the confusing name is the
+default cap for the max_sectors field used for normal file system I/O.
+
+Remove all the capping, and simply leave it to the block layer or
+user to take up or not all of that for file system I/O.
+
+Fixes: ea17fd354ca8 ("null_blk: Allow controlling max_hw_sectors limit")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20231227092305.279567-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/null_blk/main.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
+index 3021d58ca51c..13ed446b5e19 100644
+--- a/drivers/block/null_blk/main.c
++++ b/drivers/block/null_blk/main.c
+@@ -2186,10 +2186,8 @@ static int null_add_dev(struct nullb_device *dev)
+ 
+ 	blk_queue_logical_block_size(nullb->q, dev->blocksize);
+ 	blk_queue_physical_block_size(nullb->q, dev->blocksize);
+-	if (!dev->max_sectors)
+-		dev->max_sectors = queue_max_hw_sectors(nullb->q);
+-	dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS);
+-	blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
++	if (dev->max_sectors)
++		blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
+ 
+ 	if (dev->virt_boundary)
+ 		blk_queue_virt_boundary(nullb->q, PAGE_SIZE - 1);
+@@ -2289,12 +2287,6 @@ static int __init null_init(void)
+ 		g_bs = PAGE_SIZE;
+ 	}
+ 
+-	if (g_max_sectors > BLK_DEF_MAX_SECTORS) {
+-		pr_warn("invalid max sectors\n");
+-		pr_warn("defaults max sectors to %u\n", BLK_DEF_MAX_SECTORS);
+-		g_max_sectors = BLK_DEF_MAX_SECTORS;
+-	}
+-
+ 	if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) {
+ 		pr_err("invalid home_node value\n");
+ 		g_home_node = NUMA_NO_NODE;
+-- 
+2.43.0
+
diff --git a/queue-6.7/of-fix-double-free-in-of_parse_phandle_with_args_map.patch b/queue-6.7/of-fix-double-free-in-of_parse_phandle_with_args_map.patch
new file mode 100644
index 00000000000..317144dd655
--- /dev/null
+++ b/queue-6.7/of-fix-double-free-in-of_parse_phandle_with_args_map.patch
@@ -0,0 +1,231 @@
+From bd4bfef0035cfeff9ae330a05de7672f4d00ed51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Dec 2023 11:54:11 +0100
+Subject: of: Fix double free in of_parse_phandle_with_args_map
+
+From: Christian A. Ehrhardt <lk@c--e.de>
+
+[ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ]
+
+In of_parse_phandle_with_args_map() the inner loop that
+iterates through the map entries calls of_node_put(new)
+to free the reference acquired by the previous iteration
+of the inner loop. This assumes that the value of "new" is
+NULL on the first iteration of the inner loop.
+
+Make sure that this is true in all iterations of the outer
+loop by setting "new" to NULL after its value is assigned to "cur".
+
+Extend the unittest to detect the double free and add an additional
+test case that actually triggers this path.
+
+Fixes: bd6f2fd5a1 ("of: Support parsing phandle argument lists through a nexus node")
+Cc: Stephen Boyd <stephen.boyd@linaro.org>
+Signed-off-by: "Christian A. Ehrhardt" <lk@c--e.de>
+Link: https://lore.kernel.org/r/20231229105411.1603434-1-lk@c--e.de
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/base.c                           |  1 +
+ drivers/of/unittest-data/tests-phandle.dtsi | 10 ++-
+ drivers/of/unittest.c                       | 74 ++++++++++++---------
+ 3 files changed, 53 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 8d93cb6ea9cd..b0ad8fc06e80 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -1464,6 +1464,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
+ 		out_args->np = new;
+ 		of_node_put(cur);
+ 		cur = new;
++		new = NULL;
+ 	}
+ put:
+ 	of_node_put(cur);
+diff --git a/drivers/of/unittest-data/tests-phandle.dtsi b/drivers/of/unittest-data/tests-phandle.dtsi
+index d01f92f0f0db..554a996b2ef1 100644
+--- a/drivers/of/unittest-data/tests-phandle.dtsi
++++ b/drivers/of/unittest-data/tests-phandle.dtsi
+@@ -40,6 +40,13 @@ provider4: provider4 {
+ 				phandle-map-pass-thru = <0x0 0xf0>;
+ 			};
+ 
++			provider5: provider5 {
++				#phandle-cells = <2>;
++				phandle-map = <2 7 &provider4 2 3>;
++				phandle-map-mask = <0xff 0xf>;
++				phandle-map-pass-thru = <0x0 0xf0>;
++			};
++
+ 			consumer-a {
+ 				phandle-list =	<&provider1 1>,
+ 						<&provider2 2 0>,
+@@ -66,7 +73,8 @@ consumer-b {
+ 						<&provider4 4 0x100>,
+ 						<&provider4 0 0x61>,
+ 						<&provider0>,
+-						<&provider4 19 0x20>;
++						<&provider4 19 0x20>,
++						<&provider5 2 7>;
+ 				phandle-list-bad-phandle = <12345678 0 0>;
+ 				phandle-list-bad-args = <&provider2 1 0>,
+ 							<&provider4 0>;
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index e9e90e96600e..45bd0d28c717 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -456,6 +456,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ 
+ 		unittest(passed, "index %i - data error on node %pOF rc=%i\n",
+ 			 i, args.np, rc);
++
++		if (rc == 0)
++			of_node_put(args.np);
+ 	}
+ 
+ 	/* Check for missing list property */
+@@ -545,8 +548,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
+ 
+ static void __init of_unittest_parse_phandle_with_args_map(void)
+ {
+-	struct device_node *np, *p0, *p1, *p2, *p3;
++	struct device_node *np, *p[6] = {};
+ 	struct of_phandle_args args;
++	unsigned int prefs[6];
+ 	int i, rc;
+ 
+ 	np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b");
+@@ -555,34 +559,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 		return;
+ 	}
+ 
+-	p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
+-	if (!p0) {
+-		pr_err("missing testcase data\n");
+-		return;
+-	}
+-
+-	p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
+-	if (!p1) {
+-		pr_err("missing testcase data\n");
+-		return;
+-	}
+-
+-	p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
+-	if (!p2) {
+-		pr_err("missing testcase data\n");
+-		return;
+-	}
+-
+-	p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
+-	if (!p3) {
+-		pr_err("missing testcase data\n");
+-		return;
++	p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
++	p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
++	p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
++	p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
++	p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4");
++	p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5");
++	for (i = 0; i < ARRAY_SIZE(p); ++i) {
++		if (!p[i]) {
++			pr_err("missing testcase data\n");
++			return;
++		}
++		prefs[i] = kref_read(&p[i]->kobj.kref);
+ 	}
+ 
+ 	rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells");
+-	unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
++	unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
+ 
+-	for (i = 0; i < 8; i++) {
++	for (i = 0; i < 9; i++) {
+ 		bool passed = true;
+ 
+ 		memset(&args, 0, sizeof(args));
+@@ -593,13 +587,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 		switch (i) {
+ 		case 0:
+ 			passed &= !rc;
+-			passed &= (args.np == p1);
++			passed &= (args.np == p[1]);
+ 			passed &= (args.args_count == 1);
+ 			passed &= (args.args[0] == 1);
+ 			break;
+ 		case 1:
+ 			passed &= !rc;
+-			passed &= (args.np == p3);
++			passed &= (args.np == p[3]);
+ 			passed &= (args.args_count == 3);
+ 			passed &= (args.args[0] == 2);
+ 			passed &= (args.args[1] == 5);
+@@ -610,28 +604,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 			break;
+ 		case 3:
+ 			passed &= !rc;
+-			passed &= (args.np == p0);
++			passed &= (args.np == p[0]);
+ 			passed &= (args.args_count == 0);
+ 			break;
+ 		case 4:
+ 			passed &= !rc;
+-			passed &= (args.np == p1);
++			passed &= (args.np == p[1]);
+ 			passed &= (args.args_count == 1);
+ 			passed &= (args.args[0] == 3);
+ 			break;
+ 		case 5:
+ 			passed &= !rc;
+-			passed &= (args.np == p0);
++			passed &= (args.np == p[0]);
+ 			passed &= (args.args_count == 0);
+ 			break;
+ 		case 6:
+ 			passed &= !rc;
+-			passed &= (args.np == p2);
++			passed &= (args.np == p[2]);
+ 			passed &= (args.args_count == 2);
+ 			passed &= (args.args[0] == 15);
+ 			passed &= (args.args[1] == 0x20);
+ 			break;
+ 		case 7:
++			passed &= !rc;
++			passed &= (args.np == p[3]);
++			passed &= (args.args_count == 3);
++			passed &= (args.args[0] == 2);
++			passed &= (args.args[1] == 5);
++			passed &= (args.args[2] == 3);
++			break;
++		case 8:
+ 			passed &= (rc == -ENOENT);
+ 			break;
+ 		default:
+@@ -640,6 +642,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 
+ 		unittest(passed, "index %i - data error on node %s rc=%i\n",
+ 			 i, args.np->full_name, rc);
++
++		if (rc == 0)
++			of_node_put(args.np);
+ 	}
+ 
+ 	/* Check for missing list property */
+@@ -686,6 +691,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 		   "OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found 1");
+ 
+ 	unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
++
++	for (i = 0; i < ARRAY_SIZE(p); ++i) {
++		unittest(prefs[i] == kref_read(&p[i]->kobj.kref),
++			 "provider%d: expected:%d got:%d\n",
++			 i, prefs[i], kref_read(&p[i]->kobj.kref));
++		of_node_put(p[i]);
++	}
+ }
+ 
+ static void __init of_unittest_property_string(void)
+-- 
+2.43.0
+
diff --git a/queue-6.7/of-unittest-fix-of_count_phandle_with_args-expected-.patch b/queue-6.7/of-unittest-fix-of_count_phandle_with_args-expected-.patch
new file mode 100644
index 00000000000..8959bd42bcc
--- /dev/null
+++ b/queue-6.7/of-unittest-fix-of_count_phandle_with_args-expected-.patch
@@ -0,0 +1,38 @@
+From dbe926766f0232089fe33fc1527ef6a4b47259b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jan 2024 09:50:25 +0100
+Subject: of: unittest: Fix of_count_phandle_with_args() expected value message
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 716089b417cf98d01f0dc1b39f9c47e1d7b4c965 ]
+
+The expected result value for the call to of_count_phandle_with_args()
+was updated from 7 to 8, but the accompanying error message was
+forgotten.
+
+Fixes: 4dde83569832f937 ("of: Fix double free in of_parse_phandle_with_args_map")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20240111085025.2073894-1-geert+renesas@glider.be
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/unittest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 45bd0d28c717..cfd60e35a899 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -574,7 +574,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
+ 	}
+ 
+ 	rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells");
+-	unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
++	unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 8\n", rc);
+ 
+ 	for (i = 0; i < 9; i++) {
+ 		bool passed = true;
+-- 
+2.43.0
+
diff --git a/queue-6.7/perf-arm-cmn-fix-hn-f-class_occup_id-events.patch b/queue-6.7/perf-arm-cmn-fix-hn-f-class_occup_id-events.patch
new file mode 100644
index 00000000000..ecde32f94d6
--- /dev/null
+++ b/queue-6.7/perf-arm-cmn-fix-hn-f-class_occup_id-events.patch
@@ -0,0 +1,40 @@
+From 697b0e125cf7eba0cdbca5ee35a4ef59ee26ef0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Nov 2023 11:58:13 +0000
+Subject: perf/arm-cmn: Fix HN-F class_occup_id events
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 590f23b092401f29e410fd4ca67128fcc45192fc ]
+
+A subtle copy-paste error managed to slip through the reorganisation
+of these patches in development, and not only give some HN-F events
+the wrong type, but use that wrong type before the subsequent patch
+defined it. Too late to fix history, but we can at least fix the bug.
+
+Fixes: b1b7dc38e482 ("perf/arm-cmn: Refactor HN-F event selector macros")
+Reported-by: Jing Zhang <renyu.zj@linux.alibaba.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/5a22439de84ff188ef76674798052448eb03a3e1.1700740693.git.robin.murphy@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cmn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
+index 847b0dc41293..c584165b13ba 100644
+--- a/drivers/perf/arm-cmn.c
++++ b/drivers/perf/arm-cmn.c
+@@ -811,7 +811,7 @@ static umode_t arm_cmn_event_attr_is_visible(struct kobject *kobj,
+ #define CMN_EVENT_HNF_OCC(_model, _name, _event)			\
+ 	CMN_EVENT_HN_OCC(_model, hnf_##_name, CMN_TYPE_HNF, _event)
+ #define CMN_EVENT_HNF_CLS(_model, _name, _event)			\
+-	CMN_EVENT_HN_CLS(_model, hnf_##_name, CMN_TYPE_HNS, _event)
++	CMN_EVENT_HN_CLS(_model, hnf_##_name, CMN_TYPE_HNF, _event)
+ #define CMN_EVENT_HNF_SNT(_model, _name, _event)			\
+ 	CMN_EVENT_HN_SNT(_model, hnf_##_name, CMN_TYPE_HNF, _event)
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/perf-x86-intel-uncore-fix-null-pointer-dereference-i.patch b/queue-6.7/perf-x86-intel-uncore-fix-null-pointer-dereference-i.patch
new file mode 100644
index 00000000000..3bd483e5dba
--- /dev/null
+++ b/queue-6.7/perf-x86-intel-uncore-fix-null-pointer-dereference-i.patch
@@ -0,0 +1,65 @@
+From c96571ba3e24e1efd4465ecacca43f494b9eb0a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 10:52:45 -0800
+Subject: perf/x86/intel/uncore: Fix NULL pointer dereference issue in
+ upi_fill_topology()
+
+From: Alexander Antonov <alexander.antonov@linux.intel.com>
+
+[ Upstream commit 1692cf434ba13ee212495b5af795b6a07e986ce4 ]
+
+Get logical socket id instead of physical id in discover_upi_topology()
+to avoid out-of-bound access on 'upi = &type->topology[nid][idx];' line
+that leads to NULL pointer dereference in upi_fill_topology()
+
+Fixes: f680b6e6062e ("perf/x86/intel/uncore: Enable UPI topology discovery for Icelake Server")
+Reported-by: Kyle Meyer <kyle.meyer@hpe.com>
+Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Tested-by: Kyle Meyer <kyle.meyer@hpe.com>
+Link: https://lore.kernel.org/r/20231127185246.2371939-2-alexander.antonov@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/uncore_snbep.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index 8250f0f59c2b..49bc27ab26ad 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -5596,7 +5596,7 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i
+ 	struct pci_dev *ubox = NULL;
+ 	struct pci_dev *dev = NULL;
+ 	u32 nid, gid;
+-	int i, idx, ret = -EPERM;
++	int i, idx, lgc_pkg, ret = -EPERM;
+ 	struct intel_uncore_topology *upi;
+ 	unsigned int devfn;
+ 
+@@ -5614,8 +5614,13 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i
+ 		for (i = 0; i < 8; i++) {
+ 			if (nid != GIDNIDMAP(gid, i))
+ 				continue;
++			lgc_pkg = topology_phys_to_logical_pkg(i);
++			if (lgc_pkg < 0) {
++				ret = -EPERM;
++				goto err;
++			}
+ 			for (idx = 0; idx < type->num_boxes; idx++) {
+-				upi = &type->topology[nid][idx];
++				upi = &type->topology[lgc_pkg][idx];
+ 				devfn = PCI_DEVFN(dev_link0 + idx, ICX_UPI_REGS_ADDR_FUNCTION);
+ 				dev = pci_get_domain_bus_and_slot(pci_domain_nr(ubox->bus),
+ 								  ubox->bus->number,
+@@ -5626,6 +5631,7 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i
+ 						goto err;
+ 				}
+ 			}
++			break;
+ 		}
+ 	}
+ err:
+-- 
+2.43.0
+
diff --git a/queue-6.7/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch b/queue-6.7/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
new file mode 100644
index 00000000000..1bebef5b4d2
--- /dev/null
+++ b/queue-6.7/platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
@@ -0,0 +1,105 @@
+From 4081490c75dfabbf5e435c1c41d2c852f9385a86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 14:21:13 -0800
+Subject: platform/x86/intel/vsec: Fix xa_alloc memory leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David E. Box <david.e.box@linux.intel.com>
+
+[ Upstream commit 8cbcc1dbf8a62c730fadd60de761e0658547a589 ]
+
+Commit 936874b77dd0 ("platform/x86/intel/vsec: Add PCI error recovery
+support to Intel PMT") added an xarray to track the list of vsec devices to
+be recovered after a PCI error. But it did not provide cleanup for the list
+leading to a memory leak that was caught by kmemleak.  Do xa_alloc() before
+devm_add_action_or_reset() so that the list may be cleaned up with
+xa_erase() in the release function.
+
+Fixes: 936874b77dd0 ("platform/x86/intel/vsec: Add PCI error recovery support to Intel PMT")
+Signed-off-by: David E. Box <david.e.box@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20231129222132.2331261-2-david.e.box@linux.intel.com
+[hdegoede@redhat.com: Add missing xa_erase() on error-exit
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel/vsec.c | 25 +++++++++++++++----------
+ drivers/platform/x86/intel/vsec.h |  1 +
+ 2 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/platform/x86/intel/vsec.c b/drivers/platform/x86/intel/vsec.c
+index c1f9e4471b28..343ab6a82c01 100644
+--- a/drivers/platform/x86/intel/vsec.c
++++ b/drivers/platform/x86/intel/vsec.c
+@@ -120,6 +120,8 @@ static void intel_vsec_dev_release(struct device *dev)
+ {
+ 	struct intel_vsec_device *intel_vsec_dev = dev_to_ivdev(dev);
+ 
++	xa_erase(&auxdev_array, intel_vsec_dev->id);
++
+ 	mutex_lock(&vsec_ida_lock);
+ 	ida_free(intel_vsec_dev->ida, intel_vsec_dev->auxdev.id);
+ 	mutex_unlock(&vsec_ida_lock);
+@@ -135,19 +137,28 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
+ 	struct auxiliary_device *auxdev = &intel_vsec_dev->auxdev;
+ 	int ret, id;
+ 
+-	mutex_lock(&vsec_ida_lock);
+-	ret = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
+-	mutex_unlock(&vsec_ida_lock);
++	ret = xa_alloc(&auxdev_array, &intel_vsec_dev->id, intel_vsec_dev,
++		       PMT_XA_LIMIT, GFP_KERNEL);
+ 	if (ret < 0) {
+ 		kfree(intel_vsec_dev->resource);
+ 		kfree(intel_vsec_dev);
+ 		return ret;
+ 	}
+ 
++	mutex_lock(&vsec_ida_lock);
++	id = ida_alloc(intel_vsec_dev->ida, GFP_KERNEL);
++	mutex_unlock(&vsec_ida_lock);
++	if (id < 0) {
++		xa_erase(&auxdev_array, intel_vsec_dev->id);
++		kfree(intel_vsec_dev->resource);
++		kfree(intel_vsec_dev);
++		return id;
++	}
++
+ 	if (!parent)
+ 		parent = &pdev->dev;
+ 
+-	auxdev->id = ret;
++	auxdev->id = id;
+ 	auxdev->name = name;
+ 	auxdev->dev.parent = parent;
+ 	auxdev->dev.release = intel_vsec_dev_release;
+@@ -169,12 +180,6 @@ int intel_vsec_add_aux(struct pci_dev *pdev, struct device *parent,
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	/* Add auxdev to list */
+-	ret = xa_alloc(&auxdev_array, &id, intel_vsec_dev, PMT_XA_LIMIT,
+-		       GFP_KERNEL);
+-	if (ret)
+-		return ret;
+-
+ 	return 0;
+ }
+ EXPORT_SYMBOL_NS_GPL(intel_vsec_add_aux, INTEL_VSEC);
+diff --git a/drivers/platform/x86/intel/vsec.h b/drivers/platform/x86/intel/vsec.h
+index 0fd042c171ba..0a6201b4a0e9 100644
+--- a/drivers/platform/x86/intel/vsec.h
++++ b/drivers/platform/x86/intel/vsec.h
+@@ -45,6 +45,7 @@ struct intel_vsec_device {
+ 	struct ida *ida;
+ 	struct intel_vsec_platform_info *info;
+ 	int num_resources;
++	int id; /* xa */
+ 	void *priv_data;
+ 	size_t priv_data_size;
+ };
+-- 
+2.43.0
+
diff --git a/queue-6.7/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch b/queue-6.7/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
new file mode 100644
index 00000000000..7c80a2c98b4
--- /dev/null
+++ b/queue-6.7/pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
@@ -0,0 +1,92 @@
+From 5cd70fd03308a896595a95cad7f7b08c15c7c195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 06:25:13 -0500
+Subject: pNFS: Fix the pnfs block driver's calculation of layoutget size
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 8a6291bf3b0eae1bf26621e6419a91682f2d6227 ]
+
+Instead of relying on the value of the 'bytes_left' field, we should
+calculate the layout size based on the offset of the request that is
+being written out.
+
+Reported-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Fixes: 954998b60caa ("NFS: Fix error handling for O_DIRECT write scheduling")
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Tested-by: Benjamin Coddington <bcodding@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/blocklayout/blocklayout.c | 5 ++---
+ fs/nfs/direct.c                  | 5 +++--
+ fs/nfs/internal.h                | 2 +-
+ fs/nfs/pnfs.c                    | 3 ++-
+ 4 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
+index 1d1d7abc3205..6be13e0ec170 100644
+--- a/fs/nfs/blocklayout/blocklayout.c
++++ b/fs/nfs/blocklayout/blocklayout.c
+@@ -895,10 +895,9 @@ bl_pg_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req)
+ 	}
+ 
+ 	if (pgio->pg_dreq == NULL)
+-		wb_size = pnfs_num_cont_bytes(pgio->pg_inode,
+-					      req->wb_index);
++		wb_size = pnfs_num_cont_bytes(pgio->pg_inode, req->wb_index);
+ 	else
+-		wb_size = nfs_dreq_bytes_left(pgio->pg_dreq);
++		wb_size = nfs_dreq_bytes_left(pgio->pg_dreq, req_offset(req));
+ 
+ 	pnfs_generic_pg_init_write(pgio, req, wb_size);
+ 
+diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
+index f6c74f424691..5918c67dae0d 100644
+--- a/fs/nfs/direct.c
++++ b/fs/nfs/direct.c
+@@ -205,9 +205,10 @@ static void nfs_direct_req_release(struct nfs_direct_req *dreq)
+ 	kref_put(&dreq->kref, nfs_direct_req_free);
+ }
+ 
+-ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq)
++ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq, loff_t offset)
+ {
+-	return dreq->bytes_left;
++	loff_t start = offset - dreq->io_start;
++	return dreq->max_count - start;
+ }
+ EXPORT_SYMBOL_GPL(nfs_dreq_bytes_left);
+ 
+diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
+index 9c9cf764f600..b1fa81c9dff6 100644
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -655,7 +655,7 @@ extern int nfs_sillyrename(struct inode *dir, struct dentry *dentry);
+ /* direct.c */
+ void nfs_init_cinfo_from_dreq(struct nfs_commit_info *cinfo,
+ 			      struct nfs_direct_req *dreq);
+-extern ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq);
++extern ssize_t nfs_dreq_bytes_left(struct nfs_direct_req *dreq, loff_t offset);
+ 
+ /* nfs4proc.c */
+ extern struct nfs_client *nfs4_init_client(struct nfs_client *clp,
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 21a365357629..0c0fed1ecd0b 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2733,7 +2733,8 @@ pnfs_generic_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *r
+ 		if (pgio->pg_dreq == NULL)
+ 			rd_size = i_size_read(pgio->pg_inode) - req_offset(req);
+ 		else
+-			rd_size = nfs_dreq_bytes_left(pgio->pg_dreq);
++			rd_size = nfs_dreq_bytes_left(pgio->pg_dreq,
++						      req_offset(req));
+ 
+ 		pgio->pg_lseg =
+ 			pnfs_update_layout(pgio->pg_inode, nfs_req_openctx(req),
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-44x-select-i2c-for-currituck.patch b/queue-6.7/powerpc-44x-select-i2c-for-currituck.patch
new file mode 100644
index 00000000000..34dabe13323
--- /dev/null
+++ b/queue-6.7/powerpc-44x-select-i2c-for-currituck.patch
@@ -0,0 +1,43 @@
+From 077ed6706e00e16ed9cace13e6b0ef90eeca7573 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 21:51:59 -0800
+Subject: powerpc/44x: select I2C for CURRITUCK
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012 ]
+
+Fix build errors when CURRITUCK=y and I2C is not builtin (=m or is
+not set). Fixes these build errors:
+
+powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `avr_halt_system':
+ppc476.c:(.text+0x58): undefined reference to `i2c_smbus_write_byte_data'
+powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `ppc47x_device_probe':
+ppc476.c:(.init.text+0x18): undefined reference to `i2c_register_driver'
+
+Fixes: 2a2c74b2efcb ("IBM Akebono: Add the Akebono platform")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: lore.kernel.org/r/202312010820.cmdwF5X9-lkp@intel.com
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231201055159.8371-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/44x/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig
+index 1624ebf95497..35a1f4b9f827 100644
+--- a/arch/powerpc/platforms/44x/Kconfig
++++ b/arch/powerpc/platforms/44x/Kconfig
+@@ -173,6 +173,7 @@ config ISS4xx
+ config CURRITUCK
+ 	bool "IBM Currituck (476fpe) Support"
+ 	depends on PPC_47x
++	select I2C
+ 	select SWIOTLB
+ 	select 476FPE
+ 	select FORCE_PCI
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch b/queue-6.7/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
new file mode 100644
index 00000000000..4aa0fa885a5
--- /dev/null
+++ b/queue-6.7/powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
@@ -0,0 +1,50 @@
+From 13bd2510a7d4ac02602394c4d9c1a120f2d287b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Nov 2023 08:23:32 +0900
+Subject: powerpc: add crtsavres.o to always-y instead of extra-y
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 1b1e38002648819c04773647d5242990e2824264 ]
+
+crtsavres.o is linked to modules. However, as explained in commit
+d0e628cd817f ("kbuild: doc: clarify the difference between extra-y
+and always-y"), 'make modules' does not build extra-y.
+
+For example, the following command fails:
+
+  $ make ARCH=powerpc LLVM=1 KBUILD_MODPOST_WARN=1 mrproper ps3_defconfig modules
+    [snip]
+    LD [M]  arch/powerpc/platforms/cell/spufs/spufs.ko
+  ld.lld: error: cannot open arch/powerpc/lib/crtsavres.o: No such file or directory
+  make[3]: *** [scripts/Makefile.modfinal:56: arch/powerpc/platforms/cell/spufs/spufs.ko] Error 1
+  make[2]: *** [Makefile:1844: modules] Error 2
+  make[1]: *** [/home/masahiro/workspace/linux-kbuild/Makefile:350: __build_one_by_one] Error 2
+  make: *** [Makefile:234: __sub-make] Error 2
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Fixes: baa25b571a16 ("powerpc/64: Do not link crtsavres.o in vmlinux")
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231120232332.4100288-1-masahiroy@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/lib/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
+index 51ad0397c17a..6eac63e79a89 100644
+--- a/arch/powerpc/lib/Makefile
++++ b/arch/powerpc/lib/Makefile
+@@ -45,7 +45,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION)	+= error-inject.o
+ # so it is only needed for modules, and only for older linkers which
+ # do not support --save-restore-funcs
+ ifndef CONFIG_LD_IS_BFD
+-extra-$(CONFIG_PPC64)	+= crtsavres.o
++always-$(CONFIG_PPC64)	+= crtsavres.o
+ endif
+ 
+ obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-hv-gpci-add-return-value-check-in-affinity_d.patch b/queue-6.7/powerpc-hv-gpci-add-return-value-check-in-affinity_d.patch
new file mode 100644
index 00000000000..68de014fd6c
--- /dev/null
+++ b/queue-6.7/powerpc-hv-gpci-add-return-value-check-in-affinity_d.patch
@@ -0,0 +1,67 @@
+From 68152ed3f9d61ac0e4e658552adf8c8ff2f27f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Nov 2023 17:50:32 +0530
+Subject: powerpc/hv-gpci: Add return value check in
+ affinity_domain_via_partition_show function
+
+From: Kajol Jain <kjain@linux.ibm.com>
+
+[ Upstream commit 070b71f428facd9130319707db854ed8bd24637a ]
+
+To access hv-gpci kernel interface files data, the
+"Enable Performance Information Collection" option has to be set
+in hmc. Incase that option is not set and user try to read
+the interface files, it should give error message as
+operation not permitted.
+
+Result of accessing added interface files with disabled
+performance collection option:
+
+[command]# cat processor_bus_topology
+cat: processor_bus_topology: Operation not permitted
+
+[command]# cat processor_config
+cat: processor_config: Operation not permitted
+
+[command]# cat affinity_domain_via_domain
+cat: affinity_domain_via_domain: Operation not permitted
+
+[command]# cat affinity_domain_via_virtual_processor
+cat: affinity_domain_via_virtual_processor: Operation not permitted
+
+[command]# cat affinity_domain_via_partition
+
+Based on above result there is no error message when reading
+affinity_domain_via_partition file because of missing
+check for failed hcall. Fix this issue by adding
+a check in the start of affinity_domain_via_partition_show
+function, to return error incase hcall fails, with error type
+other then H_PARAMETER.
+
+Fixes: a15e0d6a6929 ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via partition information")
+Reported-by: Disha Goel <disgoel@linux.vnet.ibm.com>
+Signed-off-by: Kajol Jain <kjain@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231116122033.160964-1-kjain@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/hv-gpci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c
+index 39dbe6b348df..27f18119fda1 100644
+--- a/arch/powerpc/perf/hv-gpci.c
++++ b/arch/powerpc/perf/hv-gpci.c
+@@ -534,6 +534,9 @@ static ssize_t affinity_domain_via_partition_show(struct device *dev, struct dev
+ 	if (!ret)
+ 		goto parse_result;
+ 
++	if (ret && (ret != H_PARAMETER))
++		goto out;
++
+ 	/*
+ 	 * ret value as 'H_PARAMETER' implies that the current buffer size
+ 	 * can't accommodate all the information, and a partial buffer
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch b/queue-6.7/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
new file mode 100644
index 00000000000..4776c3911fe
--- /dev/null
+++ b/queue-6.7/powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
@@ -0,0 +1,55 @@
+From 88aaa57f4f85352beaff8059eb343d46310d6927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 17:37:19 +0800
+Subject: powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit 0a233867a39078ebb0f575e2948593bbff5826b3 ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+
+Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/imc-pmu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index 5d12ca386c1f..8664a7d297ad 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -299,6 +299,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
+ 	attr_group->attrs = attrs;
+ 	do {
+ 		ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value);
++		if (!ev_val_str)
++			continue;
+ 		dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str);
+ 		if (!dev_str)
+ 			continue;
+@@ -306,6 +308,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
+ 		attrs[j++] = dev_str;
+ 		if (pmu->events[i].scale) {
+ 			ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name);
++			if (!ev_scale_str)
++				continue;
+ 			dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale);
+ 			if (!dev_str)
+ 				continue;
+@@ -315,6 +319,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
+ 
+ 		if (pmu->events[i].unit) {
+ 			ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name);
++			if (!ev_unit_str)
++				continue;
+ 			dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit);
+ 			if (!dev_str)
+ 				continue;
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch b/queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
new file mode 100644
index 00000000000..1ebc8266841
--- /dev/null
+++ b/queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
@@ -0,0 +1,37 @@
+From a2579b1e274eaaf76be84e52876242102b884313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 11:07:55 +0800
+Subject: powerpc/powernv: Add a null pointer check in opal_event_init()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+
+Fixes: 2717a33d6074 ("powerpc/opal-irqchip: Use interrupt names if present")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231127030755.1546750-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c
+index f9a7001dacb7..56a1f7ce78d2 100644
+--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
++++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
+@@ -275,6 +275,8 @@ int __init opal_event_init(void)
+ 		else
+ 			name = kasprintf(GFP_KERNEL, "opal");
+ 
++		if (!name)
++			continue;
+ 		/* Install interrupt handler */
+ 		rc = request_irq(r->start, opal_interrupt, r->flags & IRQD_TRIGGER_MASK,
+ 				 name, NULL);
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch b/queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
new file mode 100644
index 00000000000..d6f7b753026
--- /dev/null
+++ b/queue-6.7/powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
@@ -0,0 +1,41 @@
+From 58ba1b7f04797864963806d5ff645af2371c3f0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Nov 2023 17:57:39 +0800
+Subject: powerpc/powernv: Add a null pointer check in opal_powercap_init()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit e123015c0ba859cf48aa7f89c5016cc6e98e018d ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+
+Fixes: b9ef7b4b867f ("powerpc: Convert to using %pOFn instead of device_node.name")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231126095739.1501990-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/opal-powercap.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-powercap.c b/arch/powerpc/platforms/powernv/opal-powercap.c
+index 7bfe4cbeb35a..ea917266aa17 100644
+--- a/arch/powerpc/platforms/powernv/opal-powercap.c
++++ b/arch/powerpc/platforms/powernv/opal-powercap.c
+@@ -196,6 +196,12 @@ void __init opal_powercap_init(void)
+ 
+ 		j = 0;
+ 		pcaps[i].pg.name = kasprintf(GFP_KERNEL, "%pOFn", node);
++		if (!pcaps[i].pg.name) {
++			kfree(pcaps[i].pattrs);
++			kfree(pcaps[i].pg.attrs);
++			goto out_pcaps_pattrs;
++		}
++
+ 		if (has_min) {
+ 			powercap_add_attr(min, "powercap-min",
+ 					  &pcaps[i].pattrs[j]);
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch b/queue-6.7/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
new file mode 100644
index 00000000000..074388fea06
--- /dev/null
+++ b/queue-6.7/powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
@@ -0,0 +1,41 @@
+From d0cf3dd82842be9e03d36994526a977f008640b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 16:59:37 +0800
+Subject: powerpc/powernv: Add a null pointer check to scom_debug_init_one()
+
+From: Kunwu Chan <chentao@kylinos.cn>
+
+[ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ]
+
+kasprintf() returns a pointer to dynamically allocated memory
+which can be NULL upon failure.
+Add a null pointer check, and release 'ent' to avoid memory leaks.
