--- /dev/null
+From stable+bounces-242629-greg=kroah.com@vger.kernel.org Sun May 3 02:40:18 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 May 2026 20:40:01 -0400
+Subject: iio: frequency: admv1013: add dev variable
+To: stable@vger.kernel.org
+Cc: Antoniu Miclaus <antoniu.miclaus@analog.com>, Andy Shevchenko <andriy.shevchenko@intel.com>, Jonathan Cameron <Jonathan.Cameron@huawei.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260503004002.933311-1-sashal@kernel.org>
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+[ Upstream commit e61b5bb0e91390adee41eaddc0a1a7d55d5652b2 ]
+
+Introduce a local struct device pointer in functions that reference
+&spi->dev for device-managed resource calls and device property reads,
+improving code readability.
+
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: aac0a51b1670 ("iio: frequency: admv1013: fix NULL pointer dereference on str")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/frequency/admv1013.c | 29 +++++++++++++++--------------
+ 1 file changed, 15 insertions(+), 14 deletions(-)
+
+--- a/drivers/iio/frequency/admv1013.c
++++ b/drivers/iio/frequency/admv1013.c
+@@ -518,11 +518,11 @@ static int admv1013_properties_parse(str
+ {
+ int ret;
+ const char *str;
+- struct spi_device *spi = st->spi;
++ struct device *dev = &st->spi->dev;
+
+- st->det_en = device_property_read_bool(&spi->dev, "adi,detector-enable");
++ st->det_en = device_property_read_bool(dev, "adi,detector-enable");
+
+- ret = device_property_read_string(&spi->dev, "adi,input-mode", &str);
++ ret = device_property_read_string(dev, "adi,input-mode", &str);
+ if (ret)
+ st->input_mode = ADMV1013_IQ_MODE;
+
+@@ -533,7 +533,7 @@ static int admv1013_properties_parse(str
+ else
+ return -EINVAL;
+
+- ret = device_property_read_string(&spi->dev, "adi,quad-se-mode", &str);
++ ret = device_property_read_string(dev, "adi,quad-se-mode", &str);
+ if (ret)
+ st->quad_se_mode = ADMV1013_SE_MODE_DIFF;
+
+@@ -546,11 +546,11 @@ static int admv1013_properties_parse(str
+ else
+ return -EINVAL;
+
+- ret = devm_regulator_bulk_get_enable(&st->spi->dev,
++ ret = devm_regulator_bulk_get_enable(dev,
+ ARRAY_SIZE(admv1013_vcc_regs),
+ admv1013_vcc_regs);
+ if (ret) {
+- dev_err_probe(&spi->dev, ret,
++ dev_err_probe(dev, ret,
+ "Failed to request VCC regulators\n");
+ return ret;
+ }
+@@ -562,9 +562,10 @@ static int admv1013_probe(struct spi_dev
+ {
+ struct iio_dev *indio_dev;
+ struct admv1013_state *st;
++ struct device *dev = &spi->dev;
+ int ret, vcm_uv;
+
+- indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
++ indio_dev = devm_iio_device_alloc(dev, sizeof(*st));
+ if (!indio_dev)
+ return -ENOMEM;
+
+@@ -581,20 +582,20 @@ static int admv1013_probe(struct spi_dev
+ if (ret)
+ return ret;
+
+- ret = devm_regulator_get_enable_read_voltage(&spi->dev, "vcm");
++ ret = devm_regulator_get_enable_read_voltage(dev, "vcm");
+ if (ret < 0)
+- return dev_err_probe(&spi->dev, ret,
++ return dev_err_probe(dev, ret,
+ "failed to get the common-mode voltage\n");
+
+ vcm_uv = ret;
+
+- st->clkin = devm_clk_get_enabled(&spi->dev, "lo_in");
++ st->clkin = devm_clk_get_enabled(dev, "lo_in");
+ if (IS_ERR(st->clkin))
+- return dev_err_probe(&spi->dev, PTR_ERR(st->clkin),
++ return dev_err_probe(dev, PTR_ERR(st->clkin),
+ "failed to get the LO input clock\n");
+
+ st->nb.notifier_call = admv1013_freq_change;
+- ret = devm_clk_notifier_register(&spi->dev, st->clkin, &st->nb);
++ ret = devm_clk_notifier_register(dev, st->clkin, &st->nb);
+ if (ret)
+ return ret;
+
+@@ -606,11 +607,11 @@ static int admv1013_probe(struct spi_dev
+ return ret;
+ }
+
+- ret = devm_add_action_or_reset(&spi->dev, admv1013_powerdown, st);
++ ret = devm_add_action_or_reset(dev, admv1013_powerdown, st);
+ if (ret)
+ return ret;
+
+- return devm_iio_device_register(&spi->dev, indio_dev);
++ return devm_iio_device_register(dev, indio_dev);
+ }
+
+ static const struct spi_device_id admv1013_id[] = {
--- /dev/null
+From stable+bounces-242631-greg=kroah.com@vger.kernel.org Sun May 3 02:40:26 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 May 2026 20:40:02 -0400
+Subject: iio: frequency: admv1013: fix NULL pointer dereference on str
+To: stable@vger.kernel.org
+Cc: "Antoniu Miclaus" <antoniu.miclaus@analog.com>, "Nuno Sá" <nuno.sa@analog.com>, "Andy Shevchenko" <andriy.shevchenko@intel.com>, Stable@vger.kernel.org, "Jonathan Cameron" <Jonathan.Cameron@huawei.com>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20260503004002.933311-2-sashal@kernel.org>
+
+From: Antoniu Miclaus <antoniu.miclaus@analog.com>
+
+[ Upstream commit aac0a51b16700b403a55b67ba495de021db78763 ]
+
+When device_property_read_string() fails, str is left uninitialized
+but the code falls through to strcmp(str, ...), dereferencing a garbage
+pointer. Replace manual read/strcmp with
+device_property_match_property_string() and consolidate the SE mode
+enums into a single sequential enum, mapping to hardware register
+values via a switch consistent with other bitfields in the driver.
+
+Several cleanup patches have been applied to this driver recently so
+this will need a manual backport.
+
+Fixes: da35a7b526d9 ("iio: frequency: admv1013: add support for ADMV1013")
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/frequency/admv1013.c | 67 ++++++++++++++++++++++-----------------
+ 1 file changed, 38 insertions(+), 29 deletions(-)
+
+--- a/drivers/iio/frequency/admv1013.c
++++ b/drivers/iio/frequency/admv1013.c
+@@ -85,9 +85,9 @@ enum {
+ };
+
+ enum {
+- ADMV1013_SE_MODE_POS = 6,
+- ADMV1013_SE_MODE_NEG = 9,
+- ADMV1013_SE_MODE_DIFF = 12
++ ADMV1013_SE_MODE_POS,
++ ADMV1013_SE_MODE_NEG,
++ ADMV1013_SE_MODE_DIFF,
+ };
+
+ struct admv1013_state {
+@@ -470,10 +470,23 @@ static int admv1013_init(struct admv1013
+ if (ret)
+ return ret;
+
+- data = FIELD_PREP(ADMV1013_QUAD_SE_MODE_MSK, st->quad_se_mode);
++ switch (st->quad_se_mode) {
++ case ADMV1013_SE_MODE_POS:
++ data = 6;
++ break;
++ case ADMV1013_SE_MODE_NEG:
++ data = 9;
++ break;
++ case ADMV1013_SE_MODE_DIFF:
++ data = 12;
++ break;
++ default:
++ return -EINVAL;
++ }
+
+ ret = __admv1013_spi_update_bits(st, ADMV1013_REG_QUAD,
+- ADMV1013_QUAD_SE_MODE_MSK, data);
++ ADMV1013_QUAD_SE_MODE_MSK,
++ FIELD_PREP(ADMV1013_QUAD_SE_MODE_MSK, data));
+ if (ret)
+ return ret;
+
+@@ -514,37 +527,33 @@ static void admv1013_powerdown(void *dat
+ admv1013_spi_update_bits(data, ADMV1013_REG_ENABLE, enable_reg_msk, enable_reg);
+ }
+
++static const char * const admv1013_input_modes[] = {
++ [ADMV1013_IQ_MODE] = "iq",
++ [ADMV1013_IF_MODE] = "if",
++};
++
++static const char * const admv1013_quad_se_modes[] = {
++ [ADMV1013_SE_MODE_POS] = "se-pos",
++ [ADMV1013_SE_MODE_NEG] = "se-neg",
++ [ADMV1013_SE_MODE_DIFF] = "diff",
++};
++
+ static int admv1013_properties_parse(struct admv1013_state *st)
+ {
+ int ret;
+- const char *str;
+ struct device *dev = &st->spi->dev;
+
+ st->det_en = device_property_read_bool(dev, "adi,detector-enable");
+
+- ret = device_property_read_string(dev, "adi,input-mode", &str);
+- if (ret)
+- st->input_mode = ADMV1013_IQ_MODE;
+-
+- if (!strcmp(str, "iq"))
+- st->input_mode = ADMV1013_IQ_MODE;
+- else if (!strcmp(str, "if"))
+- st->input_mode = ADMV1013_IF_MODE;
+- else
+- return -EINVAL;
+-
+- ret = device_property_read_string(dev, "adi,quad-se-mode", &str);
+- if (ret)
+- st->quad_se_mode = ADMV1013_SE_MODE_DIFF;
+-
+- if (!strcmp(str, "diff"))
+- st->quad_se_mode = ADMV1013_SE_MODE_DIFF;
+- else if (!strcmp(str, "se-pos"))
+- st->quad_se_mode = ADMV1013_SE_MODE_POS;
+- else if (!strcmp(str, "se-neg"))
+- st->quad_se_mode = ADMV1013_SE_MODE_NEG;
+- else
+- return -EINVAL;
++ ret = device_property_match_property_string(dev, "adi,input-mode",
++ admv1013_input_modes,
++ ARRAY_SIZE(admv1013_input_modes));
++ st->input_mode = ret >= 0 ? ret : ADMV1013_IQ_MODE;
++
++ ret = device_property_match_property_string(dev, "adi,quad-se-mode",
++ admv1013_quad_se_modes,
++ ARRAY_SIZE(admv1013_quad_se_modes));
++ st->quad_se_mode = ret >= 0 ? ret : ADMV1013_SE_MODE_DIFF;
+
+ ret = devm_regulator_bulk_get_enable(dev,
+ ARRAY_SIZE(admv1013_vcc_regs),
--- /dev/null
+From sashal@kernel.org Tue Apr 28 11:37:33 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Apr 2026 05:37:29 -0400
+Subject: mei: me: add nova lake point H DID
+To: stable@vger.kernel.org
+Cc: Alexander Usyskin <alexander.usyskin@intel.com>, stable <stable@kernel.org>, Tomas Winkler <tomasw@gmail.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260428093729.2692325-2-sashal@kernel.org>
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+[ Upstream commit a5a1804332afc7035d5c5b880548262e81d796bc ]
+
+Add Nova Lake H device id.