+
+Fixes: bfd2f0d49aef ("powerpc/powernv: Get rid of old scom_controller abstraction")
+Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231208085937.107210-1-chentao@kylinos.cn
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c
+index 262cd6fac907..748c2b97fa53 100644
+--- a/arch/powerpc/platforms/powernv/opal-xscom.c
++++ b/arch/powerpc/platforms/powernv/opal-xscom.c
+@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn,
+ 	ent->chip = chip;
+ 	snprintf(ent->name, 16, "%08x", chip);
+ 	ent->path.data = (void *)kasprintf(GFP_KERNEL, "%pOF", dn);
++	if (!ent->path.data) {
++		kfree(ent);
++		return -ENOMEM;
++	}
++
+ 	ent->path.size = strlen((char *)ent->path.data);
+ 
+ 	dir = debugfs_create_dir(ent->name, root);
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch b/queue-6.7/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
new file mode 100644
index 00000000000..1cbbbf5fc94
--- /dev/null
+++ b/queue-6.7/powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
@@ -0,0 +1,101 @@
+From b7b8f808085e951c4f302e00aa6cd81a6745d714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 11:01:53 -0600
+Subject: powerpc/pseries/memhp: Fix access beyond end of drmem array
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 ]
+
+dlpar_memory_remove_by_index() may access beyond the bounds of the
+drmem lmb array when the LMB lookup fails to match an entry with the
+given DRC index. When the search fails, the cursor is left pointing to
+&drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the
+last valid entry in the array. The debug message at the end of the
+function then dereferences this pointer:
+
+        pr_debug("Failed to hot-remove memory at %llx\n",
+                 lmb->base_addr);
+
+This was found by inspection and confirmed with KASAN:
+
+  pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234
+  ==================================================================
+  BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658
+  Read of size 8 at addr c000000364e97fd0 by task bash/949
+
+  dump_stack_lvl+0xa4/0xfc (unreliable)
+  print_report+0x214/0x63c
+  kasan_report+0x140/0x2e0
+  __asan_load8+0xa8/0xe0
+  dlpar_memory+0x298/0x1658
+  handle_dlpar_errorlog+0x130/0x1d0
+  dlpar_store+0x18c/0x3e0
+  kobj_attr_store+0x68/0xa0
+  sysfs_kf_write+0xc4/0x110
+  kernfs_fop_write_iter+0x26c/0x390
+  vfs_write+0x2d4/0x4e0
+  ksys_write+0xac/0x1a0
+  system_call_exception+0x268/0x530
+  system_call_vectored_common+0x15c/0x2ec
+
+  Allocated by task 1:
+   kasan_save_stack+0x48/0x80
+   kasan_set_track+0x34/0x50
+   kasan_save_alloc_info+0x34/0x50
+   __kasan_kmalloc+0xd0/0x120
+   __kmalloc+0x8c/0x320
+   kmalloc_array.constprop.0+0x48/0x5c
+   drmem_init+0x2a0/0x41c
+   do_one_initcall+0xe0/0x5c0
+   kernel_init_freeable+0x4ec/0x5a0
+   kernel_init+0x30/0x1e0
+   ret_from_kernel_user_thread+0x14/0x1c
+
+  The buggy address belongs to the object at c000000364e80000
+   which belongs to the cache kmalloc-128k of size 131072
+  The buggy address is located 0 bytes to the right of
+   allocated 98256-byte region [c000000364e80000, c000000364e97fd0)
+
+  ==================================================================
+  pseries-hotplug-mem: Failed to hot-remove memory at 0
+
+Log failed lookups with a separate message and dereference the
+cursor only when it points to a valid entry.
+
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Fixes: 51925fb3c5c9 ("powerpc/pseries: Implement memory hotplug remove in the kernel")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231114-pseries-memhp-fixes-v1-1-fb8f2bb7c557@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index a43bfb01720a..6f2eebae7bee 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -436,14 +436,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index)
+ 		}
+ 	}
+ 
+-	if (!lmb_found)
++	if (!lmb_found) {
++		pr_debug("Failed to look up LMB for drc index %x\n", drc_index);
+ 		rc = -EINVAL;
+-
+-	if (rc)
++	} else if (rc) {
+ 		pr_debug("Failed to hot-remove memory at %llx\n",
+ 			 lmb->base_addr);
+-	else
++	} else {
+ 		pr_debug("Memory at %llx was hot-removed\n", lmb->base_addr);
++	}
+ 
+ 	return rc;
+ }
+-- 
+2.43.0
+
diff --git a/queue-6.7/powerpc-rtas-avoid-warning-on-invalid-token-argument.patch b/queue-6.7/powerpc-rtas-avoid-warning-on-invalid-token-argument.patch
new file mode 100644
index 00000000000..724e5914985
--- /dev/null
+++ b/queue-6.7/powerpc-rtas-avoid-warning-on-invalid-token-argument.patch
@@ -0,0 +1,94 @@
+From 60e97eae86624e697bd6227b268445268c2292f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 11:01:48 -0600
+Subject: powerpc/rtas: Avoid warning on invalid token argument to sys_rtas()
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 01e346ffefda3a7088afebf02b940614179688e7 ]
+
+rtas_token_to_function() WARNs when passed an invalid token; it's
+meant to catch bugs in kernel-based users of RTAS functions. However,
+user space controls the token value passed to rtas_token_to_function()
+by block_rtas_call(), so user space with sufficient privilege to use
+sys_rtas() can trigger the warnings at will:
+
+  unexpected failed lookup for token 2048
+  WARNING: CPU: 20 PID: 2247 at arch/powerpc/kernel/rtas.c:556
+    rtas_token_to_function+0xfc/0x110
+  ...
+  NIP rtas_token_to_function+0xfc/0x110
+  LR  rtas_token_to_function+0xf8/0x110
+  Call Trace:
+    rtas_token_to_function+0xf8/0x110 (unreliable)
+    sys_rtas+0x188/0x880
+    system_call_exception+0x268/0x530
+    system_call_common+0x160/0x2c4
+
+It's desirable to continue warning on bogus tokens in
+rtas_token_to_function(). Currently it is used to look up RTAS
+function descriptors when tracing, where we know there has to have
+been a successful descriptor lookup by different means already, and it
+would be a serious inconsistency for the reverse lookup to fail.
+
+So instead of weakening rtas_token_to_function()'s contract by
+removing the warnings, introduce rtas_token_to_function_untrusted(),
+which has no opinion on failed lookups. Convert block_rtas_call() and
+rtas_token_to_function() to use it.
+
+Fixes: 8252b88294d2 ("powerpc/rtas: improve function information lookups")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231212-papr-sys_rtas-vs-lockdown-v6-1-e9eafd0c8c6c@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index eddc031c4b95..87d65bdd3eca 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -544,6 +544,21 @@ static int __init rtas_token_to_function_xarray_init(void)
+ }
+ arch_initcall(rtas_token_to_function_xarray_init);
+ 
++/*
++ * For use by sys_rtas(), where the token value is provided by user
++ * space and we don't want to warn on failed lookups.
++ */
++static const struct rtas_function *rtas_token_to_function_untrusted(s32 token)
++{
++	return xa_load(&rtas_token_to_function_xarray, token);
++}
++
++/*
++ * Reverse lookup for deriving the function descriptor from a
++ * known-good token value in contexts where the former is not already
++ * available. @token must be valid, e.g. derived from the result of a
++ * prior lookup against the function table.
++ */
+ static const struct rtas_function *rtas_token_to_function(s32 token)
+ {
+ 	const struct rtas_function *func;
+@@ -551,7 +566,7 @@ static const struct rtas_function *rtas_token_to_function(s32 token)
+ 	if (WARN_ONCE(token < 0, "invalid token %d", token))
+ 		return NULL;
+ 
+-	func = xa_load(&rtas_token_to_function_xarray, token);
++	func = rtas_token_to_function_untrusted(token);
+ 
+ 	if (WARN_ONCE(!func, "unexpected failed lookup for token %d", token))
+ 		return NULL;
+@@ -1726,7 +1741,7 @@ static bool block_rtas_call(int token, int nargs,
+ 	 * If this token doesn't correspond to a function the kernel
+ 	 * understands, you're not allowed to call it.
+ 	 */
+-	func = rtas_token_to_function(token);
++	func = rtas_token_to_function_untrusted(token);
+ 	if (!func)
+ 		goto err;
+ 	/*
+-- 
+2.43.0
+
diff --git a/queue-6.7/pstore-ram_core-fix-possible-overflow-in-persistent_.patch b/queue-6.7/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
new file mode 100644
index 00000000000..4febafe516b
--- /dev/null
+++ b/queue-6.7/pstore-ram_core-fix-possible-overflow-in-persistent_.patch
@@ -0,0 +1,46 @@
+From 0d4995acf67c774e8950270997d6e30ce59e964b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Nov 2023 23:29:36 +0300
+Subject: pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
+
+From: Sergey Shtylyov <s.shtylyov@omp.ru>
+
+[ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ]
+
+In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return
+64-bit value since persistent_ram_zone::buffer_size has type size_t which
+is derived from the 64-bit *unsigned long*, while the ecc_blocks variable
+this value gets assigned to has (always 32-bit) *int* type.  Even if that
+value fits into *int* type, an overflow is still possible when calculating
+the size_t typed ecc_total variable further below since there's no cast to
+any 64-bit type before multiplication.  Declaring the ecc_blocks variable
+as *size_t* should fix this mess...
+
+Found by Linux Verification Center (linuxtesting.org) with the SVACE static
+analysis tool.
+
+Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support")
+Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
+index 650e437b55e6..f1848cdd6d34 100644
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz,
+ {
+ 	int numerr;
+ 	struct persistent_ram_buffer *buffer = prz->buffer;
+-	int ecc_blocks;
++	size_t ecc_blocks;
+ 	size_t ecc_total;
+ 
+ 	if (!ecc_info || !ecc_info->ecc_size)
+-- 
+2.43.0
+
diff --git a/queue-6.7/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch b/queue-6.7/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
new file mode 100644
index 00000000000..b80d04c3815
--- /dev/null
+++ b/queue-6.7/pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
@@ -0,0 +1,80 @@
+From 87cde755f1a71872ef4f2cc1dca92fd46bb19f26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 22:07:04 +0200
+Subject: pwm: stm32: Fix enable count for clk in .probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 19f1016ea9600ed89bc24247c36ff5934ad94fbb ]
+
+Make the driver take over hardware state without disabling in .probe()
+and enable the clock for each enabled channel.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+[ukleinek: split off from a patch that also implemented .get_state()]
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm")
+Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
+index ffdfd81c0613..58ece15ef6c3 100644
+--- a/drivers/pwm/pwm-stm32.c
++++ b/drivers/pwm/pwm-stm32.c
+@@ -578,17 +578,21 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
+ 	priv->have_complementary_output = (ccer != 0);
+ }
+ 
+-static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv)
++static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv,
++					      unsigned int *num_enabled)
+ {
+-	u32 ccer;
++	u32 ccer, ccer_backup;
+ 
+ 	/*
+ 	 * If channels enable bits don't exist writing 1 will have no
+ 	 * effect so we can detect and count them.
+ 	 */
++	regmap_read(priv->regmap, TIM_CCER, &ccer_backup);
+ 	regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
+ 	regmap_read(priv->regmap, TIM_CCER, &ccer);
+-	regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
++	regmap_write(priv->regmap, TIM_CCER, ccer_backup);
++
++	*num_enabled = hweight32(ccer_backup & TIM_CCER_CCXE);
+ 
+ 	return hweight32(ccer & TIM_CCER_CCXE);
+ }
+@@ -599,6 +603,8 @@ static int stm32_pwm_probe(struct platform_device *pdev)
+ 	struct device_node *np = dev->of_node;
+ 	struct stm32_timers *ddata = dev_get_drvdata(pdev->dev.parent);
+ 	struct stm32_pwm *priv;
++	unsigned int num_enabled;
++	unsigned int i;
+ 	int ret;
+ 
+ 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+@@ -621,7 +627,11 @@ static int stm32_pwm_probe(struct platform_device *pdev)
+ 
+ 	priv->chip.dev = dev;
+ 	priv->chip.ops = &stm32pwm_ops;
+-	priv->chip.npwm = stm32_pwm_detect_channels(priv);
++	priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled);
++
++	/* Initialize clock refcount to number of enabled PWM channels. */
++	for (i = 0; i < num_enabled; i++)
++		clk_enable(priv->clk);
+ 
+ 	ret = devm_pwmchip_add(dev, &priv->chip);
+ 	if (ret < 0)
+-- 
+2.43.0
+
diff --git a/queue-6.7/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch b/queue-6.7/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
new file mode 100644
index 00000000000..f78e0de0f42
--- /dev/null
+++ b/queue-6.7/pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
@@ -0,0 +1,66 @@
+From 92f62906528f2f14df5204316c1b4d96d53f86f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Oct 2023 22:07:02 +0200
+Subject: pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 41fa8f57c0d269243fe3bde2bce71e82c884b9ad ]
+
+Use hweight32() to count the CCxE bits in stm32_pwm_detect_channels().
+Since the return value is assigned to chip.npwm, change it to unsigned
+int as well.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32.c | 17 ++---------------
+ 1 file changed, 2 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
+index 3303a754ea02..ffdfd81c0613 100644
+--- a/drivers/pwm/pwm-stm32.c
++++ b/drivers/pwm/pwm-stm32.c
+@@ -578,10 +578,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
+ 	priv->have_complementary_output = (ccer != 0);
+ }
+ 
+-static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
++static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv)
+ {
+ 	u32 ccer;
+-	int npwm = 0;
+ 
+ 	/*
+ 	 * If channels enable bits don't exist writing 1 will have no
+@@ -591,19 +590,7 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
+ 	regmap_read(priv->regmap, TIM_CCER, &ccer);
+ 	regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
+ 
+-	if (ccer & TIM_CCER_CC1E)
+-		npwm++;
+-
+-	if (ccer & TIM_CCER_CC2E)
+-		npwm++;
+-
+-	if (ccer & TIM_CCER_CC3E)
+-		npwm++;
+-
+-	if (ccer & TIM_CCER_CC4E)
+-		npwm++;
+-
+-	return npwm;
++	return hweight32(ccer & TIM_CCER_CCXE);
+ }
+ 
+ static int stm32_pwm_probe(struct platform_device *pdev)
+-- 
+2.43.0
+
diff --git a/queue-6.7/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch b/queue-6.7/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
new file mode 100644
index 00000000000..4ab8ca3d868
--- /dev/null
+++ b/queue-6.7/rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
@@ -0,0 +1,52 @@
+From 04dd98fe20df27a06da92631682496051b9943f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Nov 2023 20:34:47 +0800
+Subject: RDMA/hns: Fix inappropriate err code for unsupported operations
+
+From: Junxian Huang <huangjunxian6@hisilicon.com>
+
+[ Upstream commit f45b83ad39f8033e717b1eee57e81811113d5a84 ]
+
+EOPNOTSUPP is more situable than EINVAL for allocating XRCD while XRC
+is not supported and unsupported resizing SRQ.
+
+Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09")
+Fixes: 221109e64316 ("RDMA/hns: Add interception for resizing SRQs")
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231114123449.1106162-2-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ drivers/infiniband/hw/hns/hns_roce_pd.c    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 2bca9560f32d..e4753c802942 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -5671,7 +5671,7 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq,
+ 
+ 	/* Resizing SRQs is not supported yet */
+ 	if (srq_attr_mask & IB_SRQ_MAX_WR)
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	if (srq_attr_mask & IB_SRQ_LIMIT) {
+ 		if (srq_attr->srq_limit > srq->wqe_cnt)
+diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c
+index 783e71852c50..bd1fe89ca205 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_pd.c
++++ b/drivers/infiniband/hw/hns/hns_roce_pd.c
+@@ -150,7 +150,7 @@ int hns_roce_alloc_xrcd(struct ib_xrcd *ib_xrcd, struct ib_udata *udata)
+ 	int ret;
+ 
+ 	if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC))
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	ret = hns_roce_xrcd_alloc(hr_dev, &xrcd->xrcdn);
+ 	if (ret)
+-- 
+2.43.0
+
diff --git a/queue-6.7/rdma-hns-fix-memory-leak-in-free_mr_init.patch b/queue-6.7/rdma-hns-fix-memory-leak-in-free_mr_init.patch
new file mode 100644
index 00000000000..61f28a5c8fd
--- /dev/null
+++ b/queue-6.7/rdma-hns-fix-memory-leak-in-free_mr_init.patch
@@ -0,0 +1,40 @@
+From 3d1d85f23a35e64dcc506bc24604cb0026cbbb98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 19:42:31 +0800
+Subject: RDMA/hns: Fix memory leak in free_mr_init()
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+[ Upstream commit 288f535951aa81ed674f5e5477ab11b9d9351b8c ]
+
+When a reserved QP fails to be created, the memory of the remaining
+created reserved QPs is leaked.
+
+Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20231207114231.2872104-6-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index e4753c802942..aa9527ac2fe0 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -2698,6 +2698,10 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev)
+ 	return 0;
+ 
+ create_failed_qp:
++	for (i--; i >= 0; i--) {
++		hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL);
++		kfree(free_mr->rsv_qp[i]);
++	}
+ 	hns_roce_destroy_cq(cq, NULL);
+ 	kfree(cq);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch b/queue-6.7/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
new file mode 100644
index 00000000000..a510dc4ebb2
--- /dev/null
+++ b/queue-6.7/rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
@@ -0,0 +1,82 @@
+From cf9b8b394f990bec931368afdd1b9be457f0a6aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Nov 2023 11:28:02 +0200
+Subject: RDMA/usnic: Silence uninitialized symbol smatch warnings
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit b9a85e5eec126d6ae6c362f94b447c223e8fe6e4 ]
+
+The patch 1da177e4c3f4: "Linux-2.6.12-rc2" from Apr 16, 2005
+(linux-next), leads to the following Smatch static checker warning:
+
+        drivers/infiniband/hw/mthca/mthca_cmd.c:644 mthca_SYS_EN()
+        error: uninitialized symbol 'out'.
+
+drivers/infiniband/hw/mthca/mthca_cmd.c
+    636 int mthca_SYS_EN(struct mthca_dev *dev)
+    637 {
+    638         u64 out;
+    639         int ret;
+    640
+    641         ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
+
+We pass out here and it gets used without being initialized.
+
+        err = mthca_cmd_post(dev, in_param,
+                             out_param ? *out_param : 0,
+                                         ^^^^^^^^^^
+                             in_modifier, op_modifier,
+                             op, context->token, 1);
+
+It's the same in mthca_cmd_wait() and mthca_cmd_poll().
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/533bc3df-8078-4397-b93d-d1f6cec9b636@moroto.mountain
+Link: https://lore.kernel.org/r/c559cb7113158c02d75401ac162652072ef1b5f0.1699867650.git.leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mthca/mthca_cmd.c  | 4 ++--
+ drivers/infiniband/hw/mthca/mthca_main.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
+index f330ce895d88..8fe0cef7e2be 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
++++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
+@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox)
+ 
+ int mthca_SYS_EN(struct mthca_dev *dev)
+ {
+-	u64 out;
++	u64 out = 0;
+ 	int ret;
+ 
+ 	ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
+@@ -1955,7 +1955,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index,
+ int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
+ 		    u16 *hash)
+ {
+-	u64 imm;
++	u64 imm = 0;
+ 	int err;
+ 
+ 	err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH,
+diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
+index b54bc8865dae..1ab268b77096 100644
+--- a/drivers/infiniband/hw/mthca/mthca_main.c
++++ b/drivers/infiniband/hw/mthca/mthca_main.c
+@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
+ 			  struct mthca_init_hca_param *init_hca,
+ 			  u64 icm_size)
+ {
+-	u64 aux_pages;
++	u64 aux_pages = 0;
+ 	int err;
+ 
+ 	err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages);
+-- 
+2.43.0
+
diff --git a/queue-6.7/revert-drm-bridge-add-200ms-delay-to-wait-fw-hpd-sta.patch b/queue-6.7/revert-drm-bridge-add-200ms-delay-to-wait-fw-hpd-sta.patch
new file mode 100644
index 00000000000..4480d39498d
--- /dev/null
+++ b/queue-6.7/revert-drm-bridge-add-200ms-delay-to-wait-fw-hpd-sta.patch
@@ -0,0 +1,41 @@
+From 7876e5c3d3a8168f12db287f2c926e294d2d8ef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 17:10:36 +0800
+Subject: Revert "drm/bridge: Add 200ms delay to wait FW HPD status stable"
+
+From: Xin Ji <xji@analogixsemi.com>
+
+[ Upstream commit af3145aa142c92409d3b123ff87ff0b5fd0bf849 ]
+
+This reverts commit 330140d7319fcc4ec68bd924ea212e476bf12275
+
+200ms delay will cause panel display image later than backlight
+turn on, revert this patch.
+
+Fixes: 330140d7319fcc ("drm/bridge: Add 200ms delay to wait FW HPD status stable")
+Signed-off-by: Xin Ji <xji@analogixsemi.com>
+Reviewed-by: Robert Foss <rfoss@kernel.org>
+Signed-off-by: Robert Foss <rfoss@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20231120091038.284825-1-xji@analogixsemi.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/analogix/anx7625.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
+index 8f740154707d..51abe42c639e 100644
+--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
++++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
+@@ -1464,9 +1464,6 @@ static int _anx7625_hpd_polling(struct anx7625_data *ctx,
+ 	if (ctx->pdata.intp_irq)
+ 		return 0;
+ 
+-	/* Delay 200ms for FW HPD de-bounce */
+-	msleep(200);
+-
+ 	ret = readx_poll_timeout(anx7625_read_hpd_status_p0,
+ 				 ctx, val,
+ 				 ((val & HPD_STATUS) || (val < 0)),
+-- 
+2.43.0
+
diff --git a/queue-6.7/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch b/queue-6.7/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
new file mode 100644
index 00000000000..dfe9bf5350d
--- /dev/null
+++ b/queue-6.7/revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
@@ -0,0 +1,191 @@
+From 5bf3ca794ee1953f3c3559dbfe830ac3786cae68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 15:57:17 +0300
+Subject: Revert "drm/omapdrm: Annotate dma-fence critical section in commit
+ path"
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit 9d7c8c066916f231ca0ed4e4fce6c4b58ca3e451 ]
+
+This reverts commit 250aa22920cd5d956a5d3e9c6a43d671c2bae217.
+
+The DMA-fence annotations cause a lockdep warning (see below). As per
+https://patchwork.freedesktop.org/patch/462170/ it sounds like the
+annotations don't work correctly.
+
+======================================================
+WARNING: possible circular locking dependency detected
+6.5.0-rc2+ #2 Not tainted
+------------------------------------------------------
+kmstest/219 is trying to acquire lock:
+c4705838 (&hdmi->lock){+.+.}-{3:3}, at: hdmi5_bridge_mode_set+0x1c/0x50
+
+but task is already holding lock:
+c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (dma_fence_map){++++}-{0:0}:
+       __dma_fence_might_wait+0x48/0xb4
+       dma_resv_lockdep+0x1b8/0x2bc
+       do_one_initcall+0x68/0x3b0
+       kernel_init_freeable+0x260/0x34c
+       kernel_init+0x14/0x140
+       ret_from_fork+0x14/0x28
+
+-> #1 (fs_reclaim){+.+.}-{0:0}:
+       fs_reclaim_acquire+0x70/0xa8
+       __kmem_cache_alloc_node+0x3c/0x368
+       kmalloc_trace+0x28/0x58
+       _drm_do_get_edid+0x7c/0x35c
+       hdmi5_bridge_get_edid+0xc8/0x1ac
+       drm_bridge_connector_get_modes+0x64/0xc0
+       drm_helper_probe_single_connector_modes+0x170/0x528
+       drm_client_modeset_probe+0x208/0x1334
+       __drm_fb_helper_initial_config_and_unlock+0x30/0x548
+       omap_fbdev_client_hotplug+0x3c/0x6c
+       drm_client_register+0x58/0x94
+       pdev_probe+0x544/0x6b0
+       platform_probe+0x58/0xbc
+       really_probe+0xd8/0x3fc
+       __driver_probe_device+0x94/0x1f4
+       driver_probe_device+0x2c/0xc4
+       __device_attach_driver+0xa4/0x11c
+       bus_for_each_drv+0x84/0xdc
+       __device_attach+0xac/0x20c
+       bus_probe_device+0x8c/0x90
+       device_add+0x588/0x7e0
+       platform_device_add+0x110/0x24c
+       platform_device_register_full+0x108/0x15c
+       dss_bind+0x90/0xc0
+       try_to_bring_up_aggregate_device+0x1e0/0x2c8
+       __component_add+0xa4/0x174
+       hdmi5_probe+0x1c8/0x270
+       platform_probe+0x58/0xbc
+       really_probe+0xd8/0x3fc
+       __driver_probe_device+0x94/0x1f4
+       driver_probe_device+0x2c/0xc4
+       __device_attach_driver+0xa4/0x11c
+       bus_for_each_drv+0x84/0xdc
+       __device_attach+0xac/0x20c
+       bus_probe_device+0x8c/0x90
+       deferred_probe_work_func+0x8c/0xd8
+       process_one_work+0x2ac/0x6e4
+       worker_thread+0x30/0x4ec
+       kthread+0x100/0x124
+       ret_from_fork+0x14/0x28
+
+-> #0 (&hdmi->lock){+.+.}-{3:3}:
+       __lock_acquire+0x145c/0x29cc
+       lock_acquire.part.0+0xb4/0x258
+       __mutex_lock+0x90/0x950
+       mutex_lock_nested+0x1c/0x24
+       hdmi5_bridge_mode_set+0x1c/0x50
+       drm_bridge_chain_mode_set+0x48/0x5c
+       crtc_set_mode+0x188/0x1d0
+       omap_atomic_commit_tail+0x2c/0xbc
+       commit_tail+0x9c/0x188
+       drm_atomic_helper_commit+0x158/0x18c
+       drm_atomic_commit+0xa4/0xe8
+       drm_mode_atomic_ioctl+0x9a4/0xc38
+       drm_ioctl+0x210/0x4a8
+       sys_ioctl+0x138/0xf00
+       ret_fast_syscall+0x0/0x1c
+
+other info that might help us debug this:
+
+Chain exists of:
+  &hdmi->lock --> fs_reclaim --> dma_fence_map
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  rlock(dma_fence_map);
+                               lock(fs_reclaim);
+                               lock(dma_fence_map);
+  lock(&hdmi->lock);
+
+ *** DEADLOCK ***
+
+3 locks held by kmstest/219:
+ #0: f1011de4 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0xf0/0xc38
+ #1: c47059c8 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xf8/0x230
+ #2: c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc
+
+stack backtrace:
+CPU: 1 PID: 219 Comm: kmstest Not tainted 6.5.0-rc2+ #2
+Hardware name: Generic DRA74X (Flattened Device Tree)
+ unwind_backtrace from show_stack+0x10/0x14
+ show_stack from dump_stack_lvl+0x58/0x70
+ dump_stack_lvl from check_noncircular+0x164/0x198
+ check_noncircular from __lock_acquire+0x145c/0x29cc
+ __lock_acquire from lock_acquire.part.0+0xb4/0x258
+ lock_acquire.part.0 from __mutex_lock+0x90/0x950
+ __mutex_lock from mutex_lock_nested+0x1c/0x24
+ mutex_lock_nested from hdmi5_bridge_mode_set+0x1c/0x50
+ hdmi5_bridge_mode_set from drm_bridge_chain_mode_set+0x48/0x5c
+ drm_bridge_chain_mode_set from crtc_set_mode+0x188/0x1d0
+ crtc_set_mode from omap_atomic_commit_tail+0x2c/0xbc
+ omap_atomic_commit_tail from commit_tail+0x9c/0x188
+ commit_tail from drm_atomic_helper_commit+0x158/0x18c
+ drm_atomic_helper_commit from drm_atomic_commit+0xa4/0xe8
+ drm_atomic_commit from drm_mode_atomic_ioctl+0x9a4/0xc38
+ drm_mode_atomic_ioctl from drm_ioctl+0x210/0x4a8
+ drm_ioctl from sys_ioctl+0x138/0xf00
+ sys_ioctl from ret_fast_syscall+0x0/0x1c
+Exception stack(0xf1011fa8 to 0xf1011ff0)
+1fa0:                   00466d58 be9ab510 00000003 c03864bc be9ab510 be9ab4e0
+1fc0: 00466d58 be9ab510 c03864bc 00000036 00466ef0 00466fc0 00467020 00466f20
+1fe0: b6bc7ef4 be9ab4d0 b6bbbb00 b6cb2cc0
+
+Fixes: 250aa22920cd ("drm/omapdrm: Annotate dma-fence critical section in commit path")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-2-7ebf6f7f5bf6@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/omapdrm/omap_drv.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c
+index b2835b3ea6f5..6598c9c08ba1 100644
+--- a/drivers/gpu/drm/omapdrm/omap_drv.c
++++ b/drivers/gpu/drm/omapdrm/omap_drv.c
+@@ -69,7 +69,6 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
+ {
+ 	struct drm_device *dev = old_state->dev;
+ 	struct omap_drm_private *priv = dev->dev_private;
+-	bool fence_cookie = dma_fence_begin_signalling();
+ 
+ 	dispc_runtime_get(priv->dispc);
+ 
+@@ -92,6 +91,8 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
+ 		omap_atomic_wait_for_completion(dev, old_state);
+ 
+ 		drm_atomic_helper_commit_planes(dev, old_state, 0);
++
++		drm_atomic_helper_commit_hw_done(old_state);
+ 	} else {
+ 		/*
+ 		 * OMAP3 DSS seems to have issues with the work-around above,
+@@ -101,11 +102,9 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
+ 		drm_atomic_helper_commit_planes(dev, old_state, 0);
+ 
+ 		drm_atomic_helper_commit_modeset_enables(dev, old_state);
+-	}
+ 
+-	drm_atomic_helper_commit_hw_done(old_state);
+-
+-	dma_fence_end_signalling(fence_cookie);
++		drm_atomic_helper_commit_hw_done(old_state);
++	}
+ 
+ 	/*
+ 	 * Wait for completion of the page flips to ensure that old buffers
+-- 
+2.43.0
+
diff --git a/queue-6.7/revert-drm-tidss-annotate-dma-fence-critical-section.patch b/queue-6.7/revert-drm-tidss-annotate-dma-fence-critical-section.patch
new file mode 100644
index 00000000000..b6485297451
--- /dev/null
+++ b/queue-6.7/revert-drm-tidss-annotate-dma-fence-critical-section.patch
@@ -0,0 +1,176 @@
+From ee73b0d6f2fe119874232b3b3173de72e3bbe7e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Sep 2023 15:57:16 +0300
+Subject: Revert "drm/tidss: Annotate dma-fence critical section in commit
+ path"
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+[ Upstream commit ca34d816558c3e4c3f8fe037b5a6b16c944693de ]
+
+This reverts commit 4d56a4f08391857ba93465de489707b66adad114.
+
+The DMA-fence annotations cause a lockdep warning (see below). As per
+https://patchwork.freedesktop.org/patch/462170/ it sounds like the
+annotations don't work correctly.
+
+======================================================
+WARNING: possible circular locking dependency detected
+6.6.0-rc2+ #1 Not tainted
+------------------------------------------------------
+kmstest/733 is trying to acquire lock:
+ffff8000819377f0 (fs_reclaim){+.+.}-{0:0}, at: __kmem_cache_alloc_node+0x58/0x2d4
+
+but task is already holding lock:
+ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss]
+
+which lock already depends on the new lock.
+
+the existing dependency chain (in reverse order) is:
+
+-> #2 (dma_fence_map){++++}-{0:0}:
+       __dma_fence_might_wait+0x5c/0xd0
+       dma_resv_lockdep+0x1a4/0x32c
+       do_one_initcall+0x84/0x2fc
+       kernel_init_freeable+0x28c/0x4c4
+       kernel_init+0x24/0x1dc
+       ret_from_fork+0x10/0x20
+
+-> #1 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:
+       fs_reclaim_acquire+0x70/0xe4
+       __kmem_cache_alloc_node+0x58/0x2d4
+       kmalloc_trace+0x38/0x78
+       __kthread_create_worker+0x3c/0x150
+       kthread_create_worker+0x64/0x8c
+       workqueue_init+0x1e8/0x2f0
+       kernel_init_freeable+0x11c/0x4c4
+       kernel_init+0x24/0x1dc
+       ret_from_fork+0x10/0x20
+
+-> #0 (fs_reclaim){+.+.}-{0:0}:
+       __lock_acquire+0x1370/0x20d8
+       lock_acquire+0x1e8/0x308
+       fs_reclaim_acquire+0xd0/0xe4
+       __kmem_cache_alloc_node+0x58/0x2d4
+       __kmalloc_node_track_caller+0x58/0xf0
+       kmemdup+0x34/0x60
+       regmap_bulk_write+0x64/0x2c0
+       tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768]
+       drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm]
+       drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm]
+       drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper]
+       tidss_atomic_commit_tail+0x58/0xc0 [tidss]
+       commit_tail+0xa0/0x188 [drm_kms_helper]
+       drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper]
+       drm_atomic_commit+0xa8/0xe0 [drm]
+       drm_mode_atomic_ioctl+0x9ec/0xc80 [drm]
+       drm_ioctl_kernel+0xc4/0x170 [drm]
+       drm_ioctl+0x234/0x4b0 [drm]
+       drm_compat_ioctl+0x110/0x12c [drm]
+       __arm64_compat_sys_ioctl+0x128/0x150
+       invoke_syscall+0x48/0x110
+       el0_svc_common.constprop.0+0x40/0xe0
+       do_el0_svc_compat+0x1c/0x38
+       el0_svc_compat+0x48/0xb4
+       el0t_32_sync_handler+0xb0/0x138
+       el0t_32_sync+0x194/0x198
+
+other info that might help us debug this:
+
+Chain exists of:
+  fs_reclaim --> mmu_notifier_invalidate_range_start --> dma_fence_map
+
+ Possible unsafe locking scenario:
+
+       CPU0                    CPU1
+       ----                    ----
+  rlock(dma_fence_map);
+                               lock(mmu_notifier_invalidate_range_start);
+                               lock(dma_fence_map);
+  lock(fs_reclaim);
+
+ *** DEADLOCK ***
+
+3 locks held by kmstest/733:
+ #0: ffff800082e5bba0 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0x118/0xc80 [drm]
+ #1: ffff000004224c88 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xdc/0x1a0 [drm]
+ #2: ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss]
+
+stack backtrace:
+CPU: 0 PID: 733 Comm: kmstest Not tainted 6.6.0-rc2+ #1
+Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT)
+Call trace:
+ dump_backtrace+0x98/0x118
+ show_stack+0x18/0x24
+ dump_stack_lvl+0x60/0xac
+ dump_stack+0x18/0x24
+ print_circular_bug+0x288/0x368
+ check_noncircular+0x168/0x17c
+ __lock_acquire+0x1370/0x20d8
+ lock_acquire+0x1e8/0x308
+ fs_reclaim_acquire+0xd0/0xe4
+ __kmem_cache_alloc_node+0x58/0x2d4
+ __kmalloc_node_track_caller+0x58/0xf0
+ kmemdup+0x34/0x60
+ regmap_bulk_write+0x64/0x2c0
+ tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768]
+ drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm]
+ drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm]
+ drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper]
+ tidss_atomic_commit_tail+0x58/0xc0 [tidss]
+ commit_tail+0xa0/0x188 [drm_kms_helper]
+ drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper]
+ drm_atomic_commit+0xa8/0xe0 [drm]
+ drm_mode_atomic_ioctl+0x9ec/0xc80 [drm]
+ drm_ioctl_kernel+0xc4/0x170 [drm]
+ drm_ioctl+0x234/0x4b0 [drm]
+ drm_compat_ioctl+0x110/0x12c [drm]
+ __arm64_compat_sys_ioctl+0x128/0x150
+ invoke_syscall+0x48/0x110
+ el0_svc_common.constprop.0+0x40/0xe0
+ do_el0_svc_compat+0x1c/0x38
+ el0_svc_compat+0x48/0xb4
+ el0t_32_sync_handler+0xb0/0x138
+ el0t_32_sync+0x194/0x198
+
+Fixes: 4d56a4f08391 ("drm/tidss: Annotate dma-fence critical section in commit path")
+Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-1-7ebf6f7f5bf6@ideasonboard.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tidss/tidss_kms.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c
+index c979ad1af236..d096d8d2bc8f 100644
+--- a/drivers/gpu/drm/tidss/tidss_kms.c
++++ b/drivers/gpu/drm/tidss/tidss_kms.c
+@@ -4,8 +4,6 @@
+  * Author: Tomi Valkeinen <tomi.valkeinen@ti.com>
+  */
+ 
+-#include <linux/dma-fence.h>
+-
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
+ #include <drm/drm_bridge.h>
+@@ -25,7 +23,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state)
+ {
+ 	struct drm_device *ddev = old_state->dev;
+ 	struct tidss_device *tidss = to_tidss(ddev);
+-	bool fence_cookie = dma_fence_begin_signalling();
+ 
+ 	dev_dbg(ddev->dev, "%s\n", __func__);
+ 
+@@ -36,7 +33,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state)
+ 	drm_atomic_helper_commit_modeset_enables(ddev, old_state);
+ 
+ 	drm_atomic_helper_commit_hw_done(old_state);
+-	dma_fence_end_signalling(fence_cookie);
+ 	drm_atomic_helper_wait_for_flip_done(ddev, old_state);
+ 
+ 	drm_atomic_helper_cleanup_planes(ddev, old_state);
+-- 
+2.43.0
+
diff --git a/queue-6.7/rxrpc-fix-skbuff-cleanup-of-call-s-recvmsg_queue-and.patch b/queue-6.7/rxrpc-fix-skbuff-cleanup-of-call-s-recvmsg_queue-and.patch
new file mode 100644
index 00000000000..83e2f7bfe3b
--- /dev/null
+++ b/queue-6.7/rxrpc-fix-skbuff-cleanup-of-call-s-recvmsg_queue-and.patch
@@ -0,0 +1,48 @@
+From 46738bd1126a39b1813a340703f7bdee0455df4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Jan 2024 17:05:41 +0000
+Subject: rxrpc: Fix skbuff cleanup of call's recvmsg_queue and rx_oos_queue
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 4fc68c4c1a114ba597b4f3b082f04622dfa0e0f6 ]
+
+Fix rxrpc_cleanup_ring() to use rxrpc_purge_queue() rather than
+skb_queue_purge() so that the count of outstanding skbuffs is correctly
+updated when a failed call is cleaned up.
+
+Without this rmmod may hang waiting for rxrpc_n_rx_skbs to become zero.
+
+Fixes: 5d7edbc9231e ("rxrpc: Get rid of the Rx ring")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: "David S. Miller" <davem@davemloft.net>
+cc: Eric Dumazet <edumazet@google.com>
+cc: Jakub Kicinski <kuba@kernel.org>
+cc: Paolo Abeni <pabeni@redhat.com>
+cc: linux-afs@lists.infradead.org
+cc: netdev@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/call_object.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index 773eecd1e979..f10b37c14772 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -545,8 +545,8 @@ void rxrpc_get_call(struct rxrpc_call *call, enum rxrpc_call_trace why)
+  */
+ static void rxrpc_cleanup_ring(struct rxrpc_call *call)
+ {
+-	skb_queue_purge(&call->recvmsg_queue);
+-	skb_queue_purge(&call->rx_oos_queue);
++	rxrpc_purge_queue(&call->recvmsg_queue);
++	rxrpc_purge_queue(&call->rx_oos_queue);
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.7/s390-bpf-fix-gotol-with-large-offsets.patch b/queue-6.7/s390-bpf-fix-gotol-with-large-offsets.patch
new file mode 100644
index 00000000000..7f30f0346f3
--- /dev/null
+++ b/queue-6.7/s390-bpf-fix-gotol-with-large-offsets.patch
@@ -0,0 +1,39 @@
+From 8d38ff6e591a66c898ae6238096da4174b82a4f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 20:30:35 +0100
+Subject: s390/bpf: Fix gotol with large offsets
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit ecba66cb36e3428e9f0c2362b45e213ad43ba8d0 ]
+
+The gotol implementation uses a wrong data type for the offset: it
+should be s32, not s16.
+
+Fixes: c690191e23d8 ("s390/bpf: Implement unconditional jump with 32-bit offset")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20240102193531.3169422-2-iii@linux.ibm.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/net/bpf_jit_comp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index bf06b7283f0c..c7fbeedeb0a4 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -779,7 +779,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp,
+ 				 int i, bool extra_pass, u32 stack_depth)
+ {
+ 	struct bpf_insn *insn = &fp->insnsi[i];
+-	s16 branch_oc_off = insn->off;
++	s32 branch_oc_off = insn->off;
+ 	u32 dst_reg = insn->dst_reg;
+ 	u32 src_reg = insn->src_reg;
+ 	int last, insn_count = 1;
+-- 
+2.43.0
+
diff --git a/queue-6.7/sched-fair-update-min_vruntime-for-reweight_entity-c.patch b/queue-6.7/sched-fair-update-min_vruntime-for-reweight_entity-c.patch
new file mode 100644
index 00000000000..b1f1aa52410
--- /dev/null
+++ b/queue-6.7/sched-fair-update-min_vruntime-for-reweight_entity-c.patch
@@ -0,0 +1,58 @@
+From 64b959bbfbec46e465561b5de44589cb116e16ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 16:01:06 +0800
+Subject: sched/fair: Update min_vruntime for reweight_entity() correctly
+
+From: Yiwei Lin <s921975628@gmail.com>
+
+[ Upstream commit 5068d84054b766efe7c6202fc71b2350d1c326f1 ]
+
+Since reweight_entity() may have chance to change the weight of
+cfs_rq->curr entity, we should also update_min_vruntime() if
+this is the case
+
+Fixes: eab03c23c2a1 ("sched/eevdf: Fix vruntime adjustment on reweight")
+Signed-off-by: Yiwei Lin <s921975628@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Abel Wu <wuyun.abel@bytedance.com>
+Link: https://lore.kernel.org/r/20231117080106.12890-1-s921975628@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index d7a3c63a2171..4182fb118ce9 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3811,17 +3811,17 @@ static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
+ 	enqueue_load_avg(cfs_rq, se);
+ 	if (se->on_rq) {
+ 		update_load_add(&cfs_rq->load, se->load.weight);
+-		if (!curr) {
+-			/*
+-			 * The entity's vruntime has been adjusted, so let's check
+-			 * whether the rq-wide min_vruntime needs updated too. Since
+-			 * the calculations above require stable min_vruntime rather
+-			 * than up-to-date one, we do the update at the end of the
+-			 * reweight process.
+-			 */
++		if (!curr)
+ 			__enqueue_entity(cfs_rq, se);
+-			update_min_vruntime(cfs_rq);
+-		}
++
++		/*
++		 * The entity's vruntime has been adjusted, so let's check
++		 * whether the rq-wide min_vruntime needs updated too. Since
++		 * the calculations above require stable min_vruntime rather
++		 * than up-to-date one, we do the update at the end of the
++		 * reweight process.
++		 */
++		update_min_vruntime(cfs_rq);
+ 	}
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-bfa-use-the-proper-data-type-for-blist-flags.patch b/queue-6.7/scsi-bfa-use-the-proper-data-type-for-blist-flags.patch
new file mode 100644
index 00000000000..4d52ecbebc3
--- /dev/null
+++ b/queue-6.7/scsi-bfa-use-the-proper-data-type-for-blist-flags.patch
@@ -0,0 +1,40 @@
+From c39dcbc498a336b2c8c721c437e588260ece7d6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 11:33:38 -0800
+Subject: scsi: bfa: Use the proper data type for BLIST flags
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 0349be31e4ffc79723e46e2e373569567b06347b ]
+
+Fix the following sparse warning:
+
+drivers/scsi/bfa/bfad_bsg.c:2553:50: sparse: sparse: incorrect type in initializer (different base types)
+
+Fixes: 2e5a6c3baccd ("scsi: bfa: Convert bfad_reset_sdev_bflags() from a macro into a function")
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202311031255.lmSPisIk-lkp@intel.com/
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20231115193338.2261972-1-bvanassche@acm.org
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/bfa/bfad_bsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
+index 520f9152f3bf..d4ceca2d435e 100644
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -2550,7 +2550,7 @@ bfad_iocmd_vf_clr_stats(struct bfad_s *bfad, void *cmd)
+ static void bfad_reset_sdev_bflags(struct bfad_im_port_s *im_port,
+ 				   int lunmask_cfg)
+ {
+-	const u32 scan_flags = BLIST_NOREPORTLUN | BLIST_SPARSELUN;
++	const blist_flags_t scan_flags = BLIST_NOREPORTLUN | BLIST_SPARSELUN;
+ 	struct bfad_itnim_s *itnim;
+ 	struct scsi_device *sdev;
+ 	unsigned long flags;
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-fnic-return-error-if-vmalloc-failed.patch b/queue-6.7/scsi-fnic-return-error-if-vmalloc-failed.patch
new file mode 100644
index 00000000000..dd1795027e1
--- /dev/null
+++ b/queue-6.7/scsi-fnic-return-error-if-vmalloc-failed.patch
@@ -0,0 +1,44 @@
+From b824ede35c0418ee2c01d3035790eff4dc63d46a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Nov 2023 14:10:08 +0300
+Subject: scsi: fnic: Return error if vmalloc() failed
+
+From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+
+[ Upstream commit f5f27a332a14f43463aa0075efa3a0c662c0f4a8 ]
+
+In fnic_init_module() exists redundant check for return value from
+fnic_debugfs_init(), because at moment it only can return zero. It make
+sense to process theoretical vmalloc() failure.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 9730ddfb123d ("scsi: fnic: remove redundant assignment of variable rc")
+Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
+Link: https://lore.kernel.org/r/20231128111008.2280507-1-artem.chernyshev@red-soft.ru
+Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_debugfs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c
+index c4d9ed0d7d75..2619a2d4f5f1 100644
+--- a/drivers/scsi/fnic/fnic_debugfs.c
++++ b/drivers/scsi/fnic/fnic_debugfs.c
+@@ -52,9 +52,10 @@ int fnic_debugfs_init(void)
+ 		fc_trc_flag->fnic_trace = 2;
+ 		fc_trc_flag->fc_trace = 3;
+ 		fc_trc_flag->fc_clear = 4;
++		return 0;
+ 	}
+ 
+-	return 0;
++	return -ENOMEM;
+ }
+ 
+ /*
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-hisi_sas-check-before-using-pointer-variables.patch b/queue-6.7/scsi-hisi_sas-check-before-using-pointer-variables.patch
new file mode 100644
index 00000000000..e4018613e4f
--- /dev/null
+++ b/queue-6.7/scsi-hisi_sas-check-before-using-pointer-variables.patch
@@ -0,0 +1,51 @@
+From 46eaa06aeac90d5a25a985a08dcefc07827a8186 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:14 +0800
+Subject: scsi: hisi_sas: Check before using pointer variables
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 8dd10296be8562a45c6c6794dd492a2b7dccede8 ]
+
+In commit 4b329abc9180 ("scsi: hisi_sas: Move slot variable definition in
+hisi_sas_abort_task()"), we move the variables slot to the function head.
+However, the variable slot may be NULL, we should check it in each branch.
+
+Fixes: 4b329abc9180 ("scsi: hisi_sas: Move slot variable definition in hisi_sas_abort_task()")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-4-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_main.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index 16017064e96a..bbb7b2d9ffcf 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -1641,7 +1641,10 @@ static int hisi_sas_abort_task(struct sas_task *task)
+ 	task->task_state_flags |= SAS_TASK_STATE_ABORTED;
+ 	spin_unlock_irqrestore(&task->task_state_lock, flags);
+ 
+-	if (slot && task->task_proto & SAS_PROTOCOL_SSP) {
++	if (!slot)
++		goto out;
++
++	if (task->task_proto & SAS_PROTOCOL_SSP) {
+ 		u16 tag = slot->idx;
+ 		int rc2;
+ 
+@@ -1688,7 +1691,7 @@ static int hisi_sas_abort_task(struct sas_task *task)
+ 				rc = hisi_sas_softreset_ata_disk(device);
+ 			}
+ 		}
+-	} else if (slot && task->task_proto & SAS_PROTOCOL_SMP) {
++	} else if (task->task_proto & SAS_PROTOCOL_SMP) {
+ 		/* SMP */
+ 		u32 tag = slot->idx;
+ 		struct hisi_sas_cq *cq = &hisi_hba->cq[slot->dlvry_queue];
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch b/queue-6.7/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
new file mode 100644
index 00000000000..53f4e07f717
--- /dev/null
+++ b/queue-6.7/scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
@@ -0,0 +1,42 @@
+From c93a6b64568ca20ab45565ab91df3c8e3ac886e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:16 +0800
+Subject: scsi: hisi_sas: Correct the number of global debugfs registers
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 73e33f969ef05328766b23a99b2c07bfff765009 ]
+
+In function debugfs_debugfs_snapshot_global_reg_v3_hw() it uses
+debugfs_axi_reg.count (which is the number of axi debugfs registers) to
+acquire the number of global debugfs registers.
+
+Use debugfs_global_reg.count to acquire the number of global debugfs
+registers instead.
+
+Fixes: 623a4b6d5c2a ("scsi: hisi_sas: Move debugfs code to v3 hw driver")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-6-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 704bd65f373d..6d8577423d32 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -3476,7 +3476,7 @@ static void debugfs_snapshot_global_reg_v3_hw(struct hisi_hba *hisi_hba)
+ 	u32 *databuf = hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL].data;
+ 	int i;
+ 
+-	for (i = 0; i < debugfs_axi_reg.count; i++, databuf++)
++	for (i = 0; i < debugfs_global_reg.count; i++, databuf++)
+ 		*databuf = hisi_sas_read32(hisi_hba, 4 * i);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-hisi_sas-replace-with-standard-error-code-retur.patch b/queue-6.7/scsi-hisi_sas-replace-with-standard-error-code-retur.patch
new file mode 100644
index 00000000000..bde60cb3e70
--- /dev/null
+++ b/queue-6.7/scsi-hisi_sas-replace-with-standard-error-code-retur.patch
@@ -0,0 +1,63 @@
+From 721032e639dff53f886ac2dd6aea69efb420a3c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:13 +0800
+Subject: scsi: hisi_sas: Replace with standard error code return value
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit d34ee535705eb43885bc0f561c63046f697355ad ]
+
+In function hisi_sas_controller_prereset(), -ENOSYS (Function not
+implemented) should be returned if the driver does not support .soft_reset.
+Returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is
+already be set.
+
+In function _suspend_v3_hw(), returns -EPERM (Operation not permitted) if
+HISI_SAS_RESETTING_BIT is already be set.
+
+Fixes: 4522204ab218 ("scsi: hisi_sas: tidy host controller reset function a bit")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-3-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_main.c  | 4 ++--
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
+index d50058b41409..16017064e96a 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -1565,12 +1565,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_controller_reset_done);
+ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba)
+ {
+ 	if (!hisi_hba->hw->soft_reset)
+-		return -1;
++		return -ENOENT;
+ 
+ 	down(&hisi_hba->sem);
+ 	if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) {
+ 		up(&hisi_hba->sem);
+-		return -1;
++		return -EPERM;
+ 	}
+ 
+ 	if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct)
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index d8437a98037b..b8ee374fe6ca 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -5018,7 +5018,7 @@ static int _suspend_v3_hw(struct device *device)
+ 	}
+ 
+ 	if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
+-		return -1;
++		return -EPERM;
+ 
+ 	dev_warn(dev, "entering suspend state\n");
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch b/queue-6.7/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
new file mode 100644
index 00000000000..550ab23e5bc
--- /dev/null
+++ b/queue-6.7/scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
@@ -0,0 +1,55 @@
+From d127c77d9ddbf98f26ba45b4673b62e5f8581bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:45:15 +0800
+Subject: scsi: hisi_sas: Rollback some operations if FLR failed
+
+From: Yihang Li <liyihang9@huawei.com>
+
+[ Upstream commit 7ea3e7763c50b20a8bd25cf524ea0c6463de69be ]
+
+We obtain the semaphore and set HISI_SAS_RESETTING_BIT in
+hisi_sas_reset_prepare_v3_hw(), block the scsi host and set
+HISI_SAS_REJECT_CMD_BIT in hisi_sas_controller_reset_prepare(), released
+them in hisi_sas_controller_reset_done(). However, if the HW reset failure
+in FLR results in early return, the semaphore and flag bits will not be
+release.
+
+Rollback some operations including clearing flags / releasing semaphore
+when FLR is failed.
+
+Fixes: e5ea48014adc ("scsi: hisi_sas: Implement handlers of PCIe FLR for v3 hw")
+Signed-off-by: Yihang Li <liyihang9@huawei.com>
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Link: https://lore.kernel.org/r/1702525516-51258-5-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index b8ee374fe6ca..704bd65f373d 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -4968,6 +4968,7 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev)
+ {
+ 	struct sas_ha_struct *sha = pci_get_drvdata(pdev);
+ 	struct hisi_hba *hisi_hba = sha->lldd_ha;
++	struct Scsi_Host *shost = hisi_hba->shost;
+ 	struct device *dev = hisi_hba->dev;
+ 	int rc;
+ 
+@@ -4976,6 +4977,10 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev)
+ 	rc = hw_init_v3_hw(hisi_hba);
+ 	if (rc) {
+ 		dev_err(dev, "FLR: hw init failed rc=%d\n", rc);
++		clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags);
++		scsi_unblock_requests(shost);
++		clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
++		up(&hisi_hba->sem);
+ 		return;
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-lpfc-fix-list_entry-null-check-warning-in-lpfc_.patch b/queue-6.7/scsi-lpfc-fix-list_entry-null-check-warning-in-lpfc_.patch
new file mode 100644
index 00000000000..0d1f4eede7d
--- /dev/null
+++ b/queue-6.7/scsi-lpfc-fix-list_entry-null-check-warning-in-lpfc_.patch
@@ -0,0 +1,50 @@
+From c94eb0560ae71b06cd38e83809fbafa717d3f56b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Oct 2023 12:12:18 -0700
+Subject: scsi: lpfc: Fix list_entry null check warning in
+ lpfc_cmpl_els_plogi()
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit 1dec1311b9b6cc9c5fd26a77b936f542f03c51d1 ]
+
+Smatch called out a warning for null checking a ptr that is assigned by
+list_entry(). list_entry() does not return null and, if the list is empty,
+can return an invalid ptr. Thus, the !psrp check does not execute properly.
+
+ drivers/scsi/lpfc/lpfc_els.c:2133 lpfc_cmpl_els_plogi()
+ warn: list_entry() does not return NULL 'prsp'
+
+Replace list_entry() with list_get_first(), which does a list_empty() check
+before returning the first entry.
+
+Fixes: a3c3c0a806f1 ("scsi: lpfc: Validate ELS LS_ACC completion payload")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/linux-scsi/01b7568f-4ab4-4d56-bfa6-9ecc5fc261fe@moroto.mountain/
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Link: https://lore.kernel.org/r/20231031191224.150862-4-justintee8345@gmail.com
+Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_els.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index f9627eddab08..0829fe6ddff8 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -2128,8 +2128,8 @@ lpfc_cmpl_els_plogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ 						NLP_EVT_DEVICE_RM);
+ 	} else {
+ 		/* Good status, call state machine */
+-		prsp = list_entry(cmdiocb->cmd_dmabuf->list.next,
+-				  struct lpfc_dmabuf, list);
++		prsp = list_get_first(&cmdiocb->cmd_dmabuf->list,
++				      struct lpfc_dmabuf, list);
+ 		if (!prsp)
+ 			goto out;
+ 		if (!lpfc_is_els_acc_rsp(prsp))
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-ufs-qcom-fix-the-return-value-of-ufs_qcom_ice_p.patch b/queue-6.7/scsi-ufs-qcom-fix-the-return-value-of-ufs_qcom_ice_p.patch
new file mode 100644
index 00000000000..a60aa092c8b
--- /dev/null
+++ b/queue-6.7/scsi-ufs-qcom-fix-the-return-value-of-ufs_qcom_ice_p.patch
@@ -0,0 +1,40 @@
+From 1a828eb11b5d657d671c289d5d3f3dcefcff23c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 12:28:47 +0530
+Subject: scsi: ufs: qcom: Fix the return value of ufs_qcom_ice_program_key()
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 3bf7ab4ac30c03beecf57c052e87d5a38fb8aed6 ]
+
+Currently, the function returns -EINVAL if algorithm other than AES-256-XTS
+is requested. But the correct error code is -EOPNOTSUPP. Fix it!
+
+Cc: Abel Vesa <abel.vesa@linaro.org>
+Fixes: 56541c7c4468 ("scsi: ufs: ufs-qcom: Switch to the new ICE API")
+Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20231208065902.11006-3-manivannan.sadhasivam@linaro.org
+Tested-by: Andrew Halaney <ahalaney@redhat.com> # sa8775p-ride
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
+index 17e24270477d..c92cdca21fe1 100644
+--- a/drivers/ufs/host/ufs-qcom.c
++++ b/drivers/ufs/host/ufs-qcom.c
+@@ -158,7 +158,7 @@ static int ufs_qcom_ice_program_key(struct ufs_hba *hba,
+ 	cap = hba->crypto_cap_array[cfg->crypto_cap_idx];
+ 	if (cap.algorithm_id != UFS_CRYPTO_ALG_AES_XTS ||
+ 	    cap.key_size != UFS_CRYPTO_KEY_SIZE_256)
+-		return -EINVAL;
++		return -EOPNOTSUPP;
+ 
+ 	if (config_enable)
+ 		return qcom_ice_program_key(host->ice,
+-- 
+2.43.0
+
diff --git a/queue-6.7/scsi-ufs-qcom-fix-the-return-value-when-platform_get.patch b/queue-6.7/scsi-ufs-qcom-fix-the-return-value-when-platform_get.patch
new file mode 100644
index 00000000000..7075703c339
--- /dev/null
+++ b/queue-6.7/scsi-ufs-qcom-fix-the-return-value-when-platform_get.patch
@@ -0,0 +1,40 @@
+From 649efdab8333ef24e4de02f618a7cdd4313647e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Dec 2023 12:28:48 +0530
+Subject: scsi: ufs: qcom: Fix the return value when
+ platform_get_resource_byname() fails
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 3a747c5cf9b6c36649783b28d2ef8f9c92b16a0f ]
+
+The return value should be -ENODEV indicating that the resource is not
+provided in DT, not -ENOMEM. Fix it!
+
+Fixes: c263b4ef737e ("scsi: ufs: core: mcq: Configure resource regions")
+Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20231208065902.11006-4-manivannan.sadhasivam@linaro.org
+Tested-by: Andrew Halaney <ahalaney@redhat.com> # sa8775p-ride
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
+index c92cdca21fe1..0f4b3f16d3d7 100644
+--- a/drivers/ufs/host/ufs-qcom.c
++++ b/drivers/ufs/host/ufs-qcom.c
+@@ -1787,7 +1787,7 @@ static int ufs_qcom_mcq_config_resource(struct ufs_hba *hba)
+ 		if (!res->resource) {
+ 			dev_info(hba->dev, "Resource %s not provided\n", res->name);
+ 			if (i == RES_UFS)
+-				return -ENOMEM;
++				return -ENODEV;
+ 			continue;
+ 		} else if (i == RES_UFS) {
+ 			res_mem = res->resource;
+-- 
+2.43.0
+
diff --git a/queue-6.7/sctp-fix-busy-polling.patch b/queue-6.7/sctp-fix-busy-polling.patch
new file mode 100644
index 00000000000..8d1dd67fc36
--- /dev/null
+++ b/queue-6.7/sctp-fix-busy-polling.patch
@@ -0,0 +1,54 @@
+From 71b231b270ae08fcf931345408a65aa7a8024195 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 17:00:17 +0000
+Subject: sctp: fix busy polling
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit a562c0a2d651e040681b0bfce9b4d229ac3b0b8c ]
+
+Busy polling while holding the socket lock makes litle sense,
+because incoming packets wont reach our receive queue.
+
+Fixes: 8465a5fcd1ce ("sctp: add support for busy polling to sctp protocol")
+Reported-by: Jacob Moroni <jmoroni@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/socket.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 5fb02bbb4b34..6b9fcdb0952a 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -2102,6 +2102,10 @@ static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	if (unlikely(flags & MSG_ERRQUEUE))
+ 		return inet_recv_error(sk, msg, len, addr_len);
+ 
++	if (sk_can_busy_loop(sk) &&
++	    skb_queue_empty_lockless(&sk->sk_receive_queue))
++		sk_busy_loop(sk, flags & MSG_DONTWAIT);
++
+ 	lock_sock(sk);
+ 
+ 	if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED) &&
+@@ -9046,12 +9050,6 @@ struct sk_buff *sctp_skb_recv_datagram(struct sock *sk, int flags, int *err)
+ 		if (sk->sk_shutdown & RCV_SHUTDOWN)
+ 			break;
+ 
+-		if (sk_can_busy_loop(sk)) {
+-			sk_busy_loop(sk, flags & MSG_DONTWAIT);
+-
+-			if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
+-				continue;
+-		}
+ 
+ 		/* User doesn't want to wait.  */
+ 		error = -EAGAIN;
+-- 
+2.43.0
+
diff --git a/queue-6.7/sctp-support-msg_errqueue-flag-in-recvmsg.patch b/queue-6.7/sctp-support-msg_errqueue-flag-in-recvmsg.patch
new file mode 100644
index 00000000000..7de7a11de12
--- /dev/null
+++ b/queue-6.7/sctp-support-msg_errqueue-flag-in-recvmsg.patch
@@ -0,0 +1,59 @@
+From 57c6dd5ddfa3ead24b1af544016b1999b295d7ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 14:55:50 +0000
+Subject: sctp: support MSG_ERRQUEUE flag in recvmsg()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 4746b36b1abe11ca32987b2d21e1e770deab17cc ]
+
+For some reason sctp_poll() generates EPOLLERR if sk->sk_error_queue
+is not empty but recvmsg() can not drain the error queue yet.
+
+This is needed to better support timestamping.
+
+I had to export inet_recv_error(), since sctp
+can be compiled as a module.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Acked-by: Xin Long <lucien.xin@gmail.com>
+Link: https://lore.kernel.org/r/20231212145550.3872051-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: a562c0a2d651 ("sctp: fix busy polling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/af_inet.c | 1 +
+ net/sctp/socket.c  | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index fb81de10d332..ea0b0334a0fb 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1633,6 +1633,7 @@ int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+ #endif
+ 	return -EINVAL;
+ }
++EXPORT_SYMBOL(inet_recv_error);
+ 
+ int inet_gro_complete(struct sk_buff *skb, int nhoff)
+ {
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 7f89e43154c0..5fb02bbb4b34 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -2099,6 +2099,9 @@ static int sctp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
+ 	pr_debug("%s: sk:%p, msghdr:%p, len:%zd, flags:0x%x, addr_len:%p)\n",
+ 		 __func__, sk, msg, len, flags, addr_len);
+ 
++	if (unlikely(flags & MSG_ERRQUEUE))
++		return inet_recv_error(sk, msg, len, addr_len);
++
+ 	lock_sock(sk);
+ 
+ 	if (sctp_style(sk, TCP) && !sctp_sstate(sk, ESTABLISHED) &&
+-- 
+2.43.0
+
diff --git a/queue-6.7/selftests-bpf-fix-erroneous-bitmask-operation.patch b/queue-6.7/selftests-bpf-fix-erroneous-bitmask-operation.patch
new file mode 100644
index 00000000000..eec8cb317ad
--- /dev/null
+++ b/queue-6.7/selftests-bpf-fix-erroneous-bitmask-operation.patch
@@ -0,0 +1,52 @@
+From 1b387453602690ae3d8126ed6ba7524cd08cae5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Nov 2023 13:03:53 +0100
+Subject: selftests/bpf: Fix erroneous bitmask operation
+
+From: Jeroen van Ingen Schenau <jeroen.vaningenschenau@novoserve.com>
+
+[ Upstream commit b6a3451e0847d5d70fb5fa2b2a80ab9f80bf2c7b ]
+
+xdp_synproxy_kern.c is a BPF program that generates SYN cookies on
+allowed TCP ports and sends SYNACKs to clients, accelerating synproxy
+iptables module.
+
+Fix the bitmask operation when checking the status of an existing
+conntrack entry within tcp_lookup() function. Do not AND with the bit
+position number, but with the bitmask value to check whether the entry
+found has the IPS_CONFIRMED flag set.
+
+Fixes: fb5cd0ce70d4 ("selftests/bpf: Add selftests for raw syncookie helpers")
+Signed-off-by: Jeroen van Ingen Schenau <jeroen.vaningenschenau@novoserve.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Minh Le Hoang <minh.lehoang@novoserve.com>
+Link: https://lore.kernel.org/xdp-newbies/CAAi1gX7owA+Tcxq-titC-h-KPM7Ri-6ZhTNMhrnPq5gmYYwKow@mail.gmail.com/T/#u
+Link: https://lore.kernel.org/bpf/20231130120353.3084-1-jeroen.vaningenschenau@novoserve.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c b/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
+index 80f620602d50..518329c666e9 100644
+--- a/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
++++ b/tools/testing/selftests/bpf/progs/xdp_synproxy_kern.c
+@@ -467,13 +467,13 @@ static __always_inline int tcp_lookup(void *ctx, struct header_pointers *hdr, bo
+ 		unsigned long status = ct->status;
+ 
+ 		bpf_ct_release(ct);
+-		if (status & IPS_CONFIRMED_BIT)
++		if (status & IPS_CONFIRMED)
+ 			return XDP_PASS;
+ 	} else if (ct_lookup_opts.error != -ENOENT) {
+ 		return XDP_ABORTED;
+ 	}
+ 
+-	/* error == -ENOENT || !(status & IPS_CONFIRMED_BIT) */
++	/* error == -ENOENT || !(status & IPS_CONFIRMED) */
+ 	return XDP_TX;
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch b/queue-6.7/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
new file mode 100644
index 00000000000..691d7c846f5
--- /dev/null
+++ b/queue-6.7/selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
@@ -0,0 +1,53 @@
+From 4c4e411b947896b814d77b70e2c8d88b0e5e3ba2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 18:29:11 +0000
+Subject: selftests/bpf: Relax time_tai test for equal timestamps in
+ tai_forward
+
+From: YiFei Zhu <zhuyifei@google.com>
+
+[ Upstream commit e1ba7f64b192f083b4423644be03bb9e3dc8ae84 ]
+
+We're observing test flakiness on an arm64 platform which might not
+have timestamps as precise as x86. The test log looks like:
+
+  test_time_tai:PASS:tai_open 0 nsec
+  test_time_tai:PASS:test_run 0 nsec
+  test_time_tai:PASS:tai_ts1 0 nsec
+  test_time_tai:PASS:tai_ts2 0 nsec
+  test_time_tai:FAIL:tai_forward unexpected tai_forward: actual 1702348135471494160 <= expected 1702348135471494160
+  test_time_tai:PASS:tai_gettime 0 nsec
+  test_time_tai:PASS:tai_future_ts1 0 nsec
+  test_time_tai:PASS:tai_future_ts2 0 nsec
+  test_time_tai:PASS:tai_range_ts1 0 nsec
+  test_time_tai:PASS:tai_range_ts2 0 nsec
+  #199     time_tai:FAIL
+
+This patch changes ASSERT_GT to ASSERT_GE in the tai_forward assertion
+so that equal timestamps are permitted.
+
+Fixes: 64e15820b987 ("selftests/bpf: Add BPF-helper test for CLOCK_TAI access")
+Signed-off-by: YiFei Zhu <zhuyifei@google.com>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Link: https://lore.kernel.org/bpf/20231212182911.3784108-1-zhuyifei@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/prog_tests/time_tai.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/bpf/prog_tests/time_tai.c b/tools/testing/selftests/bpf/prog_tests/time_tai.c
+index a31119823666..f45af1b0ef2c 100644
+--- a/tools/testing/selftests/bpf/prog_tests/time_tai.c
++++ b/tools/testing/selftests/bpf/prog_tests/time_tai.c
+@@ -56,7 +56,7 @@ void test_time_tai(void)
+ 	ASSERT_NEQ(ts2, 0, "tai_ts2");
+ 
+ 	/* TAI is moving forward only */
+-	ASSERT_GT(ts2, ts1, "tai_forward");
++	ASSERT_GE(ts2, ts1, "tai_forward");
+ 
+ 	/* Check for future */
+ 	ret = clock_gettime(CLOCK_TAI, &now_tai);
+-- 
+2.43.0
+
diff --git a/queue-6.7/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch b/queue-6.7/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
new file mode 100644
index 00000000000..21376644b2c
--- /dev/null
+++ b/queue-6.7/selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
@@ -0,0 +1,68 @@
+From e40d5c310ae3c38d2ee6af26066ae78cdb190605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 14:08:49 +0800
+Subject: selftests/net: fix grep checking for fib_nexthop_multiprefix
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit a33e9da3470499e9ff476138f271fb52d6bfe767 ]
+
+When running fib_nexthop_multiprefix test I saw all IPv6 test failed.
+e.g.
+
+ ]# ./fib_nexthop_multiprefix.sh
+ TEST: IPv4: host 0 to host 1, mtu 1300                              [ OK ]
+ TEST: IPv6: host 0 to host 1, mtu 1300                              [FAIL]
+
+ With -v it shows
+
+ COMMAND: ip netns exec h0 /usr/sbin/ping6 -s 1350 -c5 -w5 2001:db8:101::1
+ PING 2001:db8:101::1(2001:db8:101::1) 1350 data bytes
+ From 2001:db8:100::64 icmp_seq=1 Packet too big: mtu=1300
+
+ --- 2001:db8:101::1 ping statistics ---
+ 1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
+
+ Route get
+ 2001:db8:101::1 via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 metric 1024 expires 599sec mtu 1300 pref medium
+ Searching for:
+     2001:db8:101::1 from :: via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 .* mtu 1300
+
+The reason is when CONFIG_IPV6_SUBTREES is not enabled, rt6_fill_node() will
+not put RTA_SRC info. After fix:
+
+]# ./fib_nexthop_multiprefix.sh
+TEST: IPv4: host 0 to host 1, mtu 1300                              [ OK ]
+TEST: IPv6: host 0 to host 1, mtu 1300                              [ OK ]
+
+Fixes: 735ab2f65dce ("selftests: Add test with multiple prefixes using single nexthop")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Link: https://lore.kernel.org/r/20231213060856.4030084-7-liuhangbin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/fib_nexthop_multiprefix.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
+index 51df5e305855..b52d59547fc5 100755
+--- a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
++++ b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
+@@ -209,12 +209,12 @@ validate_v6_exception()
+ 		echo "Route get"
+ 		ip -netns h0 -6 ro get ${dst}
+ 		echo "Searching for:"
+-		echo "    ${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
++		echo "    ${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
+ 		echo
+ 	fi
+ 
+ 	ip -netns h0 -6 ro get ${dst} | \
+-	grep -q "${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
++	grep -q "${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
+ 	rc=$?
+ 
+ 	log_test $rc 0 "IPv6: host 0 to host ${i}, mtu ${mtu}"
+-- 
+2.43.0
+
diff --git a/queue-6.7/selftests-net-specify-the-interface-when-do-arping.patch b/queue-6.7/selftests-net-specify-the-interface-when-do-arping.patch
new file mode 100644
index 00000000000..a86a48b4e0b
--- /dev/null
+++ b/queue-6.7/selftests-net-specify-the-interface-when-do-arping.patch
@@ -0,0 +1,48 @@
+From 7f8aa943f1392f632aa236397ec25a7b21baaa97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Dec 2023 10:00:59 +0800
+Subject: selftests/net: specify the interface when do arping
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 7f770d28f2e5abfd442ad689ba1129dd66593529 ]
+
+When do arping, the interface need to be specified. Or we will
+get error: Interface "lo" is not ARPable. And the test failed.