+
+Cc: stable <stable@kernel.org>
+Co-developed-by: Tomas Winkler <tomasw@gmail.com>
+Signed-off-by: Tomas Winkler <tomasw@gmail.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Link: https://patch.msgid.link/20260405141758.1634556-1-alexander.usyskin@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hw-me-regs.h | 1 +
+ drivers/misc/mei/pci-me.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -123,6 +123,7 @@
+ #define PCI_DEVICE_ID_INTEL_MEI_WCL_P 0x4D70 /* Wildcat Lake P */
+
+ #define PCI_DEVICE_ID_INTEL_MEI_NVL_S 0x6E68 /* Nova Lake Point S */
++#define PCI_DEVICE_ID_INTEL_MEI_NVL_H 0xD370 /* Nova Lake Point H */
+
+ /*
+ * MEI HW Section
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -130,6 +130,7 @@ static const struct pci_device_id mei_me
+ {PCI_DEVICE_DATA(INTEL, MEI_WCL_P, MEI_ME_PCH15_CFG)},
+
+ {PCI_DEVICE_DATA(INTEL, MEI_NVL_S, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_NVL_H, MEI_ME_PCH15_CFG)},
+
+ /* required last entry */
+ {0, }
--- /dev/null
+From sashal@kernel.org Tue Apr 28 11:37:32 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Apr 2026 05:37:28 -0400
+Subject: mei: me: use PCI_DEVICE_DATA macro
+To: stable@vger.kernel.org
+Cc: Alexander Usyskin <alexander.usyskin@intel.com>, Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260428093729.2692325-1-sashal@kernel.org>
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+[ Upstream commit 9e7a2409ecf4d411b7cc91615b08f6a7576f0aaa ]
+
+Drop old local MEI_PCI_DEVICE macro and use common
+PCI_DEVICE_DATA instead.
+Update defines to adhere to current naming convention.
+
+Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Link: https://patch.msgid.link/20260201094358.1440593-2-alexander.usyskin@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: a5a1804332af ("mei: me: add nova lake point H DID")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/bus-fixup.c | 6 -
+ drivers/misc/mei/hw-me-regs.h | 162 +++++++++++++++++-----------------
+ drivers/misc/mei/hw-me.h | 6 -
+ drivers/misc/mei/pci-me.c | 200 +++++++++++++++++++++---------------------
+ 4 files changed, 184 insertions(+), 190 deletions(-)
+
+--- a/drivers/misc/mei/bus-fixup.c
++++ b/drivers/misc/mei/bus-fixup.c
+@@ -303,9 +303,9 @@ static void mei_wd(struct mei_cl_device
+ {
+ struct pci_dev *pdev = to_pci_dev(cldev->dev.parent);
+
+- if (pdev->device == MEI_DEV_ID_WPT_LP ||
+- pdev->device == MEI_DEV_ID_SPT ||
+- pdev->device == MEI_DEV_ID_SPT_H)
++ if (pdev->device == PCI_DEVICE_ID_INTEL_MEI_WPT_LP ||
++ pdev->device == PCI_DEVICE_ID_INTEL_MEI_SPT ||
++ pdev->device == PCI_DEVICE_ID_INTEL_MEI_SPT_H)
+ cldev->me_cl->props.protocol_version = 0x2;
+
+ cldev->do_match = 1;
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -9,120 +9,120 @@
+ /*
+ * MEI device IDs
+ */
+-#define MEI_DEV_ID_82946GZ 0x2974 /* 82946GZ/GL */
+-#define MEI_DEV_ID_82G35 0x2984 /* 82G35 Express */
+-#define MEI_DEV_ID_82Q965 0x2994 /* 82Q963/Q965 */
+-#define MEI_DEV_ID_82G965 0x29A4 /* 82P965/G965 */
++#define PCI_DEVICE_ID_INTEL_MEI_82946GZ 0x2974 /* 82946GZ/GL */
++#define PCI_DEVICE_ID_INTEL_MEI_82G35 0x2984 /* 82G35 Express */
++#define PCI_DEVICE_ID_INTEL_MEI_82Q965 0x2994 /* 82Q963/Q965 */
++#define PCI_DEVICE_ID_INTEL_MEI_82G965 0x29A4 /* 82P965/G965 */
+
+-#define MEI_DEV_ID_82GM965 0x2A04 /* Mobile PM965/GM965 */
+-#define MEI_DEV_ID_82GME965 0x2A14 /* Mobile GME965/GLE960 */
++#define PCI_DEVICE_ID_INTEL_MEI_82GM965 0x2A04 /* Mobile PM965/GM965 */
++#define PCI_DEVICE_ID_INTEL_MEI_82GME965 0x2A14 /* Mobile GME965/GLE960 */
+
+-#define MEI_DEV_ID_ICH9_82Q35 0x29B4 /* 82Q35 Express */
+-#define MEI_DEV_ID_ICH9_82G33 0x29C4 /* 82G33/G31/P35/P31 Express */
+-#define MEI_DEV_ID_ICH9_82Q33 0x29D4 /* 82Q33 Express */
+-#define MEI_DEV_ID_ICH9_82X38 0x29E4 /* 82X38/X48 Express */
+-#define MEI_DEV_ID_ICH9_3200 0x29F4 /* 3200/3210 Server */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82Q35 0x29B4 /* 82Q35 Express */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82G33 0x29C4 /* 82G33/G31/P35/P31 Express */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82Q33 0x29D4 /* 82Q33 Express */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_82X38 0x29E4 /* 82X38/X48 Express */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_3200 0x29F4 /* 3200/3210 Server */
+
+-#define MEI_DEV_ID_ICH9_6 0x28B4 /* Bearlake */
+-#define MEI_DEV_ID_ICH9_7 0x28C4 /* Bearlake */
+-#define MEI_DEV_ID_ICH9_8 0x28D4 /* Bearlake */
+-#define MEI_DEV_ID_ICH9_9 0x28E4 /* Bearlake */
+-#define MEI_DEV_ID_ICH9_10 0x28F4 /* Bearlake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_6 0x28B4 /* Bearlake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_7 0x28C4 /* Bearlake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_8 0x28D4 /* Bearlake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_9 0x28E4 /* Bearlake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9_10 0x28F4 /* Bearlake */
+
+-#define MEI_DEV_ID_ICH9M_1 0x2A44 /* Cantiga */
+-#define MEI_DEV_ID_ICH9M_2 0x2A54 /* Cantiga */
+-#define MEI_DEV_ID_ICH9M_3 0x2A64 /* Cantiga */
+-#define MEI_DEV_ID_ICH9M_4 0x2A74 /* Cantiga */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_1 0x2A44 /* Cantiga */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_2 0x2A54 /* Cantiga */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_3 0x2A64 /* Cantiga */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH9M_4 0x2A74 /* Cantiga */
+
+-#define MEI_DEV_ID_ICH10_1 0x2E04 /* Eaglelake */
+-#define MEI_DEV_ID_ICH10_2 0x2E14 /* Eaglelake */
+-#define MEI_DEV_ID_ICH10_3 0x2E24 /* Eaglelake */
+-#define MEI_DEV_ID_ICH10_4 0x2E34 /* Eaglelake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_1 0x2E04 /* Eaglelake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_2 0x2E14 /* Eaglelake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_3 0x2E24 /* Eaglelake */
++#define PCI_DEVICE_ID_INTEL_MEI_ICH10_4 0x2E34 /* Eaglelake */
+
+-#define MEI_DEV_ID_IBXPK_1 0x3B64 /* Calpella */
+-#define MEI_DEV_ID_IBXPK_2 0x3B65 /* Calpella */
++#define PCI_DEVICE_ID_INTEL_MEI_IBXPK_1 0x3B64 /* Calpella */
++#define PCI_DEVICE_ID_INTEL_MEI_IBXPK_2 0x3B65 /* Calpella */
+
+-#define MEI_DEV_ID_CPT_1 0x1C3A /* Couger Point */
+-#define MEI_DEV_ID_PBG_1 0x1D3A /* C600/X79 Patsburg */
++#define PCI_DEVICE_ID_INTEL_MEI_CPT_1 0x1C3A /* Couger Point */
++#define PCI_DEVICE_ID_INTEL_MEI_PBG_1 0x1D3A /* C600/X79 Patsburg */
+
+-#define MEI_DEV_ID_PPT_1 0x1E3A /* Panther Point */
+-#define MEI_DEV_ID_PPT_2 0x1CBA /* Panther Point */
+-#define MEI_DEV_ID_PPT_3 0x1DBA /* Panther Point */
++#define PCI_DEVICE_ID_INTEL_MEI_PPT_1 0x1E3A /* Panther Point */
++#define PCI_DEVICE_ID_INTEL_MEI_PPT_2 0x1CBA /* Panther Point */
++#define PCI_DEVICE_ID_INTEL_MEI_PPT_3 0x1DBA /* Panther Point */
+
+-#define MEI_DEV_ID_LPT_H 0x8C3A /* Lynx Point H */
+-#define MEI_DEV_ID_LPT_W 0x8D3A /* Lynx Point - Wellsburg */
+-#define MEI_DEV_ID_LPT_LP 0x9C3A /* Lynx Point LP */
+-#define MEI_DEV_ID_LPT_HR 0x8CBA /* Lynx Point H Refresh */
++#define PCI_DEVICE_ID_INTEL_MEI_LPT_H 0x8C3A /* Lynx Point H */
++#define PCI_DEVICE_ID_INTEL_MEI_LPT_W 0x8D3A /* Lynx Point - Wellsburg */
++#define PCI_DEVICE_ID_INTEL_MEI_LPT_LP 0x9C3A /* Lynx Point LP */
++#define PCI_DEVICE_ID_INTEL_MEI_LPT_HR 0x8CBA /* Lynx Point H Refresh */
+
+-#define MEI_DEV_ID_WPT_LP 0x9CBA /* Wildcat Point LP */
+-#define MEI_DEV_ID_WPT_LP_2 0x9CBB /* Wildcat Point LP 2 */
++#define PCI_DEVICE_ID_INTEL_MEI_WPT_LP 0x9CBA /* Wildcat Point LP */
++#define PCI_DEVICE_ID_INTEL_MEI_WPT_LP_2 0x9CBB /* Wildcat Point LP 2 */
+
+-#define MEI_DEV_ID_SPT 0x9D3A /* Sunrise Point */
+-#define MEI_DEV_ID_SPT_2 0x9D3B /* Sunrise Point 2 */
+-#define MEI_DEV_ID_SPT_3 0x9D3E /* Sunrise Point 3 (iToutch) */
+-#define MEI_DEV_ID_SPT_H 0xA13A /* Sunrise Point H */
+-#define MEI_DEV_ID_SPT_H_2 0xA13B /* Sunrise Point H 2 */
++#define PCI_DEVICE_ID_INTEL_MEI_SPT 0x9D3A /* Sunrise Point */
++#define PCI_DEVICE_ID_INTEL_MEI_SPT_2 0x9D3B /* Sunrise Point 2 */
++#define PCI_DEVICE_ID_INTEL_MEI_SPT_3 0x9D3E /* Sunrise Point 3 (iToutch) */
++#define PCI_DEVICE_ID_INTEL_MEI_SPT_H 0xA13A /* Sunrise Point H */
++#define PCI_DEVICE_ID_INTEL_MEI_SPT_H_2 0xA13B /* Sunrise Point H 2 */
+
+-#define MEI_DEV_ID_LBG 0xA1BA /* Lewisburg (SPT) */
++#define PCI_DEVICE_ID_INTEL_MEI_LBG 0xA1BA /* Lewisburg (SPT) */
+
+-#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
+-#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
++#define PCI_DEVICE_ID_INTEL_MEI_BXT_M 0x1A9A /* Broxton M */
++#define PCI_DEVICE_ID_INTEL_MEI_APL_I 0x5A9A /* Apollo Lake I */
+
+-#define MEI_DEV_ID_DNV_IE 0x19E5 /* Denverton IE */
++#define PCI_DEVICE_ID_INTEL_MEI_DNV_IE 0x19E5 /* Denverton IE */
+
+-#define MEI_DEV_ID_GLK 0x319A /* Gemini Lake */
++#define PCI_DEVICE_ID_INTEL_MEI_GLK 0x319A /* Gemini Lake */
+
+-#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
+-#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
+-#define MEI_DEV_ID_KBP_3 0xA2BE /* Kaby Point 3 (iTouch) */
++#define PCI_DEVICE_ID_INTEL_MEI_KBP 0xA2BA /* Kaby Point */
++#define PCI_DEVICE_ID_INTEL_MEI_KBP_2 0xA2BB /* Kaby Point 2 */
++#define PCI_DEVICE_ID_INTEL_MEI_KBP_3 0xA2BE /* Kaby Point 3 (iTouch) */
+
+-#define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */
+-#define MEI_DEV_ID_CNP_LP_3 0x9DE4 /* Cannon Point LP 3 (iTouch) */
+-#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
+-#define MEI_DEV_ID_CNP_H_3 0xA364 /* Cannon Point H 3 (iTouch) */
++#define PCI_DEVICE_ID_INTEL_MEI_CNP_LP 0x9DE0 /* Cannon Point LP */
++#define PCI_DEVICE_ID_INTEL_MEI_CNP_LP_3 0x9DE4 /* Cannon Point LP 3 (iTouch) */
++#define PCI_DEVICE_ID_INTEL_MEI_CNP_H 0xA360 /* Cannon Point H */
++#define PCI_DEVICE_ID_INTEL_MEI_CNP_H_3 0xA364 /* Cannon Point H 3 (iTouch) */
+
+-#define MEI_DEV_ID_CMP_LP 0x02e0 /* Comet Point LP */
+-#define MEI_DEV_ID_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */
++#define PCI_DEVICE_ID_INTEL_MEI_CMP_LP 0x02e0 /* Comet Point LP */
++#define PCI_DEVICE_ID_INTEL_MEI_CMP_LP_3 0x02e4 /* Comet Point LP 3 (iTouch) */
+
+-#define MEI_DEV_ID_CMP_V 0xA3BA /* Comet Point Lake V */
++#define PCI_DEVICE_ID_INTEL_MEI_CMP_V 0xA3BA /* Comet Point Lake V */
+
+-#define MEI_DEV_ID_CMP_H 0x06e0 /* Comet Lake H */
+-#define MEI_DEV_ID_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */
++#define PCI_DEVICE_ID_INTEL_MEI_CMP_H 0x06e0 /* Comet Lake H */
++#define PCI_DEVICE_ID_INTEL_MEI_CMP_H_3 0x06e4 /* Comet Lake H 3 (iTouch) */
+
+-#define MEI_DEV_ID_CDF 0x18D3 /* Cedar Fork */
++#define PCI_DEVICE_ID_INTEL_MEI_CDF 0x18D3 /* Cedar Fork */
+
+-#define MEI_DEV_ID_ICP_LP 0x34E0 /* Ice Lake Point LP */
+-#define MEI_DEV_ID_ICP_N 0x38E0 /* Ice Lake Point N */
++#define PCI_DEVICE_ID_INTEL_MEI_ICP_LP 0x34E0 /* Ice Lake Point LP */
++#define PCI_DEVICE_ID_INTEL_MEI_ICP_N 0x38E0 /* Ice Lake Point N */
+
+-#define MEI_DEV_ID_JSP_N 0x4DE0 /* Jasper Lake Point N */
++#define PCI_DEVICE_ID_INTEL_MEI_JSP_N 0x4DE0 /* Jasper Lake Point N */
+
+-#define MEI_DEV_ID_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
+-#define MEI_DEV_ID_TGP_H 0x43E0 /* Tiger Lake Point H */
++#define PCI_DEVICE_ID_INTEL_MEI_TGP_LP 0xA0E0 /* Tiger Lake Point LP */
++#define PCI_DEVICE_ID_INTEL_MEI_TGP_H 0x43E0 /* Tiger Lake Point H */
+
+-#define MEI_DEV_ID_MCC 0x4B70 /* Mule Creek Canyon (EHL) */
+-#define MEI_DEV_ID_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */
++#define PCI_DEVICE_ID_INTEL_MEI_MCC 0x4B70 /* Mule Creek Canyon (EHL) */
++#define PCI_DEVICE_ID_INTEL_MEI_MCC_4 0x4B75 /* Mule Creek Canyon 4 (EHL) */
+
+-#define MEI_DEV_ID_EBG 0x1BE0 /* Emmitsburg WS */
++#define PCI_DEVICE_ID_INTEL_MEI_EBG 0x1BE0 /* Emmitsburg WS */
+
+-#define MEI_DEV_ID_ADP_S 0x7AE8 /* Alder Lake Point S */
+-#define MEI_DEV_ID_ADP_LP 0x7A60 /* Alder Lake Point LP */
+-#define MEI_DEV_ID_ADP_P 0x51E0 /* Alder Lake Point P */
+-#define MEI_DEV_ID_ADP_N 0x54E0 /* Alder Lake Point N */
++#define PCI_DEVICE_ID_INTEL_MEI_ADP_S 0x7AE8 /* Alder Lake Point S */
++#define PCI_DEVICE_ID_INTEL_MEI_ADP_LP 0x7A60 /* Alder Lake Point LP */
++#define PCI_DEVICE_ID_INTEL_MEI_ADP_P 0x51E0 /* Alder Lake Point P */
++#define PCI_DEVICE_ID_INTEL_MEI_ADP_N 0x54E0 /* Alder Lake Point N */
+
+-#define MEI_DEV_ID_RPL_S 0x7A68 /* Raptor Lake Point S */
++#define PCI_DEVICE_ID_INTEL_MEI_RPL_S 0x7A68 /* Raptor Lake Point S */
+
+-#define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */
+-#define MEI_DEV_ID_ARL_S 0x7F68 /* Arrow Lake Point S */
+-#define MEI_DEV_ID_ARL_H 0x7770 /* Arrow Lake Point H */
++#define PCI_DEVICE_ID_INTEL_MEI_MTL_M 0x7E70 /* Meteor Lake Point M */
++#define PCI_DEVICE_ID_INTEL_MEI_ARL_S 0x7F68 /* Arrow Lake Point S */
++#define PCI_DEVICE_ID_INTEL_MEI_ARL_H 0x7770 /* Arrow Lake Point H */
+
+-#define MEI_DEV_ID_LNL_M 0xA870 /* Lunar Lake Point M */
++#define PCI_DEVICE_ID_INTEL_MEI_LNL_M 0xA870 /* Lunar Lake Point M */
+
+-#define MEI_DEV_ID_PTL_H 0xE370 /* Panther Lake H */
+-#define MEI_DEV_ID_PTL_P 0xE470 /* Panther Lake P */
++#define PCI_DEVICE_ID_INTEL_MEI_PTL_H 0xE370 /* Panther Lake H */
++#define PCI_DEVICE_ID_INTEL_MEI_PTL_P 0xE470 /* Panther Lake P */
+
+-#define MEI_DEV_ID_WCL_P 0x4D70 /* Wildcat Lake P */
++#define PCI_DEVICE_ID_INTEL_MEI_WCL_P 0x4D70 /* Wildcat Lake P */
+
+-#define MEI_DEV_ID_NVL_S 0x6E68 /* Nova Lake Point S */
++#define PCI_DEVICE_ID_INTEL_MEI_NVL_S 0x6E68 /* Nova Lake Point S */
+
+ /*
+ * MEI HW Section
+--- a/drivers/misc/mei/hw-me.h
++++ b/drivers/misc/mei/hw-me.h
+@@ -33,12 +33,6 @@ struct mei_cfg {
+ u32 hw_trc_supported:1;
+ };
+
+-
+-#define MEI_PCI_DEVICE(dev, cfg) \
+- .vendor = PCI_VENDOR_ID_INTEL, .device = (dev), \
+- .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID, \
+- .driver_data = (kernel_ulong_t)(cfg),
+-
+ #define MEI_ME_RPM_TIMEOUT 500 /* ms */
+
+ /**
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -26,110 +26,110 @@
+
+ /* mei_pci_tbl - PCI Device ID Table */
+ static const struct pci_device_id mei_me_pci_tbl[] = {
+- {MEI_PCI_DEVICE(MEI_DEV_ID_82946GZ, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_82G35, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_82Q965, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_82G965, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_82GM965, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_82GME965, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82Q35, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82G33, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82Q33, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_82X38, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_3200, MEI_ME_ICH_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_6, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_7, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_8, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_9, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9_10, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_1, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_2, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_3, MEI_ME_ICH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH9M_4, MEI_ME_ICH_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_1, MEI_ME_ICH10_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_2, MEI_ME_ICH10_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_3, MEI_ME_ICH10_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICH10_4, MEI_ME_ICH10_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_1, MEI_ME_PCH6_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_IBXPK_2, MEI_ME_PCH6_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CPT_1, MEI_ME_PCH_CPT_PBG_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PBG_1, MEI_ME_PCH_CPT_PBG_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_1, MEI_ME_PCH7_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_2, MEI_ME_PCH7_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PPT_3, MEI_ME_PCH7_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_H, MEI_ME_PCH8_SPS_4_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_W, MEI_ME_PCH8_SPS_4_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_LP, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LPT_HR, MEI_ME_PCH8_SPS_4_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_WPT_LP_2, MEI_ME_PCH8_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_3, MEI_ME_PCH8_ITOUCH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, MEI_ME_PCH8_SPS_4_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, MEI_ME_PCH8_SPS_4_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, MEI_ME_PCH12_SPS_4_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, MEI_ME_PCH8_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_DNV_IE, MEI_ME_PCH8_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_GLK, MEI_ME_PCH8_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_3, MEI_ME_PCH8_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH12_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_SPS_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_3, MEI_ME_PCH12_SPS_ITOUCH_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP, MEI_ME_PCH12_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_V, MEI_ME_PCH12_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H, MEI_ME_PCH12_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CMP_H_3, MEI_ME_PCH8_ITOUCH_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_LP, MEI_ME_PCH12_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ICP_N, MEI_ME_PCH12_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_LP, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_TGP_H, MEI_ME_PCH15_SPS_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_JSP_N, MEI_ME_PCH15_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_MCC, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_MCC_4, MEI_ME_PCH8_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_CDF, MEI_ME_PCH8_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_EBG, MEI_ME_PCH15_SPS_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_S, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_LP, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_SPS_CFG)},