+]# ./arp_ndisc_untracked_subnets.sh
+    TEST: test_arp:  accept_arp=0                                       [ OK ]
+    TEST: test_arp:  accept_arp=1                                       [FAIL]
+    TEST: test_arp:  accept_arp=2  same_subnet=0                        [ OK ]
+    TEST: test_arp:  accept_arp=2  same_subnet=1                        [FAIL]
+
+After fix:
+]# ./arp_ndisc_untracked_subnets.sh
+    TEST: test_arp:  accept_arp=0                                       [ OK ]
+    TEST: test_arp:  accept_arp=1                                       [ OK ]
+    TEST: test_arp:  accept_arp=2  same_subnet=0                        [ OK ]
+    TEST: test_arp:  accept_arp=2  same_subnet=1                        [ OK ]
+
+Fixes: 0ea7b0a454ca ("selftests: net: arp_ndisc_untracked_subnets: test for arp_accept and accept_untracked_na")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
+index c899b446acb6..327427ec10f5 100755
+--- a/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
++++ b/tools/testing/selftests/net/arp_ndisc_untracked_subnets.sh
+@@ -150,7 +150,7 @@ arp_test_gratuitous() {
+ 	fi
+ 	# Supply arp_accept option to set up which sets it in sysctl
+ 	setup ${arp_accept}
+-	ip netns exec ${HOST_NS} arping -A -U ${HOST_ADDR} -c1 2>&1 >/dev/null
++	ip netns exec ${HOST_NS} arping -A -I ${HOST_INTF} -U ${HOST_ADDR} -c1 2>&1 >/dev/null
+ 
+ 	if verify_arp $1 $2; then
+ 		printf "    TEST: %-60s  [ OK ]\n" "${test_msg[*]}"
+-- 
+2.43.0
+
diff --git a/queue-6.7/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch b/queue-6.7/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
new file mode 100644
index 00000000000..2a0b7ad3d62
--- /dev/null
+++ b/queue-6.7/selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
@@ -0,0 +1,88 @@
+From 14a3fb8a183e3c869b5711680bf662788dc6bbb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 00:27:44 +1100
+Subject: selftests/powerpc: Fix error handling in FPU/VMX preemption tests
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 9dbd5927408c4a0707de73ae9dd9306b184e8fee ]
+
+The FPU & VMX preemption tests do not check for errors returned by the
+low-level asm routines, preempt_fpu() / preempt_vsx() respectively.
+That means any register corruption detected by the asm routines does not
+result in a test failure.
+
+Fix it by returning the return value of the asm routines from the
+pthread child routines.
+
+Fixes: e5ab8be68e44 ("selftests/powerpc: Test preservation of FPU and VMX regs across preemption")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20231128132748.1990179-1-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/math/fpu_preempt.c |  9 +++++----
+ tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 ++++++----
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/math/fpu_preempt.c b/tools/testing/selftests/powerpc/math/fpu_preempt.c
+index 5235bdc8c0b1..3e5b5663d244 100644
+--- a/tools/testing/selftests/powerpc/math/fpu_preempt.c
++++ b/tools/testing/selftests/powerpc/math/fpu_preempt.c
+@@ -37,19 +37,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,
+ int threads_starting;
+ int running;
+ 
+-extern void preempt_fpu(double *darray, int *threads_starting, int *running);
++extern int preempt_fpu(double *darray, int *threads_starting, int *running);
+ 
+ void *preempt_fpu_c(void *p)
+ {
++	long rc;
+ 	int i;
++
+ 	srand(pthread_self());
+ 	for (i = 0; i < 21; i++)
+ 		darray[i] = rand();
+ 
+-	/* Test failed if it ever returns */
+-	preempt_fpu(darray, &threads_starting, &running);
++	rc = preempt_fpu(darray, &threads_starting, &running);
+ 
+-	return p;
++	return (void *)rc;
+ }
+ 
+ int test_preempt_fpu(void)
+diff --git a/tools/testing/selftests/powerpc/math/vmx_preempt.c b/tools/testing/selftests/powerpc/math/vmx_preempt.c
+index 6761d6ce30ec..6f7cf400c687 100644
+--- a/tools/testing/selftests/powerpc/math/vmx_preempt.c
++++ b/tools/testing/selftests/powerpc/math/vmx_preempt.c
+@@ -37,19 +37,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12},
+ int threads_starting;
+ int running;
+ 
+-extern void preempt_vmx(vector int *varray, int *threads_starting, int *running);
++extern int preempt_vmx(vector int *varray, int *threads_starting, int *running);
+ 
+ void *preempt_vmx_c(void *p)
+ {
+ 	int i, j;
++	long rc;
++
+ 	srand(pthread_self());
+ 	for (i = 0; i < 12; i++)
+ 		for (j = 0; j < 4; j++)
+ 			varray[i][j] = rand();
+ 
+-	/* Test fails if it ever returns */
+-	preempt_vmx(varray, &threads_starting, &running);
+-	return p;
++	rc = preempt_vmx(varray, &threads_starting, &running);
++
++	return (void *)rc;
+ }
+ 
+ int test_preempt_vmx(void)
+-- 
+2.43.0
+
diff --git a/queue-6.7/selftests-xsk-fix-for-send_receive_unaligned-test.patch b/queue-6.7/selftests-xsk-fix-for-send_receive_unaligned-test.patch
new file mode 100644
index 00000000000..464df265529
--- /dev/null
+++ b/queue-6.7/selftests-xsk-fix-for-send_receive_unaligned-test.patch
@@ -0,0 +1,93 @@
+From 706311bbbf185efa505bf16a52bdc4bf78fecc75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 13:00:07 +0000
+Subject: selftests/xsk: Fix for SEND_RECEIVE_UNALIGNED test
+
+From: Tushar Vyavahare <tushar.vyavahare@intel.com>
+
+[ Upstream commit 2e1d6a04116c373fbd25beddba4267178535bc60 ]
+
+Fix test broken by shared umem test and framework enhancement commit.
+
+Correct the current implementation of pkt_stream_replace_half() by
+ensuring that nb_valid_entries are not set to half, as this is not true
+for all the tests. Ensure that the expected value for valid_entries for
+the SEND_RECEIVE_UNALIGNED test equals the total number of packets sent,
+which is 4096.
+
+Create a new function called pkt_stream_pkt_set() that allows for packet
+modification to meet specific requirements while ensuring the accurate
+maintenance of the valid packet count to prevent inconsistencies in packet
+tracking.
+
+Fixes: 6d198a89c004 ("selftests/xsk: Add a test for shared umem feature")
+Reported-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20231214130007.33281-1-tushar.vyavahare@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/xskxceiver.c | 25 +++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/xskxceiver.c b/tools/testing/selftests/bpf/xskxceiver.c
+index b604c570309a..b1102ee13faa 100644
+--- a/tools/testing/selftests/bpf/xskxceiver.c
++++ b/tools/testing/selftests/bpf/xskxceiver.c
+@@ -634,16 +634,24 @@ static u32 pkt_nb_frags(u32 frame_size, struct pkt_stream *pkt_stream, struct pk
+ 	return nb_frags;
+ }
+ 
++static bool set_pkt_valid(int offset, u32 len)
++{
++	return len <= MAX_ETH_JUMBO_SIZE;
++}
++
+ static void pkt_set(struct pkt_stream *pkt_stream, struct pkt *pkt, int offset, u32 len)
+ {
+ 	pkt->offset = offset;
+ 	pkt->len = len;
+-	if (len > MAX_ETH_JUMBO_SIZE) {
+-		pkt->valid = false;
+-	} else {
+-		pkt->valid = true;
+-		pkt_stream->nb_valid_entries++;
+-	}
++	pkt->valid = set_pkt_valid(offset, len);
++}
++
++static void pkt_stream_pkt_set(struct pkt_stream *pkt_stream, struct pkt *pkt, int offset, u32 len)
++{
++	bool prev_pkt_valid = pkt->valid;
++
++	pkt_set(pkt_stream, pkt, offset, len);
++	pkt_stream->nb_valid_entries += pkt->valid - prev_pkt_valid;
+ }
+ 
+ static u32 pkt_get_buffer_len(struct xsk_umem_info *umem, u32 len)
+@@ -665,7 +673,7 @@ static struct pkt_stream *__pkt_stream_generate(u32 nb_pkts, u32 pkt_len, u32 nb
+ 	for (i = 0; i < nb_pkts; i++) {
+ 		struct pkt *pkt = &pkt_stream->pkts[i];
+ 
+-		pkt_set(pkt_stream, pkt, 0, pkt_len);
++		pkt_stream_pkt_set(pkt_stream, pkt, 0, pkt_len);
+ 		pkt->pkt_nb = nb_start + i * nb_off;
+ 	}
+ 
+@@ -700,10 +708,9 @@ static void __pkt_stream_replace_half(struct ifobject *ifobj, u32 pkt_len,
+ 
+ 	pkt_stream = pkt_stream_clone(ifobj->xsk->pkt_stream);
+ 	for (i = 1; i < ifobj->xsk->pkt_stream->nb_pkts; i += 2)
+-		pkt_set(pkt_stream, &pkt_stream->pkts[i], offset, pkt_len);
++		pkt_stream_pkt_set(pkt_stream, &pkt_stream->pkts[i], offset, pkt_len);
+ 
+ 	ifobj->xsk->pkt_stream = pkt_stream;
+-	pkt_stream->nb_valid_entries /= 2;
+ }
+ 
+ static void pkt_stream_replace_half(struct test_spec *test, u32 pkt_len, int offset)
+-- 
+2.43.0
+
diff --git a/queue-6.7/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch b/queue-6.7/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
new file mode 100644
index 00000000000..131b7220ebf
--- /dev/null
+++ b/queue-6.7/selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
@@ -0,0 +1,55 @@
+From 06881d5a77e2d438a711383b144c7dbef02e3a13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jan 2024 17:34:15 +0100
+Subject: selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6
+ socket
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mickaël Salaün <mic@digikod.net>
+
+[ Upstream commit bbf5a1d0e5d0fb3bdf90205aa872636122692a50 ]
+
+The IPv6 network stack first checks the sockaddr length (-EINVAL error)
+before checking the family (-EAFNOSUPPORT error).
+
+This was discovered thanks to commit a549d055a22e ("selftests/landlock:
+Add network tests").
+
+Cc: Eric Paris <eparis@parisplace.org>
+Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
+Cc: Paul Moore <paul@paul-moore.com>
+Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
+Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Closes: https://lore.kernel.org/r/0584f91c-537c-4188-9e4f-04f192565667@collabora.com
+Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()")
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/hooks.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 340b2bbbb2dd..0fb890bd72cb 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -4661,6 +4661,13 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
+ 				return -EINVAL;
+ 			addr4 = (struct sockaddr_in *)address;
+ 			if (family_sa == AF_UNSPEC) {
++				if (family == PF_INET6) {
++					/* Length check from inet6_bind_sk() */
++					if (addrlen < SIN6_LEN_RFC2133)
++						return -EINVAL;
++					/* Family check from __inet6_bind() */
++					goto err_af;
++				}
+ 				/* see __inet_bind(), we only want to allow
+ 				 * AF_UNSPEC if the address is INADDR_ANY
+ 				 */
+-- 
+2.43.0
+
diff --git a/queue-6.7/series b/queue-6.7/series
new file mode 100644
index 00000000000..5aebe04fce8
--- /dev/null
+++ b/queue-6.7/series
@@ -0,0 +1,381 @@
+x86-lib-fix-overflow-when-counting-digits.patch
+x86-mce-inject-clear-test-status-value.patch
+edac-thunderx-fix-possible-out-of-bounds-string-acce.patch
+powerpc-add-crtsavres.o-to-always-y-instead-of-extra.patch
+fs-pipe-fix-lockdep-false-positive-in-watchqueue-pip.patch
+x86-fix-cpuidle_flag_irq_enable-leaking-timer-reprog.patch
+powerpc-44x-select-i2c-for-currituck.patch
+powerpc-pseries-memhp-fix-access-beyond-end-of-drmem.patch
+x86-microcode-intel-set-new-revision-only-after-a-su.patch
+perf-arm-cmn-fix-hn-f-class_occup_id-events.patch
+drivers-perf-hisi-fix-some-event-id-for-hisilicon-uc.patch
+kvm-ppc-book3s-hv-handle-pending-exceptions-on-guest.patch
+selftests-powerpc-fix-error-handling-in-fpu-vmx-pree.patch
+powerpc-hv-gpci-add-return-value-check-in-affinity_d.patch
+powerpc-rtas-avoid-warning-on-invalid-token-argument.patch
+powerpc-powernv-add-a-null-pointer-check-to-scom_deb.patch
+powerpc-powernv-add-a-null-pointer-check-in-opal_eve.patch
+powerpc-powernv-add-a-null-pointer-check-in-opal_pow.patch
+powerpc-imc-pmu-add-a-null-pointer-check-in-update_e.patch
+sched-fair-update-min_vruntime-for-reweight_entity-c.patch
+perf-x86-intel-uncore-fix-null-pointer-dereference-i.patch
+spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
+mtd-rawnand-increment-ifc_timeout_msecs-for-nand-con.patch
+acpi-video-check-for-error-while-searching-for-backl.patch
+acpi-lpit-avoid-u32-multiplication-overflow.patch
+keys-encrypted-add-check-for-strsep.patch
+spi-cadence-quadspi-add-missing-clk_disable_unprepar.patch
+platform-x86-intel-vsec-fix-xa_alloc-memory-leak.patch
+cpufreq-scmi-process-the-result-of-devm_of_clk_add_h.patch
+calipso-fix-memory-leak-in-netlbl_calipso_add_pass.patch
+efivarfs-force-ro-when-remounting-if-setvariable-is-.patch
+efivarfs-free-s_fs_info-on-unmount.patch
+spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
+acpi-lpss-fix-the-fractional-clock-divider-flags.patch
+acpi-extlog-clear-extended-error-log-status-when-ras.patch
+thermal-core-fix-null-pointer-dereference-in-zone-re.patch
+kunit-debugfs-fix-unchecked-dereference-in-debugfs_p.patch
+kunit-debugfs-handle-errors-from-alloc_string_stream.patch
+mtd-fix-gluebi-null-pointer-dereference-caused-by-ft.patch
+cpuidle-haltpoll-do-not-enable-interrupts-when-enter.patch
+drivers-thermal-loongson2_thermal-fix-incorrect-ptr_.patch
+selinux-fix-error-priority-for-bind-with-af_unspec-o.patch
+crypto-rsa-add-a-check-for-allocation-failure.patch
+crypto-qat-prevent-underflow-in-rp2srv_store.patch
+crypto-jh7110-correct-deferred-probe-return.patch
+crypto-virtio-handle-dataq-logic-with-tasklet.patch
+crypto-qat-add-sysfs_added-flag-for-ras.patch
+crypto-qat-add-sysfs_added-flag-for-rate-limiting.patch
+crypto-sa2ul-return-crypto_aead_setkey-to-transfer-t.patch
+crypto-ccp-fix-memleak-in-ccp_init_dm_workarea.patch
+crypto-af_alg-disallow-multiple-in-flight-aio-reques.patch
+crypto-qat-fix-error-path-in-add_update_sla.patch
+crypto-qat-fix-mutex-ordering-in-adf_rl.patch
+crypto-qat-add-null-pointer-check.patch
+hwrng-stm32-add-missing-clk_disable_unprepare-in-stm.patch
+crypto-safexcel-add-error-handling-for-dma_map_sg-ca.patch
+crypto-sahara-remove-flags_new_key-logic.patch
+crypto-sahara-fix-cbc-selftest-failure.patch
+crypto-sahara-fix-ahash-selftest-failure.patch
+crypto-sahara-fix-processing-requests-with-cryptlen-.patch
+crypto-sahara-fix-error-handling-in-sahara_hw_descri.patch
+crypto-hisilicon-qm-save-capability-registers-in-qm-.patch
+crypto-hisilicon-zip-add-zip-comp-high-perf-mode-con.patch
+crypto-hisilicon-qm-add-a-function-to-set-qm-algs.patch
+crypto-hisilicon-hpre-save-capability-registers-in-p.patch
+crypto-hisilicon-sec2-save-capability-registers-in-p.patch
+crypto-hisilicon-zip-save-capability-registers-in-pr.patch
+pstore-ram_core-fix-possible-overflow-in-persistent_.patch
+erofs-fix-memory-leak-on-short-lived-bounced-pages.patch
+fs-indicate-request-originates-from-old-mount-api.patch
+gfs2-fix-kernel-null-pointer-dereference-in-gfs2_rgr.patch
+gfs2-fix-kernel-bug-in-gfs2_quota_cleanup.patch
+dlm-fix-format-seq-ops-type-4.patch
+crypto-virtio-wait-for-tasklet-to-complete-on-device.patch
+crypto-sahara-avoid-skcipher-fallback-code-duplicati.patch
+crypto-sahara-handle-zero-length-aes-requests.patch
+crypto-sahara-fix-ahash-reqsize.patch
+crypto-sahara-fix-wait_for_completion_timeout-error-.patch
+crypto-sahara-improve-error-handling-in-sahara_sha_p.patch
+crypto-sahara-fix-processing-hash-requests-with-req-.patch
+crypto-sahara-do-not-resize-req-src-when-doing-hash-.patch
+crypto-scomp-fix-req-dst-buffer-overflow.patch
+keys-dns-fix-size-check-of-v1-server-list-header.patch
+csky-fix-arch_jump_label_transform_static-override.patch
+loongarch-signal.c-add-header-file-to-fix-build-erro.patch
+blocklayoutdriver-fix-reference-leak-of-pnfs_device_.patch
+nfs-use-parent-s-objective-cred-in-nfs_access_login_.patch
+nfsv4.1-pnfs-ensure-we-handle-the-error-nfs4err_retu.patch
+sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
+pnfs-fix-the-pnfs-block-driver-s-calculation-of-layo.patch
+sunrpc-fixup-v4.1-backchannel-request-timeouts.patch
+asm-generic-fix-32-bit-__generic_cmpxchg_local.patch
+arm64-dts-qcom-qrb4210-rb2-don-t-force-usb-periphera.patch
+arm64-dts-qcom-sc8280xp-x13s-use-the-correct-dp-phy-.patch
+arm64-dts-qcom-sc8280xp-x13s-add-missing-camera-led-.patch
+arm-dts-qcom-msm8226-provide-dsi-phy-clocks-to-mmcc.patch
+wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
+wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
+bpf-lpm-fix-check-prefixlen-before-walking-trie.patch
+bpf-add-kf_rcu-flag-to-bpf_refcount_acquire_impl.patch
+bpf-add-crosstask-check-to-__bpf_get_stack.patch
+wifi-ath11k-defer-on-rproc_get-failure.patch
+wifi-libertas-stop-selecting-wext.patch
+arm-dts-qcom-apq8064-correct-xoadc-register-address.patch
+scsi-lpfc-fix-list_entry-null-check-warning-in-lpfc_.patch
+net-ncsi-fix-netlink-major-minor-version-numbers.patch
+firmware-ti_sci-fix-an-off-by-one-in-ti_sci_debugfs_.patch
+scsi-bfa-use-the-proper-data-type-for-blist-flags.patch
+wifi-ath12k-fix-the-error-handler-of-rfkill-config.patch
+wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
+arm64-dts-ti-k3-am62a-main-fix-gpio-pin-count-in-dt-.patch
+arm64-dts-ti-k3-am65-main-fix-dss-irq-trigger-type.patch
+arm64-dts-ti-iot2050-re-add-aliases.patch
+wifi-rtw88-sdio-honor-the-host-max_req_size-in-the-r.patch
+selftests-bpf-fix-erroneous-bitmask-operation.patch
+md-synchronize-flush-io-with-array-reconfiguration.patch
+bpf-enforce-precision-of-r0-on-callback-return.patch
+arm-dts-qcom-sdx65-correct-pcie-ep-phy-names.patch
+arm-dts-qcom-sdx65-correct-spmi-node-name.patch
+dt-bindings-arm-qcom-fix-html-link.patch
+arm64-dts-qcom-sc8180x-primus-fix-hall_int-polarity.patch
+arm64-dts-qcom-sm8450-correct-tx-soundwire-clock.patch
+arm64-dts-qcom-sm8550-correct-tx-soundwire-clock.patch
+arm64-dts-qcom-sc7180-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sc7280-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sdm845-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sm8150-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sm8250-make-watchdog-bark-interrupt-e.patch
+arm64-dts-qcom-sa8775p-make-watchdog-bark-interrupt-.patch
+arm64-dts-qcom-sc8280xp-make-watchdog-bark-interrupt.patch
+arm64-dts-qcom-sm6350-make-watchdog-bark-interrupt-e.patch
+bpf-add-map-and-need_defer-parameters-to-.map_fd_put.patch
+bpf-defer-the-free-of-inner-map-when-necessary.patch
+selftests-net-specify-the-interface-when-do-arping.patch
+bpf-fix-check-for-attempt-to-corrupt-spilled-pointer.patch
+scsi-fnic-return-error-if-vmalloc-failed.patch
+arm64-dts-qcom-qrb2210-rb1-use-usb-host-mode.patch
+arm64-dts-qcom-qrb5165-rb5-correct-led-panic-indicat.patch
+arm64-dts-qcom-sdm845-db845c-correct-led-panic-indic.patch
+arm64-dts-qcom-sm6125-add-interrupts-to-dwc3-usb-con.patch
+arm64-dts-qcom-sm8350-fix-dma0-address.patch
+arm64-dts-qcom-sc7280-fix-up-gpu-sids.patch
+arm64-dts-qcom-sc7280-mark-adreno-smmu-as-dma-cohere.patch
+arm64-dts-qcom-sa8775p-fix-usb-wakeup-interrupt-type.patch
+arm64-dts-qcom-sc7280-fix-usb_2-wakeup-interrupt-typ.patch
+arm64-dts-qcom-sm8550-fix-usb-wakeup-interrupt-types.patch
+wifi-mt76-mt7996-fix-uninitialized-variable-in-parsi.patch
+wifi-mt76-fix-typo-in-mt76_get_of_eeprom_from_nvmem-.patch
+wifi-mt76-mt7915-fallback-to-non-wed-mode-if-platfor.patch
+wifi-mt76-mt7996-fix-the-size-of-struct-bss_rate_tlv.patch
+wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch
+wifi-mt76-mt7996-fix-alignment-of-sta-info-event.patch
+wifi-mt76-mt7915-fix-eeprom-offset-of-tssi-flag-on-m.patch
+wifi-mt76-mt7915-also-mt7981-is-3t3r-but-nss2-on-5-g.patch
+wifi-mt76-mt7996-fix-mt7996_mcu_all_sta_info_event-s.patch
+wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
+bpf-fix-verification-of-indirect-var-off-stack-acces.patch
+arm64-dts-hisilicon-hikey970-pmic-fix-regulator-cell.patch
+bpf-guard-stack-limits-against-32bit-overflow.patch
+bpf-fix-accesses-to-uninit-stack-slots.patch
+test_bpf-rename-second-alu64_smod_x-to-alu64_smod_k.patch
+dt-bindings-media-mediatek-mdp3-correct-rdma-and-wro.patch
+arm64-dts-mediatek-mt8183-correct-mdp3-dma-related-n.patch
+arm64-dts-mediatek-mt8195-revise-vdosys-rdma-node-na.patch
+arm64-dts-mediatek-mt8186-fix-alias-prefix-for-ovl_2.patch
+arm64-dts-mediatek-mt8186-fix-address-warning-for-ad.patch
+wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
+wifi-mt76-mt7921-fix-clc-command-timeout-when-suspen.patch
+wifi-mt76-mt7921-fix-wrong-6ghz-power-type.patch
+wifi-iwlwifi-don-t-support-triggered-eht-cqi-feedbac.patch
+selftests-bpf-relax-time_tai-test-for-equal-timestam.patch
+block-set-memalloc_noio-to-false-on-device_add_disk-.patch
+arm64-dts-xilinx-apply-overlays-to-base-dtbs.patch
+arm64-dts-renesas-white-hawk-cpu-fix-missing-serial-.patch
+arm64-dts-imx8mm-reduce-gpu-to-nominal-speed.patch
+scsi-ufs-qcom-fix-the-return-value-of-ufs_qcom_ice_p.patch
+scsi-ufs-qcom-fix-the-return-value-when-platform_get.patch
+scsi-hisi_sas-replace-with-standard-error-code-retur.patch
+scsi-hisi_sas-check-before-using-pointer-variables.patch
+scsi-hisi_sas-rollback-some-operations-if-flr-failed.patch
+scsi-hisi_sas-correct-the-number-of-global-debugfs-r.patch
+selftests-xsk-fix-for-send_receive_unaligned-test.patch
+arm-dts-stm32-don-t-mix-scmi-and-non-scmi-board-comp.patch
+bpf-fix-a-race-condition-between-btf_put-and-map_fre.patch
+selftests-net-fix-grep-checking-for-fib_nexthop_mult.patch
+ipmr-support-ip_pktinfo-on-cache-report-igmp-msg.patch
+virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
+virtio-vsock-send-credit-update-during-setting-so_rc.patch
+dma-mapping-clear-dev-dma_mem-to-null-after-freeing-.patch
+bpf-limit-the-number-of-uprobes-when-attaching-progr.patch
+bpf-limit-the-number-of-kprobes-when-attaching-progr.patch
+arm64-dts-qcom-acer-aspire1-correct-audio-codec-defi.patch
+soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
+arm64-dts-qcom-sm6375-fix-usb-wakeup-interrupt-types.patch
+arm64-dts-qcom-sm6375-hook-up-mpm.patch
+arm64-dts-qcom-sm8150-make-dispcc-cast-minimal-vote-.patch
+arm64-dts-qcom-sm8150-hdk-fix-ss-usb-regulators.patch
+firmware-qcom-qseecom-fix-memory-leaks-in-error-path.patch
+soc-qcom-llcc-fix-llcc_trp_attr2_cfgn-offset.patch
+block-add-check-of-minors-and-first_minor-in-device_.patch
+arm64-dts-qcom-sc7280-mark-sdhci-hosts-as-cache-cohe.patch
+arm64-dts-qcom-ipq6018-fix-clock-rates-for-gcc_usb0_.patch
+arm64-dts-qcom-sm8550-separate-out-x3-idle-state.patch
+arm64-dts-qcom-sm8550-update-idle-state-time-require.patch
+arm64-dts-qcom-sc8180x-mark-pcie-hosts-cache-coheren.patch
+arm64-dts-qcom-sc8180x-fix-up-pcie-nodes.patch
+bpf-use-c-unit_size-to-select-target-cache-during-fr.patch
+wifi-rtlwifi-add-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
+wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
+wifi-mac80211-fix-advertised-ttlm-scheduling.patch
+wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
+wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
+wifi-iwlwifi-mvm-do-not-warn-if-valid-link-pair-was-.patch
+wifi-iwlwifi-fix-out-of-bound-copy_from_user.patch
+wifi-iwlwifi-assign-phy_ctxt-before-esr-activation.patch
+netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
+netfilter-nf_tables-validate-chain-type-update-if-av.patch
+bluetooth-fix-bogus-check-for-re-auth-no-supported-w.patch
+bluetooth-btnxpuart-fix-recv_buf-return-value.patch
+bluetooth-btmtkuart-fix-recv_buf-return-value.patch
+null_blk-don-t-cap-max_hw_sectors-to-blk_def_max_sec.patch
+arm64-dts-rockchip-fix-led-pinctrl-of-lubancat-1.patch
+ice-fix-some-null-pointer-dereference-issues-in-ice_.patch
+wifi-cfg80211-correct-comment-about-mld-id.patch
+wifi-cfg80211-parse-all-ml-elements-in-an-ml-probe-r.patch
+bpf-sockmap-fix-proto-update-hook-to-avoid-dup-calls.patch
+sctp-support-msg_errqueue-flag-in-recvmsg.patch
+sctp-fix-busy-polling.patch
+s390-bpf-fix-gotol-with-large-offsets.patch
+blk-cgroup-fix-rcu-lockdep-warning-in-blkg_lookup.patch
+net-sched-act_ct-fix-skb-leak-and-crash-on-ooo-frags.patch
+mlxbf_gige-fix-intermittent-no-ip-issue.patch
+mlxbf_gige-enable-the-gige-port-in-mlxbf_gige_open.patch
+rxrpc-fix-skbuff-cleanup-of-call-s-recvmsg_queue-and.patch
+ip6_tunnel-fix-nexthdr_fragment-handling-in-ip6_tnl_.patch
+arm-davinci-always-select-config_cpu_arm926t.patch
+revert-drm-tidss-annotate-dma-fence-critical-section.patch
+revert-drm-omapdrm-annotate-dma-fence-critical-secti.patch
+drm-i915-display-move-releasing-gem-object-away-from.patch
+drm-dp_mst-fix-fractional-dsc-bpp-handling.patch
+drm-panfrost-really-power-off-gpu-cores-in-panfrost_.patch
+rdma-usnic-silence-uninitialized-symbol-smatch-warni.patch
+rdma-hns-fix-inappropriate-err-code-for-unsupported-.patch
+drm-panel-nv3051d-hold-panel-in-reset-for-unprepare.patch
+drm-panel-elida-kd35t133-hold-panel-in-reset-for-unp.patch
+drm-nouveau-fence-fix-warning-directly-dereferencing.patch
+drm-bridge-tpd12s015-drop-buggy-__exit-annotation-fo.patch
+drm-tilcdc-fix-irq-free-on-unload.patch
+media-pvrusb2-fix-use-after-free-on-context-disconne.patch
+media-mtk-jpeg-remove-cancel-worker-in-mtk_jpeg_remo.patch
+media-visl-hook-the-try_-decoder_cmd-stateless-ioctl.patch
+media-verisilicon-hook-the-try_-decoder_cmd-stateles.patch
+media-rkvdec-hook-the-try_-decoder_cmd-stateless-ioc.patch
+media-amphion-fix-vpu-core-alias-name.patch
+drm-sched-fix-bounds-limiting-when-given-a-malformed.patch
+drm-bridge-fix-typo-in-post_disable-description.patch
+drm-bridge-imx93-mipi-dsi-fix-a-couple-of-building-w.patch
+gpio-sysfs-fix-forward-declaration-of-struct-gpio_de.patch
+f2fs-fix-to-avoid-dirent-corruption.patch
+revert-drm-bridge-add-200ms-delay-to-wait-fw-hpd-sta.patch
+fbdev-sm712fb-use-correct-initializer-macros-for-str.patch
+asoc-fsl_rpmsg-update-kconfig-dependencies.patch
+drm-radeon-r600_cs-fix-possible-int-overflows-in-r60.patch
+drm-radeon-r100-fix-integer-overflow-issues-in-r100_.patch
+drm-radeon-check-return-value-of-radeon_ring_lock.patch
+drm-amd-display-fix-null-pointer-dereference-at-hibe.patch
+drm-tidss-move-reset-to-the-end-of-dispc_init.patch
+drm-tidss-return-error-value-from-from-softreset.patch
+drm-tidss-check-for-k2g-in-in-dispc_softreset.patch
+drm-tidss-fix-dss-reset.patch
+drm-imx-lcdc-fix-double-free-of-driver-data.patch
+asoc-cs35l33-fix-gpio-name-and-drop-legacy-include.patch
+asoc-cs35l34-fix-gpio-name-and-drop-legacy-include.patch
+drm-msm-a6xx-add-qmp-dependency.patch
+drm-msm-mdp4-flush-vblank-event-on-disable.patch
+drm-msm-dpu-add-missing-safe_lut_tbl-in-sc8180x-cata.patch
+drm-msm-dsi-use-pm_runtime_resume_and_get-to-prevent.patch
+drm-drv-propagate-errors-from-drm_modeset_register_a.patch
+media-v4l-async-fix-duplicated-list-deletion.patch
+asoc-intel-glk_rt5682_max98357a-fix-board-id-mismatc.patch
+asoc-intel-sof_sdw_rt_sdca_jack_common-ctx-headset_c.patch
+asoc-sof-topology-use-partial-match-for-disconnectin.patch
+drm-msm-dpu-enable-smartdma-on-sm8450.patch
+drm-msm-dpu-populate-sspp-scaler-block-version.patch
+drm-panfrost-ignore-core_mask-for-poweroff-and-disab.patch
+drm-msm-dpu-correct-clk-bit-for-wb2-block.patch
+drm-amd-display-return-drm_connector-from-find_first.patch
+drm-amd-display-use-drm_connector-in-create_stream_f.patch
+drm-amd-display-check-writeback-connectors-in-create.patch
+drm-radeon-check-the-alloc_workqueue-return-value-in.patch
+drm-radeon-dpm-fix-a-memleak-in-sumo_parse_power_tab.patch
+drm-radeon-trinity_dpm-fix-a-memleak-in-trinity_pars.patch
+drm-bridge-cdns-mhdp8546-fix-use-of-uninitialized-va.patch
+drm-bridge-tc358767-fix-return-value-on-error-case.patch
+media-cx231xx-fix-a-memleak-in-cx231xx_init_isoc.patch
+asoc-sof-intel-pci-mtl-fix-arl-s-definitions.patch
+rdma-hns-fix-memory-leak-in-free_mr_init.patch
+clk-qcom-gpucc-sm8150-update-the-gpu_cc_pll1-config.patch
+f2fs-restrict-max-filesize-for-16k-f2fs.patch
+media-bttv-start_streaming-should-return-a-proper-er.patch
+media-bttv-add-back-vbi-hack.patch
+media-videobuf2-request-more-buffers-for-vb2_read.patch
+media-imx-mipi-csis-fix-clock-handling-in-remove.patch
+media-imx-mipi-csis-drop-extra-clock-enable-at-probe.patch
+media-dt-bindings-media-rkisp1-fix-the-port-descript.patch
+media-rkisp1-fix-media-device-memory-leak.patch
+media-rkisp1-fix-memory-leaks-in-rkisp1_isp_unregist.patch
+drm-msm-adreno-fix-a680-chip-id.patch
+drm-panel-st7701-fix-avcl-calculation.patch
+f2fs-fix-to-wait-on-block-writeback-for-post_read-ca.patch
+f2fs-fix-to-check-compress-file-in-f2fs_move_file_ra.patch
+f2fs-fix-to-update-iostat-correctly-in-f2fs_filemap_.patch
+media-dvbdev-drop-refcount-on-error-path-in-dvb_devi.patch
+media-dvb-frontends-m88ds3103-fix-a-memory-leak-in-a.patch
+clk-renesas-rzg2l-cpg-reuse-code-in-rzg2l_cpg_reset.patch
+clk-renesas-rzg2l-check-reset-monitor-registers.patch
+drm-msm-dpu-set-input_sel-bit-for-intf.patch
+drm-msm-dpu-drop-enable-and-frame_count-parameters-f.patch
+media-i2c-mt9m114-use-fsleep-in-place-of-udelay.patch
+drm-mediatek-return-error-if-mdp-rdma-failed-to-enab.patch
+drm-mediatek-remove-the-redundant-driver-data-for-dp.patch
+drm-mediatek-fix-underrun-in-vdo1-when-switches-off-.patch
+drm-amdgpu-debugfs-fix-error-code-when-smc-register-.patch
+drm-amd-pm-fix-a-double-free-in-si_dpm_init.patch
+drivers-amd-pm-fix-a-use-after-free-in-kv_parse_powe.patch
+gpu-drm-radeon-fix-two-memleaks-in-radeon_vm_init.patch
+drm-amd-pm-fix-a-double-free-in-amdgpu_parse_extende.patch
+f2fs-fix-to-check-return-value-of-f2fs_recover_xattr.patch
+clk-qcom-videocc-sm8150-add-missing-pll-config-prope.patch
+clk-sp7021-fix-return-value-check-in-sp7021_clk_prob.patch
+drivers-clk-zynqmp-calculate-closest-mux-rate.patch
+drivers-clk-zynqmp-update-divider-round-rate-logic.patch
+watchdog-set-cdev-owner-before-adding.patch
+watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
+watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
+watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
+clk-rs9-fix-dif-oen-bit-placement-on-9fgv0241.patch
+clk-si5341-fix-an-error-code-problem-in-si5341_outpu.patch
+asoc-amd-vangogh-drop-conflicting-acpi-based-probing.patch
+asoc-tas2781-add-support-for-fw-version-0x0503.patch
+drm-mediatek-dp-add-phy_mtk_dp-module-as-pre-depende.patch
+accel-habanalabs-fix-information-leak-in-sec_attest_.patch
+clk-qcom-gcc-sm8550-add-the-missing-retain_ff_enable.patch
+clk-qcom-gcc-sm8550-mark-the-pcie-gdscs-votable.patch
+clk-qcom-gcc-sm8550-use-collapse-voting-for-pcie-gds.patch
+clk-qcom-gcc-sm8550-mark-rcgs-shared-where-applicabl.patch
+clk-qcom-gpucc-sm8550-update-gpu-pll-settings.patch
+clk-qcom-dispcc-sm8550-update-disp-pll-settings.patch
+clk-qcom-dispcc-sm8550-use-the-correct-pll-configura.patch
+clk-fixed-rate-fix-clk_hw_register_fixed_rate_with_a.patch
+pwm-stm32-use-hweight32-in-stm32_pwm_detect_channels.patch
+pwm-stm32-fix-enable-count-for-clk-in-.probe.patch
+asoc-rt5645-drop-double-ef20-entry-from-dmi_platform.patch
+alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch
+alsa-scarlett2-add-missing-error-check-to-scarlett2_.patch-10152
+alsa-scarlett2-add-missing-error-checks-to-_ctl_get.patch
+alsa-scarlett2-add-clamp-in-scarlett2_mixer_ctl_put.patch
+alsa-scarlett2-add-missing-mutex-lock-around-get-met.patch
+mmc-sdhci_am654-fix-ti-soc-dependencies.patch
+mmc-sdhci_omap-fix-ti-soc-dependencies.patch
+drm-amdkfd-fix-type-of-dbg_flags-in-struct-kfd_proce.patch
+gpiolib-rename-static-functions-that-are-called-with.patch
+gpiolib-use-a-mutex-to-protect-the-list-of-gpio-devi.patch
+gpiolib-remove-the-gpio-device-from-the-list-when-it.patch
+ib-iser-prevent-invalidating-wrong-mr.patch
+drm-amdkfd-confirm-list-is-non-empty-before-utilizin.patch
+drm-amd-pm-smu7-fix-a-memleak-in-smu7_hwmgr_backend_.patch
+drm-amd-display-avoid-stringop-overflow-warnings-for.patch
+kselftest-alsa-mixer-test-fix-the-number-of-paramete.patch
+kselftest-alsa-mixer-test-fix-the-print-format-speci.patch
+kselftest-alsa-conf-stringify-the-printed-errno-in-s.patch
+ksmbd-validate-the-zero-field-of-packet-header.patch
+of-fix-double-free-in-of_parse_phandle_with_args_map.patch
+fbdev-imxfb-fix-left-margin-setting.patch
+of-unittest-fix-of_count_phandle_with_args-expected-.patch
diff --git a/queue-6.7/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch b/queue-6.7/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
new file mode 100644
index 00000000000..0112f9c73cb
--- /dev/null
+++ b/queue-6.7/soc-qcom-llcc-fix-dis_cap_alloc-and-retain_on_pc-con.patch
@@ -0,0 +1,70 @@
+From e7bd958272f9dca48b4a9f255ac8584374c856e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Dec 2023 21:02:51 +0530
+Subject: soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
+
+From: Atul Dhudase <quic_adhudase@quicinc.com>
+
+[ Upstream commit eed6e57e9f3e2beac37563eb6a0129549daa330e ]
+
+Commit c14e64b46944 ("soc: qcom: llcc: Support chipsets that can
+ write to llcc") add the support for chipset where capacity based
+allocation and retention through power collapse can be programmed
+based on content of SCT table mentioned in the llcc driver where
+the target like sdm845 where the entire programming related to it
+is controlled in firmware. However, the commit introduces a bug
+where capacity/retention register get overwritten each time it
+gets programmed for each slice and that results in misconfiguration
+of the register based on SCT table and that is not expected
+behaviour instead it should be read modify write to retain the
+configuration of other slices.