+-
+- {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_S, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_ARL_H, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_82946GZ, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_82G35, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_82Q965, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_82G965, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_82GM965, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_82GME965, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82Q35, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82G33, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82Q33, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_82X38, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_3200, MEI_ME_ICH_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_6, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_7, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_8, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_9, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9_10, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_1, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_2, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_3, MEI_ME_ICH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH9M_4, MEI_ME_ICH_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_1, MEI_ME_ICH10_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_2, MEI_ME_ICH10_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_3, MEI_ME_ICH10_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICH10_4, MEI_ME_ICH10_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_IBXPK_1, MEI_ME_PCH6_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_IBXPK_2, MEI_ME_PCH6_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CPT_1, MEI_ME_PCH_CPT_PBG_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_PBG_1, MEI_ME_PCH_CPT_PBG_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_PPT_1, MEI_ME_PCH7_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_PPT_2, MEI_ME_PCH7_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_PPT_3, MEI_ME_PCH7_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_H, MEI_ME_PCH8_SPS_4_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_W, MEI_ME_PCH8_SPS_4_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_LP, MEI_ME_PCH8_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_LPT_HR, MEI_ME_PCH8_SPS_4_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_WPT_LP, MEI_ME_PCH8_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_WPT_LP_2, MEI_ME_PCH8_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_SPT, MEI_ME_PCH8_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_2, MEI_ME_PCH8_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_3, MEI_ME_PCH8_ITOUCH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_H, MEI_ME_PCH8_SPS_4_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_SPT_H_2, MEI_ME_PCH8_SPS_4_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_LBG, MEI_ME_PCH12_SPS_4_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_BXT_M, MEI_ME_PCH8_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_APL_I, MEI_ME_PCH8_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_DNV_IE, MEI_ME_PCH8_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_GLK, MEI_ME_PCH8_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_KBP, MEI_ME_PCH8_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_KBP_2, MEI_ME_PCH8_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_KBP_3, MEI_ME_PCH8_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_LP, MEI_ME_PCH12_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_H, MEI_ME_PCH12_SPS_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CNP_H_3, MEI_ME_PCH12_SPS_ITOUCH_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_LP, MEI_ME_PCH12_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_LP_3, MEI_ME_PCH8_ITOUCH_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_V, MEI_ME_PCH12_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_H, MEI_ME_PCH12_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_CMP_H_3, MEI_ME_PCH8_ITOUCH_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_ICP_LP, MEI_ME_PCH12_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ICP_N, MEI_ME_PCH12_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_TGP_LP, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_TGP_H, MEI_ME_PCH15_SPS_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_JSP_N, MEI_ME_PCH15_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_MCC, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_MCC_4, MEI_ME_PCH8_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_CDF, MEI_ME_PCH8_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_EBG, MEI_ME_PCH15_SPS_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_S, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_LP, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_P, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ADP_N, MEI_ME_PCH15_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_RPL_S, MEI_ME_PCH15_SPS_CFG)},
++
++ {PCI_DEVICE_DATA(INTEL, MEI_MTL_M, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ARL_S, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_ARL_H, MEI_ME_PCH15_CFG)},
+
+- {MEI_PCI_DEVICE(MEI_DEV_ID_LNL_M, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_LNL_M, MEI_ME_PCH15_CFG)},
+
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_H, MEI_ME_PCH15_CFG)},
+- {MEI_PCI_DEVICE(MEI_DEV_ID_PTL_P, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_PTL_H, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_PTL_P, MEI_ME_PCH15_CFG)},
+
+- {MEI_PCI_DEVICE(MEI_DEV_ID_WCL_P, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_WCL_P, MEI_ME_PCH15_CFG)},
+
+- {MEI_PCI_DEVICE(MEI_DEV_ID_NVL_S, MEI_ME_PCH15_CFG)},
++ {PCI_DEVICE_DATA(INTEL, MEI_NVL_S, MEI_ME_PCH15_CFG)},
+
+ /* required last entry */
+ {0, }
--- /dev/null
+From stable+bounces-241820-greg=kroah.com@vger.kernel.org Wed Apr 29 07:36:33 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Apr 2026 01:36:20 -0400
+Subject: mm: avoid deadlock when holding rmap on mmap_prepare error
+To: stable@vger.kernel.org
+Cc: "Lorenzo Stoakes (Oracle)" <ljs@kernel.org>, "Vlastimil Babka (SUSE)" <vbabka@kernel.org>, Alexander Shishkin <alexander.shishkin@linux.intel.com>, Alexandre Torgue <alexandre.torgue@foss.st.com>, Al Viro <viro@zeniv.linux.org.uk>, Arnd Bergmann <arnd@arndb.de>, Bodo Stroesser <bostroesser@gmail.com>, Christian Brauner <brauner@kernel.org>, Clemens Ladisch <clemens@ladisch.de>, David Hildenbrand <david@kernel.org>, David Howells <dhowells@redhat.com>, Dexuan Cui <decui@microsoft.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Haiyang Zhang <haiyangz@microsoft.com>, Jan Kara <jack@suse.cz>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, "K. Y. Srinivasan" <kys@microsoft.com>, Liam Howlett <liam.howlett@oracle.com>, Long Li <longli@microsoft.com>, Marc Dionne <marc.dionne@auristor.com>, "Martin K. Petersen" <martin.petersen@oracle.com>, Maxime Coquelin <mcoquelin.stm32@gmail.com>, Michal Hocko <mhocko@suse.com>, Mike Rapoport <rppt@kernel.org>, Miquel Raynal <miquel.raynal@bootlin.com>, Pedro Falcato <pfalcato@suse.de>, Richard Weinberger <richard@nod.at>, Ryan Roberts <ryan.roberts@arm.com>, Suren Baghdasaryan <surenb@google.com>, Vignesh Raghavendra <vigneshr@ti.com>, Wei Liu <wei.liu@kernel.org>, Andrew Morton <akpm@linux-foundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260429053620.3394030-2-sashal@kernel.org>
+
+From: "Lorenzo Stoakes (Oracle)" <ljs@kernel.org>
+
+[ Upstream commit f96e1d5f15b7c854a6a9ec1225d68a12fe7dcda6 ]
+
+Commit ac0a3fc9c07d ("mm: add ability to take further action in
+vm_area_desc") added the ability for drivers to instruct mm to take actions
+after the .mmap_prepare callback is complete.
+
+To make life simpler and safer, this is done before the VMA/mmap write lock
+is dropped but when the VMA is completely established.
+
+So on error, we simply munmap() the VMA.
+
+As part of this implementation, unfortunately a horrible hack had to be
+implemented to support some questionable behaviour hugetlb relies upon -
+that is that the file rmap lock is held until the operation is complete.
+
+The implementation, for convenience, did this in mmap_action_finish() so
+both the VMA and mmap_prepare compatibility layer paths would have this
+correctly handled.
+
+However, it turns out there is a mistake here - the rmap lock cannot be
+held on munmap, as free_pgtables() -> unlink_file_vma_batch_add() ->
+unlink_file_vma_batch_process() takes the file rmap lock.
+
+We therefore currently have a deadlock issue that might arise.
+
+Resolve this by leaving it to callers to handle the unmap.
+
+The compatibility layer does not support this rmap behaviour, so we simply
+have it unmap on error after calling mmap_action_complete().
+
+In the VMA implementation, we only perform the unmap after the rmap lock is
+dropped.
+
+This resolves the issue by ensuring the rmap lock is always dropped when
+the unmap occurs.
+
+Link: https://lkml.kernel.org/r/d44248be9da68258b07c2c59d4e73485ee0ca943.1774045440.git.ljs@kernel.org
+Fixes: ac0a3fc9c07d ("mm: add ability to take further action in vm_area_desc")
+Signed-off-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
+Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Bodo Stroesser <bostroesser@gmail.com>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Clemens Ladisch <clemens@ladisch.de>
+Cc: David Hildenbrand <david@kernel.org>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Dexuan Cui <decui@microsoft.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Jann Horn <jannh@google.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Liam Howlett <liam.howlett@oracle.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Marc Dionne <marc.dionne@auristor.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: Pedro Falcato <pfalcato@suse.de>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Ryan Roberts <ryan.roberts@arm.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Vignesh Raghavendra <vigneshr@ti.com>
+Cc: Vlastimil Babka (SUSE) <vbabka@kernel.org>
+Cc: Wei Liu <wei.liu@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/util.c | 12 +++++++-----
+ mm/vma.c | 13 ++++++++++---
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -1186,7 +1186,13 @@ int compat_vma_mmap(struct file *file, s
+ return err;
+
+ set_vma_from_desc(vma, &desc);
+- return mmap_action_complete(vma, &desc.action);
++ err = mmap_action_complete(vma, &desc.action);
++ if (err) {
++ const size_t len = vma_pages(vma) << PAGE_SHIFT;
++
++ do_munmap(current->mm, vma->vm_start, len, NULL);
++ }
++ return err;
+ }
+ EXPORT_SYMBOL(compat_vma_mmap);
+
+@@ -1279,10 +1285,6 @@ static int mmap_action_finish(struct vm_
+ * invoked if we do NOT merge, so we only clean up the VMA we created.
+ */
+ if (err) {
+- const size_t len = vma_pages(vma) << PAGE_SHIFT;
+-
+- do_munmap(current->mm, vma->vm_start, len, NULL);
+-
+ if (action->error_hook) {
+ /* We may want to filter the error. */
+ err = action->error_hook(err);
+--- a/mm/vma.c
++++ b/mm/vma.c
+@@ -2706,9 +2706,9 @@ static int call_action_complete(struct m
+ struct mmap_action *action,
+ struct vm_area_struct *vma)
+ {
+- int ret;
++ int err;
+
+- ret = mmap_action_complete(vma, action);
++ err = mmap_action_complete(vma, action);
+
+ /* If we held the file rmap we need to release it. */
+ if (map->hold_file_rmap_lock) {
+@@ -2716,7 +2716,14 @@ static int call_action_complete(struct m
+
+ i_mmap_unlock_write(file->f_mapping);
+ }
+- return ret;
++
++ if (err) {
++ const size_t len = vma_pages(vma) << PAGE_SHIFT;
++
++ do_munmap(current->mm, vma->vm_start, len, NULL);
++ }
++
++ return err;
+ }
+
+ static unsigned long __mmap_region(struct file *file, unsigned long addr,
--- /dev/null
+From stable+bounces-241819-greg=kroah.com@vger.kernel.org Wed Apr 29 07:36:29 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Apr 2026 01:36:19 -0400
+Subject: mm: various small mmap_prepare cleanups
+To: stable@vger.kernel.org
+Cc: "Lorenzo Stoakes (Oracle)" <ljs@kernel.org>, "Vlastimil Babka (SUSE)" <vbabka@kernel.org>, Alexander Shishkin <alexander.shishkin@linux.intel.com>, Alexandre Torgue <alexandre.torgue@foss.st.com>, Al Viro <viro@zeniv.linux.org.uk>, Arnd Bergmann <arnd@arndb.de>, Bodo Stroesser <bostroesser@gmail.com>, Christian Brauner <brauner@kernel.org>, Clemens Ladisch <clemens@ladisch.de>, David Hildenbrand <david@kernel.org>, David Howells <dhowells@redhat.com>, Dexuan Cui <decui@microsoft.com>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Haiyang Zhang <haiyangz@microsoft.com>, Jan Kara <jack@suse.cz>, Jann Horn <jannh@google.com>, Jonathan Corbet <corbet@lwn.net>, "K. Y. Srinivasan" <kys@microsoft.com>, Liam Howlett <liam.howlett@oracle.com>, Long Li <longli@microsoft.com>, Marc Dionne <marc.dionne@auristor.com>, "Martin K. Petersen" <martin.petersen@oracle.com>, Maxime Coquelin <mcoquelin.stm32@gmail.com>, Michal Hocko <mhocko@suse.com>, Mike Rapoport <rppt@kernel.org>, Miquel Raynal <miquel.raynal@bootlin.com>, Pedro Falcato <pfalcato@suse.de>, Richard Weinberger <richard@nod.at>, Ryan Roberts <ryan.roberts@arm.com>, Suren Baghdasaryan <surenb@google.com>, Vignesh Raghavendra <vigneshr@ti.com>, Wei Liu <wei.liu@kernel.org>, Andrew Morton <akpm@linux-foundation.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260429053620.3394030-1-sashal@kernel.org>
+
+From: "Lorenzo Stoakes (Oracle)" <ljs@kernel.org>
+
+[ Upstream commit 3e4bb2706817710d9461394da8b75be79981586b ]
+
+Patch series "mm: expand mmap_prepare functionality and usage", v4.
+
+This series expands the mmap_prepare functionality, which is intended to
+replace the deprecated f_op->mmap hook which has been the source of bugs
+and security issues for some time.
+
+This series starts with some cleanup of existing mmap_prepare logic, then
+adds documentation for the mmap_prepare call to make it easier for
+filesystem and driver writers to understand how it works.
+
+It then importantly adds a vm_ops->mapped hook, a key feature that was
+missing from mmap_prepare previously - this is invoked when a driver which
+specifies mmap_prepare has successfully been mapped but not merged with
+another VMA.
+
+mmap_prepare is invoked prior to a merge being attempted, so you cannot
+manipulate state such as reference counts as if it were a new mapping.
+
+The vm_ops->mapped hook allows a driver to perform tasks required at this
+stage, and provides symmetry against subsequent vm_ops->open,close calls.
+
+The series uses this to correct the afs implementation which wrongly
+manipulated reference count at mmap_prepare time.
+
+It then adds an mmap_prepare equivalent of vm_iomap_memory() -
+mmap_action_simple_ioremap(), then uses this to update a number of drivers.
+
+It then splits out the mmap_prepare compatibility layer (which allows for
+invocation of mmap_prepare hooks in an mmap() hook) in such a way as to
+allow for more incremental implementation of mmap_prepare hooks.
+
+It then uses this to extend mmap_prepare usage in drivers.
+
+Finally it adds an mmap_prepare equivalent of vm_map_pages(), which lays
+the foundation for future work which will extend mmap_prepare to DMA
+coherent mappings.
+
+This patch (of 21):
+
+Rather than passing arbitrary fields, pass a vm_area_desc pointer to mmap
+prepare functions to mmap prepare, and an action and vma pointer to mmap
+complete in order to put all the action-specific logic in the function
+actually doing the work.
+
+Additionally, allow mmap prepare functions to return an error so we can
+error out as soon as possible if there is something logically incorrect in
+the input.
+
+Update remap_pfn_range_prepare() to properly check the input range for the
+CoW case.
+
+Also remove io_remap_pfn_range_complete(), as we can simply set up the
+fields correctly in io_remap_pfn_range_prepare() and use
+remap_pfn_range_complete() for this.
+
+While we're here, make remap_pfn_range_prepare_vma() a little neater, and
+pass mmap_action directly to call_action_complete().
+
+Then, update compat_vma_mmap() to perform its logic directly, as
+__compat_vma_map() is not used by anything so we don't need to export it.
+
+Also update compat_vma_mmap() to use vfs_mmap_prepare() rather than
+calling the mmap_prepare op directly.
+
+Finally, update the VMA userland tests to reflect the changes.