+
+This issue is totally caught from code review and programming test
+and not through any power/perf numbers so, it is not known what
+impact this could make if we don't have this change however,
+this feature are for these targets and they should have been
+programmed accordingly as per their configuration mentioned in
+SCT table like others bits information.
+
+This change brings one difference where it keeps capacity/retention
+bits of the slices that are not mentioned in SCT table in unknown
+state where as earlier it was initialized to zero.
+
+Fixes: c14e64b46944 ("soc: qcom: llcc: Support chipsets that can write to llcc")
+Signed-off-by: Atul Dhudase <quic_adhudase@quicinc.com>
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/1701876771-10695-1-git-send-email-quic_mojha@quicinc.com
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/llcc-qcom.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
+index 674abd0d6700..2e32a0e521d5 100644
+--- a/drivers/soc/qcom/llcc-qcom.c
++++ b/drivers/soc/qcom/llcc-qcom.c
+@@ -941,15 +941,15 @@ static int _qcom_llcc_cfg_program(const struct llcc_slice_config *config,
+ 		u32 disable_cap_alloc, retain_pc;
+ 
+ 		disable_cap_alloc = config->dis_cap_alloc << config->slice_id;
+-		ret = regmap_write(drv_data->bcast_regmap,
+-				LLCC_TRP_SCID_DIS_CAP_ALLOC, disable_cap_alloc);
++		ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_SCID_DIS_CAP_ALLOC,
++					 BIT(config->slice_id), disable_cap_alloc);
+ 		if (ret)
+ 			return ret;
+ 
+ 		if (drv_data->version < LLCC_VERSION_4_1_0_0) {
+ 			retain_pc = config->retain_on_pc << config->slice_id;
+-			ret = regmap_write(drv_data->bcast_regmap,
+-					LLCC_TRP_PCB_ACT, retain_pc);
++			ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_PCB_ACT,
++						 BIT(config->slice_id), retain_pc);
+ 			if (ret)
+ 				return ret;
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.7/soc-qcom-llcc-fix-llcc_trp_attr2_cfgn-offset.patch b/queue-6.7/soc-qcom-llcc-fix-llcc_trp_attr2_cfgn-offset.patch
new file mode 100644
index 00000000000..7352097bd07
--- /dev/null
+++ b/queue-6.7/soc-qcom-llcc-fix-llcc_trp_attr2_cfgn-offset.patch
@@ -0,0 +1,39 @@
+From e2d73acbe3e3aef156cf2ca60dc1b33190fa5f9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 19:05:09 +0300
+Subject: soc: qcom: llcc: Fix LLCC_TRP_ATTR2_CFGn offset
+
+From: Abel Vesa <abel.vesa@linaro.org>
+
+[ Upstream commit 110cb8d861cc1a040cdab495b22ac436c49d1454 ]
+
+According to documentation, it has increments of 4, not 8.
+
+Fixes: c72ca343f911 ("soc: qcom: llcc: Add v4.1 HW version support")
+Reported-by: Unnathi Chalicheemala <quic_uchalich@quicinc.com>
+Reviewed-by: Satya Durga Srinivasu Prabhala <quic_satyap@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
+Link: https://lore.kernel.org/r/20231012160509.184891-1-abel.vesa@linaro.org
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/llcc-qcom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
+index 2e32a0e521d5..57d47dcf11b9 100644
+--- a/drivers/soc/qcom/llcc-qcom.c
++++ b/drivers/soc/qcom/llcc-qcom.c
+@@ -47,7 +47,7 @@
+ #define LLCC_TRP_STATUSn(n)           (4 + n * SZ_4K)
+ #define LLCC_TRP_ATTR0_CFGn(n)        (0x21000 + SZ_8 * n)
+ #define LLCC_TRP_ATTR1_CFGn(n)        (0x21004 + SZ_8 * n)
+-#define LLCC_TRP_ATTR2_CFGn(n)        (0x21100 + SZ_8 * n)
++#define LLCC_TRP_ATTR2_CFGn(n)        (0x21100 + SZ_4 * n)
+ 
+ #define LLCC_TRP_SCID_DIS_CAP_ALLOC   0x21f00
+ #define LLCC_TRP_PCB_ACT              0x21f04
+-- 
+2.43.0
+
diff --git a/queue-6.7/spi-cadence-quadspi-add-missing-clk_disable_unprepar.patch b/queue-6.7/spi-cadence-quadspi-add-missing-clk_disable_unprepar.patch
new file mode 100644
index 00000000000..3cad0f30974
--- /dev/null
+++ b/queue-6.7/spi-cadence-quadspi-add-missing-clk_disable_unprepar.patch
@@ -0,0 +1,51 @@
+From 3bcada3c4bf8f8723320c0690a4fc6a494ca0f37 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Nov 2023 16:11:47 +0800
+Subject: spi: cadence-quadspi: add missing clk_disable_unprepare() in
+ cqspi_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+[ Upstream commit 5cb475174cce1bfedf1025b6e235e2c43d81144f ]
+
+cqspi_jh7110_clk_init() is called after clk_prepare_enable(cqspi->clk),
+if it fails, it should goto label 'probe_reset_failed' to disable
+cqspi->clk.
+
+In the error path after calling cqspi_jh7110_clk_init(),
+cqspi_jh7110_disable_clk() need be called.
+
+Fixes: 33f1ef6d4eb6 ("spi: cadence-quadspi: Add clock configuration for StarFive JH7110 QSPI")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20231129081147.628004-1-yangyingliang@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence-quadspi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
+index 3d7bf62da11c..f94e0d370d46 100644
+--- a/drivers/spi/spi-cadence-quadspi.c
++++ b/drivers/spi/spi-cadence-quadspi.c
+@@ -1840,7 +1840,7 @@ static int cqspi_probe(struct platform_device *pdev)
+ 		if (ddata->jh7110_clk_init) {
+ 			ret = cqspi_jh7110_clk_init(pdev, cqspi);
+ 			if (ret)
+-				goto probe_clk_failed;
++				goto probe_reset_failed;
+ 		}
+ 
+ 		if (of_device_is_compatible(pdev->dev.of_node,
+@@ -1901,6 +1901,8 @@ static int cqspi_probe(struct platform_device *pdev)
+ probe_setup_failed:
+ 	cqspi_controller_enable(cqspi, 0);
+ probe_reset_failed:
++	if (cqspi->is_jh7110)
++		cqspi_jh7110_disable_clk(pdev, cqspi);
+ 	clk_disable_unprepare(cqspi->clk);
+ probe_clk_failed:
+ 	return ret;
+-- 
+2.43.0
+
diff --git a/queue-6.7/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch b/queue-6.7/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
new file mode 100644
index 00000000000..a51e0734a29
--- /dev/null
+++ b/queue-6.7/spi-sh-msiof-enforce-fixed-dtdl-for-r-car-h3.patch
@@ -0,0 +1,80 @@
+From ac88bebe50a627a0a2f68af2a46ead0c8814c426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Dec 2023 09:12:38 +0100
+Subject: spi: sh-msiof: Enforce fixed DTDL for R-Car H3
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit e5c7bcb499840551cfbe85c6df177ebc50432bf0 ]
+
+Documentation says only DTDL of 200 is allowed for this SoC.
+
+Fixes: 4286db8456f4 ("spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://msgid.link/r/20231212081239.14254-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-sh-msiof.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index fb452bc78372..cfc3b1ddbd22 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -29,12 +29,15 @@
+ 
+ #include <asm/unaligned.h>
+ 
++#define SH_MSIOF_FLAG_FIXED_DTDL_200	BIT(0)
++
+ struct sh_msiof_chipdata {
+ 	u32 bits_per_word_mask;
+ 	u16 tx_fifo_size;
+ 	u16 rx_fifo_size;
+ 	u16 ctlr_flags;
+ 	u16 min_div_pow;
++	u32 flags;
+ };
+ 
+ struct sh_msiof_spi_priv {
+@@ -1072,6 +1075,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = {
+ 	.min_div_pow = 1,
+ };
+ 
++static const struct sh_msiof_chipdata rcar_r8a7795_data = {
++	.bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16) |
++			      SPI_BPW_MASK(24) | SPI_BPW_MASK(32),
++	.tx_fifo_size = 64,
++	.rx_fifo_size = 64,
++	.ctlr_flags = SPI_CONTROLLER_MUST_TX,
++	.min_div_pow = 1,
++	.flags = SH_MSIOF_FLAG_FIXED_DTDL_200,
++};
++
+ static const struct of_device_id sh_msiof_match[] __maybe_unused = {
+ 	{ .compatible = "renesas,sh-mobile-msiof", .data = &sh_data },
+ 	{ .compatible = "renesas,msiof-r8a7743",   .data = &rcar_gen2_data },
+@@ -1082,6 +1095,7 @@ static const struct of_device_id sh_msiof_match[] __maybe_unused = {
+ 	{ .compatible = "renesas,msiof-r8a7793",   .data = &rcar_gen2_data },
+ 	{ .compatible = "renesas,msiof-r8a7794",   .data = &rcar_gen2_data },
+ 	{ .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data },
++	{ .compatible = "renesas,msiof-r8a7795",   .data = &rcar_r8a7795_data },
+ 	{ .compatible = "renesas,msiof-r8a7796",   .data = &rcar_gen3_data },
+ 	{ .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data },
+ 	{ .compatible = "renesas,rcar-gen4-msiof", .data = &rcar_gen3_data },
+@@ -1279,6 +1293,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
+ 		return -ENXIO;
+ 	}
+ 
++	if (chipdata->flags & SH_MSIOF_FLAG_FIXED_DTDL_200)
++		info->dtdl = 200;
++
+ 	if (info->mode == MSIOF_SPI_TARGET)
+ 		ctlr = spi_alloc_target(&pdev->dev,
+ 				        sizeof(struct sh_msiof_spi_priv));
+-- 
+2.43.0
+
diff --git a/queue-6.7/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch b/queue-6.7/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
new file mode 100644
index 00000000000..66d472144d9
--- /dev/null
+++ b/queue-6.7/spi-spi-zynqmp-gqspi-fix-driver-kconfig-dependencies.patch
@@ -0,0 +1,42 @@
+From bc616c910fb4429133e058726de589d4c34c394a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 20:23:55 +0530
+Subject: spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
+
+From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+
+[ Upstream commit 424a8166764e462258fdccaaefbdeb07517c8b21 ]
+
+ZynqMP GQSPI driver no longer uses spi-master framework. It had been
+converted to use spi-mem framework. So remove driver dependency from
+spi-master and replace it with spi-mem.
+
+Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
+Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
+Link: https://lore.kernel.org/r/1699282435-884917-1-git-send-email-radhey.shyam.pandey@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
+index 70c9dd6b6a31..ddae0fde798e 100644
+--- a/drivers/spi/Kconfig
++++ b/drivers/spi/Kconfig
+@@ -1177,9 +1177,10 @@ config SPI_ZYNQ_QSPI
+ 
+ config SPI_ZYNQMP_GQSPI
+ 	tristate "Xilinx ZynqMP GQSPI controller"
+-	depends on (SPI_MASTER && HAS_DMA) || COMPILE_TEST
++	depends on (SPI_MEM && HAS_DMA) || COMPILE_TEST
+ 	help
+ 	  Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC.
++	  This controller only supports SPI memory interface.
+ 
+ config SPI_AMD
+ 	tristate "AMD SPI controller"
+-- 
+2.43.0
+
diff --git a/queue-6.7/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch b/queue-6.7/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
new file mode 100644
index 00000000000..201c4de6e09
--- /dev/null
+++ b/queue-6.7/sunrpc-fix-_xprt_switch_find_current_entry-logic.patch
@@ -0,0 +1,35 @@
+From 9d1487512e412145d90df9dc26f7419a3f1efd23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 14:42:03 -0500
+Subject: SUNRPC: fix _xprt_switch_find_current_entry logic
+
+From: Olga Kornievskaia <kolga@netapp.com>
+
+[ Upstream commit 98b4e5137504a5bd9346562b1310cdc13486603b ]
+
+Fix the logic for picking current transport entry.
+
+Fixes: 95d0d30c66b8 ("SUNRPC create an iterator to list only OFFLINE xprts")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprtmultipath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/sunrpc/xprtmultipath.c b/net/sunrpc/xprtmultipath.c
+index 701250b305db..74ee2271251e 100644
+--- a/net/sunrpc/xprtmultipath.c
++++ b/net/sunrpc/xprtmultipath.c
+@@ -284,7 +284,7 @@ struct rpc_xprt *_xprt_switch_find_current_entry(struct list_head *head,
+ 		if (cur == pos)
+ 			found = true;
+ 		if (found && ((find_active && xprt_is_active(pos)) ||
+-			      (!find_active && xprt_is_active(pos))))
++			      (!find_active && !xprt_is_active(pos))))
+ 			return pos;
+ 	}
+ 	return NULL;
+-- 
+2.43.0
+
diff --git a/queue-6.7/sunrpc-fixup-v4.1-backchannel-request-timeouts.patch b/queue-6.7/sunrpc-fixup-v4.1-backchannel-request-timeouts.patch
new file mode 100644
index 00000000000..cbe05ee0da5
--- /dev/null
+++ b/queue-6.7/sunrpc-fixup-v4.1-backchannel-request-timeouts.patch
@@ -0,0 +1,107 @@
+From fc37fc902582dcaad7f79ee12c2d02c3f3c10c5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jan 2024 09:58:45 -0500
+Subject: SUNRPC: Fixup v4.1 backchannel request timeouts
+
+From: Benjamin Coddington <bcodding@redhat.com>
+
+[ Upstream commit e6f533b615971afcaa1141573a1a1714d9d4f31a ]
+
+After commit 59464b262ff5 ("SUNRPC: SOFTCONN tasks should time out when on
+the sending list"), any 4.1 backchannel tasks placed on the sending queue
+would immediately return with -ETIMEDOUT since their req timers are zero.
+
+Initialize the backchannel's rpc_rqst timeout parameters from the xprt's
+default timeout settings.
+
+Fixes: 59464b262ff5 ("SUNRPC: SOFTCONN tasks should time out when on the sending list")
+Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
+Tested-by: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xprt.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index 2364c485540c..6cc9ffac962d 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -651,9 +651,9 @@ static unsigned long xprt_abs_ktime_to_jiffies(ktime_t abstime)
+ 		jiffies + nsecs_to_jiffies(-delta);
+ }
+ 
+-static unsigned long xprt_calc_majortimeo(struct rpc_rqst *req)
++static unsigned long xprt_calc_majortimeo(struct rpc_rqst *req,
++		const struct rpc_timeout *to)
+ {
+-	const struct rpc_timeout *to = req->rq_task->tk_client->cl_timeout;
+ 	unsigned long majortimeo = req->rq_timeout;
+ 
+ 	if (to->to_exponential)
+@@ -665,9 +665,10 @@ static unsigned long xprt_calc_majortimeo(struct rpc_rqst *req)
+ 	return majortimeo;
+ }
+ 
+-static void xprt_reset_majortimeo(struct rpc_rqst *req)
++static void xprt_reset_majortimeo(struct rpc_rqst *req,
++		const struct rpc_timeout *to)
+ {
+-	req->rq_majortimeo += xprt_calc_majortimeo(req);
++	req->rq_majortimeo += xprt_calc_majortimeo(req, to);
+ }
+ 
+ static void xprt_reset_minortimeo(struct rpc_rqst *req)
+@@ -675,7 +676,8 @@ static void xprt_reset_minortimeo(struct rpc_rqst *req)
+ 	req->rq_minortimeo += req->rq_timeout;
+ }
+ 
+-static void xprt_init_majortimeo(struct rpc_task *task, struct rpc_rqst *req)
++static void xprt_init_majortimeo(struct rpc_task *task, struct rpc_rqst *req,
++		const struct rpc_timeout *to)
+ {
+ 	unsigned long time_init;
+ 	struct rpc_xprt *xprt = req->rq_xprt;
+@@ -684,8 +686,9 @@ static void xprt_init_majortimeo(struct rpc_task *task, struct rpc_rqst *req)
+ 		time_init = jiffies;
+ 	else
+ 		time_init = xprt_abs_ktime_to_jiffies(task->tk_start);
+-	req->rq_timeout = task->tk_client->cl_timeout->to_initval;
+-	req->rq_majortimeo = time_init + xprt_calc_majortimeo(req);
++
++	req->rq_timeout = to->to_initval;
++	req->rq_majortimeo = time_init + xprt_calc_majortimeo(req, to);
+ 	req->rq_minortimeo = time_init + req->rq_timeout;
+ }
+ 
+@@ -713,7 +716,7 @@ int xprt_adjust_timeout(struct rpc_rqst *req)
+ 	} else {
+ 		req->rq_timeout = to->to_initval;
+ 		req->rq_retries = 0;
+-		xprt_reset_majortimeo(req);
++		xprt_reset_majortimeo(req, to);
+ 		/* Reset the RTT counters == "slow start" */
+ 		spin_lock(&xprt->transport_lock);
+ 		rpc_init_rtt(req->rq_task->tk_client->cl_rtt, to->to_initval);
+@@ -1886,7 +1889,7 @@ xprt_request_init(struct rpc_task *task)
+ 	req->rq_snd_buf.bvec = NULL;
+ 	req->rq_rcv_buf.bvec = NULL;
+ 	req->rq_release_snd_buf = NULL;
+-	xprt_init_majortimeo(task, req);
++	xprt_init_majortimeo(task, req, task->tk_client->cl_timeout);
+ 
+ 	trace_xprt_reserve(req);
+ }
+@@ -1996,6 +1999,8 @@ xprt_init_bc_request(struct rpc_rqst *req, struct rpc_task *task)
+ 	 */
+ 	xbufp->len = xbufp->head[0].iov_len + xbufp->page_len +
+ 		xbufp->tail[0].iov_len;
++
++	xprt_init_majortimeo(task, req, req->rq_xprt->timeout);
+ }
+ #endif
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/test_bpf-rename-second-alu64_smod_x-to-alu64_smod_k.patch b/queue-6.7/test_bpf-rename-second-alu64_smod_x-to-alu64_smod_k.patch
new file mode 100644
index 00000000000..d0678c0ea56
--- /dev/null
+++ b/queue-6.7/test_bpf-rename-second-alu64_smod_x-to-alu64_smod_k.patch
@@ -0,0 +1,48 @@
+From fe7a6207207fbc49a7d7b41d34208a66ae2fb878 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 12:08:51 +0800
+Subject: test_bpf: Rename second ALU64_SMOD_X to ALU64_SMOD_K
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 5181dc08f79583c6dead80208137a97e68ff07b0 ]
+
+Currently, there are two test cases with same name
+"ALU64_SMOD_X: -7 % 2 = -1", the first one is right,
+the second one should be ALU64_SMOD_K because its
+code is BPF_ALU64 | BPF_MOD | BPF_K.
+
+Before:
+test_bpf: #170 ALU64_SMOD_X: -7 % 2 = -1 jited:1 4 PASS
+test_bpf: #171 ALU64_SMOD_X: -7 % 2 = -1 jited:1 4 PASS
+
+After:
+test_bpf: #170 ALU64_SMOD_X: -7 % 2 = -1 jited:1 4 PASS
+test_bpf: #171 ALU64_SMOD_K: -7 % 2 = -1 jited:1 4 PASS
+
+Fixes: daabb2b098e0 ("bpf/tests: add tests for cpuv4 instructions")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20231207040851.19730-1-yangtiezhu@loongson.cn
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_bpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/test_bpf.c b/lib/test_bpf.c
+index 7916503e6a6a..3c5a1ca06219 100644
+--- a/lib/test_bpf.c
++++ b/lib/test_bpf.c
+@@ -6293,7 +6293,7 @@ static struct bpf_test tests[] = {
+ 	},
+ 	/* BPF_ALU64 | BPF_MOD | BPF_K off=1 (SMOD64) */
+ 	{
+-		"ALU64_SMOD_X: -7 % 2 = -1",
++		"ALU64_SMOD_K: -7 % 2 = -1",
+ 		.u.insns_int = {
+ 			BPF_LD_IMM64(R0, -7),
+ 			BPF_ALU64_IMM_OFF(BPF_MOD, R0, 2, 1),
+-- 
+2.43.0
+
diff --git a/queue-6.7/thermal-core-fix-null-pointer-dereference-in-zone-re.patch b/queue-6.7/thermal-core-fix-null-pointer-dereference-in-zone-re.patch
new file mode 100644
index 00000000000..3b3cd37fa87
--- /dev/null
+++ b/queue-6.7/thermal-core-fix-null-pointer-dereference-in-zone-re.patch
@@ -0,0 +1,47 @@
+From 380be11546799098e47492a5cdd6c79c5dc011b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 11:52:25 +0100
+Subject: thermal: core: Fix NULL pointer dereference in zone registration
+ error path
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea ]
+
+If device_register() in thermal_zone_device_register_with_trips()
+returns an error, the tz variable is set to NULL and subsequently
+dereferenced in kfree(tz->tzp).
+
+Commit adc8749b150c ("thermal/drivers/core: Use put_device() if
+device_register() fails") added the tz = NULL assignment in question to
+avoid a possible double-free after dropping the reference to the zone
+device.  However, after commit 4649620d9404 ("thermal: core: Make
+thermal_zone_device_unregister() return after freeing the zone"), that
+assignment has become redundant, because dropping the reference to the
+zone device does not cause the zone object to be freed any more.
+
+Drop it to address the NULL pointer dereference.
+
+Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/thermal_core.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 9c17d35ccbbd..1bc7ba459406 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1369,7 +1369,6 @@ thermal_zone_device_register_with_trips(const char *type, struct thermal_trip *t
+ 	device_del(&tz->device);
+ release_device:
+ 	put_device(&tz->device);
+-	tz = NULL;
+ remove_id:
+ 	ida_free(&thermal_tz_ida, id);
+ free_tzp:
+-- 
+2.43.0
+
diff --git a/queue-6.7/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch b/queue-6.7/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
new file mode 100644
index 00000000000..202f14c6aa1
--- /dev/null
+++ b/queue-6.7/virtio-vsock-fix-logic-which-reduces-credit-update-m.patch
@@ -0,0 +1,69 @@
+From df6f40829f8a1472c290ba570ac69909d1a8317e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 15:52:28 +0300
+Subject: virtio/vsock: fix logic which reduces credit update messages
+
+From: Arseniy Krasnov <avkrasnov@salutedevices.com>
+
+[ Upstream commit 93b80887668226180ea5f5349cc728ca6dc700ab ]
+
+Add one more condition for sending credit update during dequeue from
+stream socket: when number of bytes in the rx queue is smaller than
+SO_RCVLOWAT value of the socket. This is actual for non-default value
+of SO_RCVLOWAT (e.g. not 1) - idea is to "kick" peer to continue data
+transmission, because we need at least SO_RCVLOWAT bytes in our rx
+queue to wake up user for reading data (in corner case it is also
+possible to stuck both tx and rx sides, this is why 'Fixes' is used).
+
+Fixes: b89d882dc9fc ("vsock/virtio: reduce credit update messages")
+Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/virtio_transport_common.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 6df246b53260..b35306dfcebe 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -557,6 +557,8 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
+ 	struct virtio_vsock_sock *vvs = vsk->trans;
+ 	size_t bytes, total = 0;
+ 	struct sk_buff *skb;
++	u32 fwd_cnt_delta;
++	bool low_rx_bytes;
+ 	int err = -EFAULT;
+ 	u32 free_space;
+ 
+@@ -600,7 +602,10 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
+ 		}
+ 	}
+ 
+-	free_space = vvs->buf_alloc - (vvs->fwd_cnt - vvs->last_fwd_cnt);
++	fwd_cnt_delta = vvs->fwd_cnt - vvs->last_fwd_cnt;
++	free_space = vvs->buf_alloc - fwd_cnt_delta;
++	low_rx_bytes = (vvs->rx_bytes <
++			sock_rcvlowat(sk_vsock(vsk), 0, INT_MAX));
+ 
+ 	spin_unlock_bh(&vvs->rx_lock);
+ 
+@@ -610,9 +615,11 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
+ 	 * too high causes extra messages. Too low causes transmitter
+ 	 * stalls. As stalls are in theory more expensive than extra
+ 	 * messages, we set the limit to a high value. TODO: experiment
+-	 * with different values.
++	 * with different values. Also send credit update message when
++	 * number of bytes in rx queue is not enough to wake up reader.
+ 	 */
+-	if (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE)
++	if (fwd_cnt_delta &&
++	    (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || low_rx_bytes))
+ 		virtio_transport_send_credit_update(vsk);
+ 
+ 	return total;
+-- 
+2.43.0
+
diff --git a/queue-6.7/virtio-vsock-send-credit-update-during-setting-so_rc.patch b/queue-6.7/virtio-vsock-send-credit-update-during-setting-so_rc.patch
new file mode 100644
index 00000000000..db28f6fb0c8
--- /dev/null
+++ b/queue-6.7/virtio-vsock-send-credit-update-during-setting-so_rc.patch
@@ -0,0 +1,189 @@
+From df917a553b9385ba52e6f89e25391b075237327e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Dec 2023 15:52:29 +0300
+Subject: virtio/vsock: send credit update during setting SO_RCVLOWAT
+
+From: Arseniy Krasnov <avkrasnov@salutedevices.com>
+
+[ Upstream commit 0fe1798968115488c0c02f4633032a015b1faf97 ]
+
+Send credit update message when SO_RCVLOWAT is updated and it is bigger
+than number of bytes in rx queue. It is needed, because 'poll()' will
+wait until number of bytes in rx queue will be not smaller than
+O_RCVLOWAT, so kick sender to send more data. Otherwise mutual hungup
+for tx/rx is possible: sender waits for free space and receiver is
+waiting data in 'poll()'.
+
+Rename 'set_rcvlowat' callback to 'notify_set_rcvlowat' and set
+'sk->sk_rcvlowat' only in one place (i.e. 'vsock_set_rcvlowat'), so the
+transport doesn't need to do it.
+
+Fixes: b89d882dc9fc ("vsock/virtio: reduce credit update messages")
+Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vsock.c                   |  1 +
+ include/linux/virtio_vsock.h            |  1 +
+ include/net/af_vsock.h                  |  2 +-
+ net/vmw_vsock/af_vsock.c                |  9 ++++++--
+ net/vmw_vsock/hyperv_transport.c        |  4 ++--
+ net/vmw_vsock/virtio_transport.c        |  1 +
+ net/vmw_vsock/virtio_transport_common.c | 30 +++++++++++++++++++++++++
+ net/vmw_vsock/vsock_loopback.c          |  1 +
+ 8 files changed, 44 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index f75731396b7e..ec20ecff85c7 100644
+--- a/drivers/vhost/vsock.c
++++ b/drivers/vhost/vsock.c
+@@ -449,6 +449,7 @@ static struct virtio_transport vhost_transport = {
+ 		.notify_send_pre_enqueue  = virtio_transport_notify_send_pre_enqueue,
+ 		.notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
+ 		.notify_buffer_size       = virtio_transport_notify_buffer_size,
++		.notify_set_rcvlowat      = virtio_transport_notify_set_rcvlowat,
+ 
+ 		.read_skb = virtio_transport_read_skb,
+ 	},
+diff --git a/include/linux/virtio_vsock.h b/include/linux/virtio_vsock.h
+index ebb3ce63d64d..c82089dee0c8 100644
+--- a/include/linux/virtio_vsock.h
++++ b/include/linux/virtio_vsock.h
+@@ -256,4 +256,5 @@ void virtio_transport_put_credit(struct virtio_vsock_sock *vvs, u32 credit);
+ void virtio_transport_deliver_tap_pkt(struct sk_buff *skb);
+ int virtio_transport_purge_skbs(void *vsk, struct sk_buff_head *list);
+ int virtio_transport_read_skb(struct vsock_sock *vsk, skb_read_actor_t read_actor);
++int virtio_transport_notify_set_rcvlowat(struct vsock_sock *vsk, int val);
+ #endif /* _LINUX_VIRTIO_VSOCK_H */
+diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
+index e302c0e804d0..535701efc1e5 100644
+--- a/include/net/af_vsock.h
++++ b/include/net/af_vsock.h
+@@ -137,7 +137,6 @@ struct vsock_transport {
+ 	u64 (*stream_rcvhiwat)(struct vsock_sock *);
+ 	bool (*stream_is_active)(struct vsock_sock *);
+ 	bool (*stream_allow)(u32 cid, u32 port);
+-	int (*set_rcvlowat)(struct vsock_sock *vsk, int val);
+ 
+ 	/* SEQ_PACKET. */
+ 	ssize_t (*seqpacket_dequeue)(struct vsock_sock *vsk, struct msghdr *msg,
+@@ -168,6 +167,7 @@ struct vsock_transport {
+ 		struct vsock_transport_send_notify_data *);
+ 	/* sk_lock held by the caller */
+ 	void (*notify_buffer_size)(struct vsock_sock *, u64 *);
++	int (*notify_set_rcvlowat)(struct vsock_sock *vsk, int val);
+ 
+ 	/* Shutdown. */
+ 	int (*shutdown)(struct vsock_sock *, int);
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 816725af281f..54ba7316f808 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -2264,8 +2264,13 @@ static int vsock_set_rcvlowat(struct sock *sk, int val)
+ 
+ 	transport = vsk->transport;
+ 
+-	if (transport && transport->set_rcvlowat)
+-		return transport->set_rcvlowat(vsk, val);
++	if (transport && transport->notify_set_rcvlowat) {
++		int err;
++
++		err = transport->notify_set_rcvlowat(vsk, val);
++		if (err)
++			return err;
++	}
+ 
+ 	WRITE_ONCE(sk->sk_rcvlowat, val ? : 1);
+ 	return 0;
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index 7cb1a9d2cdb4..e2157e387217 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -816,7 +816,7 @@ int hvs_notify_send_post_enqueue(struct vsock_sock *vsk, ssize_t written,
+ }
+ 
+ static
+-int hvs_set_rcvlowat(struct vsock_sock *vsk, int val)
++int hvs_notify_set_rcvlowat(struct vsock_sock *vsk, int val)
+ {
+ 	return -EOPNOTSUPP;
+ }
+@@ -856,7 +856,7 @@ static struct vsock_transport hvs_transport = {
+ 	.notify_send_pre_enqueue  = hvs_notify_send_pre_enqueue,
+ 	.notify_send_post_enqueue = hvs_notify_send_post_enqueue,
+ 
+-	.set_rcvlowat             = hvs_set_rcvlowat
++	.notify_set_rcvlowat      = hvs_notify_set_rcvlowat
+ };
+ 
+ static bool hvs_check_transport(struct vsock_sock *vsk)
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index af5bab1acee1..f495b9e5186b 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -537,6 +537,7 @@ static struct virtio_transport virtio_transport = {
+ 		.notify_send_pre_enqueue  = virtio_transport_notify_send_pre_enqueue,
+ 		.notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
+ 		.notify_buffer_size       = virtio_transport_notify_buffer_size,
++		.notify_set_rcvlowat      = virtio_transport_notify_set_rcvlowat,
+ 
+ 		.read_skb = virtio_transport_read_skb,
+ 	},
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index b35306dfcebe..16ff976a86e3 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -1690,6 +1690,36 @@ int virtio_transport_read_skb(struct vsock_sock *vsk, skb_read_actor_t recv_acto
+ }
+ EXPORT_SYMBOL_GPL(virtio_transport_read_skb);
+ 
++int virtio_transport_notify_set_rcvlowat(struct vsock_sock *vsk, int val)
++{
++	struct virtio_vsock_sock *vvs = vsk->trans;
++	bool send_update;
++
++	spin_lock_bh(&vvs->rx_lock);
++
++	/* If number of available bytes is less than new SO_RCVLOWAT value,
++	 * kick sender to send more data, because sender may sleep in its
++	 * 'send()' syscall waiting for enough space at our side. Also
++	 * don't send credit update when peer already knows actual value -
++	 * such transmission will be useless.