+
+Link: https://lkml.kernel.org/r/cover.1774045440.git.ljs@kernel.org
+Link: https://lkml.kernel.org/r/99f408e4694f44ab12bdc55fe0bd9685d3bd1117.1774045440.git.ljs@kernel.org
+Signed-off-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
+Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Bodo Stroesser <bostroesser@gmail.com>
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Clemens Ladisch <clemens@ladisch.de>
+Cc: David Hildenbrand <david@kernel.org>
+Cc: David Howells <dhowells@redhat.com>
+Cc: Dexuan Cui <decui@microsoft.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Jann Horn <jannh@google.com>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: K. Y. Srinivasan <kys@microsoft.com>
+Cc: Liam Howlett <liam.howlett@oracle.com>
+Cc: Long Li <longli@microsoft.com>
+Cc: Marc Dionne <marc.dionne@auristor.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Mike Rapoport <rppt@kernel.org>
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: Pedro Falcato <pfalcato@suse.de>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Ryan Roberts <ryan.roberts@arm.com>
+Cc: Suren Baghdasaryan <surenb@google.com>
+Cc: Vignesh Raghavendra <vigneshr@ti.com>
+Cc: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Stable-dep-of: f96e1d5f15b7 ("mm: avoid deadlock when holding rmap on mmap_prepare error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/fs.h | 2
+ include/linux/mm.h | 7 --
+ mm/internal.h | 34 +++++-----
+ mm/memory.c | 45 +++++++++-----
+ mm/util.c | 121 ++++++++++++++++----------------------
+ mm/vma.c | 24 ++++---
+ tools/testing/vma/include/dup.h | 7 +-
+ tools/testing/vma/include/stubs.h | 8 +-
+ 8 files changed, 127 insertions(+), 121 deletions(-)
+
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2058,8 +2058,6 @@ static inline bool can_mmap_file(struct
+ return true;
+ }
+
+-int __compat_vma_mmap(const struct file_operations *f_op,
+- struct file *file, struct vm_area_struct *vma);
+ int compat_vma_mmap(struct file *file, struct vm_area_struct *vma);
+
+ static inline int vfs_mmap(struct file *file, struct vm_area_struct *vma)
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -4078,10 +4078,9 @@ static inline void mmap_action_ioremap_f
+ mmap_action_ioremap(desc, desc->start, start_pfn, vma_desc_size(desc));
+ }
+
+-void mmap_action_prepare(struct mmap_action *action,
+- struct vm_area_desc *desc);
+-int mmap_action_complete(struct mmap_action *action,
+- struct vm_area_struct *vma);
++int mmap_action_prepare(struct vm_area_desc *desc);
++int mmap_action_complete(struct vm_area_struct *vma,
++ struct mmap_action *action);
+
+ /* Look up the first VMA which exactly match the interval vm_start ... vm_end */
+ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -1757,26 +1757,28 @@ int walk_page_range_debug(struct mm_stru
+ void dup_mm_exe_file(struct mm_struct *mm, struct mm_struct *oldmm);
+ int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm);
+
+-void remap_pfn_range_prepare(struct vm_area_desc *desc, unsigned long pfn);
+-int remap_pfn_range_complete(struct vm_area_struct *vma, unsigned long addr,
+- unsigned long pfn, unsigned long size, pgprot_t pgprot);
++int remap_pfn_range_prepare(struct vm_area_desc *desc);
++int remap_pfn_range_complete(struct vm_area_struct *vma,
++ struct mmap_action *action);
+
+-static inline void io_remap_pfn_range_prepare(struct vm_area_desc *desc,
+- unsigned long orig_pfn, unsigned long size)
++static inline int io_remap_pfn_range_prepare(struct vm_area_desc *desc)
+ {
++ struct mmap_action *action = &desc->action;
++ const unsigned long orig_pfn = action->remap.start_pfn;
++ const pgprot_t orig_pgprot = action->remap.pgprot;
++ const unsigned long size = action->remap.size;
+ const unsigned long pfn = io_remap_pfn_range_pfn(orig_pfn, size);
++ int err;
+
+- return remap_pfn_range_prepare(desc, pfn);
+-}
+-
+-static inline int io_remap_pfn_range_complete(struct vm_area_struct *vma,
+- unsigned long addr, unsigned long orig_pfn, unsigned long size,
+- pgprot_t orig_prot)
+-{
+- const unsigned long pfn = io_remap_pfn_range_pfn(orig_pfn, size);
+- const pgprot_t prot = pgprot_decrypted(orig_prot);
+-
+- return remap_pfn_range_complete(vma, addr, pfn, size, prot);
++ action->remap.start_pfn = pfn;
++ action->remap.pgprot = pgprot_decrypted(orig_pgprot);
++ err = remap_pfn_range_prepare(desc);
++ if (err)
++ return err;
++
++ /* Remap does the actual work. */
++ action->type = MMAP_REMAP_PFN;
++ return 0;
+ }
+
+ #endif /* __MM_INTERNAL_H */
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3105,26 +3105,34 @@ static int do_remap_pfn_range(struct vm_
+ }
+ #endif
+
+-void remap_pfn_range_prepare(struct vm_area_desc *desc, unsigned long pfn)
++int remap_pfn_range_prepare(struct vm_area_desc *desc)
+ {
+- /*
+- * We set addr=VMA start, end=VMA end here, so this won't fail, but we
+- * check it again on complete and will fail there if specified addr is
+- * invalid.
+- */
+- get_remap_pgoff(vma_desc_is_cow_mapping(desc), desc->start, desc->end,
+- desc->start, desc->end, pfn, &desc->pgoff);
++ const struct mmap_action *action = &desc->action;
++ const unsigned long start = action->remap.start;
++ const unsigned long end = start + action->remap.size;
++ const unsigned long pfn = action->remap.start_pfn;
++ const bool is_cow = vma_desc_is_cow_mapping(desc);
++ int err;
++
++ err = get_remap_pgoff(is_cow, start, end, desc->start, desc->end, pfn,
++ &desc->pgoff);
++ if (err)
++ return err;
++
+ vma_desc_set_flags_mask(desc, VMA_REMAP_FLAGS);
++ return 0;
+ }
+
+-static int remap_pfn_range_prepare_vma(struct vm_area_struct *vma, unsigned long addr,
+- unsigned long pfn, unsigned long size)
++static int remap_pfn_range_prepare_vma(struct vm_area_struct *vma,
++ unsigned long addr, unsigned long pfn,
++ unsigned long size)
+ {
+- unsigned long end = addr + PAGE_ALIGN(size);
++ const unsigned long end = addr + PAGE_ALIGN(size);
++ const bool is_cow = is_cow_mapping(vma->vm_flags);
+ int err;
+
+- err = get_remap_pgoff(is_cow_mapping(vma->vm_flags), addr, end,
+- vma->vm_start, vma->vm_end, pfn, &vma->vm_pgoff);
++ err = get_remap_pgoff(is_cow, addr, end, vma->vm_start, vma->vm_end,
++ pfn, &vma->vm_pgoff);
+ if (err)
+ return err;
+
+@@ -3157,10 +3165,15 @@ int remap_pfn_range(struct vm_area_struc
+ }
+ EXPORT_SYMBOL(remap_pfn_range);
+
+-int remap_pfn_range_complete(struct vm_area_struct *vma, unsigned long addr,
+- unsigned long pfn, unsigned long size, pgprot_t prot)
++int remap_pfn_range_complete(struct vm_area_struct *vma,
++ struct mmap_action *action)
+ {
+- return do_remap_pfn_range(vma, addr, pfn, size, prot);
++ const unsigned long start = action->remap.start;
++ const unsigned long pfn = action->remap.start_pfn;
++ const unsigned long size = action->remap.size;
++ const pgprot_t prot = action->remap.pgprot;
++
++ return do_remap_pfn_range(vma, start, pfn, size, prot);
+ }
+
+ /**
+--- a/mm/util.c
++++ b/mm/util.c
+@@ -1135,43 +1135,6 @@ EXPORT_SYMBOL(flush_dcache_folio);
+ #endif
+
+ /**
+- * __compat_vma_mmap() - See description for compat_vma_mmap()
+- * for details. This is the same operation, only with a specific file operations
+- * struct which may or may not be the same as vma->vm_file->f_op.
+- * @f_op: The file operations whose .mmap_prepare() hook is specified.
+- * @file: The file which backs or will back the mapping.
+- * @vma: The VMA to apply the .mmap_prepare() hook to.
+- * Returns: 0 on success or error.
+- */
+-int __compat_vma_mmap(const struct file_operations *f_op,
+- struct file *file, struct vm_area_struct *vma)
+-{
+- struct vm_area_desc desc = {
+- .mm = vma->vm_mm,
+- .file = file,
+- .start = vma->vm_start,
+- .end = vma->vm_end,
+-
+- .pgoff = vma->vm_pgoff,
+- .vm_file = vma->vm_file,
+- .vma_flags = vma->flags,
+- .page_prot = vma->vm_page_prot,
+-
+- .action.type = MMAP_NOTHING, /* Default */
+- };
+- int err;
+-
+- err = f_op->mmap_prepare(&desc);
+- if (err)
+- return err;
+-
+- mmap_action_prepare(&desc.action, &desc);
+- set_vma_from_desc(vma, &desc);
+- return mmap_action_complete(&desc.action, vma);
+-}
+-EXPORT_SYMBOL(__compat_vma_mmap);
+-
+-/**
+ * compat_vma_mmap() - Apply the file's .mmap_prepare() hook to an
+ * existing VMA and execute any requested actions.
+ * @file: The file which possesss an f_op->mmap_prepare() hook.
+@@ -1199,7 +1162,31 @@ EXPORT_SYMBOL(__compat_vma_mmap);
+ */
+ int compat_vma_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+- return __compat_vma_mmap(file->f_op, file, vma);
++ struct vm_area_desc desc = {
++ .mm = vma->vm_mm,
++ .file = file,
++ .start = vma->vm_start,
++ .end = vma->vm_end,
++
++ .pgoff = vma->vm_pgoff,
++ .vm_file = vma->vm_file,
++ .vma_flags = vma->flags,
++ .page_prot = vma->vm_page_prot,
++
++ .action.type = MMAP_NOTHING, /* Default */
++ };
++ int err;
++
++ err = vfs_mmap_prepare(file, &desc);
++ if (err)
++ return err;
++
++ err = mmap_action_prepare(&desc);
++ if (err)
++ return err;
++
++ set_vma_from_desc(vma, &desc);
++ return mmap_action_complete(vma, &desc.action);
+ }
+ EXPORT_SYMBOL(compat_vma_mmap);
+
+@@ -1283,8 +1270,8 @@ again:
+ }
+ }
+
+-static int mmap_action_finish(struct mmap_action *action,
+- const struct vm_area_struct *vma, int err)
++static int mmap_action_finish(struct vm_area_struct *vma,
++ struct mmap_action *action, int err)
+ {
+ /*
+ * If an error occurs, unmap the VMA altogether and return an error. We
+@@ -1316,37 +1303,38 @@ static int mmap_action_finish(struct mma
+ /**
+ * mmap_action_prepare - Perform preparatory setup for an VMA descriptor
+ * action which need to be performed.
+- * @desc: The VMA descriptor to prepare for @action.
+- * @action: The action to perform.