++	 */
++	send_update = (vvs->rx_bytes < val) &&
++		      (vvs->fwd_cnt != vvs->last_fwd_cnt);
++
++	spin_unlock_bh(&vvs->rx_lock);
++
++	if (send_update) {
++		int err;
++
++		err = virtio_transport_send_credit_update(vsk);
++		if (err < 0)
++			return err;
++	}
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(virtio_transport_notify_set_rcvlowat);
++
+ MODULE_LICENSE("GPL v2");
+ MODULE_AUTHOR("Asias He");
+ MODULE_DESCRIPTION("common code for virtio vsock");
+diff --git a/net/vmw_vsock/vsock_loopback.c b/net/vmw_vsock/vsock_loopback.c
+index 048640167411..6dea6119f5b2 100644
+--- a/net/vmw_vsock/vsock_loopback.c
++++ b/net/vmw_vsock/vsock_loopback.c
+@@ -96,6 +96,7 @@ static struct virtio_transport loopback_transport = {
+ 		.notify_send_pre_enqueue  = virtio_transport_notify_send_pre_enqueue,
+ 		.notify_send_post_enqueue = virtio_transport_notify_send_post_enqueue,
+ 		.notify_buffer_size       = virtio_transport_notify_buffer_size,
++		.notify_set_rcvlowat      = virtio_transport_notify_set_rcvlowat,
+ 
+ 		.read_skb = virtio_transport_read_skb,
+ 	},
+-- 
+2.43.0
+
diff --git a/queue-6.7/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch b/queue-6.7/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
new file mode 100644
index 00000000000..e5c1626afc6
--- /dev/null
+++ b/queue-6.7/watchdog-bcm2835_wdt-fix-wdioc_settimeout-handling.patch
@@ -0,0 +1,57 @@
+From a85ecdd2befc14df4fc034639019a207000e8be4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Nov 2023 18:32:51 +0100
+Subject: watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
+
+From: Stefan Wahren <wahrenst@gmx.net>
+
+[ Upstream commit f33f5b1fd1be5f5106d16f831309648cb0f1c31d ]
+
+Users report about the unexpected behavior for setting timeouts above
+15 sec on Raspberry Pi. According to watchdog-api.rst the ioctl
+WDIOC_SETTIMEOUT shouldn't fail because of hardware limitations.
+But looking at the code shows that max_timeout based on the
+register value PM_WDOG_TIME_SET, which is the maximum.
+
+Since 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat
+in watchdog core") the watchdog core is able to handle this problem.
+
+This fix has been tested with watchdog-test from selftests.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=217374
+Fixes: 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat in watchdog core")
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231112173251.4827-1-wahrenst@gmx.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/bcm2835_wdt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
+index 7a855289ff5e..bb001c5d7f17 100644
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -42,6 +42,7 @@
+ 
+ #define SECS_TO_WDOG_TICKS(x) ((x) << 16)
+ #define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
++#define WDOG_TICKS_TO_MSECS(x) ((x) * 1000 >> 16)
+ 
+ struct bcm2835_wdt {
+ 	void __iomem		*base;
+@@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = {
+ 	.info =		&bcm2835_wdt_info,
+ 	.ops =		&bcm2835_wdt_ops,
+ 	.min_timeout =	1,
+-	.max_timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
++	.max_hw_heartbeat_ms =	WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET),
+ 	.timeout =	WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
+ };
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch b/queue-6.7/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
new file mode 100644
index 00000000000..0da96b6698b
--- /dev/null
+++ b/queue-6.7/watchdog-hpwdt-only-claim-unknown-nmi-if-from-ilo.patch
@@ -0,0 +1,51 @@
+From d3070877146c1f20cb14f44f739c12f9e2f3479f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 14:53:38 -0700
+Subject: watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
+
+From: Jerry Hoemann <jerry.hoemann@hpe.com>
+
+[ Upstream commit dced0b3e51dd2af3730efe14dd86b5e3173f0a65 ]
+
+Avoid unnecessary crashes by claiming only NMIs that are due to
+ERROR signalling or generated by the hpwdt hardware device.
+
+The code does this, but only for iLO5.
+
+The intent was to preserve legacy, Gen9 and earlier, semantics of
+using hpwdt for error containtment as hardware/firmware would signal
+fatal IO errors as an NMI with the expectation of hpwdt crashing
+the system.  Howerver, these IO errors should be received by hpwdt
+as an NMI_IO_CHECK.  So the test is overly permissive and should
+not be limited to only ilo5.
+
+We need to enable this protection for future iLOs not matching the
+current PCI IDs.
+
+Fixes: 62290a5c194b ("watchdog: hpwdt: Claim NMIs generated by iLO5")
+Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231213215340.495734-2-jerry.hoemann@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/hpwdt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
+index f79f932bca14..79ed1626d8ea 100644
+--- a/drivers/watchdog/hpwdt.c
++++ b/drivers/watchdog/hpwdt.c
+@@ -178,7 +178,7 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)
+ 		"3. OA Forward Progress Log\n"
+ 		"4. iLO Event Log";
+ 
+-	if (ilo5 && ulReason == NMI_UNKNOWN && !mynmi)
++	if (ulReason == NMI_UNKNOWN && !mynmi)
+ 		return NMI_DONE;
+ 
+ 	if (ilo5 && !pretimeout && !mynmi)
+-- 
+2.43.0
+
diff --git a/queue-6.7/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch b/queue-6.7/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
new file mode 100644
index 00000000000..eef272a49b2
--- /dev/null
+++ b/queue-6.7/watchdog-rti_wdt-drop-runtime-pm-reference-count-whe.patch
@@ -0,0 +1,72 @@
+From 2c22f7c75e8de1b16bf045bb36e3ad4ea210ac0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Dec 2023 19:31:10 +0530
+Subject: watchdog: rti_wdt: Drop runtime pm reference count when watchdog is
+ unused
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit c1a6edf3b541e44e78f10bc6024df779715723f1 ]
+
+Call runtime_pm_put*() if watchdog is not already started during probe and re
+enable it in watchdog start as required.
+
+On K3 SoCs, watchdogs and their corresponding CPUs are under same
+power-domain, so if the reference count of unused watchdogs aren't
+dropped, it will lead to CPU hotplug failures as Device Management
+firmware won't allow to turn off the power-domain due to dangling
+reference count.
+
+Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support")
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Tested-by: Manorit Chawdhry <m-chawdhry@ti.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231213140110.938129-1-vigneshr@ti.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/rti_wdt.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c
+index 8e1be7ba0103..9215793a1c81 100644
+--- a/drivers/watchdog/rti_wdt.c
++++ b/drivers/watchdog/rti_wdt.c
+@@ -77,6 +77,11 @@ static int rti_wdt_start(struct watchdog_device *wdd)
+ {
+ 	u32 timer_margin;
+ 	struct rti_wdt_device *wdt = watchdog_get_drvdata(wdd);
++	int ret;
++
++	ret = pm_runtime_resume_and_get(wdd->parent);
++	if (ret)
++		return ret;
+ 
+ 	/* set timeout period */
+ 	timer_margin = (u64)wdd->timeout * wdt->freq;
+@@ -343,6 +348,9 @@ static int rti_wdt_probe(struct platform_device *pdev)
+ 	if (last_ping)
+ 		watchdog_set_last_hw_keepalive(wdd, last_ping);
+ 
++	if (!watchdog_hw_running(wdd))
++		pm_runtime_put_sync(&pdev->dev);
++
+ 	return 0;
+ 
+ err_iomap:
+@@ -357,7 +365,10 @@ static void rti_wdt_remove(struct platform_device *pdev)
+ 	struct rti_wdt_device *wdt = platform_get_drvdata(pdev);
+ 
+ 	watchdog_unregister_device(&wdt->wdd);
+-	pm_runtime_put(&pdev->dev);
++
++	if (!pm_runtime_suspended(&pdev->dev))
++		pm_runtime_put(&pdev->dev);
++
+ 	pm_runtime_disable(&pdev->dev);
+ }
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/watchdog-set-cdev-owner-before-adding.patch b/queue-6.7/watchdog-set-cdev-owner-before-adding.patch
new file mode 100644
index 00000000000..2af7b3d7e1e
--- /dev/null
+++ b/queue-6.7/watchdog-set-cdev-owner-before-adding.patch
@@ -0,0 +1,61 @@
+From f2fa7832ae6ae4971622de8c8125c62a8aea71dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Dec 2023 11:05:22 -0800
+Subject: watchdog: set cdev owner before adding
+
+From: Curtis Klein <curtis.klein@hpe.com>
+
+[ Upstream commit 38d75297745f04206db9c29bdd75557f0344c7cc ]
+
+When the new watchdog character device is registered, it becomes
+available for opening. This creates a race where userspace may open the
+device before the character device's owner is set. This results in an
+imbalance in module_get calls as the cdev_get in cdev_open will not
+increment the reference count on the watchdog driver module.
+
+This causes problems when the watchdog character device is released as
+the module loader's reference will also be released. This makes it
+impossible to open the watchdog device later on as it now appears that
+the module is being unloaded. The open will fail with -ENXIO from
+chrdev_open.
+
+The legacy watchdog device will fail with -EBUSY from the try_module_get
+in watchdog_open because it's module owner is the watchdog core module
+so it can still be opened but it will fail to get a refcount on the
+underlying watchdog device driver.
+
+Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev")
+Signed-off-by: Curtis Klein <curtis.klein@hpe.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20231205190522.55153-1-curtis.klein@hpe.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/watchdog_dev.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
+index 15df74e11a59..e2bd266b1b5b 100644
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -1073,6 +1073,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ 
+ 	/* Fill in the data structures */
+ 	cdev_init(&wd_data->cdev, &watchdog_fops);
++	wd_data->cdev.owner = wdd->ops->owner;
+ 
+ 	/* Add the device */
+ 	err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
+@@ -1087,8 +1088,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
+ 		return err;
+ 	}
+ 
+-	wd_data->cdev.owner = wdd->ops->owner;
+-
+ 	/* Record time of most recent heartbeat as 'just before now'. */
+ 	wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1);
+ 	watchdog_set_open_deadline(wd_data);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-ath11k-defer-on-rproc_get-failure.patch b/queue-6.7/wifi-ath11k-defer-on-rproc_get-failure.patch
new file mode 100644
index 00000000000..6ef89cc0e07
--- /dev/null
+++ b/queue-6.7/wifi-ath11k-defer-on-rproc_get-failure.patch
@@ -0,0 +1,57 @@
+From 13c9c672099f9c16c8308a610f7a4d8fffe7882c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Oct 2023 08:57:18 +0200
+Subject: wifi: ath11k: Defer on rproc_get failure
+
+From: Luca Weiss <luca.weiss@fairphone.com>
+
+[ Upstream commit 2a3ec40b98b46c339adb57313d3b933ee5e7a8e8 ]
+
+If we already have gotten the rproc_handle (meaning the "qcom,rproc"
+property is defined in the devicetree), it's a valid state that the
+remoteproc module hasn't probed yet so we should defer probing instead
+of just failing to probe.
+
+This resolves a race condition when the ath11k driver probes and fails
+before the wpss remoteproc driver has probed, like the following:
+
+  [    6.232360] ath11k 17a10040.wifi: failed to get rproc
+  [    6.232366] ath11k 17a10040.wifi: failed to get rproc: -22
+  [    6.232478] ath11k: probe of 17a10040.wifi failed with error -22
+       ...
+  [    6.252415] remoteproc remoteproc2: 8a00000.remoteproc is available
+  [    6.252776] remoteproc remoteproc2: powering up 8a00000.remoteproc
+  [    6.252781] remoteproc remoteproc2: Booting fw image qcom/qcm6490/fairphone5/wpss.mdt, size 7188
+
+So, defer the probe if we hit that so we can retry later once the wpss
+remoteproc is available.
+
+Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01264-QCAMSLSWPLZ-1.37886.3
+
+Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
+Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20231027-ath11k-rproc-defer-v1-1-f6b6a812cd18@fairphone.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath11k/ahb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
+index 235336ef2a7a..f8f5e653cd03 100644
+--- a/drivers/net/wireless/ath/ath11k/ahb.c
++++ b/drivers/net/wireless/ath/ath11k/ahb.c
+@@ -803,8 +803,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab)
+ 
+ 	prproc = rproc_get_by_phandle(rproc_phandle);
+ 	if (!prproc) {
+-		ath11k_err(ab, "failed to get rproc\n");
+-		return -EINVAL;
++		ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n");
++		return -EPROBE_DEFER;
+ 	}
+ 	ab_ahb->tgt_rproc = prproc;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-ath12k-fix-the-error-handler-of-rfkill-config.patch b/queue-6.7/wifi-ath12k-fix-the-error-handler-of-rfkill-config.patch
new file mode 100644
index 00000000000..61fd0d02e6b
--- /dev/null
+++ b/queue-6.7/wifi-ath12k-fix-the-error-handler-of-rfkill-config.patch
@@ -0,0 +1,59 @@
+From 025e37053291e2d1d8ba7dfc6ab22a01b2ecc3b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 20:31:02 +0200
+Subject: wifi: ath12k: fix the error handler of rfkill config
+
+From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+
+[ Upstream commit 898d8b3e1414cd900492ee6a0b582f8095ba4a1a ]
+
+When the core rfkill config throws error, it should free the
+allocated resources. Currently it is not freeing the core pdev
+create resources. Avoid this issue by calling the core pdev
+destroy in the error handler of core rfkill config.
+
+Found this issue in the code review and it is compile tested only.
+
+Fixes: 004ccbc0dd49 ("wifi: ath12k: add support for hardware rfkill for WCN7850")
+Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
+Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20231111040107.18708-1-quic_periyasa@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath12k/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath12k/core.c b/drivers/net/wireless/ath/ath12k/core.c
+index b936760b5140..6c01b282fcd3 100644
+--- a/drivers/net/wireless/ath/ath12k/core.c
++++ b/drivers/net/wireless/ath/ath12k/core.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: BSD-3-Clause-Clear
+ /*
+  * Copyright (c) 2018-2021 The Linux Foundation. All rights reserved.
+- * Copyright (c) 2021-2022 Qualcomm Innovation Center, Inc. All rights reserved.
++ * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  */
+ 
+ #include <linux/module.h>
+@@ -698,13 +698,15 @@ int ath12k_core_qmi_firmware_ready(struct ath12k_base *ab)
+ 	ret = ath12k_core_rfkill_config(ab);
+ 	if (ret && ret != -EOPNOTSUPP) {
+ 		ath12k_err(ab, "failed to config rfkill: %d\n", ret);
+-		goto err_core_stop;
++		goto err_core_pdev_destroy;
+ 	}
+ 
+ 	mutex_unlock(&ab->core_lock);
+ 
+ 	return 0;
+ 
++err_core_pdev_destroy:
++	ath12k_core_pdev_destroy(ab);
+ err_core_stop:
+ 	ath12k_core_stop(ab);
+ 	ath12k_mac_destroy(ab);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-cfg80211-correct-comment-about-mld-id.patch b/queue-6.7/wifi-cfg80211-correct-comment-about-mld-id.patch
new file mode 100644
index 00000000000..21ff242f41f
--- /dev/null
+++ b/queue-6.7/wifi-cfg80211-correct-comment-about-mld-id.patch
@@ -0,0 +1,46 @@
+From 599a9b3aac64a31f70f5777e2a63db1ad1e31286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 21:35:30 +0200
+Subject: wifi: cfg80211: correct comment about MLD ID
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit 2a0698f86d4dfc43cc0c1703efb7ba6b1506a4e2 ]
+
+The comment was referencing the wrong section of the documentation and
+was also subtly wrong as it assumed the rules that apply when sending
+probe requests directly to a nontransmitted AP. However, in that case
+the response comes from the transmitting AP and the AP MLD ID will be
+included.
+
+Fixes: 2481b5da9c6b ("wifi: cfg80211: handle BSS data contained in ML probe responses")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240102213313.0917ab4b5d7f.I76aff0e261a5de44ffb467e591a46597a30d7c0a@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 9e5ccffd6868..8cd3eef76f2b 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2647,8 +2647,11 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
+ 	/* MLD capabilities and operations */
+ 	pos += 2;
+ 
+-	/* Not included when the (nontransmitted) AP is responding itself,
+-	 * but defined to zero then (Draft P802.11be_D3.0, 9.4.2.170.2)
++	/*
++	 * The MLD ID of the reporting AP is always zero. It is set if the AP
++	 * is part of an MBSSID set and will be non-zero for ML Elements
++	 * relating to a nontransmitted BSS (matching the Multi-BSSID Index,
++	 * Draft P802.11be_D3.2, 35.3.4.2)
+ 	 */
+ 	if (u16_get_bits(control, IEEE80211_MLC_BASIC_PRES_MLD_ID)) {
+ 		mld_id = *pos;
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-cfg80211-parse-all-ml-elements-in-an-ml-probe-r.patch b/queue-6.7/wifi-cfg80211-parse-all-ml-elements-in-an-ml-probe-r.patch
new file mode 100644
index 00000000000..c2b980d8486
--- /dev/null
+++ b/queue-6.7/wifi-cfg80211-parse-all-ml-elements-in-an-ml-probe-r.patch
@@ -0,0 +1,98 @@
+From bff03826272360ead21439209cdba99e57c1e74d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jan 2024 21:35:31 +0200
+Subject: wifi: cfg80211: parse all ML elements in an ML probe response
+
+From: Benjamin Berg <benjamin.berg@intel.com>
+
+[ Upstream commit d18125b640309e925441ce49559be33867ae6b29 ]
+
+A probe response from a transmitting AP in an Multi-BSSID setup will
+contain more than one Multi-Link element. Most likely, only one of these
+elements contains per-STA profiles.
+
+Fixes: 2481b5da9c6b ("wifi: cfg80211: handle BSS data contained in ML probe responses")
+Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20240102213313.6635eb152735.I94289002d4a2f7b6b44dfa428344854e37b0b29c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/scan.c | 40 ++++++++++++++++++++++++++--------------
+ 1 file changed, 26 insertions(+), 14 deletions(-)
+
+diff --git a/net/wireless/scan.c b/net/wireless/scan.c
+index 8cd3eef76f2b..0d6c3fc1238a 100644
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2591,10 +2591,12 @@ cfg80211_tbtt_info_for_mld_ap(const u8 *ie, size_t ielen, u8 mld_id, u8 link_id,
+ 	return false;
+ }
+ 
+-static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
+-				       struct cfg80211_inform_single_bss_data *tx_data,
+-				       struct cfg80211_bss *source_bss,
+-				       gfp_t gfp)
++static void
++cfg80211_parse_ml_elem_sta_data(struct wiphy *wiphy,
++				struct cfg80211_inform_single_bss_data *tx_data,
++				struct cfg80211_bss *source_bss,
++				const struct element *elem,
++				gfp_t gfp)
+ {
+ 	struct cfg80211_inform_single_bss_data data = {
+ 		.drv_data = tx_data->drv_data,
+@@ -2603,7 +2605,6 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
+ 		.bss_source = BSS_SOURCE_STA_PROFILE,
+ 	};
+ 	struct ieee80211_multi_link_elem *ml_elem;
+-	const struct element *elem;
+ 	struct cfg80211_mle *mle;
+ 	u16 control;
+ 	u8 *new_ie;
+@@ -2613,15 +2614,7 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
+ 	const u8 *pos;
+ 	u8 i;
+ 
+-	if (!source_bss)
+-		return;
+-
+-	if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP)
+-		return;
+-
+-	elem = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK,
+-				      tx_data->ie, tx_data->ielen);
+-	if (!elem || !ieee80211_mle_size_ok(elem->data + 1, elem->datalen - 1))
++	if (!ieee80211_mle_size_ok(elem->data + 1, elem->datalen - 1))
+ 		return;
+ 
+ 	ml_elem = (void *)elem->data + 1;
+@@ -2756,6 +2749,25 @@ static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
+ 	kfree(mle);
+ }
+ 
++static void cfg80211_parse_ml_sta_data(struct wiphy *wiphy,
++				       struct cfg80211_inform_single_bss_data *tx_data,
++				       struct cfg80211_bss *source_bss,
++				       gfp_t gfp)
++{
++	const struct element *elem;
++
++	if (!source_bss)
++		return;
++
++	if (tx_data->ftype != CFG80211_BSS_FTYPE_PRESP)
++		return;
++
++	for_each_element_extid(elem, WLAN_EID_EXT_EHT_MULTI_LINK,
++			       tx_data->ie, tx_data->ielen)
++		cfg80211_parse_ml_elem_sta_data(wiphy, tx_data, source_bss,
++						elem, gfp);
++}
++
+ struct cfg80211_bss *
+ cfg80211_inform_bss_data(struct wiphy *wiphy,
+ 			 struct cfg80211_inform_bss *data,
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-iwlwifi-assign-phy_ctxt-before-esr-activation.patch b/queue-6.7/wifi-iwlwifi-assign-phy_ctxt-before-esr-activation.patch
new file mode 100644
index 00000000000..1ab85c58549
--- /dev/null
+++ b/queue-6.7/wifi-iwlwifi-assign-phy_ctxt-before-esr-activation.patch
@@ -0,0 +1,55 @@
+From 3f8f79f8779d77093248d3fbc7360d4fb1a113e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 21:58:56 +0200
+Subject: wifi: iwlwifi: assign phy_ctxt before eSR activation
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 9b6614e5ead5d19a71893bcca3f1a6569ca0c456 ]
+
+eSR is activated when a chanctx is assigned to more than one link.
+During eSR activation we should disable RLC for both phys, and configure
+the FW with a special phy command for both phys.
+Currently we assign the phy_ctxt to the link only after eSR activation,
+so RLC is not disabled for the new phy_ctxt, and a cmd is not sent to FW.
+Fix this by first assigning the new phy_ctxt to the link and then
+doing the eSR activation.
+
+Fixes: 12bacfc2c065 ("wifi: iwlwifi: handle eSR transitions")
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231219215605.3d94507f5d9a.I537fcd73aedf94c7348c03157e486f24301fef14@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
+index 8e263acbc763..61170173f917 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
+@@ -271,17 +271,17 @@ __iwl_mvm_mld_assign_vif_chanctx(struct iwl_mvm *mvm,
+ 		}
+ 	}
+ 
++	mvmvif->link[link_id]->phy_ctxt = phy_ctxt;
++
+ 	if (iwl_mvm_is_esr_supported(mvm->fwrt.trans) && n_active > 1) {
+ 		mvmvif->link[link_id]->listen_lmac = true;
+ 		ret = iwl_mvm_esr_mode_active(mvm, vif);
+ 		if (ret) {
+ 			IWL_ERR(mvm, "failed to activate ESR mode (%d)\n", ret);
+-			return ret;
++			goto out;
+ 		}
+ 	}
+ 
+-	mvmvif->link[link_id]->phy_ctxt = phy_ctxt;
+-
+ 	if (switching_chanctx) {
+ 		/* reactivate if we turned this off during channel switch */
+ 		if (vif->type == NL80211_IFTYPE_AP)
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-iwlwifi-don-t-support-triggered-eht-cqi-feedbac.patch b/queue-6.7/wifi-iwlwifi-don-t-support-triggered-eht-cqi-feedbac.patch
new file mode 100644
index 00000000000..694c614562e
--- /dev/null
+++ b/queue-6.7/wifi-iwlwifi-don-t-support-triggered-eht-cqi-feedbac.patch
@@ -0,0 +1,39 @@
+From 1327de595e7135c05f8d528b694f668e0373525a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Dec 2023 04:50:08 +0200
+Subject: wifi: iwlwifi: don't support triggered EHT CQI feedback
+
+From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+
+[ Upstream commit 637bbd5b3cbd0fc6945ebd2e311315b6cca1f9c5 ]
+
+EHT CQI is one of the EHT PHY capabilities. We don't support EHT CQI.
+The non-triggered CQI feedback bit was unset in a previous patch,
+but the triggered CQI feedback bit wasn't. Unset it.
+
+Fixes: 0e21ec6edbb5 ("wifi: iwlwifi: nvm: Update EHT capabilities for GL device")
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231207044813.092528daf59e.I5715769490835819beddb00c91bbc9e806e170cb@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index 6015e1255d2a..480f8edbfd35 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -1029,7 +1029,8 @@ iwl_nvm_fixup_sband_iftd(struct iwl_trans *trans,
+ 			  IEEE80211_EHT_PHY_CAP3_NG_16_MU_FEEDBACK |
+ 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_4_2_SU_FDBK |
+ 			  IEEE80211_EHT_PHY_CAP3_CODEBOOK_7_5_MU_FDBK |
+-			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK);
++			  IEEE80211_EHT_PHY_CAP3_TRIG_MU_BF_PART_BW_FDBK |
++			  IEEE80211_EHT_PHY_CAP3_TRIG_CQI_FDBK);
+ 		iftype_data->eht_cap.eht_cap_elem.phy_cap_info[4] &=
+ 			~(IEEE80211_EHT_PHY_CAP4_PART_BW_DL_MU_MIMO |
+ 			  IEEE80211_EHT_PHY_CAP4_POWER_BOOST_FACT_SUPP);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-iwlwifi-fix-out-of-bound-copy_from_user.patch b/queue-6.7/wifi-iwlwifi-fix-out-of-bound-copy_from_user.patch
new file mode 100644
index 00000000000..a3978f0a47e
--- /dev/null
+++ b/queue-6.7/wifi-iwlwifi-fix-out-of-bound-copy_from_user.patch
@@ -0,0 +1,44 @@
+From 5235f932df8124e3a9af9df121914bdef4e9be29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 21:58:55 +0200
+Subject: wifi: iwlwifi: fix out of bound copy_from_user
+
+From: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+
+[ Upstream commit cb2dfacb197bed0241fbb4f84bd0995a47f4465e ]
+
+The driver copies the userspace buffer into an internal NUL
+byte terminated buffer. While doing so, it was reading beyond
+the end of the userspace buffer, overwriting its own NUL
+termination in the process.
+
+Fix this by only copying the correct number of bytes.
+
+Fixes: 3f244876ef73 ("wifi: iwlwifi: make debugfs entries link specific")
+Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Reviewed-by: Benjamin Berg <benjamin.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231219215605.e4913deb2ad4.Idcf6a7e909ff4b7801cd49c2f691f84a2f68eff9@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+index 329c545f65fd..7737650e56cb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+@@ -1815,7 +1815,7 @@ static ssize_t _iwl_dbgfs_link_sta_##name##_write(struct file *file,	\
+ 	char buf[buflen] = {};						\
+ 	size_t buf_size = min(count, sizeof(buf) -  1);			\
+ 									\
+-	if (copy_from_user(buf, user_buf, sizeof(buf)))			\
++	if (copy_from_user(buf, user_buf, buf_size))			\
+ 		return -EFAULT;						\
+ 									\
+ 	return _iwl_dbgfs_link_sta_wrap_write(iwl_dbgfs_##name##_write,	\
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-iwlwifi-mvm-do-not-warn-if-valid-link-pair-was-.patch b/queue-6.7/wifi-iwlwifi-mvm-do-not-warn-if-valid-link-pair-was-.patch
new file mode 100644
index 00000000000..0430d94929a
--- /dev/null
+++ b/queue-6.7/wifi-iwlwifi-mvm-do-not-warn-if-valid-link-pair-was-.patch
@@ -0,0 +1,40 @@
+From 3a48cf26824960ba98d5f28fe272341058fa5cb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 21:58:54 +0200
+Subject: wifi: iwlwifi: mvm: Do not warn if valid link pair was not found
+
+From: Ilan Peer <ilan.peer@intel.com>
+
+[ Upstream commit c5bfdb46636a2ea7f0678243c6d3e9f8d26b027a ]
+
+It is possible that though multiple links are enabled we cannot enabled
+EMLSR enable more than a single link, e.g., all valid links are on the
+same band etc. Thus, do not warn in case no valid link pair is found.
+
+Fixes: b9be67fb4207 ("wifi: iwlwifi: mvm: Add basic link selection logic")
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231219215605.142e57a05230.I7cfe78c94c3d15c4c744bccadd8f187e43594932@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
+index ff6cb064051b..8e263acbc763 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c
+@@ -716,7 +716,7 @@ void iwl_mvm_mld_select_links(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ 		}
+ 	}
+ 
+-	if (WARN_ON(!new_active_links))
++	if (!new_active_links)
+ 		return;
+ 
+ 	if (vif->active_links != new_active_links)
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch b/queue-6.7/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
new file mode 100644
index 00000000000..d9628a26041
--- /dev/null
+++ b/queue-6.7/wifi-iwlwifi-mvm-send-tx-path-flush-in-rfkill.patch
@@ -0,0 +1,42 @@
+From 3d7460f6b91c832d62b2baabc19f029b34e63071 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 21:58:52 +0200
+Subject: wifi: iwlwifi: mvm: send TX path flush in rfkill
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 2afc3dad39ea84a072d04ff40a417234326adc47 ]
+
+If we want to drop packets, that's surely a good thing to
+do when we want to enter rfkill. Send this command despite
+rfkill so we can successfully clean up everything, we need
+to handle it separately since it has CMD_WANT_SKB, so it's
+not going to automatically return success when in rfkill.
+
+Fixes: d4e3a341b87b ("iwlwifi: mvm: add support for new flush queue response")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231219215605.c528a6fa6cec.Ibe5e9560359ccc0fba60c35e01de285c376748a2@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index ae5cd13cd6dd..db986bfc4dc3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -2256,7 +2256,7 @@ int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids)
+ 	WARN_ON(!iwl_mvm_has_new_tx_api(mvm));
+ 
+ 	if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0)
+-		cmd.flags |= CMD_WANT_SKB;
++		cmd.flags |= CMD_WANT_SKB | CMD_SEND_IN_RFKILL;
+ 
+ 	IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n",
+ 			    sta_id, tids);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch b/queue-6.7/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
new file mode 100644
index 00000000000..f3620e932ae
--- /dev/null
+++ b/queue-6.7/wifi-iwlwifi-mvm-set-siso-mimo-chains-to-1-in-fw-smp.patch
@@ -0,0 +1,49 @@
+From 99422412b3574022c821986d39533eb0709d94ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 21:58:49 +0200
+Subject: wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit b1a2e5c310e063560760806d2cc5d2233c596067 ]
+
+The firmware changed their mind, don't set the chains to zero,
+instead set them to 1 as we normally would for connections to
+APs that don't use MIMO.
+
+Fixes: 2a7ce54ccc23 ("iwlwifi: mvm: honour firmware SMPS requests")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231219215605.7f031f1a127f.Idc816e0f604b07d22a9d5352bc23c445512fad14@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+index 4e1fccff3987..334d1f59f6e4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+@@ -99,17 +99,6 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm,
+ 		active_cnt = 2;
+ 	}
+ 
+-	/*
+-	 * If the firmware requested it, then we know that it supports
+-	 * getting zero for the values to indicate "use one, but pick
+-	 * which one yourself", which means it can dynamically pick one
+-	 * that e.g. has better RSSI.
+-	 */
+-	if (mvm->fw_static_smps_request && active_cnt == 1 && idle_cnt == 1) {
+-		idle_cnt = 0;
+-		active_cnt = 0;
+-	}
+-
+ 	*rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) <<
+ 					PHY_RX_CHAIN_VALID_POS);
+ 	*rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-libertas-stop-selecting-wext.patch b/queue-6.7/wifi-libertas-stop-selecting-wext.patch
new file mode 100644
index 00000000000..23b01a12021
--- /dev/null
+++ b/queue-6.7/wifi-libertas-stop-selecting-wext.patch
@@ -0,0 +1,37 @@
+From b7220cdc69e8caed489e97f7844221a148d30c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Nov 2023 16:34:03 +0100
+Subject: wifi: libertas: stop selecting wext
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 8170b04c2c92eee52ea50b96db4c54662197e512 ]
+
+Libertas no longer references the iw_handler infrastructure or wext_spy,
+so neither of the 'select' statements are used any more.
+
+Fixes: e86dc1ca4676 ("Libertas: cfg80211 support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231108153409.1065286-1-arnd@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas/Kconfig | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas/Kconfig b/drivers/net/wireless/marvell/libertas/Kconfig
+index 6d62ab49aa8d..c7d02adb3eea 100644
+--- a/drivers/net/wireless/marvell/libertas/Kconfig
++++ b/drivers/net/wireless/marvell/libertas/Kconfig
+@@ -2,8 +2,6 @@
+ config LIBERTAS
+ 	tristate "Marvell 8xxx Libertas WLAN driver support"
+ 	depends on CFG80211
+-	select WIRELESS_EXT
+-	select WEXT_SPY
+ 	select LIB80211
+ 	select FW_LOADER
+ 	help
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mac80211-fix-advertised-ttlm-scheduling.patch b/queue-6.7/wifi-mac80211-fix-advertised-ttlm-scheduling.patch
new file mode 100644
index 00000000000..17150103208
--- /dev/null
+++ b/queue-6.7/wifi-mac80211-fix-advertised-ttlm-scheduling.patch
@@ -0,0 +1,112 @@
+From 2e6c919fb13cc8dd78923400709125a0510f5f54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Dec 2023 13:41:44 +0200
+Subject: wifi: mac80211: fix advertised TTLM scheduling
+
+From: Ayala Beker <ayala.beker@intel.com>
+
+[ Upstream commit b1a23f8ae0d76ad32fe36682730c050251275b0b ]
+
+Handle a case of time overflow, where the switch time might
+be smaller than the partial TSF in the beacon.
+Additionally, apply advertised TTLM earlier in order to be
+ready on time on the newly activated links.
+
+Fixes: 702e80470a33 ("wifi: mac80211: support handling of advertised TID-to-link mapping")
+Signed-off-by: Ayala Beker <ayala.beker@intel.com>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
+Link: https://msgid.link/20231220133549.15079c34e5c8.I0dd50bcceff5953080cdd7aee5118b72c78c6507@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mlme.c | 49 ++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 9 deletions(-)
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index c8998cf01b7a..dcdaab19efbd 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -43,6 +43,9 @@
+ #define IEEE80211_ASSOC_TIMEOUT_SHORT	(HZ / 10)
+ #define IEEE80211_ASSOC_MAX_TRIES	3
+ 
++#define IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS msecs_to_jiffies(100)
++#define IEEE80211_ADV_TTLM_ST_UNDERFLOW 0xff00
++
+ static int max_nullfunc_tries = 2;
+ module_param(max_nullfunc_tries, int, 0644);
+ MODULE_PARM_DESC(max_nullfunc_tries,
+@@ -5946,6 +5949,13 @@ ieee80211_parse_adv_t2l(struct ieee80211_sub_if_data *sdata,
+ 	pos++;
+ 
+ 	ttlm_info->switch_time = get_unaligned_le16(pos);
++
++	/* Since ttlm_info->switch_time == 0 means no switch time, bump it
++	 * by 1.
++	 */
++	if (!ttlm_info->switch_time)
++		ttlm_info->switch_time = 1;
++
+ 	pos += 2;
+ 
+ 	if (control & IEEE80211_TTLM_CONTROL_EXPECTED_DUR_PRESENT) {
+@@ -6040,25 +6050,46 @@ static void ieee80211_process_adv_ttlm(struct ieee80211_sub_if_data *sdata,
+ 		}
+ 
+ 		if (ttlm_info.switch_time) {
+-			u32 st_us, delay = 0;
+-			u32 ts_l26 = beacon_ts & GENMASK(25, 0);
++			u16 beacon_ts_tu, st_tu, delay;
++			u32 delay_jiffies;
++			u64 mask;
+ 
+ 			/* The t2l map switch time is indicated with a partial
+-			 * TSF value, convert it to TSF and calc the delay
+-			 * to the start time.
++			 * TSF value (bits 10 to 25), get the partial beacon TS
++			 * as well, and calc the delay to the start time.
++			 */
++			mask = GENMASK_ULL(25, 10);
++			beacon_ts_tu = (beacon_ts & mask) >> 10;
++			st_tu = ttlm_info.switch_time;
++			delay = st_tu - beacon_ts_tu;
++
++			/*
++			 * If the switch time is far in the future, then it
++			 * could also be the previous switch still being
++			 * announced.
++			 * We can simply ignore it for now, if it is a future
++			 * switch the AP will continue to announce it anyway.
++			 */
++			if (delay > IEEE80211_ADV_TTLM_ST_UNDERFLOW)
++				return;
++
++			delay_jiffies = TU_TO_JIFFIES(delay);
++
++			/* Link switching can take time, so schedule it
++			 * 100ms before to be ready on time
+ 			 */
+-			st_us = ieee80211_tu_to_usec(ttlm_info.switch_time);
+-			if (st_us > ts_l26)
+-				delay = st_us - ts_l26;
++			if (delay_jiffies > IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS)
++				delay_jiffies -=
++					IEEE80211_ADV_TTLM_SAFETY_BUFFER_MS;
+ 			else
+-				continue;
++				delay_jiffies = 0;
+ 
+ 			sdata->u.mgd.ttlm_info = ttlm_info;
+ 			wiphy_delayed_work_cancel(sdata->local->hw.wiphy,
+ 						  &sdata->u.mgd.ttlm_work);
+ 			wiphy_delayed_work_queue(sdata->local->hw.wiphy,
+ 						 &sdata->u.mgd.ttlm_work,
+-						 usecs_to_jiffies(delay));
++						 delay_jiffies);
+ 			return;
+ 		}
+ 	}
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-fix-typo-in-mt76_get_of_eeprom_from_nvmem-.patch b/queue-6.7/wifi-mt76-fix-typo-in-mt76_get_of_eeprom_from_nvmem-.patch
new file mode 100644
index 00000000000..a2e7abfeda4
--- /dev/null
+++ b/queue-6.7/wifi-mt76-fix-typo-in-mt76_get_of_eeprom_from_nvmem-.patch
@@ -0,0 +1,45 @@
+From 78861631cc320250e30378bfcbc98398e25b1c13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Oct 2023 15:09:38 +0200
+Subject: wifi: mt76: fix typo in mt76_get_of_eeprom_from_nvmem function
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit c33e5f4cbb9f961e66473a9ace077c4d1f29a5bb ]
+
+Fix typo in mt76_get_of_eeprom_from_nvmem where eeprom was misspelled as
+epprom.
+
+Fixes: 5bef3a406c6e ("wifi: mt76: add support for providing eeprom in nvmem cells")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/eeprom.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/eeprom.c b/drivers/net/wireless/mediatek/mt76/eeprom.c
+index 7725dd6763ef..be55c7e0aff1 100644
+--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
++++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
+@@ -106,7 +106,7 @@ static int mt76_get_of_epprom_from_mtd(struct mt76_dev *dev, void *eep, int offs
+ #endif
+ }
+ 
+-static int mt76_get_of_epprom_from_nvmem(struct mt76_dev *dev, void *eep, int len)
++static int mt76_get_of_eeprom_from_nvmem(struct mt76_dev *dev, void *eep, int len)
+ {
+ 	struct device_node *np = dev->dev->of_node;
+ 	struct nvmem_cell *cell;
+@@ -153,7 +153,7 @@ int mt76_get_of_eeprom(struct mt76_dev *dev, void *eep, int offset, int len)
+ 	if (!ret)
+ 		return 0;
+ 
+-	return mt76_get_of_epprom_from_nvmem(dev, eep, len);
++	return mt76_get_of_eeprom_from_nvmem(dev, eep, len);
+ }
+ EXPORT_SYMBOL_GPL(mt76_get_of_eeprom);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7915-also-mt7981-is-3t3r-but-nss2-on-5-g.patch b/queue-6.7/wifi-mt76-mt7915-also-mt7981-is-3t3r-but-nss2-on-5-g.patch
new file mode 100644
index 00000000000..078d24e79bc
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7915-also-mt7981-is-3t3r-but-nss2-on-5-g.patch
@@ -0,0 +1,41 @@
+From 71e017b17958bda71ff2dd511bbb062686a69862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 22:39:31 +0000
+Subject: wifi: mt76: mt7915: also MT7981 is 3T3R but nss2 on 5 GHz band
+
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+
+[ Upstream commit ff434cc129d6907e6dbc89dd0ebc59fd3646d4c2 ]
+
+Just like MT7916 also MT7981 can handle 3T3R DBDC frontend and should
+hence be included in the corresponding conditional expression in the
+driver. Add it.
+
+Fixes: 6bad146d162e ("wifi: mt76: mt7915: add support for MT7981")
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/main.c b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+index a3fd54cc1911..9d747eb8ab82 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/main.c
+@@ -1059,8 +1059,9 @@ mt7915_set_antenna(struct ieee80211_hw *hw, u32 tx_ant, u32 rx_ant)
+ 
+ 	phy->mt76->antenna_mask = tx_ant;
+ 
+-	/* handle a variant of mt7916 which has 3T3R but nss2 on 5 GHz band */
+-	if (is_mt7916(&dev->mt76) && band && hweight8(tx_ant) == max_nss)
++	/* handle a variant of mt7916/mt7981 which has 3T3R but nss2 on 5 GHz band */
++	if ((is_mt7916(&dev->mt76) || is_mt7981(&dev->mt76)) &&
++	    band && hweight8(tx_ant) == max_nss)
+ 		phy->mt76->chainmask = (dev->chainmask >> chainshift) << chainshift;
+ 	else
+ 		phy->mt76->chainmask = tx_ant << (chainshift * band);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7915-fallback-to-non-wed-mode-if-platfor.patch b/queue-6.7/wifi-mt76-mt7915-fallback-to-non-wed-mode-if-platfor.patch
new file mode 100644
index 00000000000..76630133db4
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7915-fallback-to-non-wed-mode-if-platfor.patch
@@ -0,0 +1,39 @@
+From 8e9fb1425f9abe34ae867115e208a1be49fc23f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Oct 2023 12:45:19 +0200
+Subject: wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource
+ fails in mt7915_mmio_wed_init()
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 5f9d5d4fc561e7bd3a18742f1fdb96cab98f1870 ]
+
+mt76 assumes mt7915_mmio_wed_init can fail just after wed driver has
+been attached running mtk_wed_device_attach().
+Fall back to non-wed mode if platform_get_resource fails in
+mt7915_mmio_wed_init routines.
+
+Fixes: eebb70976be5 ("wifi: mt76: mt7915: enable wed for mt7986-wmac chipset")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/mmio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
+index e7d8e03f826f..04a49ef67560 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c
+@@ -742,7 +742,7 @@ int mt7915_mmio_wed_init(struct mt7915_dev *dev, void *pdev_ptr,
+ 
+ 		res = platform_get_resource(plat_dev, IORESOURCE_MEM, 0);
+ 		if (!res)
+-			return -ENOMEM;
++			return 0;
+ 
+ 		wed->wlan.platform_dev = plat_dev;
+ 		wed->wlan.bus_type = MTK_WED_BUS_AXI;
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7915-fix-eeprom-offset-of-tssi-flag-on-m.patch b/queue-6.7/wifi-mt76-mt7915-fix-eeprom-offset-of-tssi-flag-on-m.patch
new file mode 100644
index 00000000000..b3709826d36
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7915-fix-eeprom-offset-of-tssi-flag-on-m.patch
@@ -0,0 +1,38 @@
+From 8c90161f30b0787f9cf01d029839ad04b04267ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Nov 2023 22:38:53 +0000
+Subject: wifi: mt76: mt7915: fix EEPROM offset of TSSI flag on MT7981
+
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+
+[ Upstream commit 3531c72aedb95261f4d78c47efa4b5ba7cdcddd9 ]
+
+The offset of the TSSI flag on the EEPROM of MT7981 devices was wrong.
+Set the correct offset instead.
+
+Fixes: 6bad146d162e ("wifi: mt76: mt7915: add support for MT7981")
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+index f3e56817d36e..adc26a222823 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7915/eeprom.h
+@@ -144,7 +144,8 @@ static inline bool
+ mt7915_tssi_enabled(struct mt7915_dev *dev, enum nl80211_band band)
+ {
+ 	u8 *eep = dev->mt76.eeprom.data;
+-	u8 val = eep[MT_EE_WIFI_CONF + 7];
++	u8 offs = is_mt7981(&dev->mt76) ? 8 : 7;
++	u8 val = eep[MT_EE_WIFI_CONF + offs];
+ 
+ 	if (band == NL80211_BAND_2GHZ)
+ 		return val & MT_EE_WIFI_CONF7_TSSI0_2G;
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7921-fix-clc-command-timeout-when-suspen.patch b/queue-6.7/wifi-mt76-mt7921-fix-clc-command-timeout-when-suspen.patch
new file mode 100644
index 00000000000..5ad97cf7672
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7921-fix-clc-command-timeout-when-suspen.patch
@@ -0,0 +1,103 @@
+From 279df68191c81b143ff831235672aea0400484bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 11:06:45 +0800
+Subject: wifi: mt76: mt7921: fix CLC command timeout when suspend/resume
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit d0a2bc5fe712217d2c73822ae75fd4e69a15cb2c ]
+
+When enter suspend/resume while in a connected state, the upper layer
+will trigger disconnection before entering suspend, and at the same time,
+it will trigger regd_notifier() and update CLC, causing the CLC event to
+not be received due to suspend, resulting in a command timeout.
+
+Therefore, the update of CLC is postponed until resume, to ensure data
+consistency and avoid the occurrence of command timeout.
+
+Fixes: 4fc8df50fd41 ("wifi: mt76: mt7921: get regulatory information from the clc event")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/init.c  | 23 +++++++++++++++----
+ .../wireless/mediatek/mt76/mt7921/mt7921.h    |  1 +
+ .../net/wireless/mediatek/mt76/mt7921/pci.c   |  3 +++
+ 3 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+index 7d6a9d746011..48433c6d5e7d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c
+@@ -110,24 +110,37 @@ mt7921_regd_channel_update(struct wiphy *wiphy, struct mt792x_dev *dev)
+ 	}
+ }
+ 
++void mt7921_regd_update(struct mt792x_dev *dev)
++{
++	struct mt76_dev *mdev = &dev->mt76;
++	struct ieee80211_hw *hw = mdev->hw;
++	struct wiphy *wiphy = hw->wiphy;
++
++	mt7921_mcu_set_clc(dev, mdev->alpha2, dev->country_ie_env);
++	mt7921_regd_channel_update(wiphy, dev);
++	mt76_connac_mcu_set_channel_domain(hw->priv);
++	mt7921_set_tx_sar_pwr(hw, NULL);
++}
++EXPORT_SYMBOL_GPL(mt7921_regd_update);
++
+ static void
+ mt7921_regd_notifier(struct wiphy *wiphy,
+ 		     struct regulatory_request *request)
+ {
+ 	struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+ 	struct mt792x_dev *dev = mt792x_hw_dev(hw);
++	struct mt76_connac_pm *pm = &dev->pm;
+ 
+ 	memcpy(dev->mt76.alpha2, request->alpha2, sizeof(dev->mt76.alpha2));
+ 	dev->mt76.region = request->dfs_region;
+ 	dev->country_ie_env = request->country_ie_env;
+ 
++	if (pm->suspended)
++		return;
++
+ 	mt792x_mutex_acquire(dev);
+-	mt7921_mcu_set_clc(dev, request->alpha2, request->country_ie_env);
+-	mt76_connac_mcu_set_channel_domain(hw->priv);
+-	mt7921_set_tx_sar_pwr(hw, NULL);
++	mt7921_regd_update(dev);
+ 	mt792x_mutex_release(dev);
+-
+-	mt7921_regd_channel_update(wiphy, dev);
+ }
+ 
+ int mt7921_mac_init(struct mt792x_dev *dev)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+index f28621121927..5c4cc370e6ce 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mt7921.h
+@@ -233,6 +233,7 @@ mt7921_l1_rmw(struct mt792x_dev *dev, u32 addr, u32 mask, u32 val)
+ #define mt7921_l1_set(dev, addr, val)	mt7921_l1_rmw(dev, addr, 0, val)
+ #define mt7921_l1_clear(dev, addr, val)	mt7921_l1_rmw(dev, addr, val, 0)
+ 
++void mt7921_regd_update(struct mt792x_dev *dev);
+ int mt7921_mac_init(struct mt792x_dev *dev);
+ bool mt7921_mac_wtbl_update(struct mt792x_dev *dev, int idx, u32 mask);
+ int mt7921_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+index f04e7095e181..42fd456eb6fa 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -507,6 +507,9 @@ static int mt7921_pci_resume(struct device *device)
+ 		mt76_connac_mcu_set_deep_sleep(&dev->mt76, false);
+ 
+ 	err = mt76_connac_mcu_set_hif_suspend(mdev, false);
++
++	mt7921_regd_update(dev);
++
+ failed:
+ 	pm->suspended = false;
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch b/queue-6.7/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
new file mode 100644
index 00000000000..46e8999ecda
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7921-fix-country-count-limitation-for-cl.patch
@@ -0,0 +1,65 @@
+From 5bc587cc366c4ddb1ce67fc5e535339f1c948b96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 11:06:44 +0800
+Subject: wifi: mt76: mt7921: fix country count limitation for CLC
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit fa6ad88e023ddfa6c5dcdb466d159e89f451e305 ]
+
+Due to the increase in the number of power tables for 6Ghz on CLC,
+the variable nr_country is no longer sufficient to represent the
+total quantity. Therefore, we have switched to calculating the
+length of clc buf to obtain the correct power table. Additionally,
+the version number has been incremented to 1.
+
+Fixes: 23bdc5d8cadf ("wifi: mt76: mt7921: introduce Country Location Control support")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+index 2cc2d2788f83..399d7ca6bebc 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+@@ -1263,13 +1263,15 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
+ 		u8 env_6g;
+ 		u8 rsvd[63];
+ 	} __packed req = {
++		.ver = 1,
+ 		.idx = idx,
+ 		.env = env_cap,
+ 		.env_6g = dev->phy.power_type,
+ 		.acpi_conf = mt792x_acpi_get_flags(&dev->phy),
+ 	};
+ 	int ret, valid_cnt = 0;
+-	u8 i, *pos;
++	u16 buf_len = 0;
++	u8 *pos;
+ 
+ 	if (!clc)
+ 		return 0;
+@@ -1279,12 +1281,15 @@ int __mt7921_mcu_set_clc(struct mt792x_dev *dev, u8 *alpha2,
+ 	if (mt76_find_power_limits_node(&dev->mt76))
+ 		req.cap |= CLC_CAP_DTS_EN;
+ 
++	buf_len = le16_to_cpu(clc->len) - sizeof(*clc);
+ 	pos = clc->data;
+-	for (i = 0; i < clc->nr_country; i++) {
++	while (buf_len > 16) {
+ 		struct mt7921_clc_rule *rule = (struct mt7921_clc_rule *)pos;
+ 		u16 len = le16_to_cpu(rule->len);
++		u16 offset = len + sizeof(*rule);
+ 
+-		pos += len + sizeof(*rule);
++		pos += offset;
++		buf_len -= offset;
+ 		if (rule->alpha2[0] != alpha2[0] ||
+ 		    rule->alpha2[1] != alpha2[1])
+ 			continue;
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7921-fix-wrong-6ghz-power-type.patch b/queue-6.7/wifi-mt76-mt7921-fix-wrong-6ghz-power-type.patch
new file mode 100644
index 00000000000..f731b30519e
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7921-fix-wrong-6ghz-power-type.patch
@@ -0,0 +1,102 @@
+From 88fdf417427c43abd6174d6295844c1ae598501f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 11:06:46 +0800
+Subject: wifi: mt76: mt7921: fix wrong 6Ghz power type
+
+From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+
+[ Upstream commit 10f2903147ed04784522ab841c20bb469bdd8681 ]
+
+To avoid using incorrect 6g power settings after disconnection,
+it should to update back to the default state when disconnected.
+
+Fixes: 51ba0e3a15eb ("wifi: mt76: mt7921: add 6GHz power type support for clc")
+Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/mediatek/mt76/mt7921/main.c  | 38 +++++++++++++++++--
+ 1 file changed, 35 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+index 510a575a973b..0645417e0582 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+@@ -683,17 +683,45 @@ static void mt7921_bss_info_changed(struct ieee80211_hw *hw,
+ }
+ 
+ static void
+-mt7921_regd_set_6ghz_power_type(struct ieee80211_vif *vif)
++mt7921_calc_vif_num(void *priv, u8 *mac, struct ieee80211_vif *vif)
++{
++	u32 *num = priv;
++
++	if (!priv)
++		return;
++
++	switch (vif->type) {
++	case NL80211_IFTYPE_STATION:
++	case NL80211_IFTYPE_P2P_CLIENT:
++	case NL80211_IFTYPE_AP:
++	case NL80211_IFTYPE_P2P_GO:
++		*num += 1;
++		break;
++	default:
++		break;
++	}
++}
++
++static void
++mt7921_regd_set_6ghz_power_type(struct ieee80211_vif *vif, bool is_add)
+ {
+ 	struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
+ 	struct mt792x_phy *phy = mvif->phy;
+ 	struct mt792x_dev *dev = phy->dev;
++	u32 valid_vif_num = 0;
++
++	ieee80211_iterate_active_interfaces(mt76_hw(dev),
++					    IEEE80211_IFACE_ITER_RESUME_ALL,
++					    mt7921_calc_vif_num, &valid_vif_num);
+ 
+-	if (hweight64(dev->mt76.vif_mask) > 1) {
++	if (valid_vif_num > 1) {
+ 		phy->power_type = MT_AP_DEFAULT;
+ 		goto out;
+ 	}
+ 
++	if (!is_add)
++		vif->bss_conf.power_type = IEEE80211_REG_UNSET_AP;
++
+ 	switch (vif->bss_conf.power_type) {
+ 	case IEEE80211_REG_SP_AP:
+ 		phy->power_type = MT_AP_SP;
+@@ -705,6 +733,8 @@ mt7921_regd_set_6ghz_power_type(struct ieee80211_vif *vif)
+ 		phy->power_type = MT_AP_LPI;
+ 		break;
+ 	case IEEE80211_REG_UNSET_AP:
++		phy->power_type = MT_AP_UNSET;
++		break;
+ 	default:
+ 		phy->power_type = MT_AP_DEFAULT;
+ 		break;
+@@ -749,7 +779,7 @@ int mt7921_mac_sta_add(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 	if (ret)
+ 		return ret;
+ 
+-	mt7921_regd_set_6ghz_power_type(vif);
++	mt7921_regd_set_6ghz_power_type(vif, true);
+ 
+ 	mt76_connac_power_save_sched(&dev->mphy, &dev->pm);
+ 
+@@ -811,6 +841,8 @@ void mt7921_mac_sta_remove(struct mt76_dev *mdev, struct ieee80211_vif *vif,
+ 		list_del_init(&msta->wcid.poll_list);
+ 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
+ 
++	mt7921_regd_set_6ghz_power_type(vif, false);
++
+ 	mt76_connac_power_save_sched(&dev->mphy, &dev->pm);
+ }
+ EXPORT_SYMBOL_GPL(mt7921_mac_sta_remove);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch b/queue-6.7/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
new file mode 100644
index 00000000000..97585ed0820
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7921s-fix-workqueue-problem-causes-sta-a.patch
@@ -0,0 +1,180 @@
+From 40b1f33f56407a9d6d969b75fe538c38f6debb8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Nov 2023 20:54:49 +0800
+Subject: wifi: mt76: mt7921s: fix workqueue problem causes STA association
+ fail
+
+From: Wang Zhao <wang.zhao@mediatek.com>
+
+[ Upstream commit 92184eae1d5ad804884e2c6e289d885b9e3194d1 ]
+
+The ieee80211_queue_work function queues work into the mac80211
+local->workqueue, which is widely used for mac80211 internal
+work processes. In the mt76 driver, both the mt76-sido-status and
+mt76-sdio-net threads enqueue workers to the workqueue with this
+function. However, in some cases, when two workers are enqueued
+to the workqueue almost simultaneously, the second worker may not
+be scheduled immediately and may get stuck for a while.
+This can cause timing issues. To avoid these timing
+conflicts caused by worker scheduling, replace the worker
+with an independent thread.
+
+Fixes: 48fab5bbef40 ("mt76: mt7921: introduce mt7921s support")
+Signed-off-by: Wang Zhao <wang.zhao@mediatek.com>
+Signed-off-by: Deren Wu <deren.wu@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h      |  3 +--
+ .../net/wireless/mediatek/mt76/mt7615/sdio.c   |  2 +-
+ .../net/wireless/mediatek/mt76/mt7921/sdio.c   |  4 +++-
+ .../wireless/mediatek/mt76/mt7921/sdio_mac.c   |  3 ++-
+ drivers/net/wireless/mediatek/mt76/sdio.c      | 18 +++++++++++-------
+ 5 files changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index ea828ba0b83a..a17b2fbd693b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -575,8 +575,7 @@ struct mt76_sdio {
+ 	struct mt76_worker txrx_worker;
+ 	struct mt76_worker status_worker;
+ 	struct mt76_worker net_worker;
+-
+-	struct work_struct stat_work;
++	struct mt76_worker stat_worker;
+ 
+ 	u8 *xmit_buf;
+ 	u32 xmit_buf_sz;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c
+index fc547a0031ea..67cedd2555f9 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio.c
+@@ -204,8 +204,8 @@ static int mt7663s_suspend(struct device *dev)
+ 	mt76_worker_disable(&mdev->mt76.sdio.txrx_worker);
+ 	mt76_worker_disable(&mdev->mt76.sdio.status_worker);
+ 	mt76_worker_disable(&mdev->mt76.sdio.net_worker);
++	mt76_worker_disable(&mdev->mt76.sdio.stat_worker);
+ 
+-	cancel_work_sync(&mdev->mt76.sdio.stat_work);
+ 	clear_bit(MT76_READING_STATS, &mdev->mphy.state);
+ 
+ 	mt76_tx_status_check(&mdev->mt76, true);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
+index dc1beb76df3e..7591e54d2897 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio.c
+@@ -228,7 +228,7 @@ static int mt7921s_suspend(struct device *__dev)
+ 	mt76_txq_schedule_all(&dev->mphy);
+ 	mt76_worker_disable(&mdev->tx_worker);
+ 	mt76_worker_disable(&mdev->sdio.status_worker);
+-	cancel_work_sync(&mdev->sdio.stat_work);
++	mt76_worker_disable(&mdev->sdio.stat_worker);
+ 	clear_bit(MT76_READING_STATS, &dev->mphy.state);
+ 	mt76_tx_status_check(mdev, true);
+ 
+@@ -260,6 +260,7 @@ static int mt7921s_suspend(struct device *__dev)
+ restore_worker:
+ 	mt76_worker_enable(&mdev->tx_worker);
+ 	mt76_worker_enable(&mdev->sdio.status_worker);
++	mt76_worker_enable(&mdev->sdio.stat_worker);
+ 
+ 	if (!pm->ds_enable)
+ 		mt76_connac_mcu_set_deep_sleep(mdev, false);
+@@ -292,6 +293,7 @@ static int mt7921s_resume(struct device *__dev)
+ 	mt76_worker_enable(&mdev->sdio.txrx_worker);
+ 	mt76_worker_enable(&mdev->sdio.status_worker);
+ 	mt76_worker_enable(&mdev->sdio.net_worker);
++	mt76_worker_enable(&mdev->sdio.stat_worker);
+ 
+ 	/* restore previous ds setting */
+ 	if (!pm->ds_enable)
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
+index 8edd0291c128..389eb0903807 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c
+@@ -107,7 +107,7 @@ int mt7921s_mac_reset(struct mt792x_dev *dev)
+ 	mt76_worker_disable(&dev->mt76.sdio.txrx_worker);
+ 	mt76_worker_disable(&dev->mt76.sdio.status_worker);
+ 	mt76_worker_disable(&dev->mt76.sdio.net_worker);
+-	cancel_work_sync(&dev->mt76.sdio.stat_work);
++	mt76_worker_disable(&dev->mt76.sdio.stat_worker);
+ 
+ 	mt7921s_disable_irq(&dev->mt76);
+ 	mt7921s_wfsys_reset(dev);
+@@ -115,6 +115,7 @@ int mt7921s_mac_reset(struct mt792x_dev *dev)
+ 	mt76_worker_enable(&dev->mt76.sdio.txrx_worker);
+ 	mt76_worker_enable(&dev->mt76.sdio.status_worker);
+ 	mt76_worker_enable(&dev->mt76.sdio.net_worker);
++	mt76_worker_enable(&dev->mt76.sdio.stat_worker);
+ 
+ 	dev->fw_assert = false;
+ 	clear_bit(MT76_MCU_RESET, &dev->mphy.state);
+diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
+index 419723118ded..c52d550f0c32 100644
+--- a/drivers/net/wireless/mediatek/mt76/sdio.c
++++ b/drivers/net/wireless/mediatek/mt76/sdio.c
+@@ -481,21 +481,21 @@ static void mt76s_status_worker(struct mt76_worker *w)
+ 		if (dev->drv->tx_status_data && ndata_frames > 0 &&
+ 		    !test_and_set_bit(MT76_READING_STATS, &dev->phy.state) &&
+ 		    !test_bit(MT76_STATE_SUSPEND, &dev->phy.state))
+-			ieee80211_queue_work(dev->hw, &dev->sdio.stat_work);
++			mt76_worker_schedule(&sdio->stat_worker);
+ 	} while (nframes > 0);
+ 
+ 	if (resched)
+ 		mt76_worker_schedule(&dev->tx_worker);
+ }
+ 
+-static void mt76s_tx_status_data(struct work_struct *work)
++static void mt76s_tx_status_data(struct mt76_worker *worker)
+ {
+ 	struct mt76_sdio *sdio;
+ 	struct mt76_dev *dev;
+ 	u8 update = 1;
+ 	u16 count = 0;
+ 
+-	sdio = container_of(work, struct mt76_sdio, stat_work);
++	sdio = container_of(worker, struct mt76_sdio, stat_worker);
+ 	dev = container_of(sdio, struct mt76_dev, sdio);
+ 
+ 	while (true) {
+@@ -508,7 +508,7 @@ static void mt76s_tx_status_data(struct work_struct *work)
+ 	}
+ 
+ 	if (count && test_bit(MT76_STATE_RUNNING, &dev->phy.state))
+-		ieee80211_queue_work(dev->hw, &sdio->stat_work);
++		mt76_worker_schedule(&sdio->status_worker);
+ 	else
+ 		clear_bit(MT76_READING_STATS, &dev->phy.state);
+ }
+@@ -600,8 +600,8 @@ void mt76s_deinit(struct mt76_dev *dev)
+ 	mt76_worker_teardown(&sdio->txrx_worker);
+ 	mt76_worker_teardown(&sdio->status_worker);
+ 	mt76_worker_teardown(&sdio->net_worker);
++	mt76_worker_teardown(&sdio->stat_worker);
+ 
+-	cancel_work_sync(&sdio->stat_work);
+ 	clear_bit(MT76_READING_STATS, &dev->phy.state);
+ 
+ 	mt76_tx_status_check(dev, true);
+@@ -644,10 +644,14 @@ int mt76s_init(struct mt76_dev *dev, struct sdio_func *func,
+ 	if (err)
+ 		return err;
+ 
++	err = mt76_worker_setup(dev->hw, &sdio->stat_worker, mt76s_tx_status_data,
++				"sdio-sta");
++	if (err)
++		return err;
++
+ 	sched_set_fifo_low(sdio->status_worker.task);
+ 	sched_set_fifo_low(sdio->net_worker.task);
+-
+-	INIT_WORK(&sdio->stat_work, mt76s_tx_status_data);
++	sched_set_fifo_low(sdio->stat_worker.task);
+ 
+ 	dev->queue_ops = &sdio_queue_ops;
+ 	dev->bus = bus_ops;
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7996-fix-alignment-of-sta-info-event.patch b/queue-6.7/wifi-mt76-mt7996-fix-alignment-of-sta-info-event.patch
new file mode 100644
index 00000000000..d925e402a86
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7996-fix-alignment-of-sta-info-event.patch
@@ -0,0 +1,36 @@
+From d6ebe284be88445fc0b07bc46fe7999e525314f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 18:02:59 +0800
+Subject: wifi: mt76: mt7996: fix alignment of sta info event
+
+From: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+
+[ Upstream commit d58a9778f7ca0634622d2fc2e9f76163467bdf5b ]
+
+Fix the alignment of struct mt7996_mcu_all_sta_info_event.
+
+Fixes: adde3eed4a75 ("wifi: mt76: mt7996: Add mcu commands for getting sta tx statistic")
+Signed-off-by: StanleyYP Wang <StanleyYP.Wang@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+index ebe96a85ca9e..14c0dd31387a 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+@@ -160,7 +160,7 @@ struct mt7996_mcu_all_sta_info_event {
+ 	u8 more;
+ 	u8 rsv2;
+ 	__le16 sta_num;
+-	u8 rsv3[2];
++	u8 rsv3[4];
+ 
+ 	union {
+ 		struct {
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7996-fix-mt7996_mcu_all_sta_info_event-s.patch b/queue-6.7/wifi-mt76-mt7996-fix-mt7996_mcu_all_sta_info_event-s.patch
new file mode 100644
index 00000000000..2d7137b5cc1
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7996-fix-mt7996_mcu_all_sta_info_event-s.patch
@@ -0,0 +1,52 @@
+From ef66e1a7e47af6709020c6189821afdeaf863f14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Nov 2023 15:29:30 +0100
+Subject: wifi: mt76: mt7996: fix mt7996_mcu_all_sta_info_event struct packing
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 2ee1c40daeb9a33e25c460bf87feca58e91af879 ]
+
+The internal struct and union inside mt7996_mcu_all_sta_info_event is
+marked as being aligned, which conflicts with it being unaligned
+within that structure:
+
+drivers/net/wireless/mediatek/mt76/mt7996/mcu.h:165:2: error: field  within 'struct mt7996_mcu_all_sta_info_event' is less aligned than 'union mt7996_mcu_all_sta_info_event::(anonymous at ../drivers/net/wireless/mediatek/mt76/mt7996/mcu.h:165:2)' and is usually due to 'struct mt7996_mcu_all_sta_info_event' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
+
+Mark all three as being packed as well to ensure byte packing for
+the entire thing.
+
+Fixes: adde3eed4a75 ("wifi: mt76: mt7996: Add mcu commands for getting sta tx statistic")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+index 14c0dd31387a..9300cd8eeb76 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+@@ -168,15 +168,15 @@ struct mt7996_mcu_all_sta_info_event {
+ 			u8 rsv[2];
+ 			__le32 tx_bytes[IEEE80211_NUM_ACS];
+ 			__le32 rx_bytes[IEEE80211_NUM_ACS];
+-		} adm_stat[0];
++		} adm_stat[0] __packed;
+ 
+ 		struct {
+ 			__le16 wlan_idx;
+ 			u8 rsv[2];
+ 			__le32 tx_msdu_cnt;
+ 			__le32 rx_msdu_cnt;
+-		} msdu_cnt[0];
+-	};
++		} msdu_cnt[0] __packed;
++	} __packed;
+ } __packed;
+ 
+ enum mt7996_chan_mib_offs {
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch b/queue-6.7/wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch
new file mode 100644
index 00000000000..0090c150ac8
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7996-fix-rate-usage-of-inband-discovery-.patch
@@ -0,0 +1,42 @@
+From effdcfaa4c2d3cb12ff0edb40a1383ede95a1d20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 23:38:54 +0800
+Subject: wifi: mt76: mt7996: fix rate usage of inband discovery frames
+
+From: MeiChia Chiu <meichia.chiu@mediatek.com>
+
+[ Upstream commit 1e3f387736c744e73b5398a147b90412f82f54da ]
+
+For UBPR and FILS frames, the BSS_CHANGED_BEACON flag will also be set,
+which causes those frames to use the beacon rate in TX descriptors.
+Adjust the statement to fix this issue.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: MeiChia Chiu <meichia.chiu@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 59ab07b89087..fa3001e59a36 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -840,10 +840,10 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
+ 	struct mt76_vif *mvif;
+ 	u16 tx_count = 15;
+ 	u32 val;
+-	bool beacon = !!(changed & (BSS_CHANGED_BEACON |
+-				    BSS_CHANGED_BEACON_ENABLED));
+ 	bool inband_disc = !!(changed & (BSS_CHANGED_UNSOL_BCAST_PROBE_RESP |
+ 					 BSS_CHANGED_FILS_DISCOVERY));
++	bool beacon = !!(changed & (BSS_CHANGED_BEACON |
++				    BSS_CHANGED_BEACON_ENABLED)) && (!inband_disc);
+ 
+ 	mvif = vif ? (struct mt76_vif *)vif->drv_priv : NULL;
+ 	if (mvif) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7996-fix-the-size-of-struct-bss_rate_tlv.patch b/queue-6.7/wifi-mt76-mt7996-fix-the-size-of-struct-bss_rate_tlv.patch
new file mode 100644
index 00000000000..6cfbc5f9e93
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7996-fix-the-size-of-struct-bss_rate_tlv.patch
@@ -0,0 +1,36 @@
+From 5e606d69a48e36472f49a30e3690e3991d50ca60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Oct 2023 23:38:49 +0800
+Subject: wifi: mt76: mt7996: fix the size of struct bss_rate_tlv
+
+From: Sujuan Chen <sujuan.chen@mediatek.com>
+
+[ Upstream commit 4aa9992674e70074fce450f65ebc95c2ba2b79ae ]
+
+Align the format of struct bss_rate_tlv to the firmware.