++ * @desc: The VMA descriptor to prepare for its @desc->action.
++ *
++ * Returns: %0 on success, otherwise error.
+ */
+-void mmap_action_prepare(struct mmap_action *action,
+- struct vm_area_desc *desc)
++int mmap_action_prepare(struct vm_area_desc *desc)
+ {
+- switch (action->type) {
++ switch (desc->action.type) {
+ case MMAP_NOTHING:
+- break;
++ return 0;
+ case MMAP_REMAP_PFN:
+- remap_pfn_range_prepare(desc, action->remap.start_pfn);
+- break;
++ return remap_pfn_range_prepare(desc);
+ case MMAP_IO_REMAP_PFN:
+- io_remap_pfn_range_prepare(desc, action->remap.start_pfn,
+- action->remap.size);
+- break;
++ return io_remap_pfn_range_prepare(desc);
+ }
++
++ WARN_ON_ONCE(1);
++ return -EINVAL;
+ }
+ EXPORT_SYMBOL(mmap_action_prepare);
+
+ /**
+ * mmap_action_complete - Execute VMA descriptor action.
+- * @action: The action to perform.
+ * @vma: The VMA to perform the action upon.
++ * @action: The action to perform.
+ *
+ * Similar to mmap_action_prepare().
+ *
+ * Return: 0 on success, or error, at which point the VMA will be unmapped.
+ */
+-int mmap_action_complete(struct mmap_action *action,
+- struct vm_area_struct *vma)
++int mmap_action_complete(struct vm_area_struct *vma,
++ struct mmap_action *action)
++
+ {
+ int err = 0;
+
+@@ -1354,25 +1342,22 @@ int mmap_action_complete(struct mmap_act
+ case MMAP_NOTHING:
+ break;
+ case MMAP_REMAP_PFN:
+- err = remap_pfn_range_complete(vma, action->remap.start,
+- action->remap.start_pfn, action->remap.size,
+- action->remap.pgprot);
++ err = remap_pfn_range_complete(vma, action);
+ break;
+ case MMAP_IO_REMAP_PFN:
+- err = io_remap_pfn_range_complete(vma, action->remap.start,
+- action->remap.start_pfn, action->remap.size,
+- action->remap.pgprot);
++ /* Should have been delegated. */
++ WARN_ON_ONCE(1);
++ err = -EINVAL;
+ break;
+ }
+
+- return mmap_action_finish(action, vma, err);
++ return mmap_action_finish(vma, action, err);
+ }
+ EXPORT_SYMBOL(mmap_action_complete);
+ #else
+-void mmap_action_prepare(struct mmap_action *action,
+- struct vm_area_desc *desc)
++int mmap_action_prepare(struct vm_area_desc *desc)
+ {
+- switch (action->type) {
++ switch (desc->action.type) {
+ case MMAP_NOTHING:
+ break;
+ case MMAP_REMAP_PFN:
+@@ -1380,11 +1365,13 @@ void mmap_action_prepare(struct mmap_act
+ WARN_ON_ONCE(1); /* nommu cannot handle these. */
+ break;
+ }
++
++ return 0;
+ }
+ EXPORT_SYMBOL(mmap_action_prepare);
+
+-int mmap_action_complete(struct mmap_action *action,
+- struct vm_area_struct *vma)
++int mmap_action_complete(struct vm_area_struct *vma,
++ struct mmap_action *action)
+ {
+ int err = 0;
+
+@@ -1399,7 +1386,7 @@ int mmap_action_complete(struct mmap_act
+ break;
+ }
+
+- return mmap_action_finish(action, vma, err);
++ return mmap_action_finish(vma, action, err);
+ }
+ EXPORT_SYMBOL(mmap_action_complete);
+ #endif
+--- a/mm/vma.c
++++ b/mm/vma.c
+@@ -2611,15 +2611,18 @@ static void __mmap_complete(struct mmap_
+ vma_set_page_prot(vma);
+ }
+
+-static void call_action_prepare(struct mmap_state *map,
+- struct vm_area_desc *desc)
++static int call_action_prepare(struct mmap_state *map,
++ struct vm_area_desc *desc)
+ {
+- struct mmap_action *action = &desc->action;
++ int err;
+
+- mmap_action_prepare(action, desc);
++ err = mmap_action_prepare(desc);
++ if (err)
++ return err;
+
+- if (action->hide_from_rmap_until_complete)
++ if (desc->action.hide_from_rmap_until_complete)
+ map->hold_file_rmap_lock = true;
++ return 0;
+ }
+
+ /*
+@@ -2643,7 +2646,9 @@ static int call_mmap_prepare(struct mmap
+ if (err)
+ return err;
+
+- call_action_prepare(map, desc);
++ err = call_action_prepare(map, desc);
++ if (err)
++ return err;
+
+ /* Update fields permitted to be changed. */
+ map->pgoff = desc->pgoff;
+@@ -2698,13 +2703,12 @@ static bool can_set_ksm_flags_early(stru
+ }
+
+ static int call_action_complete(struct mmap_state *map,
+- struct vm_area_desc *desc,
++ struct mmap_action *action,
+ struct vm_area_struct *vma)
+ {
+- struct mmap_action *action = &desc->action;
+ int ret;
+
+- ret = mmap_action_complete(action, vma);
++ ret = mmap_action_complete(vma, action);
+
+ /* If we held the file rmap we need to release it. */
+ if (map->hold_file_rmap_lock) {
+@@ -2766,7 +2770,7 @@ static unsigned long __mmap_region(struc
+ __mmap_complete(&map, vma);
+
+ if (have_mmap_prepare && allocated_new) {
+- error = call_action_complete(&map, &desc, vma);
++ error = call_action_complete(&map, &desc.action, vma);
+
+ if (error)
+ return error;
+--- a/tools/testing/vma/include/dup.h
++++ b/tools/testing/vma/include/dup.h
+@@ -1093,9 +1093,12 @@ static inline int __compat_vma_mmap(cons
+ if (err)
+ return err;
+
+- mmap_action_prepare(&desc.action, &desc);
++ err = mmap_action_prepare(&desc);
++ if (err)
++ return err;
++
+ set_vma_from_desc(vma, &desc);
+- return mmap_action_complete(&desc.action, vma);
++ return mmap_action_complete(vma, &desc.action);
+ }
+
+ static inline int compat_vma_mmap(struct file *file,
+--- a/tools/testing/vma/include/stubs.h
++++ b/tools/testing/vma/include/stubs.h
+@@ -81,13 +81,13 @@ static inline void free_anon_vma_name(st
+ {
+ }
+
+-static inline void mmap_action_prepare(struct mmap_action *action,
+- struct vm_area_desc *desc)
++static inline int mmap_action_prepare(struct vm_area_desc *desc)
+ {
++ return 0;
+ }
+
+-static inline int mmap_action_complete(struct mmap_action *action,
+- struct vm_area_struct *vma)
++static inline int mmap_action_complete(struct vm_area_struct *vma,
++ struct mmap_action *action)
+ {
+ return 0;
+ }
--- /dev/null
+From 841dbf4871c57ce2da18c4ea7ffac5487d0eda16 Mon Sep 17 00:00:00 2001
+From: WANG Rui <r@hev.cc>
+Date: Tue, 14 Apr 2026 08:51:52 +0800
+Subject: perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND
+
+From: WANG Rui <r@hev.cc>
+
+commit 841dbf4871c57ce2da18c4ea7ffac5487d0eda16 upstream.
+
+Building perf for LoongArch fails when CONFIG_LIBDW_DWARF_UNWIND is
+enabled because unwind-libdw.o is still referenced in
+arch/loongarch/util/Build.
+
+Fixes: e62fae9d9e8 ("perf unwind-libdw: Fix a cross-arch unwinding bug")
+Signed-off-by: WANG Rui <r@hev.cc>
+Acked-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/arch/loongarch/util/Build | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/tools/perf/arch/loongarch/util/Build
++++ b/tools/perf/arch/loongarch/util/Build
+@@ -1,4 +1,3 @@
+ perf-util-y += header.o
+
+ perf-util-$(CONFIG_LOCAL_LIBUNWIND) += unwind-libunwind.o
+-perf-util-$(CONFIG_LIBDW_DWARF_UNWIND) += unwind-libdw.o
--- /dev/null
+From stable+bounces-242598-greg=kroah.com@vger.kernel.org Sat May 2 14:27:10 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 May 2026 08:27:02 -0400
+Subject: selftests/landlock: Fix socket file descriptor leaks in audit helpers
+To: stable@vger.kernel.org
+Cc: "Mickaël Salaün" <mic@digikod.net>, "Günther Noack" <gnoack@google.com>, "Günther Noack" <gnoack3000@gmail.com>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20260502122702.517486-1-sashal@kernel.org>
+
+From: Mickaël Salaün <mic@digikod.net>
+
+[ Upstream commit 9143d790337a0d066c2d632c802f69b981e6c23a ]
+
+audit_init() opens a netlink socket and configures it, but leaks the
+file descriptor if audit_set_status() or setsockopt() fails. Fix this
+by jumping to an error path that closes the socket before returning.
+
+Apply the same fix to audit_init_with_exe_filter(), which leaks the file
+descriptor from audit_init() if audit_init_filter_exe() or
+audit_filter_exe() fails, and to audit_cleanup(), which leaks it if
+audit_init_filter_exe() fails in FIXTURE_TEARDOWN_PARENT().
+
+Cc: Günther Noack <gnoack@google.com>
+Cc: stable@vger.kernel.org
+Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs")
+Reviewed-by: Günther Noack <gnoack3000@gmail.com>
+Link: https://lore.kernel.org/r/20260402192608.1458252-3-mic@digikod.net
+Signed-off-by: Mickaël Salaün <mic@digikod.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/landlock/audit.h | 26 +++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/tools/testing/selftests/landlock/audit.h b/tools/testing/selftests/landlock/audit.h
+index 44eb433e96661..0007c247cd335 100644
+--- a/tools/testing/selftests/landlock/audit.h
++++ b/tools/testing/selftests/landlock/audit.h
+@@ -379,19 +379,25 @@ static int audit_init(void)
+
+ err = audit_set_status(fd, AUDIT_STATUS_ENABLED, 1);
+ if (err)
+- return err;
++ goto err_close;
+
+ err = audit_set_status(fd, AUDIT_STATUS_PID, getpid());
+ if (err)
+- return err;
++ goto err_close;
+
+ /* Sets a timeout for negative tests. */
+ err = setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &audit_tv_default,
+ sizeof(audit_tv_default));
+- if (err)
+- return -errno;
++ if (err) {
++ err = -errno;
++ goto err_close;
++ }
+
+ return fd;
++
++err_close:
++ close(fd);
++ return err;
+ }
+
+ static int audit_init_filter_exe(struct audit_filter *filter, const char *path)
+@@ -441,8 +447,10 @@ static int audit_cleanup(int audit_fd, struct audit_filter *filter)
+
+ filter = &new_filter;
+ err = audit_init_filter_exe(filter, NULL);
+- if (err)
++ if (err) {
++ close(audit_fd);
+ return err;
++ }
+ }
+
+ /* Filters might not be in place. */
+@@ -468,11 +476,15 @@ static int audit_init_with_exe_filter(struct audit_filter *filter)
+
+ err = audit_init_filter_exe(filter, NULL);
+ if (err)
+- return err;
++ goto err_close;
+
+ err = audit_filter_exe(fd, filter, AUDIT_ADD_RULE);
+ if (err)
+- return err;
++ goto err_close;
+
+ return fd;
++
++err_close:
++ close(fd);
++ return err;
+ }
+--
+2.53.0
+
sched_ext-documentation-clarify-ops.dispatch-role-in-task-lifecycle.patch
scsi-sd-fix-missing-put_disk-when-device_add-disk_dev-fails.patch
seg6-fix-seg6-lwtunnel-output-redirect-for-l2-reduced-encap-mode.patch
+perf-loongarch-fix-build-failure-with-config_libdw_dwarf_unwind.patch
+iio-frequency-admv1013-add-dev-variable.patch
+iio-frequency-admv1013-fix-null-pointer-dereference-on-str.patch
+wifi-mt76-mt792x-describe-usb-wfsys-reset-with-a-descriptor.patch
+wifi-mt76-mt792x-fix-mt7925u-usb-wfsys-reset-handling.patch
+mm-various-small-mmap_prepare-cleanups.patch
+mm-avoid-deadlock-when-holding-rmap-on-mmap_prepare-error.patch
+mei-me-use-pci_device_data-macro.patch
+mei-me-add-nova-lake-point-h-did.patch
+selftests-landlock-fix-socket-file-descriptor-leaks-in-audit-helpers.patch
--- /dev/null
+From stable+bounces-242154-greg=kroah.com@vger.kernel.org Thu Apr 30 18:15:29 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2026 12:07:21 -0400
+Subject: wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
+To: stable@vger.kernel.org
+Cc: Sean Wang <sean.wang@mediatek.com>, Felix Fietkau <nbd@nbd.name>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260430160722.1784926-1-sashal@kernel.org>
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit e6f48512c1ceebcd1ce6bb83df3b3d56a261507d ]
+
+Prepare mt792xu_wfsys_reset() for chips that share the same USB WFSYS
+reset flow but use different register definitions.
+
+This is a pure refactor of the current mt7921u path and keeps the reset
+sequence unchanged.
+
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Link: https://patch.msgid.link/20260311002825.15502-1-sean.wang@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Stable-dep-of: 56154fef47d1 ("wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 40 +++++++++++++++++++-----
+ 1 file changed, 32 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
+@@ -206,6 +206,24 @@ static void mt792xu_epctl_rst_opt(struct
+ mt792xu_uhw_wr(&dev->mt76, MT_SSUSB_EPCTL_CSR_EP_RST_OPT, val);
+ }
+
++struct mt792xu_wfsys_desc {
++ u32 rst_reg;
++ u32 done_reg;
++ u32 done_mask;
++ u32 done_val;
++ u32 delay_ms;
++ bool need_status_sel;
++};
++
++static const struct mt792xu_wfsys_desc mt7921_wfsys_desc = {
++ .rst_reg = MT_CBTOP_RGU_WF_SUBSYS_RST,
++ .done_reg = MT_UDMA_CONN_INFRA_STATUS,
++ .done_mask = MT_UDMA_CONN_WFSYS_INIT_DONE,
++ .done_val = MT_UDMA_CONN_WFSYS_INIT_DONE,
++ .delay_ms = 0,
++ .need_status_sel = true,
++};
++
+ int mt792xu_dma_init(struct mt792x_dev *dev, bool resume)
+ {
+ int err;
+@@ -236,25 +254,31 @@ EXPORT_SYMBOL_GPL(mt792xu_dma_init);
+
+ int mt792xu_wfsys_reset(struct mt792x_dev *dev)
+ {
++ const struct mt792xu_wfsys_desc *desc = &mt7921_wfsys_desc;
+ u32 val;
+ int i;
+
+ mt792xu_epctl_rst_opt(dev, false);
+
+- val = mt792xu_uhw_rr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST);
++ val = mt792xu_uhw_rr(&dev->mt76, desc->rst_reg);
+ val |= MT_CBTOP_RGU_WF_SUBSYS_RST_WF_WHOLE_PATH;
+- mt792xu_uhw_wr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST, val);
++ mt792xu_uhw_wr(&dev->mt76, desc->rst_reg, val);
+
+- usleep_range(10, 20);
++ if (desc->delay_ms)
++ msleep(desc->delay_ms);
++ else
++ usleep_range(10, 20);
+
+- val = mt792xu_uhw_rr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST);
++ val = mt792xu_uhw_rr(&dev->mt76, desc->rst_reg);
+ val &= ~MT_CBTOP_RGU_WF_SUBSYS_RST_WF_WHOLE_PATH;
+- mt792xu_uhw_wr(&dev->mt76, MT_CBTOP_RGU_WF_SUBSYS_RST, val);
++ mt792xu_uhw_wr(&dev->mt76, desc->rst_reg, val);
++
++ if (desc->need_status_sel)
++ mt792xu_uhw_wr(&dev->mt76, MT_UDMA_CONN_INFRA_STATUS_SEL, 0);
+
+- mt792xu_uhw_wr(&dev->mt76, MT_UDMA_CONN_INFRA_STATUS_SEL, 0);
+ for (i = 0; i < MT792x_WFSYS_INIT_RETRY_COUNT; i++) {
+- val = mt792xu_uhw_rr(&dev->mt76, MT_UDMA_CONN_INFRA_STATUS);
+- if (val & MT_UDMA_CONN_WFSYS_INIT_DONE)
++ val = mt792xu_uhw_rr(&dev->mt76, desc->done_reg);
++ if ((val & desc->done_mask) == desc->done_val)
+ break;
+
+ msleep(100);
--- /dev/null
+From stable+bounces-242155-greg=kroah.com@vger.kernel.org Thu Apr 30 18:07:36 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2026 12:07:22 -0400
+Subject: wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
+To: stable@vger.kernel.org
+Cc: Sean Wang <sean.wang@mediatek.com>, Felix Fietkau <nbd@nbd.name>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260430160722.1784926-2-sashal@kernel.org>
+
+From: Sean Wang <sean.wang@mediatek.com>
+
+[ Upstream commit 56154fef47d104effa9f29ed3db4f805cbc0d640 ]
+
+mt7925u uses different reset/status registers from mt7921u. Reusing the
+mt7921u register set causes the WFSYS reset to fail.
+
+Add a chip-specific descriptor in mt792xu_wfsys_reset() to select the
+correct registers and fix mt7925u failing to initialize after a warm
+reboot.
+
+Fixes: d28e1a48952e ("wifi: mt76: mt792x: introduce mt792x-usb module")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Wang <sean.wang@mediatek.com>
+Link: https://patch.msgid.link/20260311002825.15502-2-sean.wang@kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt792x_regs.h | 4 ++++
+ drivers/net/wireless/mediatek/mt76/mt792x_usb.c | 13 ++++++++++++-
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_regs.h
+@@ -390,6 +390,10 @@
+ #define MT_CBTOP_RGU_WF_SUBSYS_RST MT_CBTOP_RGU(0x600)
+ #define MT_CBTOP_RGU_WF_SUBSYS_RST_WF_WHOLE_PATH BIT(0)
+
++#define MT7925_CBTOP_RGU_WF_SUBSYS_RST 0x70028600
++#define MT7925_WFSYS_INIT_DONE_ADDR 0x184c1604
++#define MT7925_WFSYS_INIT_DONE 0x00001d1e
++
+ #define MT_HW_BOUND 0x70010020
+ #define MT_HW_CHIPID 0x70010200
+ #define MT_HW_REV 0x70010204
+--- a/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt792x_usb.c
+@@ -224,6 +224,15 @@ static const struct mt792xu_wfsys_desc m
+ .need_status_sel = true,
+ };
+
++static const struct mt792xu_wfsys_desc mt7925_wfsys_desc = {
++ .rst_reg = MT7925_CBTOP_RGU_WF_SUBSYS_RST,
++ .done_reg = MT7925_WFSYS_INIT_DONE_ADDR,
++ .done_mask = U32_MAX,
++ .done_val = MT7925_WFSYS_INIT_DONE,
++ .delay_ms = 20,
++ .need_status_sel = false,
++};
++
+ int mt792xu_dma_init(struct mt792x_dev *dev, bool resume)
+ {
+ int err;
+@@ -254,7 +263,9 @@ EXPORT_SYMBOL_GPL(mt792xu_dma_init);
+
+ int mt792xu_wfsys_reset(struct mt792x_dev *dev)
+ {
+- const struct mt792xu_wfsys_desc *desc = &mt7921_wfsys_desc;
++ const struct mt792xu_wfsys_desc *desc = is_mt7925(&dev->mt76) ?
++ &mt7925_wfsys_desc :
++ &mt7921_wfsys_desc;
+ u32 val;
+ int i;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