+
+Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
+Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
+Signed-off-by: Shayne Chen <shayne.chen@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mcu.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+index a88f6af323da..ebe96a85ca9e 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.h
+@@ -247,7 +247,7 @@ struct bss_rate_tlv {
+ 	u8 short_preamble;
+ 	u8 bc_fixed_rate;
+ 	u8 mc_fixed_rate;
+-	u8 __rsv2[1];
++	u8 __rsv2[9];
+ } __packed;
+ 
+ struct bss_ra_tlv {
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-mt76-mt7996-fix-uninitialized-variable-in-parsi.patch b/queue-6.7/wifi-mt76-mt7996-fix-uninitialized-variable-in-parsi.patch
new file mode 100644
index 00000000000..2998c3847c0
--- /dev/null
+++ b/queue-6.7/wifi-mt76-mt7996-fix-uninitialized-variable-in-parsi.patch
@@ -0,0 +1,35 @@
+From a082690ae2d66f422c711ee5c0428c52e1ece7f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Oct 2023 15:00:26 -0700
+Subject: wifi: mt76: mt7996: fix uninitialized variable in parsing txfree
+
+From: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
+
+[ Upstream commit 706e83b33103fc5dc945765ddbf6a3e879d21275 ]
+
+Fix the uninitialized variable warning in mt7996_mac_tx_free.
+
+Fixes: 2461599f835e ("wifi: mt76: mt7996: get tx_retries and tx_failed from txfree")
+Signed-off-by: Yi-Chia Hsieh <yi-chia.hsieh@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+index 04540833485f..59ab07b89087 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+@@ -1074,7 +1074,7 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len)
+ 	struct mt76_phy *phy3 = mdev->phys[MT_BAND2];
+ 	struct mt76_txwi_cache *txwi;
+ 	struct ieee80211_sta *sta = NULL;
+-	struct mt76_wcid *wcid;
++	struct mt76_wcid *wcid = NULL;
+ 	LIST_HEAD(free_list);
+ 	struct sk_buff *skb, *tmp;
+ 	void *end = data + len;
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch b/queue-6.7/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
new file mode 100644
index 00000000000..64ce20ee1e0
--- /dev/null
+++ b/queue-6.7/wifi-plfxlc-check-for-allocation-failure-in-plfxlc_u.patch
@@ -0,0 +1,41 @@
+From 10658963ed23856d1c032359537ac46ed29e995e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Oct 2023 12:03:23 +0300
+Subject: wifi: plfxlc: check for allocation failure in plfxlc_usb_wreq_async()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 40018a8fa9aa63ca5b26e803502138158fb0ff96 ]
+
+Check for if the usb_alloc_urb() failed.
+
+Fixes: 68d57a07bfe5 ("wireless: add plfxlc driver for pureLiFi X, XL, XC devices")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/e8d4a19a-f251-4101-a89b-607345e938cb@moroto.mountain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/purelifi/plfxlc/usb.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/purelifi/plfxlc/usb.c b/drivers/net/wireless/purelifi/plfxlc/usb.c
+index 76d0a778636a..311676c1ece0 100644
+--- a/drivers/net/wireless/purelifi/plfxlc/usb.c
++++ b/drivers/net/wireless/purelifi/plfxlc/usb.c
+@@ -493,9 +493,12 @@ int plfxlc_usb_wreq_async(struct plfxlc_usb *usb, const u8 *buffer,
+ 			  void *context)
+ {
+ 	struct usb_device *udev = interface_to_usbdev(usb->ez_usb);
+-	struct urb *urb = usb_alloc_urb(0, GFP_ATOMIC);
++	struct urb *urb;
+ 	int r;
+ 
++	urb = usb_alloc_urb(0, GFP_ATOMIC);
++	if (!urb)
++		return -ENOMEM;
+ 	usb_fill_bulk_urb(urb, udev, usb_sndbulkpipe(udev, EP_DATA_OUT),
+ 			  (void *)buffer, buffer_len, complete_fn, context);
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-add-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-add-calculate_bit_shift.patch
new file mode 100644
index 00000000000..a1221c08b8a
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-add-calculate_bit_shift.patch
@@ -0,0 +1,43 @@
+From 561450363aea4c5e0fea9102f08bc997f93c55c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:29 +0800
+Subject: wifi: rtlwifi: add calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46 ]
+
+There are many same functions like _rtl88e_phy_calculate_bit_shift(),
+_rtl92c_phy_calculate_bit_shift() and so on. And these functions can
+cause undefined bitwise shift behavior. Add calculate_bit_shift() to
+replace them and fix undefined behavior in subsequent patches.
+
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-2-suhui@nfschina.com
+Stable-dep-of: 969bc926f04b ("wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index 31a481f43a07..5d842cc394aa 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -3069,4 +3069,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw,
+ 	return ieee80211_find_sta(mac->vif, mac_addr);
+ }
+ 
++static inline u32 calculate_bit_shift(u32 bitmask)
++{
++	if (WARN_ON_ONCE(!bitmask))
++		return 0;
++
++	return __ffs(bitmask);
++}
+ #endif
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..bd026c87b05
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8188ee-phy-using-calculate_bit_shift.patch
@@ -0,0 +1,77 @@
+From 2ee7d6c121236b79752dcf45e53da71bb3a88bdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:31 +0800
+Subject: wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 969bc926f04b438676768aeffffffb050e480b62 ]
+
+Using calculate_bit_shift() to replace _rtl88e_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: f0eb856e0b6c ("rtlwifi: rtl8188ee: Add new driver")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-4-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c   | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
+index 12d0b3a87af7..0fab3a0c7d49 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
+@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,
+ static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 					enum radio_path rfpath, u32 offset,
+ 					u32 data);
+-static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+ static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw);
+ static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
+ static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
+@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -99,7 +93,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 
+ 
+ 	original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr);
+-	bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -127,7 +121,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl88e_phy_rf_serial_read(hw,
+ 								    rfpath,
+ 								    regaddr);
+-			bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..88c107d3949
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8192c-using-calculate_bit_shift.patch
@@ -0,0 +1,74 @@
+From 1e316f34440918302294c0e367171d0b5d617ef9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:32 +0800
+Subject: wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 1dedc3a6699d827d345019e921b8d8f37f694333 ]
+
+Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: 4295cd254af3 ("rtlwifi: Move common parts of rtl8192ce/phy.c")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-5-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c   | 12 ++----------
+ .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h   |  1 -
+ 2 files changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
+index 3d29c8dbb255..144ee780e1b6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
+@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n",
+ 		regaddr, bitmask);
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
+ }
+ EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write);
+ 
+-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift);
+-
+ static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw)
+ {
+ 	rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
+index 75afa6253ad0..e64d377dfe9e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
+@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw,
+ void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw);
+ void rtl92c_phy_set_io(struct ieee80211_hw *hw);
+ void rtl92c_bb_block_on(struct ieee80211_hw *hw);
+-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
+ long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
+ 				  enum wireless_mode wirelessmode,
+ 				  u8 txpwridx);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..ce805388a46
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8192ce-using-calculate_bit_shift.patch
@@ -0,0 +1,68 @@
+From 5b92ce5d0eb4980f2eb7cdf7fd740d045dc992bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:34 +0800
+Subject: wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 3d03e8231031bcc65a48cd88ef9c71b6524ce70b ]
+
+Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-7-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +++---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 -
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
+index da54e51badd3..fa70a7d5539f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
+@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 							       rfpath, regaddr);
+ 	}
+ 
+-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_rf_serial_read(hw,
+ 								    rfpath,
+ 								    regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
+ 								       rfpath,
+ 								       regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
+index 7582a162bd11..c7a0d4c776f0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
+@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 			       u32 offset);
+ u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw,
+ 				  enum radio_path rfpath, u32 offset);
+-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
+ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 				 enum radio_path rfpath, u32 offset, u32 data);
+ void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..df4ba554cfd
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8192cu-using-calculate_bit_shift.patch
@@ -0,0 +1,55 @@
+From 3b0d875def1c2636c22e6ae54120f369ea6ec751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:33 +0800
+Subject: wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec ]
+
+Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
+And fix an undefined bitwise shift behavior problem.
+
+Fixes: f0a39ae738d6 ("rtlwifi: rtl8192cu: Add routine phy")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-6-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
+index a8d9fe269f31..0b8cb7e61fd8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
+@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 		original_value = _rtl92c_phy_fw_rf_serial_read(hw,
+ 							       rfpath, regaddr);
+ 	}
+-	bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
+@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_rf_serial_read(hw,
+ 								    rfpath,
+ 								    regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 			original_value = _rtl92c_phy_fw_rf_serial_read(hw,
+ 								       rfpath,
+ 								       regaddr);
+-			bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data =
+ 			    ((original_value & (~bitmask)) |
+ 			     (data << bitshift));
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..0279c4fcaa1
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8192de-using-calculate_bit_shift.patch
@@ -0,0 +1,78 @@
+From d8334748742eef53613d0966cbb418b860daec8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:35 +0800
+Subject: wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit b8b2baad2e652042cf8b6339939ac2f4e6f53de4 ]
+
+Using calculate_bit_shift() to replace _rtl92d_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: 7274a8c22980 ("rtlwifi: rtl8192de: Merge phy routines")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-8-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c  | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+index d18c092b6142..d835a27429f0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+@@ -169,13 +169,6 @@ static const u8 channel_all[59] = {
+ 	157, 159, 161, 163, 165
+ };
+ 
+-static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-
+ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -198,7 +191,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	} else {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+ 	}
+-	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"BBR MASK=0x%x Addr[0x%x]=0x%x\n",
+@@ -230,7 +223,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw,
+ 					dbi_direct);
+ 		else
+ 			originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 	if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob)
+@@ -317,7 +310,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 		regaddr, rfpath, bitmask);
+ 	spin_lock(&rtlpriv->locks.rf_lock);
+ 	original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr);
+-	bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -343,7 +336,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 		if (bitmask != RFREG_OFFSET_MASK) {
+ 			original_value = _rtl92d_phy_rf_serial_read(hw,
+ 				rfpath, regaddr);
+-			bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
++			bitshift = calculate_bit_shift(bitmask);
+ 			data = ((original_value & (~bitmask)) |
+ 				(data << bitshift));
+ 		}
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..8b09deff687
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8192ee-using-calculate_bit_shift.patch
@@ -0,0 +1,86 @@
+From e0215a58993274c5b0c9c02bd42a2cd174cc4784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:36 +0800
+Subject: wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit 63526897fc0d086069bcab67c3a112caaec751cb ]
+
+Using calculate_bit_shift() to replace _rtl92ee_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: b1a3bfc97cd9 ("rtlwifi: rtl8192ee: Move driver from staging to the regular tree")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-9-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
+index cc0bcaf13e96..73ef602bfb01 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
+@@ -16,7 +16,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw,
+ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 					 enum radio_path rfpath, u32 offset,
+ 					 u32 data);
+-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask);
+ static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw);
+ static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
+ static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw,
+@@ -46,7 +45,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+ 		"regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
+@@ -68,7 +67,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -92,7 +91,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw,
+ 	spin_lock(&rtlpriv->locks.rf_lock);
+ 
+ 	original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr);
+-	bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -119,7 +118,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw,
+ 
+ 	if (bitmask != RFREG_OFFSET_MASK) {
+ 		original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr);
+-		bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = (original_value & (~bitmask)) | (data << bitshift);
+ 	}
+ 
+@@ -201,13 +200,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 		pphyreg->rf3wire_offset, data_and_addr);
+ }
+ 
+-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-
+ bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw)
+ {
+ 	return _rtl92ee_phy_config_mac_with_headerfile(hw);
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch b/queue-6.7/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
new file mode 100644
index 00000000000..74053b27a5a
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8192se-using-calculate_bit_shift.patch
@@ -0,0 +1,78 @@
+From f1fd1e7b430e3650da8b8ece564caa2ccb6af98d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Dec 2023 14:57:37 +0800
+Subject: wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit ac32b9317063b101a8ff3d3e885f76f87a280419 ]
+
+Using calculate_bit_shift() to replace _rtl92s_phy_calculate_bit_shift().
+And fix the undefined bitwise shift behavior problem.
+
+Fixes: d15853163bea ("rtlwifi: rtl8192se: Merge phy routines")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://msgid.link/20231219065739.1895666-10-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/realtek/rtlwifi/rtl8192se/phy.c  | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+index 09591a0b5a81..d9ef7e1da1db 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+@@ -14,13 +14,6 @@
+ #include "hw.h"
+ #include "table.h"
+ 
+-static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask)
+-{
+-	u32 i = ffs(bitmask);
+-
+-	return i ? i - 1 : 32;
+-}
+-
+ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ {
+ 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -30,7 +23,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ 		regaddr, bitmask);
+ 
+ 	originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	returnvalue = (originalvalue & bitmask) >> bitshift;
+ 
+ 	rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
+@@ -52,7 +45,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
+ 
+ 	if (bitmask != MASKDWORD) {
+ 		originalvalue = rtl_read_dword(rtlpriv, regaddr);
+-		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((originalvalue & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+@@ -157,7 +150,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 
+ 	original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr);
+ 
+-	bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++	bitshift = calculate_bit_shift(bitmask);
+ 	readback_value = (original_value & bitmask) >> bitshift;
+ 
+ 	spin_unlock(&rtlpriv->locks.rf_lock);
+@@ -188,7 +181,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ 	if (bitmask != RFREG_OFFSET_MASK) {
+ 		original_value = _rtl92s_phy_rf_serial_read(hw, rfpath,
+ 							    regaddr);
+-		bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
++		bitshift = calculate_bit_shift(bitmask);
+ 		data = ((original_value & (~bitmask)) | (data << bitshift));
+ 	}
+ 
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch b/queue-6.7/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
new file mode 100644
index 00000000000..3260e396b55
--- /dev/null
+++ b/queue-6.7/wifi-rtlwifi-rtl8821ae-phy-fix-an-undefined-bitwise-.patch
@@ -0,0 +1,59 @@
+From 611d90e4d88810b5967bd3dad547846aabe7bcd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Nov 2023 09:35:13 +0800
+Subject: wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift
+ behavior
+
+From: Su Hui <suhui@nfschina.com>
+
+[ Upstream commit bc8263083af60e7e57c6120edbc1f75d6c909a35 ]
+
+Clang static checker warns:
+
+drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:184:49:
+	The result of the left shift is undefined due to shifting by '32',
+	which is greater or equal to the width of type 'u32'.
+	[core.UndefinedBinaryOperatorResult]
+
+If the value of the right operand is negative or is greater than or
+equal to the width of the promoted left operand, the behavior is
+undefined.[1][2]
+
+For example, when using different gcc's compilation optimization options
+(-O0 or -O2), the result of '(u32)data << 32' is different. One is 0, the
+other is old value of data. Let _rtl8821ae_phy_calculate_bit_shift()'s
+return value less than 32 to fix this problem. Warn if bitmask is zero.
+
+[1] https://stackoverflow.com/questions/11270492/what-does-the-c-standard-say-about-bitshifting-more-bits-than-the-width-of-type
+[2] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf
+
+Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree")
+Signed-off-by: Su Hui <suhui@nfschina.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231127013511.26694-2-suhui@nfschina.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+index 5323ead30db0..fa1839d8ee55 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw,
+ 					   u32 data);
+ static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask)
+ {
+-	u32 i = ffs(bitmask);
++	if (WARN_ON_ONCE(!bitmask))
++		return 0;
+ 
+-	return i ? i - 1 : 32;
++	return __ffs(bitmask);
+ }
+ static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw);
+ /*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch b/queue-6.7/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
new file mode 100644
index 00000000000..2b290084194
--- /dev/null
+++ b/queue-6.7/wifi-rtw88-fix-rx-filter-in-fif_allmulti-flag.patch
@@ -0,0 +1,42 @@
+From 5930f44bc352530e56d3db91840a6c7c5d29d764 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Nov 2023 10:08:51 +0800
+Subject: wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
+
+From: Chih-Kang Chang <gary.chang@realtek.com>
+
+[ Upstream commit 53ee0b3b99edc6a47096bffef15695f5a895386f ]
+
+The broadcast packets will be filtered in the FIF_ALLMULTI flag in
+the original code, which causes beacon packets to be filtered out
+and disconnection. Therefore, we fix it.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231103020851.102238-1-pkshih@realtek.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
+index a99b53d44267..d8d68f16014e 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
++++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
+@@ -280,9 +280,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw,
+ 
+ 	if (changed_flags & FIF_ALLMULTI) {
+ 		if (*new_flags & FIF_ALLMULTI)
+-			rtwdev->hal.rcr |= BIT_AM | BIT_AB;
++			rtwdev->hal.rcr |= BIT_AM;
+ 		else
+-			rtwdev->hal.rcr &= ~(BIT_AM | BIT_AB);
++			rtwdev->hal.rcr &= ~(BIT_AM);
+ 	}
+ 	if (changed_flags & FIF_FCSFAIL) {
+ 		if (*new_flags & FIF_FCSFAIL)
+-- 
+2.43.0
+
diff --git a/queue-6.7/wifi-rtw88-sdio-honor-the-host-max_req_size-in-the-r.patch b/queue-6.7/wifi-rtw88-sdio-honor-the-host-max_req_size-in-the-r.patch
new file mode 100644
index 00000000000..fab59936322
--- /dev/null
+++ b/queue-6.7/wifi-rtw88-sdio-honor-the-host-max_req_size-in-the-r.patch
@@ -0,0 +1,119 @@
+From e2f0ed06c679a6fb58896870240aab600efca964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Nov 2023 12:57:26 +0100
+Subject: wifi: rtw88: sdio: Honor the host max_req_size in the RX path
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 00384f565a91c08c4bedae167f749b093d10e3fe ]
+
+Lukas reports skb_over_panic errors on his Banana Pi BPI-CM4 which comes
+with an Amlogic A311D (G12B) SoC and a RTL8822CS SDIO wifi/Bluetooth
+combo card. The error he observed is identical to what has been fixed
+in commit e967229ead0e ("wifi: rtw88: sdio: Check the HISR RX_REQUEST
+bit in rtw_sdio_rx_isr()") but that commit didn't fix Lukas' problem.
+
+Lukas found that disabling or limiting RX aggregation works around the
+problem for some time (but does not fully fix it). In the following
+discussion a few key topics have been discussed which have an impact on
+this problem:
+- The Amlogic A311D (G12B) SoC has a hardware bug in the SDIO controller
+  which prevents DMA transfers. Instead all transfers need to go through
+  the controller SRAM which limits transfers to 1536 bytes
+- rtw88 chips don't split incoming (RX) packets, so if a big packet is
+  received this is forwarded to the host in it's original form
+- rtw88 chips can do RX aggregation, meaning more multiple incoming
+  packets can be pulled by the host from the card with one MMC/SDIO
+  transfer. This Depends on settings in the REG_RXDMA_AGG_PG_TH
+  register (BIT_RXDMA_AGG_PG_TH limits the number of packets that will
+  be aggregated, BIT_DMA_AGG_TO_V1 configures a timeout for aggregation
+  and BIT_EN_PRE_CALC makes the chip honor the limits more effectively)
+
+Use multiple consecutive reads in rtw_sdio_read_port() and limit the
+number of bytes which are copied by the host from the card in one
+MMC/SDIO transfer. This allows receiving a buffer that's larger than
+the hosts max_req_size (number of bytes which can be transferred in
+one MMC/SDIO transfer). As a result of this the skb_over_panic error
+is gone as the rtw88 driver is now able to receive more than 1536 bytes
+from the card (either because the incoming packet is larger than that
+or because multiple packets have been aggregated).
+
+In case of an receive errors (-EILSEQ has been observed by Lukas) we
+need to drain the remaining data from the card's buffer, otherwise the
+card will return corrupt data for the next rtw_sdio_read_port() call.
+
+Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO based chipsets")
+Reported-by: Lukas F. Hartmann <lukas@mntre.com>
+Closes: https://lore.kernel.org/linux-wireless/CAFBinCBaXtebixKbjkWKW_WXc5k=NdGNaGUjVE8NCPNxOhsb2g@mail.gmail.com/
+Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Lukas F. Hartmann <lukas@mntre.com>
+Reported-by: Lukas F. Hartmann <lukas@mntre.com>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Tested-by: Lukas F. Hartmann <lukas@mntre.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231120115726.1569323-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/sdio.c | 35 ++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c
+index 2c1fb2dabd40..0cae5746f540 100644
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -500,19 +500,40 @@ static u32 rtw_sdio_get_tx_addr(struct rtw_dev *rtwdev, size_t size,
+ static int rtw_sdio_read_port(struct rtw_dev *rtwdev, u8 *buf, size_t count)
+ {
+ 	struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv;
++	struct mmc_host *host = rtwsdio->sdio_func->card->host;
+ 	bool bus_claim = rtw_sdio_bus_claim_needed(rtwsdio);
+ 	u32 rxaddr = rtwsdio->rx_addr++;
+-	int ret;
++	int ret = 0, err;
++	size_t bytes;
+ 
+ 	if (bus_claim)
+ 		sdio_claim_host(rtwsdio->sdio_func);
+ 
+-	ret = sdio_memcpy_fromio(rtwsdio->sdio_func, buf,
+-				 RTW_SDIO_ADDR_RX_RX0FF_GEN(rxaddr), count);
+-	if (ret)
+-		rtw_warn(rtwdev,
+-			 "Failed to read %zu byte(s) from SDIO port 0x%08x",
+-			 count, rxaddr);
++	while (count > 0) {
++		bytes = min_t(size_t, host->max_req_size, count);
++
++		err = sdio_memcpy_fromio(rtwsdio->sdio_func, buf,
++					 RTW_SDIO_ADDR_RX_RX0FF_GEN(rxaddr),
++					 bytes);
++		if (err) {
++			rtw_warn(rtwdev,
++				 "Failed to read %zu byte(s) from SDIO port 0x%08x: %d",
++				 bytes, rxaddr, err);
++
++			 /* Signal to the caller that reading did not work and
++			  * that the data in the buffer is short/corrupted.
++			  */
++			ret = err;
++
++			/* Don't stop here - instead drain the remaining data
++			 * from the card's buffer, else the card will return
++			 * corrupt data for the next rtw_sdio_read_port() call.
++			 */
++		}
++
++		count -= bytes;
++		buf += bytes;
++	}
+ 
+ 	if (bus_claim)
+ 		sdio_release_host(rtwsdio->sdio_func);
+-- 
+2.43.0
+
diff --git a/queue-6.7/x86-fix-cpuidle_flag_irq_enable-leaking-timer-reprog.patch b/queue-6.7/x86-fix-cpuidle_flag_irq_enable-leaking-timer-reprog.patch
new file mode 100644
index 00000000000..a8bd097324a
--- /dev/null
+++ b/queue-6.7/x86-fix-cpuidle_flag_irq_enable-leaking-timer-reprog.patch
@@ -0,0 +1,121 @@
+From a2935f9d4b4d86c6e5f78b50ce5b511c9a1d8871 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Nov 2023 10:13:23 -0500
+Subject: x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit edc8fc01f608108b0b7580cb2c29dfb5135e5f0e ]
+
+intel_idle_irq() re-enables IRQs very early. As a result, an interrupt
+may fire before mwait() is eventually called. If such an interrupt queues
+a timer, it may go unnoticed until mwait returns and the idle loop
+handles the tick re-evaluation. And monitoring TIF_NEED_RESCHED doesn't
+help because a local timer enqueue doesn't set that flag.
+
+The issue is mitigated by the fact that this idle handler is only invoked
+for shallow C-states when, presumably, the next tick is supposed to be
+close enough. There may still be rare cases though when the next tick
+is far away and the selected C-state is shallow, resulting in a timer
+getting ignored for a while.
+
+Fix this with using sti_mwait() whose IRQ-reenablement only triggers
+upon calling mwait(), dealing with the race while keeping the interrupt
+latency within acceptable bounds.
+
+Fixes: c227233ad64c (intel_idle: enable interrupts before C1 on Xeons)
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+Link: https://lkml.kernel.org/r/20231115151325.6262-3-frederic@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/mwait.h | 11 +++++++++--
+ drivers/idle/intel_idle.c    | 19 +++++++------------
+ 2 files changed, 16 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
+index 778df05f8539..bae83810505b 100644
+--- a/arch/x86/include/asm/mwait.h
++++ b/arch/x86/include/asm/mwait.h
+@@ -115,8 +115,15 @@ static __always_inline void mwait_idle_with_hints(unsigned long eax, unsigned lo
+ 		}
+ 
+ 		__monitor((void *)&current_thread_info()->flags, 0, 0);
+-		if (!need_resched())
+-			__mwait(eax, ecx);
++
++		if (!need_resched()) {
++			if (ecx & 1) {
++				__mwait(eax, ecx);
++			} else {
++				__sti_mwait(eax, ecx);
++				raw_local_irq_disable();
++			}
++		}
+ 	}
+ 	current_clr_polling();
+ }
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index dcda0afecfc5..3e01a6b23e75 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -131,11 +131,12 @@ static unsigned int mwait_substates __initdata;
+ #define MWAIT2flg(eax) ((eax & 0xFF) << 24)
+ 
+ static __always_inline int __intel_idle(struct cpuidle_device *dev,
+-					struct cpuidle_driver *drv, int index)
++					struct cpuidle_driver *drv,
++					int index, bool irqoff)
+ {
+ 	struct cpuidle_state *state = &drv->states[index];
+ 	unsigned long eax = flg2MWAIT(state->flags);
+-	unsigned long ecx = 1; /* break on interrupt flag */
++	unsigned long ecx = 1*irqoff; /* break on interrupt flag */
+ 
+ 	mwait_idle_with_hints(eax, ecx);
+ 
+@@ -159,19 +160,13 @@ static __always_inline int __intel_idle(struct cpuidle_device *dev,
+ static __cpuidle int intel_idle(struct cpuidle_device *dev,
+ 				struct cpuidle_driver *drv, int index)
+ {
+-	return __intel_idle(dev, drv, index);
++	return __intel_idle(dev, drv, index, true);
+ }
+ 
+ static __cpuidle int intel_idle_irq(struct cpuidle_device *dev,
+ 				    struct cpuidle_driver *drv, int index)
+ {
+-	int ret;
+-
+-	raw_local_irq_enable();
+-	ret = __intel_idle(dev, drv, index);
+-	raw_local_irq_disable();
+-
+-	return ret;
++	return __intel_idle(dev, drv, index, false);
+ }
+ 
+ static __cpuidle int intel_idle_ibrs(struct cpuidle_device *dev,
+@@ -184,7 +179,7 @@ static __cpuidle int intel_idle_ibrs(struct cpuidle_device *dev,
+ 	if (smt_active)
+ 		__update_spec_ctrl(0);
+ 
+-	ret = __intel_idle(dev, drv, index);
++	ret = __intel_idle(dev, drv, index, true);
+ 
+ 	if (smt_active)
+ 		__update_spec_ctrl(spec_ctrl);
+@@ -196,7 +191,7 @@ static __cpuidle int intel_idle_xstate(struct cpuidle_device *dev,
+ 				       struct cpuidle_driver *drv, int index)
+ {
+ 	fpu_idle_fpregs();
+-	return __intel_idle(dev, drv, index);
++	return __intel_idle(dev, drv, index, true);
+ }
+ 
+ /**
+-- 
+2.43.0
+
diff --git a/queue-6.7/x86-lib-fix-overflow-when-counting-digits.patch b/queue-6.7/x86-lib-fix-overflow-when-counting-digits.patch
new file mode 100644
index 00000000000..216127fab48
--- /dev/null
+++ b/queue-6.7/x86-lib-fix-overflow-when-counting-digits.patch
@@ -0,0 +1,66 @@
+From 548ff0f18e11f7cad782e3f35e688178ec5cfb6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Nov 2023 17:49:01 +0000
+Subject: x86/lib: Fix overflow when counting digits
+
+From: Colin Ian King <colin.i.king@gmail.com>
+
+[ Upstream commit a24d61c609813963aacc9f6ec8343f4fcaac7243 ]
+
+tl;dr: The num_digits() function has a theoretical overflow issue.
+But it doesn't affect any actual in-tree users.  Fix it by using
+a larger type for one of the local variables.
+
+Long version:
+
+There is an overflow in variable m in function num_digits when val
+is >= 1410065408 which leads to the digit calculation loop to
+iterate more times than required. This results in either more
+digits being counted or in some cases (for example where val is
+1932683193) the value of m eventually overflows to zero and the
+while loop spins forever).
+
+Currently the function num_digits is currently only being used for
+small values of val in the SMP boot stage for digit counting on the
+number of cpus and NUMA nodes, so the overflow is never encountered.
+However it is useful to fix the overflow issue in case the function
+is used for other purposes in the future. (The issue was discovered
+while investigating the digit counting performance in various
+kernel helper functions rather than any real-world use-case).
+
+The simplest fix is to make m a long long, the overhead in
+multiplication speed for a long long is very minor for small values
+of val less than 10000 on modern processors. The alternative
+fix is to replace the multiplication with a constant division
+by 10 loop (this compiles down to an multiplication and shift)
+without needing to make m a long long, but this is slightly slower
+than the fix in this commit when measured on a range of x86
+processors).
+
+[ dhansen: subject and changelog tweaks ]
+
+Fixes: 646e29a1789a ("x86: Improve the printout of the SMP bootup CPU table")
+Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lore.kernel.org/all/20231102174901.2590325-1-colin.i.king%40gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/misc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/lib/misc.c b/arch/x86/lib/misc.c
+index 92cd8ecc3a2c..40b81c338ae5 100644
+--- a/arch/x86/lib/misc.c
++++ b/arch/x86/lib/misc.c
+@@ -8,7 +8,7 @@
+  */
+ int num_digits(int val)
+ {
+-	int m = 10;
++	long long m = 10;
+ 	int d = 1;
+ 
+ 	if (val < 0) {
+-- 
+2.43.0
+
diff --git a/queue-6.7/x86-mce-inject-clear-test-status-value.patch b/queue-6.7/x86-mce-inject-clear-test-status-value.patch
new file mode 100644
index 00000000000..ade52802af4
--- /dev/null
+++ b/queue-6.7/x86-mce-inject-clear-test-status-value.patch
@@ -0,0 +1,57 @@
+From 2cbaafe227f97af0c5a05259934eae4a048d8cb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Nov 2023 13:32:29 -0600
+Subject: x86/mce/inject: Clear test status value
+
+From: Yazen Ghannam <yazen.ghannam@amd.com>
+
+[ Upstream commit 6175b407756b22e7fdc771181b7d832ebdedef5c ]
+
+AMD systems generally allow MCA "simulation" where MCA registers can be
+written with valid data and the full MCA handling flow can be tested by
+software.
+
+However, the platform on Scalable MCA systems, can prevent software from
+writing data to the MCA registers. There is no architectural way to
+determine this configuration. Therefore, the MCE injection module will
+check for this behavior by writing and reading back a test status value.
+This is done during module init, and the check can run on any CPU with
+any valid MCA bank.
+
+If MCA_STATUS writes are ignored by the platform, then there are no side
+effects on the hardware state.
+
+If the writes are not ignored, then the test status value will remain in
+the hardware MCA_STATUS register. It is likely that the value will not
+be overwritten by hardware or software, since the tested CPU and bank
+are arbitrary. Therefore, the user may see a spurious, synthetic MCA
+error reported whenever MCA is polled for this CPU.
+
+Clear the test value immediately after writing it. It is very unlikely
+that a valid MCA error is logged by hardware during the test. Errors
+that cause an #MC won't be affected.
+
+Fixes: 891e465a1bd8 ("x86/mce: Check whether writes to MCA_STATUS are getting ignored")
+Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20231118193248.1296798-2-yazen.ghannam@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mce/inject.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c
+index 4d8d4bcf915d..72f0695c3dc1 100644
+--- a/arch/x86/kernel/cpu/mce/inject.c
++++ b/arch/x86/kernel/cpu/mce/inject.c
+@@ -746,6 +746,7 @@ static void check_hw_inj_possible(void)
+ 
+ 		wrmsrl_safe(mca_msr_reg(bank, MCA_STATUS), status);
+ 		rdmsrl_safe(mca_msr_reg(bank, MCA_STATUS), &status);
++		wrmsrl_safe(mca_msr_reg(bank, MCA_STATUS), 0);
+ 
+ 		if (!status) {
+ 			hw_injection_possible = false;
+-- 
+2.43.0
+
diff --git a/queue-6.7/x86-microcode-intel-set-new-revision-only-after-a-su.patch b/queue-6.7/x86-microcode-intel-set-new-revision-only-after-a-su.patch
new file mode 100644
index 00000000000..a684a72862b
--- /dev/null
+++ b/queue-6.7/x86-microcode-intel-set-new-revision-only-after-a-su.patch
@@ -0,0 +1,68 @@
+From 950e399037b1c3edaece6e697801ddd1b753b63c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Dec 2023 14:35:06 +0100
+Subject: x86/microcode/intel: Set new revision only after a successful update
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+[ Upstream commit 9c21ea53e6bd1104c637b80a0688040f184cc761 ]
+
+This was meant to be done only when early microcode got updated
+successfully. Move it into the if-branch.
+
+Also, make sure the current revision is read unconditionally and only
+once.
+
+Fixes: 080990aa3344 ("x86/microcode: Rework early revisions reporting")
+Reported-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Tested-by: Ashok Raj <ashok.raj@intel.com>
+Link: https://lore.kernel.org/r/ZWjVt5dNRjbcvlzR@a4bf019067fa.jf.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/microcode/intel.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
+index 070426b9895f..334972c097d9 100644
+--- a/arch/x86/kernel/cpu/microcode/intel.c
++++ b/arch/x86/kernel/cpu/microcode/intel.c
+@@ -370,14 +370,14 @@ static __init struct microcode_intel *get_microcode_blob(struct ucode_cpu_info *
+ {
+ 	struct cpio_data cp;
+ 
++	intel_collect_cpu_info(&uci->cpu_sig);
++
+ 	if (!load_builtin_intel_microcode(&cp))
+ 		cp = find_microcode_in_initrd(ucode_path);
+ 
+ 	if (!(cp.data && cp.size))
+ 		return NULL;
+ 
+-	intel_collect_cpu_info(&uci->cpu_sig);
+-
+ 	return scan_microcode(cp.data, cp.size, uci, save);
+ }
+ 
+@@ -410,13 +410,13 @@ void __init load_ucode_intel_bsp(struct early_load_data *ed)
+ {
+ 	struct ucode_cpu_info uci;
+ 
+-	ed->old_rev = intel_get_microcode_revision();
+-
+ 	uci.mc = get_microcode_blob(&uci, false);
+-	if (uci.mc && apply_microcode_early(&uci) == UCODE_UPDATED)
+-		ucode_patch_va = UCODE_BSP_LOADED;
++	ed->old_rev = uci.cpu_sig.rev;
+ 
+-	ed->new_rev = uci.cpu_sig.rev;
++	if (uci.mc && apply_microcode_early(&uci) == UCODE_UPDATED) {
++		ucode_patch_va = UCODE_BSP_LOADED;
++		ed->new_rev = uci.cpu_sig.rev;
++	}
+ }
+ 
+ void load_ucode_intel_ap(void)
+-- 
+2.43.0
+
-- 
2.47.3